<?xml version="1.0" encoding="UTF-8"?>
<arf:asset-report-collection xmlns:arf="http://scap.nist.gov/schema/asset-reporting-format/1.1" xmlns:core="http://scap.nist.gov/schema/reporting-core/1.1" xmlns:ai="http://scap.nist.gov/schema/asset-identification/1.1">
  <core:relationships xmlns:arfvocab="http://scap.nist.gov/specifications/arf/vocabulary/relationships/1.0#">
    <core:relationship type="arfvocab:createdFor" subject="xccdf1">
      <core:ref>collection1</core:ref>
    </core:relationship>
    <core:relationship type="arfvocab:isAbout" subject="xccdf1">
      <core:ref>asset0</core:ref>
    </core:relationship>
  </core:relationships>
  <arf:report-requests>
    <arf:report-request id="collection1">
      <arf:content>
        <ds:data-stream-collection xmlns:cat="urn:oasis:names:tc:entity:xmlns:xml:catalog" xmlns:cpe-dict="http://cpe.mitre.org/dictionary/2.0" xmlns:cpe-lang="http://cpe.mitre.org/language/2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ds="http://scap.nist.gov/schema/scap/source/1.2" xmlns:html="http://www.w3.org/1999/xhtml" xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:ocil="http://scap.nist.gov/schema/ocil/2.0" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="scap_org.open-scap_collection_from_xccdf_ssg-fedora-xccdf-1.2.xml" schematron-version="1.3">
  <ds:data-stream id="scap_org.open-scap_datastream_from_xccdf_ssg-fedora-xccdf-1.2.xml" scap-version="1.3" use-case="OTHER">
    <ds:dictionaries>
      <ds:component-ref id="scap_org.open-scap_cref_ssg-fedora-cpe-dictionary.xml" xlink:href="#scap_org.open-scap_comp_ssg-fedora-cpe-dictionary.xml">
        <cat:catalog>
          <cat:uri name="ssg-fedora-cpe-oval.xml" uri="#scap_org.open-scap_cref_ssg-fedora-cpe-oval.xml"/>
        </cat:catalog>
      </ds:component-ref>
    </ds:dictionaries>
    <ds:checklists>
      <ds:component-ref id="scap_org.open-scap_cref_ssg-fedora-xccdf-1.2.xml" xlink:href="#scap_org.open-scap_comp_ssg-fedora-xccdf-1.2.xml">
        <cat:catalog>
          <cat:uri name="ssg-fedora-oval.xml" uri="#scap_org.open-scap_cref_ssg-fedora-oval.xml"/>
          <cat:uri name="ssg-fedora-ocil.xml" uri="#scap_org.open-scap_cref_ssg-fedora-ocil.xml"/>
        </cat:catalog>
      </ds:component-ref>
    </ds:checklists>
    <ds:checks>
      <ds:component-ref id="scap_org.open-scap_cref_ssg-fedora-oval.xml" xlink:href="#scap_org.open-scap_comp_ssg-fedora-oval.xml"/>
      <ds:component-ref id="scap_org.open-scap_cref_ssg-fedora-ocil.xml" xlink:href="#scap_org.open-scap_comp_ssg-fedora-ocil.xml"/>
      <ds:component-ref id="scap_org.open-scap_cref_ssg-fedora-cpe-oval.xml" xlink:href="#scap_org.open-scap_comp_ssg-fedora-cpe-oval.xml"/>
    </ds:checks>
  </ds:data-stream>
  <ds:component id="scap_org.open-scap_comp_ssg-fedora-cpe-dictionary.xml" timestamp="2022-07-23T00:00:00">
    <cpe-dict:cpe-list xsi:schemaLocation="http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd">
      <cpe-dict:cpe-item name="cpe:/a:aarch64_arch">
        <cpe-dict:title xml:lang="en-us">System architecture is AARCH64</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-proc_sys_kernel_osrelease_arch_aarch64:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:audit">
        <cpe-dict:title xml:lang="en-us">Package audit is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_audit_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:chrony">
        <cpe-dict:title xml:lang="en-us">Package chrony is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_chrony_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:gdm">
        <cpe-dict:title xml:lang="en-us">Package gdm is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_gdm_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:grub2">
        <cpe-dict:title xml:lang="en-us">Package grub2 is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_grub2_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:libuser">
        <cpe-dict:title xml:lang="en-us">Package libuser is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_libuser_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:login_defs">
        <cpe-dict:title xml:lang="en-us">Package providing /etc/login.defs is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_login_defs:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:machine">
        <cpe-dict:title xml:lang="en-us">Bare-metal or Virtual Machine</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_is_a_machine:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:net-snmp">
        <cpe-dict:title xml:lang="en-us">Package net-snmp is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_net-snmp_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:non-uefi">
        <cpe-dict:title xml:lang="en-us">System boot mode is non-UEFI</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-system_boot_mode_is_non_uefi:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:not_s390x_arch">
        <cpe-dict:title xml:lang="en-us">System architecture is not S390X</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-proc_sys_kernel_osrelease_arch_not_s390x:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:ntp">
        <cpe-dict:title xml:lang="en-us">Package ntp is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_ntp_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:pam">
        <cpe-dict:title xml:lang="en-us">Package pam is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_pam_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:polkit">
        <cpe-dict:title xml:lang="en-us">Package polkit is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_polkit_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:postfix">
        <cpe-dict:title xml:lang="en-us">Package postfix is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_postfix_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:s390x_arch">
        <cpe-dict:title xml:lang="en-us">System architecture is S390X</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:sssd">
        <cpe-dict:title xml:lang="en-us">Package sssd-common is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_sssd-common_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:sudo">
        <cpe-dict:title xml:lang="en-us">Package sudo is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_sudo_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:uefi">
        <cpe-dict:title xml:lang="en-us">System boot mode is UEFI</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-system_boot_mode_is_uefi:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:usbguard">
        <cpe-dict:title xml:lang="en-us">Package usbguard is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_usbguard_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:wifi-iface">
        <cpe-dict:title xml:lang="en-us">WiFi interface is present</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_wifi_interface:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:yum">
        <cpe-dict:title xml:lang="en-us">Package yum is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_yum_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/o:fedoraproject:fedora:34">
        <cpe-dict:title xml:lang="en-us">Fedora 34</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_OS_is_fedora:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/o:fedoraproject:fedora:35">
        <cpe-dict:title xml:lang="en-us">Fedora 35</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_OS_is_fedora:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/o:fedoraproject:fedora:36">
        <cpe-dict:title xml:lang="en-us">Fedora 36</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_OS_is_fedora:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/o:fedoraproject:fedora:37">
        <cpe-dict:title xml:lang="en-us">Fedora 37</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_OS_is_fedora:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
    </cpe-dict:cpe-list>
  </ds:component>
  <ds:component id="scap_org.open-scap_comp_ssg-fedora-xccdf-1.2.xml" timestamp="2022-07-23T00:00:00">
    <xccdf-1.2:Benchmark id="xccdf_org.ssgproject.content_benchmark_FEDORA" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 xccdf-1.1.4.xsd" style="SCAP_1.2" resolved="true" xml:lang="en-US">
      <xccdf-1.2:status date="2022-07-23">draft</xccdf-1.2:status>
      <xccdf-1.2:title>Guide to the Secure Configuration of Fedora</xccdf-1.2:title>
      <xccdf-1.2:description>This guide presents a catalog of security-relevant
configuration settings for Fedora. It is a rendering of
content structured in the eXtensible Configuration Checklist Description Format (XCCDF)
in order to support security automation.  The SCAP content is
is available in the <html:code>scap-security-guide</html:code> package which is developed at

    <html:a href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a>.
<html:br/><html:br/>
Providing system administrators with such guidance informs them how to securely
configure systems under their control in a variety of network roles. Policy
makers and baseline creators can use this catalog of settings, with its
associated references to higher-level security control catalogs, in order to
assist them in security baseline creation. This guide is a <html:em>catalog, not a
checklist</html:em>, and satisfaction of every item is not likely to be possible or
sensible in many operational scenarios. However, the XCCDF format enables
granular selection and adjustment of settings, and their association with OVAL
and OCIL content provides an automated checking capability. Transformations of
this document, and its associated automated checking content, are capable of
providing baselines that meet a diverse set of policy objectives. Some example
XCCDF <html:em>Profiles</html:em>, which are selections of items that form checklists and
can be used as baselines, are available with this guide. They can be
processed, in an automated fashion, with tools that support the Security
Content Automation Protocol (SCAP). The DISA STIG, which provides required
settings for US Department of Defense systems, is one example of a baseline
created from this guidance.
</xccdf-1.2:description>
      <xccdf-1.2:notice id="terms_of_use">Do not attempt to implement any of the settings in
this guide without first testing them in a non-operational environment. The
creators of this guidance assume no responsibility whatsoever for its use by
other parties, and makes no guarantees, expressed or implied, about its
quality, reliability, or any other characteristic.
</xccdf-1.2:notice>
      <xccdf-1.2:front-matter>The SCAP Security Guide Project<html:br/>

    <html:a href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a>
</xccdf-1.2:front-matter>
      <xccdf-1.2:rear-matter>Red Hat and Red Hat Enterprise Linux are either registered
trademarks or trademarks of Red Hat, Inc. in the United States and other
countries. All other names are registered trademarks or trademarks of their
respective companies.</xccdf-1.2:rear-matter>
      <cpe-lang:platform-specification>
        <cpe-lang:platform id="machine">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:fact-ref name="cpe:/a:machine"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="postfix">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:fact-ref name="cpe:/a:postfix"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="chrony_or_ntp">
          <cpe-lang:logical-test operator="OR" negate="false">
            <cpe-lang:fact-ref name="cpe:/a:chrony"/>
            <cpe-lang:fact-ref name="cpe:/a:ntp"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="machine_and_chrony_or_ntp">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:logical-test operator="OR" negate="false">
              <cpe-lang:fact-ref name="cpe:/a:chrony"/>
              <cpe-lang:fact-ref name="cpe:/a:ntp"/>
            </cpe-lang:logical-test>
            <cpe-lang:fact-ref name="cpe:/a:machine"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="chrony">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:fact-ref name="cpe:/a:chrony"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="ntp">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:fact-ref name="cpe:/a:ntp"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="net-snmp">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:fact-ref name="cpe:/a:net-snmp"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="sssd">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:fact-ref name="cpe:/a:sssd"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="not_s390x_arch">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:fact-ref name="cpe:/a:not_s390x_arch"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="usbguard">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:fact-ref name="cpe:/a:usbguard"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="gdm">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:fact-ref name="cpe:/a:gdm"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="pam">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:fact-ref name="cpe:/a:pam"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="libuser">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:fact-ref name="cpe:/a:libuser"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="login_defs">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:fact-ref name="cpe:/a:login_defs"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="grub2">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:fact-ref name="cpe:/a:grub2"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="audit">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:fact-ref name="cpe:/a:audit"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="non-uefi">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:fact-ref name="cpe:/a:non-uefi"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="uefi">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:fact-ref name="cpe:/a:uefi"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="s390x_arch">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:fact-ref name="cpe:/a:s390x_arch"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="aarch64_arch">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:fact-ref name="cpe:/a:aarch64_arch"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="wifi-iface">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:fact-ref name="cpe:/a:wifi-iface"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="polkit">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:fact-ref name="cpe:/a:polkit"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="sudo">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:fact-ref name="cpe:/a:sudo"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="yum">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:fact-ref name="cpe:/a:yum"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
      </cpe-lang:platform-specification>
      <xccdf-1.2:platform idref="cpe:/o:fedoraproject:fedora:37"/>
      <xccdf-1.2:platform idref="cpe:/o:fedoraproject:fedora:36"/>
      <xccdf-1.2:platform idref="cpe:/o:fedoraproject:fedora:35"/>
      <xccdf-1.2:platform idref="cpe:/o:fedoraproject:fedora:34"/>
      <xccdf-1.2:version update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.62</xccdf-1.2:version>
      <xccdf-1.2:metadata>
        <dc:publisher>SCAP Security Guide Project</dc:publisher>
        <dc:creator>SCAP Security Guide Project</dc:creator>
        <dc:contributor>Frank J Cameron (CAM1244) &lt;cameron@ctc.com&gt;</dc:contributor>
        <dc:contributor>0x66656c6978 &lt;0x66656c6978@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Jack Adolph &lt;jack.adolph@gmail.com&gt;</dc:contributor>
        <dc:contributor>Edgar Aguilar &lt;edgar.aguilar@oracle.com&gt;</dc:contributor>
        <dc:contributor>Gabe Alford &lt;redhatrises@gmail.com&gt;</dc:contributor>
        <dc:contributor>Firas AlShafei &lt;firas.alshafei@us.abb.com&gt;</dc:contributor>
        <dc:contributor>Rodrigo Alvares &lt;ralvares@redhat.com&gt;</dc:contributor>
        <dc:contributor>Christopher Anderson &lt;cba@fedoraproject.org&gt;</dc:contributor>
        <dc:contributor>angystardust &lt;angystardust@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>anivan-suse &lt;anastasija.ivanovic@suse.com&gt;</dc:contributor>
        <dc:contributor>anixon-rh &lt;55244503+anixon-rh@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Ikko Ashimine &lt;eltociear@gmail.com&gt;</dc:contributor>
        <dc:contributor>Chuck Atkins &lt;chuck.atkins@kitware.com&gt;</dc:contributor>
        <dc:contributor>ayfantis &lt;ayfantis@localhost.localdomain&gt;</dc:contributor>
        <dc:contributor>Ryan Ballanger &lt;root@rballang-admin-2.fastenal.com&gt;</dc:contributor>
        <dc:contributor>Alex Baranowski &lt;alex@euro-linux.com&gt;</dc:contributor>
        <dc:contributor>Eduardo Barretto &lt;eduardo.barretto@canonical.com&gt;</dc:contributor>
        <dc:contributor>Molly Jo Bault &lt;Molly.Jo.Bault@ballardtech.com&gt;</dc:contributor>
        <dc:contributor>Gabriel Becker &lt;ggasparb@redhat.com&gt;</dc:contributor>
        <dc:contributor>Alexander Bergmann &lt;abergmann@suse.com&gt;</dc:contributor>
        <dc:contributor>Dale Bewley &lt;dale@bewley.net&gt;</dc:contributor>
        <dc:contributor>Jose Luis BG &lt;bgjoseluis@gmail.com&gt;</dc:contributor>
        <dc:contributor>Joseph Bisch &lt;joseph.bisch@gmail.com&gt;</dc:contributor>
        <dc:contributor>Jeffrey Blank &lt;blank@eclipse.ncsc.mil&gt;</dc:contributor>
        <dc:contributor>Olivier Bonhomme &lt;ptitoliv@ptitoliv.net&gt;</dc:contributor>
        <dc:contributor>Lance Bragstad &lt;lbragstad@gmail.com&gt;</dc:contributor>
        <dc:contributor>Ted Brunell &lt;tbrunell@redhat.com&gt;</dc:contributor>
        <dc:contributor>Marcus Burghardt &lt;marcus@mbsec.com.br&gt;</dc:contributor>
        <dc:contributor>Matthew Burket &lt;mburket@redhat.com&gt;</dc:contributor>
        <dc:contributor>Blake Burkhart &lt;blake.burkhart@us.af.mil&gt;</dc:contributor>
        <dc:contributor>Patrick Callahan &lt;pmc@patrickcallahan.com&gt;</dc:contributor>
        <dc:contributor>George Campbell &lt;gcampbell@palantir.com&gt;</dc:contributor>
        <dc:contributor>Nick Carboni &lt;ncarboni@redhat.com&gt;</dc:contributor>
        <dc:contributor>Carlos &lt;64919342+carlosmmatos@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>James Cassell &lt;james.cassell@ll.mit.edu&gt;</dc:contributor>
        <dc:contributor>Frank Caviggia &lt;fcaviggi@ra.iad.redhat.com&gt;</dc:contributor>
        <dc:contributor>Eric Christensen &lt;echriste@redhat.com&gt;</dc:contributor>
        <dc:contributor>Dan Clark &lt;danclark@redhat.com&gt;</dc:contributor>
        <dc:contributor>Jayson Cofell &lt;1051437+70k10@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Caleb Cooper &lt;coopercd@ornl.gov&gt;</dc:contributor>
        <dc:contributor>Richard Maciel Costa &lt;richard.maciel.costa@canonical.com&gt;</dc:contributor>
        <dc:contributor>Deric Crago &lt;deric.crago@gmail.com&gt;</dc:contributor>
        <dc:contributor>crleekwc &lt;crleekwc@gmail.com&gt;</dc:contributor>
        <dc:contributor>cyarbrough76 &lt;42849651+cyarbrough76@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Maura Dailey &lt;maura@eclipse.ncsc.mil&gt;</dc:contributor>
        <dc:contributor>Klaas Demter &lt;demter@atix.de&gt;</dc:contributor>
        <dc:contributor>dhanushkar-wso2 &lt;dhanushkar@wso2.com&gt;</dc:contributor>
        <dc:contributor>Andrew DiPrinzio &lt;andrew.diprinzio@jhuapl.edu&gt;</dc:contributor>
        <dc:contributor>dom &lt;dominique.blaze@devinci.fr&gt;</dc:contributor>
        <dc:contributor>Jean-Baptiste Donnette &lt;jean-baptiste.donnette@epita.fr&gt;</dc:contributor>
        <dc:contributor>Marco De Donno &lt;mdedonno1337@gmail.com&gt;</dc:contributor>
        <dc:contributor>dperrone &lt;dperrone@redhat.com&gt;</dc:contributor>
        <dc:contributor>drax &lt;applezip@gmail.com&gt;</dc:contributor>
        <dc:contributor>Sebastian Dunne &lt;sdunne@redhat.com&gt;</dc:contributor>
        <dc:contributor>François Duthilleul &lt;francoisduthilleul@gmail.com&gt;</dc:contributor>
        <dc:contributor>Greg Elin &lt;gregelin@gitmachines.com&gt;</dc:contributor>
        <dc:contributor>eradot4027 &lt;jrtonmac@gmail.com&gt;</dc:contributor>
        <dc:contributor>Alexis Facques &lt;alexis.facques@mythalesgroup.io&gt;</dc:contributor>
        <dc:contributor>Leah Fisher &lt;lfisher047@gmail.com&gt;</dc:contributor>
        <dc:contributor>Yavor Georgiev &lt;strandjata@gmail.com&gt;</dc:contributor>
        <dc:contributor>Alijohn Ghassemlouei &lt;alijohn@secureagc.com&gt;</dc:contributor>
        <dc:contributor>Swarup Ghosh &lt;swghosh@redhat.com&gt;</dc:contributor>
        <dc:contributor>ghylock &lt;ghylock@gmail.com&gt;</dc:contributor>
        <dc:contributor>Andrew Gilmore &lt;agilmore2@gmail.com&gt;</dc:contributor>
        <dc:contributor>Joshua Glemza &lt;jglemza@nasa.gov&gt;</dc:contributor>
        <dc:contributor>Nick Gompper &lt;forestgomp@yahoo.com&gt;</dc:contributor>
        <dc:contributor>Loren Gordon &lt;lorengordon@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Patrik Greco &lt;sikevux@sikevux.se&gt;</dc:contributor>
        <dc:contributor>Steve Grubb &lt;sgrubb@redhat.com&gt;</dc:contributor>
        <dc:contributor>guangyee &lt;gyee@suse.com&gt;</dc:contributor>
        <dc:contributor>Marek Haicman &lt;mhaicman@redhat.com&gt;</dc:contributor>
        <dc:contributor>Vern Hart &lt;vern.hart@canonical.com&gt;</dc:contributor>
        <dc:contributor>Alex Haydock &lt;alex@alexhaydock.co.uk&gt;</dc:contributor>
        <dc:contributor>Rebekah Hayes &lt;rhayes@corp.rivierautilities.com&gt;</dc:contributor>
        <dc:contributor>Trey Henefield &lt;thenefield@gmail.com&gt;</dc:contributor>
        <dc:contributor>Henning Henkel &lt;henning.henkel@helvetia.ch&gt;</dc:contributor>
        <dc:contributor>hex2a &lt;hex2a@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>John Hooks &lt;jhooks@starscream.pa.jhbcomputers.com&gt;</dc:contributor>
        <dc:contributor>Jakub Hrozek &lt;jhrozek@redhat.com&gt;</dc:contributor>
        <dc:contributor>De Huo &lt;De.Huo@windriver.com&gt;</dc:contributor>
        <dc:contributor>Robin Price II &lt;robin@redhat.com&gt;</dc:contributor>
        <dc:contributor>Yasir Imam &lt;yimam@redhat.com&gt;</dc:contributor>
        <dc:contributor>Jiri Jaburek &lt;jjaburek@redhat.com&gt;</dc:contributor>
        <dc:contributor>Keith Jackson &lt;keithkjackson@gmail.com&gt;</dc:contributor>
        <dc:contributor>Jeremiah Jahn &lt;jeremiah@goodinassociates.com&gt;</dc:contributor>
        <dc:contributor>Jakub Jelen &lt;jjelen@redhat.com&gt;</dc:contributor>
        <dc:contributor>Jessicahfy &lt;Jessicahfy@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Stephan Joerrens &lt;Stephan.Joerrens@fiduciagad.de&gt;</dc:contributor>
        <dc:contributor>Jono &lt;jono@ubuntu-18.localdomain&gt;</dc:contributor>
        <dc:contributor>justchris1 &lt;justchris1@justchris1.email&gt;</dc:contributor>
        <dc:contributor>Kai Kang &lt;kai.kang@windriver.com&gt;</dc:contributor>
        <dc:contributor>Charles Kernstock &lt;charles.kernstock@ultra-ats.com&gt;</dc:contributor>
        <dc:contributor>Yuli Khodorkovskiy &lt;ykhodorkovskiy@tresys.com&gt;</dc:contributor>
        <dc:contributor>Sherine Khoury &lt;skhoury@redhat.com&gt;</dc:contributor>
        <dc:contributor>Nathan Kinder &lt;nkinder@redhat.com&gt;</dc:contributor>
        <dc:contributor>Lee Kinser &lt;lee.kinser@gmail.com&gt;</dc:contributor>
        <dc:contributor>Evgeny Kolesnikov &lt;ekolesni@redhat.com&gt;</dc:contributor>
        <dc:contributor>Peter 'Pessoft' Kolínek &lt;github@pessoft.com&gt;</dc:contributor>
        <dc:contributor>Luke Kordell &lt;luke.t.kordell@lmco.com&gt;</dc:contributor>
        <dc:contributor>Malte Kraus &lt;malte.kraus@suse.com&gt;</dc:contributor>
        <dc:contributor>Seth Kress &lt;seth.kress@dsainc.com&gt;</dc:contributor>
        <dc:contributor>Felix Krohn &lt;felix.krohn@helvetia.ch&gt;</dc:contributor>
        <dc:contributor>kspargur &lt;kspargur@kspargur.csb&gt;</dc:contributor>
        <dc:contributor>Amit Kumar &lt;amitkuma@redhat.com&gt;</dc:contributor>
        <dc:contributor>Fen Labalme &lt;fen@civicactions.com&gt;</dc:contributor>
        <dc:contributor>Ade Lee &lt;alee@redhat.com&gt;</dc:contributor>
        <dc:contributor>Christopher Lee &lt;Crleekwc@gmail.com&gt;</dc:contributor>
        <dc:contributor>Ian Lee &lt;lee1001@llnl.gov&gt;</dc:contributor>
        <dc:contributor>Jarrett Lee &lt;jarrettl@umd.edu&gt;</dc:contributor>
        <dc:contributor>Joseph Lenox &lt;joseph.lenox@collins.com&gt;</dc:contributor>
        <dc:contributor>Jan Lieskovsky &lt;jlieskov@redhat.com&gt;</dc:contributor>
        <dc:contributor>Markus Linnala &lt;Markus.Linnala@knowit.fi&gt;</dc:contributor>
        <dc:contributor>Šimon Lukašík &lt;slukasik@redhat.com&gt;</dc:contributor>
        <dc:contributor>Milan Lysonek &lt;mlysonek@redhat.com&gt;</dc:contributor>
        <dc:contributor>Fredrik Lysén &lt;fredrik@pipemore.se&gt;</dc:contributor>
        <dc:contributor>Caitlin Macleod &lt;caitelatte@gmail.com&gt;</dc:contributor>
        <dc:contributor>Nick Maludy &lt;nmaludy@gmail.com&gt;</dc:contributor>
        <dc:contributor>Lokesh Mandvekar &lt;lsm5@fedoraproject.org&gt;</dc:contributor>
        <dc:contributor>Matus Marhefka &lt;mmarhefk@redhat.com&gt;</dc:contributor>
        <dc:contributor>Jamie Lorwey Martin &lt;jlmartin@redhat.com&gt;</dc:contributor>
        <dc:contributor>Carlos Matos &lt;cmatos@redhat.com&gt;</dc:contributor>
        <dc:contributor>Robert McAllister &lt;rmcallis@redhat.com&gt;</dc:contributor>
        <dc:contributor>Karen McCarron &lt;kmccarro@redhat.com&gt;</dc:contributor>
        <dc:contributor>Michael McConachie &lt;michael@redhat.com&gt;</dc:contributor>
        <dc:contributor>Marcus Meissner &lt;meissner@suse.de&gt;</dc:contributor>
        <dc:contributor>Khary Mendez &lt;kmendez@redhat.com&gt;</dc:contributor>
        <dc:contributor>Rodney Mercer &lt;rmercer@harris.com&gt;</dc:contributor>
        <dc:contributor>mgjadoul &lt;mgjadoul@laptomatic.auth-o-matic.corp&gt;</dc:contributor>
        <dc:contributor>Matt Micene &lt;nzwulfin@gmail.com&gt;</dc:contributor>
        <dc:contributor>Brian Millett &lt;bmillett@gmail.com&gt;</dc:contributor>
        <dc:contributor>Takuya Mishina &lt;tmishina@jp.ibm.com&gt;</dc:contributor>
        <dc:contributor>Mixer9 &lt;35545791+Mixer9@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>mmosel &lt;mmosel@kde.example.com&gt;</dc:contributor>
        <dc:contributor>Zbynek Moravec &lt;zmoravec@redhat.com&gt;</dc:contributor>
        <dc:contributor>Kazuo Moriwaka &lt;moriwaka@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Michael Moseley &lt;michael@eclipse.ncsc.mil&gt;</dc:contributor>
        <dc:contributor>Renaud Métrich &lt;rmetrich@redhat.com&gt;</dc:contributor>
        <dc:contributor>Joe Nall &lt;joe@nall.com&gt;</dc:contributor>
        <dc:contributor>Neiloy &lt;neiloy@redhat.com&gt;</dc:contributor>
        <dc:contributor>Axel Nennker &lt;axel@nennker.de&gt;</dc:contributor>
        <dc:contributor>Michele Newman &lt;mnewman@redhat.com&gt;</dc:contributor>
        <dc:contributor>Sean O'Keeffe &lt;seanokeeffe797@gmail.com&gt;</dc:contributor>
        <dc:contributor>Jiri Odehnal &lt;jodehnal@redhat.com&gt;</dc:contributor>
        <dc:contributor>Ilya Okomin &lt;ilya.okomin@oracle.com&gt;</dc:contributor>
        <dc:contributor>Kaustubh Padegaonkar &lt;theTuxRacer@gmail.com&gt;</dc:contributor>
        <dc:contributor>Michael Palmiotto &lt;mpalmiotto@tresys.com&gt;</dc:contributor>
        <dc:contributor>Eryx Paredes &lt;eryxp@lyft.com&gt;</dc:contributor>
        <dc:contributor>Max R.D. Parmer &lt;maxp@trystero.is&gt;</dc:contributor>
        <dc:contributor>Arnaud Patard &lt;apatard@hupstream.com&gt;</dc:contributor>
        <dc:contributor>Jan Pazdziora &lt;jpazdziora@redhat.com&gt;</dc:contributor>
        <dc:contributor>pcactr &lt;paul.c.arnold4.ctr@mail.mil&gt;</dc:contributor>
        <dc:contributor>Kenneth Peeples &lt;kennethwpeeples@gmail.com&gt;</dc:contributor>
        <dc:contributor>Nathan Peters &lt;Nathaniel.Peters@ca.com&gt;</dc:contributor>
        <dc:contributor>Frank Lin PIAT &lt;fpiat@klabs.be&gt;</dc:contributor>
        <dc:contributor>Stefan Pietsch &lt;mail.ipv4v6+gh@gmail.com&gt;</dc:contributor>
        <dc:contributor>piggyvenus &lt;piggyvenus@gmail.com&gt;</dc:contributor>
        <dc:contributor>Vojtech Polasek &lt;vpolasek@redhat.com&gt;</dc:contributor>
        <dc:contributor>Orion Poplawski &lt;orion@nwra.com&gt;</dc:contributor>
        <dc:contributor>Nick Poyant &lt;npoyant@redhat.com&gt;</dc:contributor>
        <dc:contributor>Martin Preisler &lt;mpreisle@redhat.com&gt;</dc:contributor>
        <dc:contributor>Wesley Ceraso Prudencio &lt;wcerasop@redhat.com&gt;</dc:contributor>
        <dc:contributor>Raphael Sanchez Prudencio &lt;rsprudencio@redhat.com&gt;</dc:contributor>
        <dc:contributor>T.O. Radzy Radzykewycz &lt;radzy@windriver.com&gt;</dc:contributor>
        <dc:contributor>Kenyon Ralph &lt;kenyon@kenyonralph.com&gt;</dc:contributor>
        <dc:contributor>Mike Ralph &lt;mralph@redhat.com&gt;</dc:contributor>
        <dc:contributor>Federico Ramirez &lt;federico.r.ramirez@oracle.com&gt;</dc:contributor>
        <dc:contributor>rchikov &lt;rumen.chikov@suse.com&gt;</dc:contributor>
        <dc:contributor>Rick Renshaw &lt;Richard_Renshaw@xtoenergy.com&gt;</dc:contributor>
        <dc:contributor>Chris Reynolds &lt;c.reynolds82@gmail.com&gt;</dc:contributor>
        <dc:contributor>rhayes &lt;rhayes@rivierautilities.com&gt;</dc:contributor>
        <dc:contributor>Pat Riehecky &lt;riehecky@fnal.gov&gt;</dc:contributor>
        <dc:contributor>rlucente-se-jboss &lt;rlucente@redhat.com&gt;</dc:contributor>
        <dc:contributor>Juan Antonio Osorio Robles &lt;juan.osoriorobles@eu.equinix.com&gt;</dc:contributor>
        <dc:contributor>Matt Rogers &lt;mrogers@redhat.com&gt;</dc:contributor>
        <dc:contributor>Jesse Roland &lt;jesse.roland@onyxpoint.com&gt;</dc:contributor>
        <dc:contributor>Joshua Roys &lt;roysjosh@gmail.com&gt;</dc:contributor>
        <dc:contributor>rrenshaw &lt;bofh69@yahoo.com&gt;</dc:contributor>
        <dc:contributor>Chris Ruffalo &lt;chris.ruffalo@gmail.com&gt;</dc:contributor>
        <dc:contributor>rumch-se &lt;77793453+rumch-se@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Ray Shaw (Cont ARL/CISD) rvshaw &lt;rvshaw@esme.arl.army.mil&gt;</dc:contributor>
        <dc:contributor>Earl Sampson &lt;ESampson@suse.com&gt;</dc:contributor>
        <dc:contributor>sampsone &lt;esampson@suse.com&gt;</dc:contributor>
        <dc:contributor>Willy Santos &lt;wsantos@redhat.com&gt;</dc:contributor>
        <dc:contributor>Nagarjuna Sarvepalli &lt;snagarju@redhat.com&gt;</dc:contributor>
        <dc:contributor>Anderson Sasaki &lt;33833274+ansasaki@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Gautam Satish &lt;gautams@hpe.com&gt;</dc:contributor>
        <dc:contributor>Watson Sato &lt;wsato@redhat.com&gt;</dc:contributor>
        <dc:contributor>Satoru SATOH &lt;satoru.satoh@gmail.com&gt;</dc:contributor>
        <dc:contributor>Alexander Scheel &lt;ascheel@redhat.com&gt;</dc:contributor>
        <dc:contributor>Bryan Schneiders &lt;pschneiders@trisept.com&gt;</dc:contributor>
        <dc:contributor>shaneboulden &lt;shane.boulden@gmail.com&gt;</dc:contributor>
        <dc:contributor>Vincent Shen &lt;47534281+Vincent056@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Spencer Shimko &lt;sshimko@tresys.com&gt;</dc:contributor>
        <dc:contributor>Mark Shoger &lt;mshoger@redhat.com&gt;</dc:contributor>
        <dc:contributor>THOBY Simon &lt;Simon.THOBY@viveris.fr&gt;</dc:contributor>
        <dc:contributor>Thomas Sjögren &lt;konstruktoid@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Francisco Slavin &lt;fslavin@tresys.com&gt;</dc:contributor>
        <dc:contributor>David Smith &lt;dsmith@eclipse.ncsc.mil&gt;</dc:contributor>
        <dc:contributor>Kevin Spargur &lt;kspargur@redhat.com&gt;</dc:contributor>
        <dc:contributor>Kenneth Stailey &lt;kstailey.lists@gmail.com&gt;</dc:contributor>
        <dc:contributor>Leland Steinke &lt;leland.j.steinke.ctr@mail.mil&gt;</dc:contributor>
        <dc:contributor>Justin Stephenson &lt;jstephen@redhat.com&gt;</dc:contributor>
        <dc:contributor>Brian Stinson &lt;brian@bstinson.com&gt;</dc:contributor>
        <dc:contributor>Jake Stookey &lt;jakestookey@gmail.com&gt;</dc:contributor>
        <dc:contributor>Jonathan Sturges &lt;jsturges@redhat.com&gt;</dc:contributor>
        <dc:contributor>Ian Tewksbury &lt;itewk@redhat.com&gt;</dc:contributor>
        <dc:contributor>Philippe Thierry &lt;phil@reseau-libre.net&gt;</dc:contributor>
        <dc:contributor>Derek Thurston &lt;thegrit@gmail.com&gt;</dc:contributor>
        <dc:contributor>tianzhenjia &lt;jiatianzhen@cmss.chinamobile.com&gt;</dc:contributor>
        <dc:contributor>Greg Tinsley &lt;gtinsley@redhat.com&gt;</dc:contributor>
        <dc:contributor>Paul Tittle &lt;ptittle@cmf.nrl.navy.mil&gt;</dc:contributor>
        <dc:contributor>tom &lt;tom@localhost.localdomain&gt;</dc:contributor>
        <dc:contributor>tomas.hudik &lt;tomas.hudik@embedit.cz&gt;</dc:contributor>
        <dc:contributor>Jeb Trayer &lt;jeb.d.trayer@uscg.mil&gt;</dc:contributor>
        <dc:contributor>TrilokGeer &lt;tgeer@redhat.com&gt;</dc:contributor>
        <dc:contributor>Viktors Trubovics &lt;viktors.trubovics@suse.com&gt;</dc:contributor>
        <dc:contributor>Nico Truzzolino &lt;nico.truzzolino@gmx.de&gt;</dc:contributor>
        <dc:contributor>Brian Turek &lt;brian.turek@gmail.com&gt;</dc:contributor>
        <dc:contributor>Matěj Týč &lt;matyc@redhat.com&gt;</dc:contributor>
        <dc:contributor>VadimDor &lt;29509093+VadimDor@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Trevor Vaughan &lt;tvaughan@onyxpoint.com&gt;</dc:contributor>
        <dc:contributor>vtrubovics &lt;82443408+vtrubovics@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Samuel Warren &lt;swarren@redhat.com&gt;</dc:contributor>
        <dc:contributor>wcushen &lt;54533890+wcushen@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Shawn Wells &lt;shawn@shawndwells.io&gt;</dc:contributor>
        <dc:contributor>Daniel E. White &lt;linuxdan@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Bernhard M. Wiedemann &lt;bwiedemann@suse.de&gt;</dc:contributor>
        <dc:contributor>Roy Williams &lt;roywilli@roywilli.redhat.com&gt;</dc:contributor>
        <dc:contributor>Willumpie &lt;willumpie@xs4all.nl&gt;</dc:contributor>
        <dc:contributor>Rob Wilmoth &lt;rwilmoth@redhat.com&gt;</dc:contributor>
        <dc:contributor>Lucas Yamanishi &lt;lucas.yamanishi@onyxpoint.com&gt;</dc:contributor>
        <dc:contributor>Xirui Yang &lt;xirui.yang@oracle.com&gt;</dc:contributor>
        <dc:contributor>yarunachalam &lt;yarunachalam@suse.com&gt;</dc:contributor>
        <dc:contributor>Guang Yee &lt;guang.yee@suse.com&gt;</dc:contributor>
        <dc:contributor>Achilleas John Yfantis &lt;ayfantis@redhat.com&gt;</dc:contributor>
        <dc:contributor>Kevin Zimmerman &lt;kevin.zimmerman@kitware.com&gt;</dc:contributor>
        <dc:contributor>Luigi Mario Zuccarelli &lt;luzuccar@redhat.com&gt;</dc:contributor>
        <dc:contributor>Jan Černý &lt;jcerny@redhat.com&gt;</dc:contributor>
        <dc:contributor>Michal Šrubař &lt;msrubar@redhat.com&gt;</dc:contributor>
        <dc:source>https://github.com/ComplianceAsCode/content/releases/latest</dc:source>
      </xccdf-1.2:metadata>
      <xccdf-1.2:Profile id="xccdf_org.ssgproject.content_profile_ospp">
        <xccdf-1.2:title override="true">OSPP - Protection Profile for General Purpose Operating Systems</xccdf-1.2:title>
        <xccdf-1.2:description override="true">This profile reflects mandatory configuration controls identified in the
NIAP Configuration Annex to the Protection Profile for General Purpose
Operating Systems (Protection Profile Version 4.2).

As Fedora OS is moving target, this profile does not guarantee to provide
security levels required from US National Security Systems. Main goal of
the profile is to provide Fedora developers with hardened environment
similar to the one mandated by US National Security Systems.</xccdf-1.2:description>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_ocredit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_retry" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_tmout" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open_by_handle_at" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_openat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open_by_handle_at" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_openat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open_by_handle_at" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_openat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_chcon" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_restorecon" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_semanage" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_setsebool" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_seunshare" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_renameat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rmdir" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlink" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlinkat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_immutable" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_faillock" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_lastlog" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_tallylog" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_at" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chage" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chsh" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_crontab" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_gpasswd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_mount" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgidmap" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgrp" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newuidmap" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_pt_chown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_ssh_keysign" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_su" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudo" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudoedit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_umount" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_chkpwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_userhelper" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_usernetctl" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_session_events" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_sysadmin_actions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_chmod" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_chown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_creat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchmod" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchmodat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchownat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fremovexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fsetxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_ftruncate" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_lchown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_lremovexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_lsetxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_o_creat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_o_trunc_write" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_rule_order" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat_o_creat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat_o_trunc_write" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat_rule_order" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_removexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_rename" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_renameat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_setxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_truncate" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_unlink" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_unlinkat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_configure_remote_server" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_encrypt_sent_records" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_syslog_plugin_activated" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_freq" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_local_events" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_log_format" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_name_format" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_write_logs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_banner_etc_issue" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_chronyd_client_only" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_bind_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_libreswan_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_coredump_disable_backtraces" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_coredump_disable_storage" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_db_up_to_date" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_login_retries" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_info" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_locks" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_session_idle_user_locks" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_directory_access_var_log_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_disable_host_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dnf-automatic_apply_updates" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dnf-automatic_security_updates_only" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_enable_fips_mode" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_fedora_gpgkey_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_local_packages" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_automatic_login" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_guest_login" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_audit_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_audit_backlog_limit_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_disable_interactive_boot" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_page_poison_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_password" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_pti_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_slub_debug_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_uefi_password" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_installed_OS_is_vendor_supported" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_kernel_module_atm_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_kernel_module_can_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_kernel_module_firewire-core_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_kernel_module_tipc_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_no_empty_passwords" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_abrt_removed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_fapolicyd_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_screen_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_sendmail_removed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_require_singleuser_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rpm_verify_hashes" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_cron_logging" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_selinux_all_devicefiles_labeled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_selinux_confinement_of_daemons" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_selinux_policytype" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_selinux_state" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_auditd_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_debug-shell_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_firewalld_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_rngd_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_systemd-coredump_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_set_firewalld_default_zone" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_gssapi_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_kerb_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_rekey_limit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sssd_run_as_sssd_user" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_core_pattern" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_dmesg_restrict" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_kexec_load_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_kptr_restrict" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_event_paranoid" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_unprivileged_bpf_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_core_bpf_jit_harden" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_user_max_user_namespaces" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_timer_dnf-automatic_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_aide" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_endpoint_security_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mcafee_security_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mcafee_endpoint_security_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mcafee_hbss_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disk_partitioning" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_media_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_network_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_remote_access_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_system_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sap_host" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sudo" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_system-tools" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_password_quality_pamcracklib" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_set_password_hashing_algorithm" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_smart_card_login" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_account_expiration" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_root_logins" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_root_paths" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_user_umask" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_audit_execution_acl_commands" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_audit_time_rules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_policy_rules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_apparmor" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_bootloader-zipl" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_entropy" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_kernel_build_config" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gcc_plugin" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configure_logwatch_on_logserver" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_journald" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_log_rotation" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_rsyslog_accepting_remote_messages" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-ipsec" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-iptables" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_activation" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_ruleset_modifications" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_icmp_disabled" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_log_and_drop_suspicious" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-ipv6" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_ipv6" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configuring_ipv6" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_ipv6_limit_requests" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-kernel" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_host_and_router_parameters" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_host_parameters" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-susefirewall2" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-wireless" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_wireless_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_disable_unused_interfaces" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_ssl" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_files" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_permissions_important_account_files" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_permissions_var_log_dir" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_permissions_within_important_dirs" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mounting" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_permissions_local" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_daemon_umask" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_enable_nx" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_selinux-booleans" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_apport" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_apt" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_avahi" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_avahi_configuration" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disable_avahi_group" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_cron_and_at" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_restrict_at_cron_users" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_deprecated" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dhcp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dhcp_client_configuration" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dhcp_server_configuration" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_client" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dns_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_isolation" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_chroot" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_dedicated" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_protection" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_partition_with_views" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_separate_internal_external" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_docker" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_vsftpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp_configure_vsftpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp_restrict_users" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp_use_vsftpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_http" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_httpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_installing_httpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_minimal_modules_installed" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_securing_httpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_configure_os_protect_web_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_chroot" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_restrict_file_dir_access" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_configure_perl_securely" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_configure_php_securely" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_directory_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_minimize_loadable_modules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_core_modules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_basic_authentication" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_minimize_config_files_included" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_optional_components" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_modules_improve_security" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_deploy_mod_security" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_deploy_mod_ssl" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_restrict_info_leakage" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_secure_content" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_use_dos_protection_modules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_imap" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configure_dovecot" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dovecot_allow_imap_access" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dovecot_enabling_ssl" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dovecot_support_necessary_protocols" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dovecot" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_kerberos" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ldap" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_openldap_client" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_openldap_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ldap_server_config_certificate_files" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_client" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_harden_os" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_configure_ssl_certs" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_install_ssl_cert" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_cfg" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_dos" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_recipient_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_relay_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_require_tls" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_set_trusted" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_smtp_auth_for_untrusted" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_and_rpc" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_nfs" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_netfs" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_nfs_services" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_all_machines" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_client_or_server_not_both" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configure_fixed_ports" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_clients" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_nfsd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mounting_remote_filesystems" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_servers" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configure_exports_restrictively" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_export_filesystems_read_only" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_use_acl_enforce_auth_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_obsolete" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_inetd_and_xinetd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nis" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_r_services" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_talk" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_telnet" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_tftp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_printing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configure_printing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_proxy" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_squid" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_radius" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_routing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_quagga" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_smb" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configuring_samba" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_smb_disable_printing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_smb_restrict_file_sharing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_samba" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_snmp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_snmp_service" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_snmp_configure_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ssh_client" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sshd_strengthen_firewall" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sssd-ldap" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_usbguard" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_xwindows" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_xwindows" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_general-principles" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-encrypt-transmitted-data" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-least-privilege" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-minimize-software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-separate-servers" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-use-security-tools" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_how-to-use" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-formatting-conventions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-read-sections-completely" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-reboot-required" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-root-shell-assumed" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-test-non-production" selected="false"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" selector="fips"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" selector="targeted"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_selinux_state" selector="enforcing"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" selector="12"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_ocredit" selector="1"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_dcredit" selector="1"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_ucredit" selector="1"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_lcredit" selector="1"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_tmout" selector="10_min"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" selector="3"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" selector="900"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" selector="never"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_retry" selector="3"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_login_banner_text" selector="usgcb_default"/>
      </xccdf-1.2:Profile>
      <xccdf-1.2:Profile id="xccdf_org.ssgproject.content_profile_pci-dss">
        <xccdf-1.2:title override="true">PCI-DSS v3.2.1 Control Baseline for Fedora</xccdf-1.2:title>
        <xccdf-1.2:description override="true">Ensures PCI-DSS v3.2.1 related security configuration settings are applied.</xccdf-1.2:description>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_account_unique_name" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_aide_build_database" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_renameat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rmdir" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlink" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlinkat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_immutable" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_finit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_media_export" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_session_events" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_sysadmin_actions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_settimeofday" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_stime" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_watch_localtime" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_creat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_ftruncate" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_truncate" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_syslog_plugin_activated" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_num_logs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_multiple_servers" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_remote_server" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_bind_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_libreswan_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_opensc_card_drivers" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_db_up_to_date" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_session_idle_user_locks" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_display_login_attempts" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_fedora_gpgkey_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_logrotate_activated" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_var_log_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_force_opensc_card_drivers" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_gid_passwd_group_same" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_audit_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_install_hids" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_no_empty_passwords" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_aide_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_audispd-plugins_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_libreswan_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_opensc_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rpm_verify_hashes" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rpm_verify_permissions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_ownership" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_permissions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_security_patches_up_to_date" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_auditd_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_chronyd_or_ntpd_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_pcscd_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_libuserconf" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sssd_enable_smartcards" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_fips" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_certified-vendor" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mcafee_security_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mcafee_endpoint_security_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mcafee_hbss_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disk_partitioning" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_login_screen" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_media_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_network_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_remote_access_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_system_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sap_host" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sudo" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_system-tools" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_accounts-banners" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gui_login_banner" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_password_quality_pamcracklib" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_console_screen_locking" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_root_logins" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_accounts-session" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_root_paths" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_user_umask" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_audit_execution_acl_commands" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_audit_execution_selinux_commands" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_policy_rules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_apparmor" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_uefi" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_bootloader-zipl" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_entropy" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_kernel_build_config" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gcc_plugin" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configure_logwatch_on_logserver" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_journald" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_rsyslog_accepting_remote_messages" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_rsyslog_sending_messages" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-firewalld" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_firewalld_activation" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ruleset_modifications" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-iptables" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_activation" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_ruleset_modifications" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_icmp_disabled" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_log_and_drop_suspicious" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-ipv6" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_ipv6" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configuring_ipv6" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_ipv6_limit_requests" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-kernel" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_host_and_router_parameters" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_host_parameters" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-susefirewall2" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-uncommon" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-wireless" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_wireless_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_disable_unused_interfaces" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_ssl" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_permissions_var_log_dir" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_permissions_within_important_dirs" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mounting" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_partitions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_permissions_local" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_coredumps" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_daemon_umask" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_enable_execshield_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_enable_nx" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_poisoning" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_selinux" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_selinux-booleans" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_apport" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_apt" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_avahi" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_avahi_configuration" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disable_avahi_group" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_base" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_cron_and_at" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_restrict_at_cron_users" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_deprecated" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dhcp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dhcp_client_configuration" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dhcp_server_configuration" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_client" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dns_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_isolation" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_chroot" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_dedicated" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_protection" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_partition_with_views" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_separate_internal_external" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_docker" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_fapolicyd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_vsftpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp_configure_vsftpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp_restrict_users" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp_use_vsftpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_http" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_httpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_installing_httpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_minimal_modules_installed" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_securing_httpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_configure_os_protect_web_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_chroot" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_restrict_file_dir_access" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_configure_perl_securely" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_configure_php_securely" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_directory_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_minimize_loadable_modules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_core_modules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_basic_authentication" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_minimize_config_files_included" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_optional_components" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_modules_improve_security" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_deploy_mod_security" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_deploy_mod_ssl" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_restrict_info_leakage" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_secure_content" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_use_dos_protection_modules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_imap" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configure_dovecot" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dovecot_allow_imap_access" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dovecot_enabling_ssl" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dovecot_support_necessary_protocols" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dovecot" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_kerberos" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ldap" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_openldap_client" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_openldap_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ldap_server_config_certificate_files" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mail" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_client" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_harden_os" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_configure_ssl_certs" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_install_ssl_cert" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_cfg" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_dos" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_recipient_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_relay_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_require_tls" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_set_trusted" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_smtp_auth_for_untrusted" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_and_rpc" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_nfs" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_netfs" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_nfs_services" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_all_machines" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_client_or_server_not_both" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configure_fixed_ports" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_clients" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_nfsd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mounting_remote_filesystems" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_servers" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configure_exports_restrictively" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_export_filesystems_read_only" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_use_acl_enforce_auth_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_obsolete" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_inetd_and_xinetd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nis" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_r_services" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_talk" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_telnet" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_tftp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_printing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configure_printing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_proxy" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_squid" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_radius" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_rng" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_routing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_quagga" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_smb" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configuring_samba" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_smb_disable_printing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_smb_restrict_file_sharing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_samba" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_snmp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_snmp_service" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_snmp_configure_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ssh" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ssh_client" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ssh_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sshd_strengthen_firewall" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sssd-ldap" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_usbguard" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_xwindows" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_xwindows" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_general-principles" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-encrypt-transmitted-data" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-least-privilege" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-minimize-software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-separate-servers" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-use-security-tools" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_how-to-use" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-formatting-conventions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-read-sections-completely" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-reboot-required" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-root-shell-assumed" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-test-non-production" selected="false"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember" selector="4"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" selector="90"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" selector="6"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" selector="1800"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" selector="7"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass" selector="2"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" selector="90"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_num_logs" selector="5"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" selector="rhel"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" selector="cac"/>
      </xccdf-1.2:Profile>
      <xccdf-1.2:Profile id="xccdf_org.ssgproject.content_profile_standard">
        <xccdf-1.2:title override="true">Standard System Security Profile for Fedora</xccdf-1.2:title>
        <xccdf-1.2:description override="true">This profile contains rules to ensure standard security baseline of a Fedora system.
Regardless of your system's workload all of these checks should pass.</xccdf-1.2:description>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_account_unique_name" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_root_path_dirs_no_write" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_aide_build_database" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_immutable" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_media_export" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_session_events" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_sysadmin_actions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_settimeofday" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_stime" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_watch_localtime" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_syslog_plugin_activated" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_num_logs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_remote_server" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_bind_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_libreswan_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_display_login_attempts" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_ownership_binary_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_ownership_library_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_binary_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_library_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_gid_passwd_group_same" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_audit_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_nousb_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_no_direct_root_logins" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_no_empty_passwords" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_no_netrc_files" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_restrict_serial_port_logins" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rpm_verify_hashes" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rpm_verify_permissions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_securetty_root_login_console_only" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_auditd_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_chronyd_or_ntpd_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_firewalld_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_set_firewalld_default_zone" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_fips" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_certified-vendor" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_endpoint_security_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mcafee_security_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mcafee_endpoint_security_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mcafee_hbss_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disk_partitioning" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_login_screen" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_media_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_network_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_remote_access_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_screen_locking" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_system_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sap_host" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sudo" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_system-tools" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_accounts-banners" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gui_login_banner" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_locking_out_password_attempts" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_password_quality" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_password_quality_pamcracklib" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_password_quality_pwquality" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_set_password_hashing_algorithm" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_accounts-physical" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_screen_locking" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_console_screen_locking" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_smart_card_login" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_user_umask" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_audit_execution_acl_commands" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_audit_execution_selinux_commands" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_policy_rules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_apparmor" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_bootloader-grub2" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_non-uefi" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_uefi" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_bootloader-zipl" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_entropy" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_kernel_build_config" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gcc_plugin" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_logging" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configure_logwatch_on_logserver" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ensure_rsyslog_log_file_configuration" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_journald" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_log_rotation" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_rsyslog_accepting_remote_messages" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_rsyslog_sending_messages" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-ipsec" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-iptables" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_activation" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_ruleset_modifications" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_icmp_disabled" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_log_and_drop_suspicious" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-ipv6" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_ipv6" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configuring_ipv6" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_ipv6_limit_requests" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-kernel" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_host_and_router_parameters" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_host_parameters" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-susefirewall2" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-uncommon" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-wireless" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_wireless_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_disable_unused_interfaces" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_ssl" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_permissions_important_account_files" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_permissions_var_log_dir" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_partitions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_permissions_local" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_coredumps" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_daemon_umask" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_enable_execshield_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_enable_nx" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_poisoning" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_selinux" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_selinux-booleans" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_apport" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_apt" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_avahi" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_avahi_configuration" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disable_avahi_group" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_base" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_cron_and_at" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_restrict_at_cron_users" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_deprecated" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dhcp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dhcp_client_configuration" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dhcp_server_configuration" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_client" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dns_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_isolation" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_chroot" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_dedicated" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_protection" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_partition_with_views" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_separate_internal_external" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_docker" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_fapolicyd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_vsftpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp_configure_vsftpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp_restrict_users" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp_use_vsftpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_http" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_httpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_installing_httpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_minimal_modules_installed" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_securing_httpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_configure_os_protect_web_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_chroot" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_restrict_file_dir_access" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_configure_perl_securely" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_configure_php_securely" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_directory_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_minimize_loadable_modules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_core_modules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_basic_authentication" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_minimize_config_files_included" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_optional_components" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_modules_improve_security" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_deploy_mod_security" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_deploy_mod_ssl" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_restrict_info_leakage" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_secure_content" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_use_dos_protection_modules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_imap" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configure_dovecot" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dovecot_allow_imap_access" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dovecot_enabling_ssl" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dovecot_support_necessary_protocols" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dovecot" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_kerberos" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ldap" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_openldap_client" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_openldap_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ldap_server_config_certificate_files" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mail" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_client" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_harden_os" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_configure_ssl_certs" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_install_ssl_cert" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_cfg" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_dos" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_recipient_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_relay_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_require_tls" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_set_trusted" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_smtp_auth_for_untrusted" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_and_rpc" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_nfs" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_netfs" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_nfs_services" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_all_machines" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_client_or_server_not_both" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configure_fixed_ports" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_clients" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_nfsd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mounting_remote_filesystems" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_servers" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configure_exports_restrictively" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_export_filesystems_read_only" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_use_acl_enforce_auth_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_obsolete" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_inetd_and_xinetd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nis" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_r_services" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_talk" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_telnet" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_tftp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_printing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configure_printing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_proxy" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_squid" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_radius" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_rng" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_routing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_quagga" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_smb" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configuring_samba" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_smb_disable_printing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_smb_restrict_file_sharing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_samba" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_snmp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_snmp_service" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_snmp_configure_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ssh_client" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sshd_strengthen_firewall" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sssd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sssd-ldap" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_usbguard" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_xwindows" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_xwindows" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_general-principles" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-encrypt-transmitted-data" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-least-privilege" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-minimize-software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-separate-servers" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-use-security-tools" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_how-to-use" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-formatting-conventions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-read-sections-completely" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-reboot-required" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-root-shell-assumed" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-test-non-production" selected="false"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs" selector="12"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" selector="7"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" selector="90"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" selector="7"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_num_logs" selector="5"/>
      </xccdf-1.2:Profile>
      <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_system">
        <xccdf-1.2:title>System Settings</xccdf-1.2:title>
        <xccdf-1.2:description>Contains rules that check correct system settings.</xccdf-1.2:description>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_software">
          <xccdf-1.2:title>Installing and Maintaining Software</xccdf-1.2:title>
          <xccdf-1.2:description>The following sections contain information on
security-relevant choices during the initial operating system
installation process and the setup of software
updates.</xccdf-1.2:description>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_prefer_64bit_os" severity="medium">
            <xccdf-1.2:title>Prefer to use a 64-bit Operating System when supported</xccdf-1.2:title>
            <xccdf-1.2:description>Prefer installation of 64-bit operating systems when the CPU supports it.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation besides installing a 64-bit operating system.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R10)</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Use of a 64-bit operating system offers a few advantages, like a larger address space range for
Address Space Layout Randomization (ASLR) and systematic presence of No eXecute and Execute Disable (NX/XD) protection bits.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-prefer_64bit_os:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-prefer_64bit_os_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_integrity">
            <xccdf-1.2:title>System and Software Integrity</xccdf-1.2:title>
            <xccdf-1.2:description>System and software integrity can be gained by installing antivirus, increasing
system encryption strength with FIPS, verifying installed software, enabling SELinux,
installing an Intrusion Prevention System, etc. However, installing or enabling integrity
checking tools cannot <html:i>prevent</html:i> intrusions, but they can detect that an intrusion
may have occurred. Requirements for integrity checking may be highly dependent on
the environment in which the system will be used. Snapshot-based approaches such
as AIDE may induce considerable overhead in the presence of frequent software updates.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_software-integrity">
              <xccdf-1.2:title>Software Integrity Checking</xccdf-1.2:title>
              <xccdf-1.2:description>Both the AIDE (Advanced Intrusion Detection Environment)
software and the RPM package management system provide
mechanisms for verifying the integrity of installed software.
AIDE uses snapshots of file metadata (such as hashes) and compares these
to current system files in order to detect changes.
<html:br/><html:br/>
The RPM package management system can conduct integrity
checks by comparing information in its metadata database with
files installed on the system.</xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_aide_scan_notification_email" type="string" interactive="true">
                <xccdf-1.2:title>Integrity Scan Notification Email Address</xccdf-1.2:title>
                <xccdf-1.2:description>Specify the email address for designated personnel if baseline
configurations are changed in an unauthorized manner.</xccdf-1.2:description>
                <xccdf-1.2:value>root@localhost</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_rpm_verification">
                <xccdf-1.2:title>Verify Integrity with RPM</xccdf-1.2:title>
                <xccdf-1.2:description>The RPM package management system includes the ability
to verify the integrity of installed packages by comparing the
installed files with information about the files taken from the
package metadata stored in the RPM database. Although an attacker
could corrupt the RPM database (analogous to attacking the AIDE
database as described above), this check can still reveal
modification of important files. To list which files on the system differ from what is expected by the RPM database:
<html:pre>$ rpm -qVa</html:pre>
See the man page for <html:code>rpm</html:code> to see a complete explanation of each column.</xccdf-1.2:description>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rpm_verify_hashes" severity="high">
                  <xccdf-1.2:title>Verify File Hashes with RPM</xccdf-1.2:title>
                  <xccdf-1.2:description>Without cryptographic integrity protections, system
executables and files can be altered by unauthorized users without
detection.
The RPM package management system can check the hashes of
installed software packages, including many that are important to system
security.
To verify that the cryptographic hash of system files and commands matches vendor
values, run the following command to list which files on the system
have hashes that differ from what is expected by the RPM database:
<html:pre>$ rpm -Va --noconfig | grep '^..5'</html:pre>
A "c" in the second column indicates that a file is a configuration file, which
may appropriately be expected to change. If the file was not expected to
change, investigate the cause of the change using audit logs or other means.
The package can then be reinstalled to restore the file.
Run the following command to determine which package owns the file:
<html:pre>$ rpm -qf <html:i>FILENAME</html:i></html:pre>
The package can be reinstalled from a dnf repository using the command:
<html:pre>$ sudo dnf reinstall <html:i>PACKAGENAME</html:i></html:pre>
Alternatively, the package can be reinstalled from trusted media using the command:
<html:pre>$ sudo rpm -Uvh <html:i>PACKAGENAME</html:i></html:pre></xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001749</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(2)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(i)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(d)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(6)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(3)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-11.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>The hashes of important files like system executables should match the
information given by the RPM database. Executables with erroneous hashes could
be a sign of nefarious activity on the system.</xccdf-1.2:rationale>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="rpm_verify_hashes">
# Find which files have incorrect hash (not in /etc, because of the system related config files) and then get files names
files_with_incorrect_hash="$(rpm -Va --noconfig | grep -E '^..5' | awk '{print $NF}' )"

# From files names get package names and change newline to space, because rpm writes each package to new line
packages_to_reinstall="$(rpm -qf $files_with_incorrect_hash | tr '\n' ' ')"

dnf reinstall -y $packages_to_reinstall
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="rpm_verify_hashes" complexity="high" disruption="medium" reboot="false" strategy="restrict">- name: 'Set fact: Package manager reinstall command (dnf)'
  set_fact:
    package_manager_reinstall_cmd: dnf reinstall -y
  when: ansible_distribution == "Fedora"
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.3.8
    - NIST-800-171-3.4.1
    - NIST-800-53-AU-9(3)
    - NIST-800-53-CM-6(c)
    - NIST-800-53-CM-6(d)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - NIST-800-53-SI-7(6)
    - PCI-DSS-Req-11.5
    - high_complexity
    - high_severity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy
    - rpm_verify_hashes

- name: 'Set fact: Package manager reinstall command (yum)'
  set_fact:
    package_manager_reinstall_cmd: yum reinstall -y
  when: (ansible_distribution == "RedHat" or ansible_distribution == "OracleLinux")
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.3.8
    - NIST-800-171-3.4.1
    - NIST-800-53-AU-9(3)
    - NIST-800-53-CM-6(c)
    - NIST-800-53-CM-6(d)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - NIST-800-53-SI-7(6)
    - PCI-DSS-Req-11.5
    - high_complexity
    - high_severity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy
    - rpm_verify_hashes

- name: Read files with incorrect hash
  command: rpm -Va --nodeps --nosize --nomtime --nordev --nocaps --nolinkto --nouser
    --nogroup --nomode --noghost --noconfig
  args:
    warn: false
  register: files_with_incorrect_hash
  changed_when: false
  failed_when: files_with_incorrect_hash.rc &gt; 1
  check_mode: false
  when: (package_manager_reinstall_cmd is defined)
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.3.8
    - NIST-800-171-3.4.1
    - NIST-800-53-AU-9(3)
    - NIST-800-53-CM-6(c)
    - NIST-800-53-CM-6(d)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - NIST-800-53-SI-7(6)
    - PCI-DSS-Req-11.5
    - high_complexity
    - high_severity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy
    - rpm_verify_hashes

- name: Create list of packages
  command: rpm -qf "{{ item }}"
  args:
    warn: false
  with_items: '{{ files_with_incorrect_hash.stdout_lines | map(''regex_findall'',
    ''^[.]+[5]+.* (\/.*)'', ''\1'') | map(''join'') | select(''match'', ''(\/.*)'')
    | list | unique }}'
  register: list_of_packages
  changed_when: false
  check_mode: false
  when:
    - files_with_incorrect_hash.stdout_lines is defined
    - (files_with_incorrect_hash.stdout_lines | length &gt; 0)
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.3.8
    - NIST-800-171-3.4.1
    - NIST-800-53-AU-9(3)
    - NIST-800-53-CM-6(c)
    - NIST-800-53-CM-6(d)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - NIST-800-53-SI-7(6)
    - PCI-DSS-Req-11.5
    - high_complexity
    - high_severity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy
    - rpm_verify_hashes

- name: Reinstall packages of files with incorrect hash
  command: '{{ package_manager_reinstall_cmd }} ''{{ item }}'''
  args:
    warn: false
  with_items: '{{ list_of_packages.results | map(attribute=''stdout_lines'') | list
    | unique }}'
  when:
    - files_with_incorrect_hash.stdout_lines is defined
    - (package_manager_reinstall_cmd is defined and (files_with_incorrect_hash.stdout_lines
      | length &gt; 0))
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.3.8
    - NIST-800-171-3.4.1
    - NIST-800-53-AU-9(3)
    - NIST-800-53-CM-6(c)
    - NIST-800-53-CM-6(d)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - NIST-800-53-SI-7(6)
    - PCI-DSS-Req-11.5
    - high_complexity
    - high_severity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy
    - rpm_verify_hashes
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-rpm_verify_hashes:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-rpm_verify_hashes_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rpm_verify_permissions" severity="high">
                  <xccdf-1.2:title>Verify and Correct File Permissions with RPM</xccdf-1.2:title>
                  <xccdf-1.2:description>The RPM package management system can check file access permissions
of installed software packages, including many that are important
to system security.
Verify that the file permissions of system files
and commands match vendor values. Check the file permissions
with the following command:
<html:pre>$ sudo rpm -Va | awk '{ if (substr($0,2,1)=="M") print $NF }'</html:pre>
Output indicates files that do not match vendor defaults.
After locating a file with incorrect permissions,
run the following command to determine which package owns it:
<html:pre>$ rpm -qf <html:i>FILENAME</html:i></html:pre>
<html:br/>
Next, run the following command to reset its permissions to
the correct values:
<html:pre>$ sudo rpm --setperms <html:i>PACKAGENAME</html:i></html:pre></xccdf-1.2:description>
                  <xccdf-1.2:warning category="general">Profiles may require that specific files have stricter file permissions than defined by the
vendor.
Such files will be reported as a finding and need to be evaluated according to your policy
and deployment environment.</xccdf-1.2:warning>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001493</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001494</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001495</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001496</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(2)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(i)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(d)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(6)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(3)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-11.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000256-GPOS-00097</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000257-GPOS-00098</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000258-GPOS-00099</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000278-GPOS-00108</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Permissions on system binaries and configuration files that are too generous
could allow an unauthorized user to gain privileges that they should not have.
The permissions set by the vendor should be maintained. Any deviations from
this baseline should be investigated.</xccdf-1.2:rationale>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="rpm_verify_permissions" complexity="high" disruption="medium" reboot="false" strategy="restrict">
# Declare array to hold set of RPM packages we need to correct permissions for
declare -A SETPERMS_RPM_DICT

# Create a list of files on the system having permissions different from what
# is expected by the RPM database
readarray -t FILES_WITH_INCORRECT_PERMS &lt; &lt;(rpm -Va --nofiledigest | awk '{ if (substr($0,2,1)=="M") print $NF }')

for FILE_PATH in "${FILES_WITH_INCORRECT_PERMS[@]}"
do
        # NOTE: some files maybe controlled by more then one package
        readarray -t RPM_PACKAGES &lt; &lt;(rpm -qf "${FILE_PATH}")
        for RPM_PACKAGE in "${RPM_PACKAGES[@]}"
        do
                # Use an associative array to store packages as it's keys, not having to care about duplicates.
                SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1
        done
done

# For each of the RPM packages left in the list -- reset its permissions to the
# correct values
for RPM_PACKAGE in "${!SETPERMS_RPM_DICT[@]}"
do
	rpm --restore "${RPM_PACKAGE}"
done
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="rpm_verify_permissions" complexity="high" disruption="medium" reboot="false" strategy="restrict">- name: Read list of files with incorrect permissions
  command: rpm -Va --nodeps --nosignature --nofiledigest --nosize --nomtime --nordev
    --nocaps --nolinkto --nouser --nogroup
  args:
    warn: false
  register: files_with_incorrect_permissions
  failed_when: files_with_incorrect_permissions.rc &gt; 1
  changed_when: false
  check_mode: false
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.3.8
    - NIST-800-171-3.4.1
    - NIST-800-53-AU-9(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(c)
    - NIST-800-53-CM-6(d)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - NIST-800-53-SI-7(6)
    - PCI-DSS-Req-11.5
    - high_complexity
    - high_severity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy
    - rpm_verify_permissions

- name: Create list of packages
  command: rpm -qf "{{ item }}"
  args:
    warn: false
  with_items: '{{ files_with_incorrect_permissions.stdout_lines | map(''regex_findall'',
    ''^[.]+[M]+.* (\/.*)'', ''\1'') | map(''join'') | select(''match'', ''(\/.*)'')
    | list | unique }}'
  register: list_of_packages
  changed_when: false
  check_mode: false
  when: (files_with_incorrect_permissions.stdout_lines | length &gt; 0)
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.3.8
    - NIST-800-171-3.4.1
    - NIST-800-53-AU-9(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(c)
    - NIST-800-53-CM-6(d)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - NIST-800-53-SI-7(6)
    - PCI-DSS-Req-11.5
    - high_complexity
    - high_severity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy
    - rpm_verify_permissions

- name: Correct file permissions with RPM
  command: rpm --setperms '{{ item }}'
  args:
    warn: false
  with_items: '{{ list_of_packages.results | map(attribute=''stdout_lines'') | list
    | unique }}'
  when: (files_with_incorrect_permissions.stdout_lines | length &gt; 0)
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.3.8
    - NIST-800-171-3.4.1
    - NIST-800-53-AU-9(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(c)
    - NIST-800-53-CM-6(d)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - NIST-800-53-SI-7(6)
    - PCI-DSS-Req-11.5
    - high_complexity
    - high_severity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy
    - rpm_verify_permissions
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-rpm_verify_permissions:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-rpm_verify_permissions_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
              </xccdf-1.2:Group>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_aide">
                <xccdf-1.2:title>Verify Integrity with AIDE</xccdf-1.2:title>
                <xccdf-1.2:description>AIDE conducts integrity checks by comparing information about
files with previously-gathered information. Ideally, the AIDE database is
created immediately after initial system configuration, and then again after any
software update.  AIDE is highly configurable, with further configuration
information located in <html:code>/usr/share/doc/aide-<html:i>VERSION</html:i></html:code>.</xccdf-1.2:description>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_aide_installed" severity="medium">
                  <xccdf-1.2:title>Install AIDE</xccdf-1.2:title>
                  <xccdf-1.2:description>The <html:code>aide</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install aide</html:pre></xccdf-1.2:description>
                  <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R51)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI02.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS04.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002696</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002699</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001744</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1034</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1288</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1341</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1417</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-11.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000363-GPOS-00150</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000445-GPOS-00199</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>The AIDE package must be installed if it is to be available for integrity checking.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#machine"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_aide_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "aide" ; then
    dnf install -y "aide"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_aide_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure aide is installed
  package:
    name: aide
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_aide_installed
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_aide_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_aide

class install_aide {
  package { 'aide':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_aide_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=aide
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_aide_installed">
[[packages]]
name = "aide"
version = "*"
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_aide_installed:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_aide_installed_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_aide_build_database" severity="medium">
                  <xccdf-1.2:title>Build and Test AIDE Database</xccdf-1.2:title>
                  <xccdf-1.2:description>Run the following command to generate a new database:

<html:pre>$ sudo /usr/sbin/aide --init</html:pre>

By default, the database will be written to the file

<html:code>/var/lib/aide/aide.db.new.gz</html:code>.

Storing the database, the configuration file <html:code>/etc/aide.conf</html:code>, and the binary

<html:code>/usr/sbin/aide</html:code>

(or hashes of these files), in a secure location (such as on read-only media) provides additional assurance about their integrity.
The newly-generated database can be installed as follows:

<html:pre>$ sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz</html:pre>

To initiate a manual check, run the following command:

<html:pre>$ sudo /usr/sbin/aide --check</html:pre>

If this check produces any unexpected output, investigate.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R51)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI02.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS04.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-11.5</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>For AIDE to be effective, an initial database of "known-good" information about files
must be captured and it should be able to be verified against the installed files.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#machine"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="aide_build_database"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "aide" ; then
    dnf install -y "aide"
fi

/usr/sbin/aide --init
/bin/cp -p /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="aide_build_database" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Ensure AIDE is installed
  package:
    name: '{{ item }}'
    state: present
  with_items:
    - aide
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - aide_build_database
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Build and Test AIDE Database
  command: /usr/sbin/aide --init
  changed_when: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - aide_build_database
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check whether the stock AIDE Database exists
  stat:
    path: /var/lib/aide/aide.db.new.gz
  register: aide_database_stat
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - aide_build_database
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Stage AIDE Database
  copy:
    src: /var/lib/aide/aide.db.new.gz
    dest: /var/lib/aide/aide.db.gz
    backup: true
    remote_src: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (aide_database_stat.stat.exists is defined and aide_database_stat.stat.exists)
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - aide_build_database
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-aide_build_database:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-aide_build_database_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_aide_check_audit_tools" severity="medium">
                  <xccdf-1.2:title>Configure AIDE to Verify the Audit Tools</xccdf-1.2:title>
                  <xccdf-1.2:description>The operating system file integrity tool must be configured to protect the integrity of the audit tools.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001496</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(3)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(3).1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000278-GPOS-00108</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Protecting the integrity of the tools used for auditing purposes is a
critical step toward ensuring the integrity of audit information. Audit
information includes all information (e.g., audit records, audit settings,
and audit reports) needed to successfully audit information system
activity.

Audit tools include but are not limited to vendor-provided and open-source
audit tools needed to successfully view and manipulate audit information
system activity and records. Audit tools include custom queries and report
generators.

It is not uncommon for attackers to replace the audit tools or inject code
into the existing tools to provide the capability to hide or erase system
activity from the audit logs.

To address this risk, audit tools must be cryptographically signed to
provide the capability to identify when the audit tools have been modified,
manipulated, or replaced. An example is a checksum hash of the file or
files.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#machine"/>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-aide_check_audit_tools:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-aide_check_audit_tools_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking" severity="medium">
                  <xccdf-1.2:title>Configure Periodic Execution of AIDE</xccdf-1.2:title>
                  <xccdf-1.2:description>At a minimum, AIDE should be configured to run a weekly scan.
To implement a daily execution of AIDE at 4:05am using cron, add the following line to <html:code>/etc/crontab</html:code>:
<html:pre>05 4 * * * root  --check</html:pre>
To implement a weekly execution of AIDE at 4:05am using cron, add the following line to <html:code>/etc/crontab</html:code>:
<html:pre>05 4 * * 0 root  --check</html:pre>
AIDE can be executed periodically through other means; this is merely one example.
The usage of cron's special time codes, such as  <html:code>@daily</html:code> and
<html:code>@weekly</html:code> is acceptable.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R51)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI02.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS04.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001744</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002699</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002702</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-11.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000363-GPOS-00150</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000446-GPOS-00200</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000447-GPOS-00201</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>By default, AIDE does not install itself for periodic execution. Periodically
running AIDE is necessary to reveal unexpected changes in installed files.
<html:br/><html:br/>
Unauthorized changes to the baseline configuration could make the system vulnerable
to various attacks or allow unauthorized access to the operating system. Changes to
operating system configurations can have unintended side effects, some of which may
be relevant to security.
<html:br/><html:br/>
Detecting such changes and providing an automated response can help avoid unintended,
negative consequences that could ultimately affect the security state of the operating
system. The operating system's Information Management Officer (IMO)/Information System
Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
monitoring system trap when there is an unauthorized modification of a configuration item.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#machine"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="aide_periodic_cron_checking"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "aide" ; then
    dnf install -y "aide"
fi

if ! grep -q "/usr/sbin/aide --check" /etc/crontab ; then
    echo "05 4 * * * root /usr/sbin/aide --check" &gt;&gt; /etc/crontab
else
    sed -i '\!^.* --check.*$!d' /etc/crontab
    echo "05 4 * * * root /usr/sbin/aide --check" &gt;&gt; /etc/crontab
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="aide_periodic_cron_checking" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Ensure AIDE is installed
  package:
    name: '{{ item }}'
    state: present
  with_items:
    - aide
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - PCI-DSS-Req-11.5
    - aide_periodic_cron_checking
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set cron package name - RedHat
  set_fact:
    cron_pkg_name: cronie
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ansible_os_family == "RedHat" or ansible_os_family == "Suse"
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - PCI-DSS-Req-11.5
    - aide_periodic_cron_checking
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set cron package name - Debian
  set_fact:
    cron_pkg_name: cron
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ansible_os_family == "Debian"
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - PCI-DSS-Req-11.5
    - aide_periodic_cron_checking
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Install cron
  package:
    name: '{{ cron_pkg_name }}'
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - PCI-DSS-Req-11.5
    - aide_periodic_cron_checking
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Configure Periodic Execution of AIDE
  cron:
    name: run AIDE check
    minute: 5
    hour: 4
    weekday: 0
    user: root
    job: /usr/sbin/aide --check
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - PCI-DSS-Req-11.5
    - aide_periodic_cron_checking
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-aide_periodic_cron_checking:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-aide_periodic_cron_checking_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_fips">
              <xccdf-1.2:title>Federal Information Processing Standard (FIPS)</xccdf-1.2:title>
              <xccdf-1.2:description>The Federal Information Processing Standard (FIPS) is a computer security standard which
is developed by the U.S. Government and industry working groups to validate the quality
of cryptographic modules. The FIPS standard provides four security levels to ensure
adequate coverage of different industries, implementation of cryptographic modules, and
organizational sizes and requirements.
<html:br/><html:br/>
FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules
utilize authentication that meets industry and government requirements. For government systems, this allows
Security Levels 1, 2, 3, or 4 for use on Fedora.
<html:br/><html:br/>
See <html:b><html:a href="http://csrc.nist.gov/publications/PubsFIPS.html">http://csrc.nist.gov/publications/PubsFIPS.html</html:a></html:b> for more information.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_enable_dracut_fips_module" severity="high">
                <xccdf-1.2:title>Enable Dracut FIPS Module</xccdf-1.2:title>
                <xccdf-1.2:description>To enable FIPS mode, run the following command:
<html:pre>fips-mode-setup --enable</html:pre>
To enable FIPS, the system requires that the <html:code>fips</html:code> module is added in <html:code>dracut</html:code> configuration.
Check if <html:code>/etc/dracut.conf.d/40-fips.conf</html:code> contain <html:code>add_dracutmodules+=" fips "</html:code></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">The system needs to be rebooted for these changes to take effect.</xccdf-1.2:warning>
                <xccdf-1.2:warning category="regulatory">System Crypto Modules must be provided by a vendor that undergoes FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use cryptographic-based security
systems to protect sensitive information in computer and telecommunication systems
(including voice systems) as defined in Section 5131 of the Information Technology
Management Reform Act of 1996, Public Law 104-106. This standard shall be used in designing
and implementing cryptographic modules that Federal departments and agencies operate or are
operated for them under contract.
See <html:b><html:a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf">https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf</html:a></html:b>
To meet this, the system has to have cryptographic software provided by a vendor that has
undergone this certification. This means providing documentation, test results, design
information, and independent third party review by an accredited lab. While open source
software is capable of meeting this, it does not meet FIPS-140 unless the vendor submits to
this process.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000068</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000803</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002450</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1446</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_RBG_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000478-GPOS-00223</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000120-VMM-000600</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000478-VMM-001980</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000396-VMM-001590</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to
protect data. The operating system must implement cryptographic modules adhering to the higher
standards approved by the federal government since this provides assurance they have been tested
and validated.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="enable_dracut_fips_module"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

fips-mode-setup --enable
FIPS_CONF="/etc/dracut.conf.d/40-fips.conf"
if ! grep "^add_dracutmodules+=\" fips \"" $FIPS_CONF; then
    echo "add_dracutmodules+=\" fips \"" &gt;&gt; $FIPS_CONF
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="enable_dracut_fips_module" complexity="medium" disruption="medium" reboot="true" strategy="restrict">- name: Check to see the current status of FIPS mode
  command: /usr/bin/fips-mode-setup --check
  register: is_fips_enabled
  changed_when: false
  failed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-7
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - enable_dracut_fips_module
    - high_severity
    - medium_complexity
    - medium_disruption
    - reboot_required
    - restrict_strategy

- name: Enable FIPS mode
  command: /usr/bin/fips-mode-setup --enable
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - is_fips_enabled.stdout.find('FIPS mode is enabled.') == -1
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-7
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - enable_dracut_fips_module
    - high_severity
    - medium_complexity
    - medium_disruption
    - reboot_required
    - restrict_strategy

- name: Enable Dracut FIPS Module
  lineinfile:
    path: /etc/dracut.conf.d/40-fips.conf
    line: add_dracutmodules+=" fips "
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-7
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - enable_dracut_fips_module
    - high_severity
    - medium_complexity
    - medium_disruption
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-enable_dracut_fips_module:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-enable_dracut_fips_module_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_enable_fips_mode" severity="high">
                <xccdf-1.2:title>Enable FIPS Mode</xccdf-1.2:title>
                <xccdf-1.2:description>To enable FIPS mode, run the following command:
<html:pre>fips-mode-setup --enable</html:pre>
<html:br/>
The <html:code>fips-mode-setup</html:code> command will configure the system in
FIPS mode by automatically configuring the following:
<html:ul><html:li>Setting the kernel FIPS mode flag (<html:code>/proc/sys/crypto/fips_enabled</html:code>) to <html:code>1</html:code></html:li><html:li>Creating <html:code>/etc/system-fips</html:code></html:li><html:li>Setting the system crypto policy in <html:code>/etc/crypto-policies/config</html:code> to <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" use="legacy"/></html:code></html:li><html:li>Loading the Dracut <html:code>fips</html:code> module</html:li></html:ul></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">The system needs to be rebooted for these changes to take effect.</xccdf-1.2:warning>
                <xccdf-1.2:warning category="regulatory">This rule DOES NOT CHECK if the components of the operating system are FIPS certified.
You can find the list of FIPS certified modules at 
<html:a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search">https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search</html:a>.
This rule checks if the system is running in FIPS mode. See the rule description for more information about what it means.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000068</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000803</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002450</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1446</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-3(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_CKM.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_CKM.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_TLSC_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_RBG_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000478-GPOS-00223</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000396-GPOS-00176</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000120-VMM-000600</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000478-VMM-001980</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000396-VMM-001590</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to
protect data. The operating system must implement cryptographic modules adhering to the higher
standards approved by the federal government since this provides assurance they have been tested
and validated.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="enable_fips_mode"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

var_system_crypto_policy='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" use="legacy"/>'


fips-mode-setup --enable

stderr_of_call=$(update-crypto-policies --set ${var_system_crypto_policy} 2&gt;&amp;1 &gt; /dev/null)
rc=$?

if test "$rc" = 127; then
	echo "$stderr_of_call" &gt;&amp;2
	echo "Make sure that the script is installed on the remediated system." &gt;&amp;2
	echo "See output of the 'dnf provides update-crypto-policies' command" &gt;&amp;2
	echo "to see what package to (re)install" &gt;&amp;2

	false  # end with an error code
elif test "$rc" != 0; then
	echo "Error invoking the update-crypto-policies script: $stderr_of_call" &gt;&amp;2
	false  # end with an error code
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="enable_fips_mode" complexity="medium" disruption="medium" reboot="true" strategy="restrict">- name: XCCDF Value var_system_crypto_policy # promote to variable
  set_fact:
    var_system_crypto_policy: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" use="legacy"/>
  tags:
    - always

- name: Check to see the current status of FIPS mode
  command: /usr/bin/fips-mode-setup --check
  register: is_fips_enabled
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-3(6)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-7
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - enable_fips_mode
    - high_severity
    - medium_complexity
    - medium_disruption
    - reboot_required
    - restrict_strategy

- name: Enable FIPS mode
  command: /usr/bin/fips-mode-setup --enable
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - is_fips_enabled.stdout.find('FIPS mode is enabled.') == -1
  tags:
    - NIST-800-53-CM-3(6)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-7
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - enable_fips_mode
    - high_severity
    - medium_complexity
    - medium_disruption
    - reboot_required
    - restrict_strategy

- name: Enable FIPS Mode
  lineinfile:
    path: /etc/crypto-policies/config
    regexp: ^(?!#)(\S+)$
    line: '{{ var_system_crypto_policy }}'
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-3(6)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-7
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - enable_fips_mode
    - high_severity
    - medium_complexity
    - medium_disruption
    - reboot_required
    - restrict_strategy

- name: Verify that Crypto Policy is Set (runtime)
  command: /usr/bin/update-crypto-policies --set {{ var_system_crypto_policy }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-3(6)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-7
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - enable_fips_mode
    - high_severity
    - medium_complexity
    - medium_disruption
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_system_crypto_policy:var:1" value-id="xccdf_org.ssgproject.content_value_var_system_crypto_policy"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-enable_fips_mode:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-enable_fips_mode_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_etc_system_fips_exists" severity="high">
                <xccdf-1.2:title>Ensure '/etc/system-fips' exists</xccdf-1.2:title>
                <xccdf-1.2:description>On a system where FIPS mode is enabled, <html:code>/etc/system-fips</html:code> must exist.
To enable FIPS mode, run the following command:
<html:pre>fips-mode-setup --enable</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">The system needs to be rebooted for these changes to take effect.</xccdf-1.2:warning>
                <xccdf-1.2:warning category="regulatory">System Crypto Modules must be provided by a vendor that undergoes
FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as
defined in Section 5131 of the Information Technology Management Reform
Act of 1996, Public Law 104-106. This standard shall be used in
designing and implementing cryptographic modules that Federal
departments and agencies operate or are operated for them under
contract. See <html:b><html:a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf">https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf</html:a></html:b>
To meet this, the system has to have cryptographic software provided by
a vendor that has undergone this certification. This means providing
documentation, test results, design information, and independent third
party review by an accredited lab. While open source software is
capable of meeting this, it does not meet FIPS-140 unless the vendor
submits to this process.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000068</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000803</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002450</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000120-VMM-000600</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000478-VMM-001980</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000396-VMM-001590</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to
protect data. The operating system must implement cryptographic modules adhering to the higher
standards approved by the federal government since this provides assurance they have been tested
and validated.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-etc_system_fips_exists:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-etc_system_fips_exists_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_crypto_fips_enabled" severity="high">
                <xccdf-1.2:title>Set kernel parameter 'crypto.fips_enabled' to 1</xccdf-1.2:title>
                <xccdf-1.2:description>System running in FIPS mode is indicated by kernel parameter
<html:code>'crypto.fips_enabled'</html:code>. This parameter should be set to <html:code>1</html:code> in FIPS mode.
To enable FIPS mode, run the following command:
<html:pre>fips-mode-setup --enable</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">The system needs to be rebooted for these changes to take effect.</xccdf-1.2:warning>
                <xccdf-1.2:warning category="regulatory">System Crypto Modules must be provided by a vendor that undergoes FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use cryptographic-based security
systems to protect sensitive information in computer and telecommunication systems
(including voice systems) as defined in Section 5131 of the Information Technology
Management Reform Act of 1996, Public Law 104-106. This standard shall be used in designing
and implementing cryptographic modules that Federal departments and agencies operate or are
operated for them under contract.
See <html:b><html:a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf">https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf</html:a></html:b>
To meet this, the system has to have cryptographic software provided by a vendor that has
undergone this certification. This means providing documentation, test results, design
information, and independent third party review by an accredited lab. While open source
software is capable of meeting this, it does not meet FIPS-140 unless the vendor submits to
this process.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000068</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000803</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002450</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000033-GPOS-00014</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000125-GPOS-00065</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000396-GPOS-00176</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000423-GPOS-00187</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000478-GPOS-00223</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000120-VMM-000600</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000478-VMM-001980</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000396-VMM-001590</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to
protect data. The operating system must implement cryptographic modules adhering to the higher
standards approved by the federal government since this provides assurance they have been tested
and validated.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_crypto_fips_enabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_crypto_fips_enabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_crypto">
              <xccdf-1.2:title>System Cryptographic Policies</xccdf-1.2:title>
              <xccdf-1.2:description>Linux has the capability to centrally configure cryptographic polices. The command
<html:code>update-crypto-policies</html:code> is used to set the policy applicable for the various
cryptographic back-ends, such as SSL/TLS libraries. The configured cryptographic
policies will be the default policy used by these backends unless the application
user configures them otherwise. When the system has been configured to use the
centralized cryptographic policies, the administrator is assured that any application
that utilizes the supported backends will follow a policy that adheres to the
configured profile.

Currently the supported backends are:
<html:ul><html:li>GnuTLS library</html:li><html:li>OpenSSL library</html:li><html:li>NSS library</html:li><html:li>OpenJDK</html:li><html:li>Libkrb5</html:li><html:li>BIND</html:li><html:li>OpenSSH</html:li></html:ul>
Applications and languages which rely on any of these backends will follow the
system policies as well. Examples are apache httpd, nginx, php, and others.</xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ssh_client_rekey_limit_size" type="string" interactive="true">
                <xccdf-1.2:title>SSH client RekeyLimit - size</xccdf-1.2:title>
                <xccdf-1.2:description>Specify the size component of the rekey limit. This limit signifies amount
of data. After this amount of data is transferred through the connection,
the session key is renegotiated. The number is followed by K, M or G for
kilobytes, megabytes or gigabytes. Note that the RekeyLimit can be also
configured according to elapsed time.</xccdf-1.2:description>
                <xccdf-1.2:value>512M</xccdf-1.2:value>
                <xccdf-1.2:value selector="512M">512M</xccdf-1.2:value>
                <xccdf-1.2:value selector="1G">1G</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ssh_client_rekey_limit_time" type="string" interactive="true">
                <xccdf-1.2:title>SSH client RekeyLimit - time</xccdf-1.2:title>
                <xccdf-1.2:description>Specify the time component of the rekey limit. The session key is
renegotiated after the defined amount of time passes. The number is followed
by units such as H or M for hours or minutes. Note that the RekeyLimit can
be also configured according to amount of transfered data.</xccdf-1.2:description>
                <xccdf-1.2:value>1h</xccdf-1.2:value>
                <xccdf-1.2:value selector="1hour">1h</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_system_crypto_policy" type="string">
                <xccdf-1.2:title>The system-provided crypto policies</xccdf-1.2:title>
                <xccdf-1.2:description>Specify the crypto policy for the system.</xccdf-1.2:description>
                <xccdf-1.2:value>DEFAULT</xccdf-1.2:value>
                <xccdf-1.2:value selector="default_policy">DEFAULT</xccdf-1.2:value>
                <xccdf-1.2:value selector="default_nosha1">DEFAULT:NO-SHA1</xccdf-1.2:value>
                <xccdf-1.2:value selector="fips">FIPS</xccdf-1.2:value>
                <xccdf-1.2:value selector="fips_ospp">FIPS:OSPP</xccdf-1.2:value>
                <xccdf-1.2:value selector="legacy">LEGACY</xccdf-1.2:value>
                <xccdf-1.2:value selector="future">FUTURE</xccdf-1.2:value>
                <xccdf-1.2:value selector="next">NEXT</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configure_bind_crypto_policy" severity="high">
                <xccdf-1.2:title>Configure BIND to use System Crypto Policy</xccdf-1.2:title>
                <xccdf-1.2:description>Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
BIND is supported by crypto policy, but the BIND configuration may be
set up to ignore it.

To check that Crypto Policies settings are configured correctly, ensure that the <html:code>/etc/named.conf</html:code>
includes the appropriate configuration:
In the <html:code>options</html:code> section of <html:code>/etc/named.conf</html:code>, make sure that the following line
is not commented out or superseded by later includes:
<html:code>include "/etc/crypto-policies/back-ends/bind.config";</html:code></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000423-GPOS-00187</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000426-GPOS-00190</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Overriding the system crypto policy makes the behavior of the BIND service violate expectations,
and makes system configuration more fragmented.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="configure_bind_crypto_policy">
function remediate_bind_crypto_policy() {
	CONFIG_FILE="/etc/named.conf"
	if test -f "$CONFIG_FILE"; then
		sed -i 's|options {|&amp;\n\tinclude "/etc/crypto-policies/back-ends/bind.config";|' "$CONFIG_FILE"
		return 0
	else
		echo "Aborting remediation as '$CONFIG_FILE' was not even found." &gt;&amp;2
		return 1
	fi
}

remediate_bind_crypto_policy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-configure_bind_crypto_policy:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-configure_bind_crypto_policy_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configure_crypto_policy" severity="high">
                <xccdf-1.2:title>Configure System Cryptography Policy</xccdf-1.2:title>
                <xccdf-1.2:description>To configure the system cryptography policy to use ciphers only from the <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" use="legacy"/></html:code>
policy, run the following command:
<html:pre>$ sudo update-crypto-policies --set <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" use="legacy"/></html:pre>
The rule checks if settings for selected crypto policy are configured as expected. Configuration files in the <html:code>/etc/crypto-policies/back-ends</html:code> are either symlinks to correct files provided by Crypto-policies package or they are regular files in case crypto policy customizations are applied.
Crypto policies may be customized by crypto policy modules, in which case it is delimited from the base policy using a colon.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">The system needs to be rebooted for these changes to take effect.</xccdf-1.2:warning>
                <xccdf-1.2:warning category="regulatory">System Crypto Modules must be provided by a vendor that undergoes
FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as
defined in Section 5131 of the Information Technology Management Reform
Act of 1996, Public Law 104-106. This standard shall be used in
designing and implementing cryptographic modules that Federal
departments and agencies operate or are operated for them under
contract. See <html:b><html:a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf">https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf</html:a></html:b>
To meet this, the system has to have cryptographic software provided by
a vendor that has undergone this certification. This means providing
documentation, test results, design information, and independent third
party review by an accredited lab. While open source software is
capable of meeting this, it does not meet FIPS-140 unless the vendor
submits to this process.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1446</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_CKM.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_CKM.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_TLSC_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000396-GPOS-00176</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000393-GPOS-00173</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000394-GPOS-00174</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Centralized cryptographic policies simplify applying secure ciphers across an operating system and
the applications that run on that operating system. Use of weak or untested encryption algorithms
undermines the purposes of utilizing encryption to protect data.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="configure_crypto_policy">
var_system_crypto_policy='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" use="legacy"/>'


stderr_of_call=$(update-crypto-policies --set ${var_system_crypto_policy} 2&gt;&amp;1 &gt; /dev/null)
rc=$?

if test "$rc" = 127; then
	echo "$stderr_of_call" &gt;&amp;2
	echo "Make sure that the script is installed on the remediated system." &gt;&amp;2
	echo "See output of the 'dnf provides update-crypto-policies' command" &gt;&amp;2
	echo "to see what package to (re)install" &gt;&amp;2

	false  # end with an error code
elif test "$rc" != 0; then
	echo "Error invoking the update-crypto-policies script: $stderr_of_call" &gt;&amp;2
	false  # end with an error code
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="configure_crypto_policy" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: XCCDF Value var_system_crypto_policy # promote to variable
  set_fact:
    var_system_crypto_policy: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" use="legacy"/>
  tags:
    - always

- name: Configure System Cryptography Policy
  lineinfile:
    path: /etc/crypto-policies/config
    regexp: ^(?!#)(\S+)$
    line: '{{ var_system_crypto_policy }}'
    create: true
  tags:
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - configure_crypto_policy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy

- name: Verify that Crypto Policy is Set (runtime)
  command: /usr/bin/update-crypto-policies --set {{ var_system_crypto_policy }}
  tags:
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - configure_crypto_policy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_system_crypto_policy:var:1" value-id="xccdf_org.ssgproject.content_value_var_system_crypto_policy"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-configure_crypto_policy:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-configure_crypto_policy_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configure_gnutls_tls_crypto_policy" severity="medium">
                <xccdf-1.2:title>Configure GnuTLS library to use DoD-approved TLS Encryption</xccdf-1.2:title>
                <xccdf-1.2:description>Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
GnuTLS is supported by system crypto policy, but the GnuTLS configuration may be
set up to ignore it.

To check that Crypto Policies settings are configured correctly, ensure that
<html:code>/etc/crypto-policies/back-ends/gnutls.config</html:code> contains the following
line and is not commented out:
<html:code>+VERS-ALL:-VERS-DTLS0.9:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS1.0</html:code></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001453</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000423-GPOS-00187</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Overriding the system crypto policy makes the behavior of the GnuTLS
library violate expectations, and makes system configuration more
fragmented.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="configure_gnutls_tls_crypto_policy" complexity="low" disruption="low" reboot="true" strategy="restrict">
CONF_FILE=/etc/crypto-policies/back-ends/gnutls.config
correct_value='+VERS-ALL:-VERS-DTLS0.9:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS1.0'

grep -q ${correct_value} ${CONF_FILE}

if [[ $? -ne 0 ]]; then
    # We need to get the existing value, using PCRE to maintain same regex
    existing_value=$(grep -Po '(\+VERS-ALL(?::-VERS-[A-Z]+\d\.\d)+)' ${CONF_FILE})

    if [[ ! -z ${existing_value} ]]; then
        # replace existing_value with correct_value
        sed -i "s/${existing_value}/${correct_value}/g" ${CONF_FILE}
    else
        # ***NOTE*** #
        # This probably means this file is not here or it's been modified
        # unintentionally.
        # ********** #
        # echo correct_value to end
        echo ${correct_value} &gt;&gt; ${CONF_FILE}
    fi
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="configure_gnutls_tls_crypto_policy" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: 'Configure GnuTLS library to use DoD-approved TLS Encryption: set_fact'
  set_fact:
    path: /etc/crypto-policies/back-ends/gnutls.config
    correct_value: +VERS-ALL:-VERS-DTLS0.9:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS1.0
    lineinfile_reg: \+VERS-ALL:-VERS-DTLS0\.9:-VERS-SSL3\.0:-VERS-TLS1\.0:-VERS-TLS1\.1:-VERS-DTLS1\.0
  tags:
    - NIST-800-53-AC-17(2)
    - configure_gnutls_tls_crypto_policy
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: 'Configure GnuTLS library to use DoD-approved TLS Encryption: stat'
  stat:
    path: '{{ path }}'
    follow: true
  register: gnutls_file
  tags:
    - NIST-800-53-AC-17(2)
    - configure_gnutls_tls_crypto_policy
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: 'Configure GnuTLS library to use DoD-approved TLS Encryption: Add'
  lineinfile:
    path: '{{ path }}'
    regexp: '{{ lineinfile_reg }}'
    line: '{{ correct_value }}'
    create: true
  when: not gnutls_file.stat.exists or gnutls_file.stat.size &lt;= correct_value|length
  tags:
    - NIST-800-53-AC-17(2)
    - configure_gnutls_tls_crypto_policy
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Configure GnuTLS library to use DoD-approved TLS Encryption
  block:

    - name: 'Configure GnuTLS library to use DoD-approved TLS Encryption: Existing
        value check'
      lineinfile:
        path: '{{ path }}'
        create: false
        regexp: '{{ lineinfile_reg }}'
        state: absent
      check_mode: true
      changed_when: false
      register: gnutls

    - name: 'Configure GnuTLS library to use DoD-approved TLS Encryption: Update'
      replace:
        path: '{{ path }}'
        regexp: (\+VERS-ALL(?::-VERS-[A-Z]+\d\.\d)+)
        replace: '{{ correct_value }}'
      when: gnutls.found is defined and gnutls.found != 1
  when: gnutls_file.stat.exists and gnutls_file.stat.size &gt; correct_value|length
  tags:
    - NIST-800-53-AC-17(2)
    - configure_gnutls_tls_crypto_policy
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-configure_gnutls_tls_crypto_policy:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-configure_gnutls_tls_crypto_policy_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy" severity="high">
                <xccdf-1.2:title>Configure Kerberos to use System Crypto Policy</xccdf-1.2:title>
                <xccdf-1.2:description>Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
Kerberos is supported by crypto policy, but it's configuration may be
set up to ignore it.
To check that Crypto Policies settings for Kerberos are configured correctly, examine that there is a symlink at
/etc/krb5.conf.d/crypto-policies targeting /etc/cypto-policies/back-ends/krb5.config.
If the symlink exists, Kerberos is configured to use the system-wide crypto policy settings.</xccdf-1.2:description>
                <xccdf-1.2:reference href="">0418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1055</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1402</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Overriding the system crypto policy makes the behavior of Kerberos violate expectations,
and makes system configuration more fragmented.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="configure_kerberos_crypto_policy" complexity="low" disruption="low" reboot="true" strategy="configure">
rm -f /etc/krb5.conf.d/crypto-policies
ln -s /etc/crypto-policies/back-ends/krb5.config /etc/krb5.conf.d/crypto-policies
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="configure_kerberos_crypto_policy" complexity="low" disruption="low" reboot="true" strategy="configure">- name: Configure Kerberos to use System Crypto Policy
  file:
    src: /etc/crypto-policies/back-ends/krb5.config
    path: /etc/krb5.conf.d/crypto-policies
    state: link
  tags:
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - configure_kerberos_crypto_policy
    - configure_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - reboot_required
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-configure_kerberos_crypto_policy:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-configure_kerberos_crypto_policy_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configure_libreswan_crypto_policy" severity="high">
                <xccdf-1.2:title>Configure Libreswan to use System Crypto Policy</xccdf-1.2:title>
                <xccdf-1.2:description>Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
Libreswan is supported by system crypto policy, but the Libreswan configuration may be
set up to ignore it.

To check that Crypto Policies settings are configured correctly, ensure that the <html:code>/etc/ipsec.conf</html:code>
includes the appropriate configuration file.
In <html:code>/etc/ipsec.conf</html:code>, make sure that the following line
is not commented out or superseded by later includes:
<html:code>include /etc/crypto-policies/back-ends/libreswan.config</html:code></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_IPSEC_EXT.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_IPSEC_EXT.1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000033-GPOS-00014</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Overriding the system crypto policy makes the behavior of the Libreswan
service violate expectations, and makes system configuration more
fragmented.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="configure_libreswan_crypto_policy">
function remediate_libreswan_crypto_policy() {
    CONFIG_FILE="/etc/ipsec.conf"
    if ! grep -qP "^\s*include\s+/etc/crypto-policies/back-ends/libreswan.config\s*(?:#.*)?$" "$CONFIG_FILE" ; then
        echo 'include /etc/crypto-policies/back-ends/libreswan.config' &gt;&gt; "$CONFIG_FILE"
    fi
    return 0
}

remediate_libreswan_crypto_policy
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="configure_libreswan_crypto_policy" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Configure Libreswan to use System Crypto Policy
  lineinfile:
    path: /etc/ipsec.conf
    line: include /etc/crypto-policies/back-ends/libreswan.config
    create: true
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - configure_libreswan_crypto_policy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-configure_libreswan_crypto_policy:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-configure_libreswan_crypto_policy_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy" severity="medium">
                <xccdf-1.2:title>Configure OpenSSL library to use System Crypto Policy</xccdf-1.2:title>
                <xccdf-1.2:description>Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
OpenSSL is supported by crypto policy, but the OpenSSL configuration may be
set up to ignore it.
To check that Crypto Policies settings are configured correctly, you have to examine the OpenSSL config file
available under <html:code>/etc/pki/tls/openssl.cnf</html:code>.
This file has the <html:code>ini</html:code> format, and it enables crypto policy support
if there is a <html:code>[ crypto_policy ]</html:code> section that contains the <html:code>.include /etc/crypto-policies/back-ends/opensslcnf.config</html:code> directive.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001453</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Overriding the system crypto policy makes the behavior of the Java runtime violates expectations,
and makes system configuration more fragmented.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="configure_openssl_crypto_policy">
OPENSSL_CRYPTO_POLICY_SECTION='[ crypto_policy ]'
OPENSSL_CRYPTO_POLICY_SECTION_REGEX='\[\s*crypto_policy\s*\]'
OPENSSL_CRYPTO_POLICY_INCLUSION='.include /etc/crypto-policies/back-ends/opensslcnf.config'
OPENSSL_CRYPTO_POLICY_INCLUSION_REGEX='^\s*\.include\s*/etc/crypto-policies/back-ends/opensslcnf.config$'


  


function remediate_openssl_crypto_policy() {
	CONFIG_FILE=/etc/pki/tls/openssl.cnf
	if test -f "$CONFIG_FILE"; then
		if ! grep -q "^\\s*$OPENSSL_CRYPTO_POLICY_SECTION_REGEX" "$CONFIG_FILE"; then
			printf '\n%s\n\n%s' "$OPENSSL_CRYPTO_POLICY_SECTION" "$OPENSSL_CRYPTO_POLICY_INCLUSION" &gt;&gt; "$CONFIG_FILE"
			return 0
		elif ! grep -q "^\\s*$OPENSSL_CRYPTO_POLICY_INCLUSION_REGEX" "$CONFIG_FILE"; then
			sed -i "s|$OPENSSL_CRYPTO_POLICY_SECTION_REGEX|&amp;\\n\\n$OPENSSL_CRYPTO_POLICY_INCLUSION\\n|" "$CONFIG_FILE"
			return 0
		fi
	else
		echo "Aborting remediation as '$CONFIG_FILE' was not even found." &gt;&amp;2
		return 1
	fi
}

remediate_openssl_crypto_policy
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="configure_openssl_crypto_policy" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Test for crypto_policy group
  command: grep '^\s*\[\s*crypto_policy\s*]' /etc/pki/tls/openssl.cnf
  register: test_crypto_policy_group
  ignore_errors: true
  changed_when: false
  check_mode: false
  tags:
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - configure_openssl_crypto_policy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Add .include for opensslcnf.config to crypto_policy section
  lineinfile:
    create: true
    insertafter: ^\s*\[\s*crypto_policy\s*]\s*
    line: .include /etc/crypto-policies/back-ends/opensslcnf.config
    path: /etc/pki/tls/openssl.cnf
  when:
    - test_crypto_policy_group.stdout is defined
    - test_crypto_policy_group.stdout | length &gt; 0
  tags:
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - configure_openssl_crypto_policy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Add crypto_policy group and set include opensslcnf.config
  lineinfile:
    create: true
    line: |-
      [crypto_policy]
      .include /etc/crypto-policies/back-ends/opensslcnf.config
    path: /etc/pki/tls/openssl.cnf
  when:
    - test_crypto_policy_group.stdout is defined
    - test_crypto_policy_group.stdout | length &lt; 1
  tags:
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - configure_openssl_crypto_policy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-configure_openssl_crypto_policy:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-configure_openssl_crypto_policy_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy" severity="medium">
                <xccdf-1.2:title>Configure SSH to use System Crypto Policy</xccdf-1.2:title>
                <xccdf-1.2:description>Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
SSH is supported by crypto policy, but the SSH configuration may be
set up to ignore it.
To check that Crypto Policies settings are configured correctly, ensure that
the <html:code>CRYPTO_POLICY</html:code> variable is either commented or not set at all
in the <html:code>/etc/sysconfig/sshd</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Overriding the system crypto policy makes the behavior of the SSH service violate expectations,
and makes system configuration more fragmented.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="configure_ssh_crypto_policy">
SSH_CONF="/etc/sysconfig/sshd"

sed -i "/^\s*CRYPTO_POLICY.*$/Id" $SSH_CONF
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="configure_ssh_crypto_policy" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Configure SSH to use System Crypto Policy
  lineinfile:
    dest: /etc/sysconfig/sshd
    state: absent
    regexp: ^\s*(?i)CRYPTO_POLICY.*$
  tags:
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-13
    - configure_ssh_crypto_policy
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-configure_ssh_crypto_policy:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-configure_ssh_crypto_policy_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_harden_ssh_client_crypto_policy" severity="medium">
                <xccdf-1.2:title>Harden SSH client Crypto Policy</xccdf-1.2:title>
                <xccdf-1.2:description>Crypto Policies are means of enforcing certain cryptographic settings for selected applications including OpenSSH client.
To override the system wide crypto policy for Openssh client, place a file in the <html:code>/etc/ssh/ssh_config.d/</html:code> so that it is loaded before the <html:code>05-redhat.conf</html:code>. In this case it is file named <html:code>02-ospp.conf</html:code> containing parameters which need to be changed with respect to the crypto policy.
This rule checks if the file exists and if it contains required parameters and values which modify the Crypto Policy.
During the parsing process, as soon as Openssh client parses some configuration option and its value, it remembers it and ignores any subsequent overrides. The customization mechanism provided by crypto policies appends eventual customizations at the end of the system wide crypto policy. Therefore, if the crypto policy customization overrides some parameter which is already configured in the system wide crypto policy, the SSH client will not honor that customized parameter.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_SSHC_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000033-GPOS-00014</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000393-GPOS-00173</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000394-GPOS-00174</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The Common Criteria requirements specify how certain parameters for OpenSSH Client are configured. Particular parameters are RekeyLimit, GSSAPIAuthentication, Ciphers, PubkeyAcceptedKeyTypes, MACs and KexAlgorithms. Currently particular requirements specified by CC are stricter compared to any existing Crypto Policy.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="harden_ssh_client_crypto_policy">
#the file starts with 02 so that it is loaded before the 05-redhat.conf which activates configuration provided by system vide crypto policy
file="/etc/ssh/ssh_config.d/02-ospp.conf"
echo -e "Match final all\n\
RekeyLimit 512M 1h\n\
GSSAPIAuthentication no\n\
Ciphers aes256-ctr,aes256-cbc,aes128-ctr,aes128-cbc\n\
PubkeyAcceptedKeyTypes ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256\n\
MACs hmac-sha2-512,hmac-sha2-256\n\
KexAlgorithms ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1\n" &gt; "$file"
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-harden_ssh_client_crypto_policy:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-harden_ssh_client_crypto_policy_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_openssh_conf_crypto_policy" severity="high">
                <xccdf-1.2:title>Configure SSH Client to Use FIPS 140-2 Validated Ciphers: openssh.config</xccdf-1.2:title>
                <xccdf-1.2:description>Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
OpenSSH is supported by system crypto policy, but the OpenSSH configuration may be
set up incorrectly.

To check that Crypto Policies settings for ciphers are configured correctly, ensure that
<html:code>/etc/crypto-policies/back-ends/openssh.config</html:code> contains the following
line and is not commented out:
<html:pre>Ciphers <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_approved_ciphers" use="legacy"/></html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">The system needs to be rebooted for these changes to take effect.</xccdf-1.2:warning>
                <xccdf-1.2:warning category="regulatory">System Crypto Modules must be provided by a vendor that undergoes
FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as
defined in Section 5131 of the Information Technology Management Reform
Act of 1996, Public Law 104-106. This standard shall be used in
designing and implementing cryptographic modules that Federal
departments and agencies operate or are operated for them under
contract. See <html:b><html:a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf">https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf</html:a></html:b>
To meet this, the system has to have cryptographic software provided by
a vendor that has undergone this certification. This means providing
documentation, test results, design information, and independent third
party review by an accredited lab. While open source software is
capable of meeting this, it does not meet FIPS-140 unless the vendor
submits to this process.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001453</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Overriding the system crypto policy makes the behavior of the OpenSSH client
violate expectations, and makes system configuration more fragmented. By
specifying a cipher list with the order of ciphers being in a “strongest to
weakest” orientation, the system will automatically attempt to use the
strongest cipher for securing SSH connections.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="harden_sshd_ciphers_openssh_conf_crypto_policy">
sshd_approved_ciphers='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_approved_ciphers" use="legacy"/>'


if [ -e "/etc/crypto-policies/back-ends/openssh.config" ] ; then
    
    LC_ALL=C sed -i "/^.*Ciphers\s\+/d" "/etc/crypto-policies/back-ends/openssh.config"
else
    touch "/etc/crypto-policies/back-ends/openssh.config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/crypto-policies/back-ends/openssh.config"

cp "/etc/crypto-policies/back-ends/openssh.config" "/etc/crypto-policies/back-ends/openssh.config.bak"
# Insert at the end of the file
printf '%s\n' "Ciphers ${sshd_approved_ciphers}" &gt;&gt; "/etc/crypto-policies/back-ends/openssh.config"
# Clean up after ourselves.
rm "/etc/crypto-policies/back-ends/openssh.config.bak"
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="harden_sshd_ciphers_openssh_conf_crypto_policy" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: XCCDF Value sshd_approved_ciphers # promote to variable
  set_fact:
    sshd_approved_ciphers: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_approved_ciphers" use="legacy"/>
  tags:
    - always

- name: 'Configure SSH Daemon to Use FIPS 140-2 Validated Ciphers: openssh.config'
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/crypto-policies/back-ends/openssh.config
        create: false
        regexp: ^.*Ciphers\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/crypto-policies/back-ends/openssh.config
      lineinfile:
        path: /etc/crypto-policies/back-ends/openssh.config
        create: false
        regexp: ^.*Ciphers\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/crypto-policies/back-ends/openssh.config
      lineinfile:
        path: /etc/crypto-policies/back-ends/openssh.config
        create: true
        regexp: ^.*Ciphers\s+
        line: Ciphers {{ sshd_approved_ciphers }}
        state: present
  tags:
    - NIST-800-53-AC-17(2)
    - harden_sshd_ciphers_openssh_conf_crypto_policy
    - high_severity
    - low_complexity
    - low_disruption
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sshd_approved_ciphers:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_approved_ciphers"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_harden_sshd_crypto_policy" severity="medium">
                <xccdf-1.2:title>Harden SSHD Crypto Policy</xccdf-1.2:title>
                <xccdf-1.2:description>Crypto Policies are means of enforcing certain cryptographic settings for selected applications including OpenSSH server.
The SSHD service is by default configured to modify its configuration based on currently configured Crypto-Policy. However, in certain cases it might be needed to override the Crypto Policy specific to OpenSSH Server and leave rest of the Crypto Policy intact.
This can be done by dropping a file named <html:code>opensshserver-xxx.config</html:code>, replacing <html:code>xxx</html:code> with arbitrary identifier, into <html:code>/etc/crypto-policies/local.d</html:code>. This has to be followed by running <html:code>update-crypto-policies</html:code> so that changes are applied.
Changes are propagated into <html:code>/etc/crypto-policies/back-ends/opensshserver.config</html:code>. This rule checks if this file contains predefined <html:code>CRYPTO_POLICY</html:code> environment variable configured with predefined value.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_SSHS_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000033-GPOS-00014</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The Common Criteria requirements specify that certain parameters for OpenSSH Server are configured e.g. supported ciphers, accepted host key algorithms, public key types, key exchange algorithms, HMACs and GSSAPI key exchange is disabled. Currently particular requirements specified by CC are stricter compared to any existing Crypto Policy.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="harden_sshd_crypto_policy">
cp="CRYPTO_POLICY='-oCiphers=aes256-ctr,aes128-ctr,aes256-cbc,aes128-cbc -oMACs=hmac-sha2-512,hmac-sha2-256 -oGSSAPIKeyExchange=no -oKexAlgorithms=ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256 -oPubkeyAcceptedKeyTypes=rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256'"
file=/etc/crypto-policies/local.d/opensshserver-ospp.config

#blank line at the begining to ease later readibility
echo '' &gt; "$file"
echo "$cp" &gt;&gt; "$file"
update-crypto-policies
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-harden_sshd_crypto_policy:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-harden_sshd_crypto_policy_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_harden_sshd_macs_openssh_conf_crypto_policy" severity="high">
                <xccdf-1.2:title>Configure SSH Client to Use FIPS 140-2 Validated MACs: openssh.config</xccdf-1.2:title>
                <xccdf-1.2:description>Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
OpenSSH is supported by system crypto policy, but the OpenSSH configuration may be
set up incorrectly.

To check that Crypto Policies settings are configured correctly, ensure that
<html:code>/etc/crypto-policies/back-ends/openssh.config</html:code> contains the following
line and is not commented out:
<html:code>MACs hmac-sha2-512,hmac-sha2-256</html:code></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">The system needs to be rebooted for these changes to take effect.</xccdf-1.2:warning>
                <xccdf-1.2:warning category="regulatory">System Crypto Modules must be provided by a vendor that undergoes
FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as
defined in Section 5131 of the Information Technology Management Reform
Act of 1996, Public Law 104-106. This standard shall be used in
designing and implementing cryptographic modules that Federal
departments and agencies operate or are operated for them under
contract. See <html:b><html:a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf">https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf</html:a></html:b>
To meet this, the system has to have cryptographic software provided by
a vendor that has undergone this certification. This means providing
documentation, test results, design information, and independent third
party review by an accredited lab. While open source software is
capable of meeting this, it does not meet FIPS-140 unless the vendor
submits to this process.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001453</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Overriding the system crypto policy makes the behavior of the OpenSSH
client violate expectations, and makes system configuration more
fragmented.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="harden_sshd_macs_openssh_conf_crypto_policy">
sshd_approved_macs='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_approved_macs" use="legacy"/>'


if [ -e "/etc/crypto-policies/back-ends/openssh.config" ] ; then
    
    LC_ALL=C sed -i "/^.*MACs\s\+/d" "/etc/crypto-policies/back-ends/openssh.config"
else
    touch "/etc/crypto-policies/back-ends/openssh.config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/crypto-policies/back-ends/openssh.config"

cp "/etc/crypto-policies/back-ends/openssh.config" "/etc/crypto-policies/back-ends/openssh.config.bak"
# Insert at the end of the file
printf '%s\n' "MACs ${sshd_approved_macs}" &gt;&gt; "/etc/crypto-policies/back-ends/openssh.config"
# Clean up after ourselves.
rm "/etc/crypto-policies/back-ends/openssh.config.bak"
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="harden_sshd_macs_openssh_conf_crypto_policy" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: XCCDF Value sshd_approved_macs # promote to variable
  set_fact:
    sshd_approved_macs: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_approved_macs" use="legacy"/>
  tags:
    - always

- name: 'Configure SSH Daemon to Use FIPS 140-2 Validated MACs: openssh.config'
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/crypto-policies/back-ends/openssh.config
        create: false
        regexp: ^.*MACs\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/crypto-policies/back-ends/openssh.config
      lineinfile:
        path: /etc/crypto-policies/back-ends/openssh.config
        create: false
        regexp: ^.*MACs\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/crypto-policies/back-ends/openssh.config
      lineinfile:
        path: /etc/crypto-policies/back-ends/openssh.config
        create: true
        regexp: ^.*MACs\s+
        line: MACs {{ sshd_approved_macs }}
        state: present
  tags:
    - NIST-800-53-AC-17(2)
    - harden_sshd_macs_openssh_conf_crypto_policy
    - high_severity
    - low_complexity
    - low_disruption
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sshd_approved_macs:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_approved_macs"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-harden_sshd_macs_openssh_conf_crypto_policy:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-harden_sshd_macs_openssh_conf_crypto_policy_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_certified-vendor">
              <xccdf-1.2:title>Operating System Vendor Support and Certification</xccdf-1.2:title>
              <xccdf-1.2:description>The assurance of a vendor to provide operating system support and maintenance
for their product is an important criterion to ensure product stability and
security over the life of the product. A certified product that follows the
necessary standards and government certification requirements guarantees that
known software vulnerabilities will be remediated, and proper guidance for
protecting and securing the operating system will be given.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_installed_OS_is_FIPS_certified" severity="high">
                <xccdf-1.2:title>The Installed Operating System Is FIPS 140-2 Certified</xccdf-1.2:title>
                <xccdf-1.2:description>To enable processing of sensitive information the operating system must
provide certified cryptographic modules compliant with FIPS 140-2
standard.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">There is no remediation besides switching to a different operating system.</xccdf-1.2:warning>
                <xccdf-1.2:warning category="regulatory">System Crypto Modules must be provided by a vendor that undergoes
FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as
defined in Section 5131 of the Information Technology Management Reform
Act of 1996, Public Law 104-106. This standard shall be used in
designing and implementing cryptographic modules that Federal
departments and agencies operate or are operated for them under
contract. See <html:b><html:a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf">https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf</html:a></html:b>
To meet this, the system has to have cryptographic software provided by
a vendor that has undergone this certification. This means providing
documentation, test results, design information, and independent third
party review by an accredited lab. While open source software is
capable of meeting this, it does not meet FIPS-140 unless the vendor
submits to this process.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000803</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002450</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000120-VMM-000600</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000478-VMM-001980</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000396-VMM-001590</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The Federal Information Processing Standard (FIPS) Publication 140-2, (FIPS
PUB 140-2) is a computer security standard. The standard specifies security
requirements for cryptographic modules used to protect sensitive
unclassified information.  Refer to the full FIPS 140-2 standard at

    <html:a href="http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf">http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf</html:a>
for further details on the requirements.
FIPS 140-2 validation is required by U.S. law when information systems use
cryptography to protect sensitive government information. In order to
achieve FIPS 140-2 certification, cryptographic modules are subject to
extensive testing by independent laboratories, accredited by National
Institute of Standards and Technology (NIST).</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-installed_OS_is_FIPS_certified:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-installed_OS_is_FIPS_certified_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_installed_OS_is_vendor_supported" severity="high">
                <xccdf-1.2:title>The Installed Operating System Is Vendor Supported</xccdf-1.2:title>
                <xccdf-1.2:description>The installed operating system must be maintained by a vendor.

Red Hat Enterprise Linux is supported by Red Hat, Inc. As the Red Hat Enterprise
Linux vendor, Red Hat, Inc. is responsible for providing security patches.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">There is no remediation besides switching to a different operating system.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-13(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.RA-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An operating system is considered "supported" if the vendor continues to
provide security patches for the product.  With an unsupported release, it
will not be possible to resolve any security issue discovered in the system
software.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-installed_OS_is_vendor_supported:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-installed_OS_is_vendor_supported_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_endpoint_security_software">
              <xccdf-1.2:title>Endpoint Protection Software</xccdf-1.2:title>
              <xccdf-1.2:description>Endpoint protection security software that is not provided or supported

by Red Hat can be installed to provide complementary or duplicative

security capabilities to those provided by the base platform.  Add-on
software may not be appropriate for some specialized systems.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configure_user_data_backups" severity="medium">
                <xccdf-1.2:title>Configure Backups of User Data</xccdf-1.2:title>
                <xccdf-1.2:description>The operating system must conduct backups of user data contained
in the operating system. The operating system provides utilities for
automating backups of user data. Commercial and open-source products
are also available.</xccdf-1.2:description>
                <xccdf-1.2:rationale>Operating system backup is a critical step in maintaining data assurance and
availability. User-level information is data generated by information system
and/or application users. Backups shall be consistent with organizational
recovery time and recovery point objectives.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-configure_user_data_backups_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_install_antivirus" severity="high">
                <xccdf-1.2:title>Install Virus Scanning Software</xccdf-1.2:title>
                <xccdf-1.2:description>Virus scanning software can be used to protect a system from penetration from
computer viruses and to limit their spread through intermediate systems.

The virus scanning software should be configured to perform scans dynamically
on accessed files. If this capability is not available, the system must be
configured to scan, at a minimum, all altered files on the system on a daily
basis.

If the system processes inbound SMTP mail, the virus scanner must be configured
to scan all received mail.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS04.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001239</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001668</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.DP-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Virus scanning software can be used to detect if a system has been compromised by
computer viruses, as well as to limit their spread to other systems.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-install_antivirus:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-install_antivirus_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_install_hids" severity="high">
                <xccdf-1.2:title>Install Intrusion Detection Software</xccdf-1.2:title>
                <xccdf-1.2:description>The base Fedora platform already includes a sophisticated auditing system that
can detect intruder activity, as well as SELinux, which provides host-based
intrusion prevention capabilities by confining privileged programs and user
sessions which may become compromised.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">In DoD environments, supplemental intrusion detection and antivirus tools,
such as the McAfee Host-based Security System, are available to integrate with
existing infrastructure. Per DISA guidance, when these supplemental tools interfere
with proper functioning of SELinux, SELinux takes precedence. Should further
clarification be required, DISA contact information is published publicly at
https://public.cyber.mil/stigs/</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001263</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-11.4</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Host-based intrusion detection tools provide a system-level defense when an
intruder gains access to a system or network.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:conflicts idref="xccdf_org.ssgproject.content_rule_selinux_state"/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-install_hids:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-install_hids_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_mcafee_security_software">
                <xccdf-1.2:title>McAfee Endpoint Security Software</xccdf-1.2:title>
                <xccdf-1.2:description>In DoD environments, McAfee Host-based Security System (HBSS) and
VirusScan Enterprise for Linux (VSEL) is required to be installed on all systems.</xccdf-1.2:description>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mcafee_antivirus_definition_expire" type="number">
                  <xccdf-1.2:title>The age of McAfee defintion file before requiring updating</xccdf-1.2:title>
                  <xccdf-1.2:description>Specify the amount of time (in seconds) before McAfee definition files need to be
updated.</xccdf-1.2:description>
                  <xccdf-1.2:value>2592000</xccdf-1.2:value>
                  <xccdf-1.2:value selector="1_day">86400</xccdf-1.2:value>
                  <xccdf-1.2:value selector="1_week">604800</xccdf-1.2:value>
                  <xccdf-1.2:value selector="30_days">2592000</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_mcafee_endpoint_security_software">
                  <xccdf-1.2:title>McAfee Endpoint Security for Linux (ENSL)</xccdf-1.2:title>
                  <xccdf-1.2:description>McAfee Endpoint Security for Linux (ENSL) is a suite of software applications
used to monitor, detect, and defend computer networks and systems.</xccdf-1.2:description>
                  <xccdf-1.2:platform idref="#machine"/>
                </xccdf-1.2:Group>
                <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_mcafee_hbss_software">
                  <xccdf-1.2:title>McAfee Host-Based Intrusion Detection Software (HBSS)</xccdf-1.2:title>
                  <xccdf-1.2:description>McAfee Host-based Security System (HBSS) is a suite of software applications
used to monitor, detect, and defend computer networks and systems.</xccdf-1.2:description>
                  <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_MFEhiplsm_installed" severity="medium">
                    <xccdf-1.2:title>Install the Host Intrusion Prevention System (HIPS) Module</xccdf-1.2:title>
                    <xccdf-1.2:description>Install the McAfee Host Intrusion Prevention System (HIPS) Module if it is absolutely
necessary. If SELinux is enabled, do not install or enable this module.</xccdf-1.2:description>
                    <xccdf-1.2:warning category="functionality">Installing and enabling this module conflicts with SELinux.
Per DoD/DISA guidance, SELinux takes precedence over this module.</xccdf-1.2:warning>
                    <xccdf-1.2:warning category="general">Due to McAfee HIPS being 3rd party software, automated
remediation is not available for this configuration check.</xccdf-1.2:warning>
                    <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO07.06</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO08.04</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.06</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.01</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.02</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.03</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.04</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.02</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.04</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.05</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.04</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS04.05</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.01</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.01</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA03.03</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA03.04</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001233</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001263</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.12</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.7</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.9</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.2</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.9</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.2</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.4</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.3</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.9</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.1</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.1</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.2</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.8</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.1</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.2</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.3</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.6</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.2.2</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.2.3</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">Clause 16.1.2</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">Clause 7.4</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-2</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-4</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-5</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-6</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.DP-2</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.DP-3</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.DP-4</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.DP-5</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.RA-1</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-8</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.CO-3</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-11.4</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000191-GPOS-00080</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000196</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                    <xccdf-1.2:rationale>Without a host-based intrusion detection tool, there is no system-level defense
when an intruder gains access to a system or network. Additionally, a host-based
intrusion prevention tool can provide methods to immediately lock out detected
intrusion attempts.</xccdf-1.2:rationale>
                    <xccdf-1.2:conflicts idref="xccdf_org.ssgproject.content_rule_selinux_state"/>
                    <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_MFEhiplsm_installed">
[[packages]]
name = "MFEhiplsm"
version = "*"
</xccdf-1.2:fix>
                    <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                      <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_MFEhiplsm_installed:def:1"/>
                    </xccdf-1.2:check>
                    <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                      <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_MFEhiplsm_installed_ocil:questionnaire:1"/>
                    </xccdf-1.2:check>
                  </xccdf-1.2:Rule>
                </xccdf-1.2:Group>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disk_partitioning">
            <xccdf-1.2:title>Disk Partitioning</xccdf-1.2:title>
            <xccdf-1.2:description>To ensure separation and protection of data, there
are top-level system directories which should be placed on their
own physical partition or logical volume. The installer's default
partitioning scheme creates separate logical volumes for
<html:code>/</html:code>, <html:code>/boot</html:code>, and <html:code>swap</html:code>.
<html:ul><html:li>If starting with any of the default layouts, check the box to
\"Review and modify partitioning.\" This allows for the easy creation
of additional logical volumes inside the volume group already
created, though it may require making <html:code>/</html:code>'s logical volume smaller to
create space. In general, using logical volumes is preferable to
using partitions because they can be more easily adjusted
later.</html:li><html:li>If creating a custom layout, create the partitions mentioned in
the previous paragraph (which the installer will require anyway),
as well as separate ones described in the following sections.</html:li></html:ul>
If a system has already been installed, and the default
partitioning
scheme was used, it is possible but nontrivial to
modify it to create separate logical volumes for the directories
listed above. The Logical Volume Manager (LVM) makes this possible.
See the LVM HOWTO at 
    <html:a href="http://tldp.org/HOWTO/LVM-HOWTO/">http://tldp.org/HOWTO/LVM-HOWTO/</html:a>
for more detailed information on LVM.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_encrypt_partitions" severity="high">
              <xccdf-1.2:title>Encrypt Partitions</xccdf-1.2:title>
              <xccdf-1.2:description>Fedora natively supports partition encryption through the
Linux Unified Key Setup-on-disk-format (LUKS) technology. The easiest way to
encrypt a partition is during installation time.
<html:br/><html:br/>
For manual installations, select the <html:code>Encrypt</html:code> checkbox during
partition creation to encrypt the partition. When this
option is selected the system will prompt for a passphrase to use in
decrypting the partition. The passphrase will subsequently need to be entered manually
every time the system boots.

<html:br/><html:br/>
For automated/unattended installations, it is possible to use Kickstart by adding
the <html:code>--encrypted</html:code> and <html:code>--passphrase=</html:code> options to the definition of each partition to be
encrypted. For example, the following line would encrypt the root partition:
<html:pre>part / --fstype=ext4 --size=100 --onpart=hda1 --encrypted --passphrase=<html:i>PASSPHRASE</html:i></html:pre>
Any <html:i>PASSPHRASE</html:i> is stored in the Kickstart in plaintext, and the Kickstart
must then be protected accordingly.
Omitting the <html:code>--passphrase=</html:code> option from the partition definition will cause the
installer to pause and interactively ask for the passphrase during installation.
<html:br/><html:br/>
By default, the <html:code>Anaconda</html:code> installer uses <html:code>aes-xts-plain64</html:code> cipher
with a minimum <html:code>512</html:code> bit key size which should be compatible with FIPS enabled.

<html:br/><html:br/>
Detailed information on encrypting partitions using LUKS or LUKS ciphers can be found on
the Fedora Documentation web site:<html:br/>

    
    <html:a href="https://docs.fedoraproject.org/en-US/quick-docs/encrypting-drives-using-LUKS/">https://docs.fedoraproject.org/en-US/quick-docs/encrypting-drives-using-LUKS/</html:a>
.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS04.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001199</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002475</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002476</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(iv)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.314(b)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-28</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-28(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000405-GPOS-00184</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000185-GPOS-00079</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000404-GPOS-00183</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000404-VMM-001650</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000405-VMM-001660</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The risk of a system's physical compromise, particularly mobile systems such as
laptops, places its data at risk of compromise.  Encrypting this data mitigates
the risk of its loss if the system is lost.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-encrypt_partitions_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_partition_for_boot" severity="medium">
              <xccdf-1.2:title>Ensure /boot Located On Separate Partition</xccdf-1.2:title>
              <xccdf-1.2:description>It is recommended that the <html:code>/boot</html:code> directory resides on a separate
partition. This makes it easier to apply restrictions e.g. through the
<html:code>noexec</html:code> mount option. Eventually, the <html:code>/boot</html:code> partition can
be configured not to be mounted automatically with the <html:code>noauto</html:code> mount
option.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>/boot</html:code> partition contains the kernel and bootloader files.
Access to this partition should be restricted.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="partition_for_boot" complexity="low" disruption="high" reboot="false" strategy="enable">
part /boot
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="partition_for_boot">
[[customizations.filesystem]]
mountpoint = "/boot"
size = 1073741824
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-partition_for_boot:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-partition_for_boot_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_partition_for_home" severity="low">
              <xccdf-1.2:title>Ensure /home Located On Separate Partition</xccdf-1.2:title>
              <xccdf-1.2:description>If user home directories will be stored locally, create a separate partition
for <html:code>/home</html:code> at installation time (or migrate it later using LVM). If
<html:code>/home</html:code> will be mounted from another system such as an NFS server, then
creating a separate partition is not necessary at installation time, and the
mountpoint can instead be configured later.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001208</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Ensuring that <html:code>/home</html:code> is mounted on its own partition enables the
setting of more restrictive mount options, and also helps ensure that
users cannot trivially fill partitions used for log or audit data storage.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="partition_for_home" complexity="low" disruption="high" reboot="false" strategy="enable">
part /home
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="partition_for_home">
[[customizations.filesystem]]
mountpoint = "/home"
size = 1073741824
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-partition_for_home:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-partition_for_home_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_partition_for_opt" severity="medium">
              <xccdf-1.2:title>Ensure /opt Located On Separate Partition</xccdf-1.2:title>
              <xccdf-1.2:description>It is recommended that the <html:code>/opt</html:code> directory resides on a separate
partition.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>/opt</html:code> partition contains additional software, usually installed
outside the packaging system. Putting this directory on a separate partition
makes it easier to apply restrictions e.g. through the <html:code>nosuid</html:code> mount
option.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="partition_for_opt" complexity="low" disruption="high" reboot="false" strategy="enable">
part /opt
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="partition_for_opt">
[[customizations.filesystem]]
mountpoint = "/opt"
size = 1073741824
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-partition_for_opt:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-partition_for_opt_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_partition_for_srv" severity="unknown">
              <xccdf-1.2:title>Ensure /srv Located On Separate Partition</xccdf-1.2:title>
              <xccdf-1.2:description>If a file server (FTP, TFTP...) is hosted locally, create a separate partition
for <html:code>/srv</html:code> at installation time (or migrate it later using LVM). If
<html:code>/srv</html:code> will be mounted from another system such as an NFS server, then
creating a separate partition is not necessary at installation time, and the
mountpoint can instead be configured later.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Srv deserves files for local network file server such as FTP. Ensuring
that <html:code>/srv</html:code> is mounted on its own partition enables the setting of
more restrictive mount options, and also helps ensure that
users cannot trivially fill partitions used for log or audit data storage.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="partition_for_srv" complexity="low" disruption="high" reboot="false" strategy="enable">
part /srv
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="partition_for_srv">
[[customizations.filesystem]]
mountpoint = "/srv"
size = 1073741824
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-partition_for_srv:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-partition_for_srv_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_partition_for_tmp" severity="low">
              <xccdf-1.2:title>Ensure /tmp Located On Separate Partition</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>/tmp</html:code> directory is a world-writable directory used
for temporary file storage. Ensure it has its own partition or
logical volume at installation time, or migrate it using LVM.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>/tmp</html:code> partition is used as temporary storage by many programs.
Placing <html:code>/tmp</html:code> in its own partition enables the setting of more
restrictive mount options, which can help protect programs which use it.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="partition_for_tmp" complexity="low" disruption="high" reboot="false" strategy="enable">
part /tmp
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="partition_for_tmp">
[[customizations.filesystem]]
mountpoint = "/tmp"
size = 1073741824
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-partition_for_tmp:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-partition_for_tmp_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_partition_for_usr" severity="medium">
              <xccdf-1.2:title>Ensure /usr Located On Separate Partition</xccdf-1.2:title>
              <xccdf-1.2:description>It is recommended that the <html:code>/usr</html:code> directory resides on a separate
partition.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>/usr</html:code> partition contains system software, utilities and files.
Putting it on a separate partition allows limiting its size and applying
restrictions through mount options.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="partition_for_usr" complexity="low" disruption="high" reboot="false" strategy="enable">
part /usr
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="partition_for_usr">
[[customizations.filesystem]]
mountpoint = "/usr"
size = 5368709120
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-partition_for_usr:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-partition_for_usr_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_partition_for_var" severity="low">
              <xccdf-1.2:title>Ensure /var Located On Separate Partition</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>/var</html:code> directory is used by daemons and other system
services to store frequently-changing data. Ensure that <html:code>/var</html:code> has its own partition
or logical volume at installation time, or migrate it using LVM.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000341-VMM-001220</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Ensuring that <html:code>/var</html:code> is mounted on its own partition enables the
setting of more restrictive mount options. This helps protect
system services such as daemons or other programs which use it.
It is not uncommon for the <html:code>/var</html:code> directory to contain
world-writable directories installed by other software packages.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="partition_for_var" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="partition_for_var">
[[customizations.filesystem]]
mountpoint = "/var"
size = 3221225472
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-partition_for_var:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-partition_for_var_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_partition_for_var_log" severity="low">
              <xccdf-1.2:title>Ensure /var/log Located On Separate Partition</xccdf-1.2:title>
              <xccdf-1.2:description>System logs are stored in the <html:code>/var/log</html:code> directory.

Ensure that <html:code>/var/log</html:code> has its own partition or logical
volume at installation time, or migrate it using LVM.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R47)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Placing <html:code>/var/log</html:code> in its own partition
enables better separation between log files
and other files in <html:code>/var/</html:code>.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="partition_for_var_log" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var/log
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="partition_for_var_log">
[[customizations.filesystem]]
mountpoint = "/var/log"
size = 5368709120
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-partition_for_var_log:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-partition_for_var_log_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_partition_for_var_log_audit" severity="low">
              <xccdf-1.2:title>Ensure /var/log/audit Located On Separate Partition</xccdf-1.2:title>
              <xccdf-1.2:description>Audit logs are stored in the <html:code>/var/log/audit</html:code> directory.

Ensure that <html:code>/var/log/audit</html:code> has its own partition or logical
volume at installation time, or migrate it using LVM.
Make absolutely certain that it is large enough to store all
audit logs that will be created by the auditing daemon.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R43)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001849</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000341-GPOS-00132</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000341-VMM-001220</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Placing <html:code>/var/log/audit</html:code> in its own partition
enables better separation between audit files
and other files, and helps ensure that
auditing cannot be halted due to the partition running out
of space.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="partition_for_var_log_audit" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var/log/audit
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="partition_for_var_log_audit">
[[customizations.filesystem]]
mountpoint = "/var/log/audit"
size = 10737418240
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-partition_for_var_log_audit:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-partition_for_var_log_audit_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gnome">
            <xccdf-1.2:title>GNOME Desktop Environment</xccdf-1.2:title>
            <xccdf-1.2:description>GNOME is a graphical desktop environment bundled with many Linux distributions that
allow users to easily interact with the operating system graphically rather than
textually. The GNOME Graphical Display Manager (GDM) provides login, logout, and user
switching contexts as well as display server management.
<html:br/><html:br/>
GNOME is developed by the GNOME Project and is considered the default

Red Hat Graphical environment.

<html:br/><html:br/>
For more information on GNOME and the GNOME Project, see <html:b><html:a href="https://www.gnome.org">https://www.gnome.org</html:a></html:b>.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#gdm"/>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_gdm_removed" severity="medium">
              <xccdf-1.2:title>Remove the GDM Package Group</xccdf-1.2:title>
              <xccdf-1.2:description>
By removing the <html:code>gdm</html:code> package, the system no longer has GNOME installed

installed. If X Windows is not installed then the system cannot boot into graphical user mode.
This prevents the system from being accidentally or maliciously booted into a <html:code>graphical.target</html:code>
mode. To do so, run the following command:

<html:pre>$ sudo yum remove gdm</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Unnecessary service packages must not be installed to decrease the attack surface of the system.
A graphical environment is unnecessary for certain types of systems including a virtualization
hypervisor.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#gdm"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_gdm_removed" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm; then

# CAUTION: This remediation script will remove gdm
#	   from the system, and may remove any packages
#	   that depend on gdm. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "gdm" ; then

    dnf remove -y "gdm"

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_gdm_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_gdm_removed

- name: Ensure gdm is removed
  package:
    name: gdm
    state: absent
  when: '"gdm" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_gdm_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_gdm_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_gdm

class remove_gdm {
  package { 'gdm':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_gdm_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=gdm
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_gdm_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_gdm_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_db_up_to_date" severity="high">
              <xccdf-1.2:title>Make sure that the dconf databases are up-to-date with regards to respective keyfiles</xccdf-1.2:title>
              <xccdf-1.2:description>By default, DConf uses a binary database as a data backend.
The system-level database is compiled from keyfiles in the /etc/dconf/db/
directory by the <html:pre>dconf update</html:pre> command. More specifically, content present
in the following directories:
<html:pre>/etc/dconf/db/distro.d</html:pre>
<html:pre>/etc/dconf/db/local.d</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Unlike text-based keyfiles, the binary database is impossible to check by OVAL.
Therefore, in order to evaluate dconf configuration, both have to be true at the same time -
configuration files have to be compliant, and the database needs to be more recent than those keyfiles,
which gives confidence that it reflects them.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_db_up_to_date"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_db_up_to_date:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_db_up_to_date_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_enable_dconf_user_profile" severity="high">
              <xccdf-1.2:title>Configure GNOME3 DConf User Profile</xccdf-1.2:title>
              <xccdf-1.2:description>By default, DConf provides a standard user profile. This profile contains a list
of DConf configuration databases. The user profile and database always take the
highest priority. As such the DConf User profile should always exist and be
configured correctly.
<html:br/><html:br/>

To make sure that the user profile is configured correctly, the <html:code>/etc/dconf/profile/user</html:code>
should be set as follows:
<html:pre>user-db:user
system-db:local
system-db:site
system-db:distro
</html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale>Failure to have a functional DConf profile prevents GNOME3 configuration settings
from being enforced for all users and allows various security risks.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-enable_dconf_user_profile:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-enable_dconf_user_profile_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gnome_login_screen">
              <xccdf-1.2:title>Configure GNOME Login Screen</xccdf-1.2:title>
              <xccdf-1.2:description>In the default GNOME desktop, the login is displayed after system boot
and can display user accounts, allow users to reboot the system, and allow users to
login automatically and/or with a guest account. The login screen should be configured
to prevent such behavior.
<html:br/><html:br/>

For more information about enforcing preferences in the GNOME3 environment using the DConf
configuration system, see <html:b><html:a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/desktop_migration_and_administration_guide">https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/desktop_migration_and_administration_guide</html:a>/&gt;</html:b> and the man page <html:code>dconf(1)</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#gdm"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_restart_shutdown" severity="high">
                <xccdf-1.2:title>Disable the GNOME3 Login Restart and Shutdown Buttons</xccdf-1.2:title>
                <xccdf-1.2:description>In the default graphical environment, users logging directly into the
system are greeted with a login screen that allows any user, known or
unknown, the ability the ability to shutdown or restart the system. This
functionality should be disabled by setting
<html:code>disable-restart-buttons</html:code> to <html:code>true</html:code>.
<html:br/><html:br/>
To disable, add or edit <html:code>disable-restart-buttons</html:code> to
<html:code>/etc/dconf/db/distro.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/login-screen]
disable-restart-buttons=true</html:pre>
Once the setting has been added, add a lock to
<html:code>/etc/dconf/db/distro.d/locks/00-security-settings-lock</html:code> to prevent
user modification. For example:
<html:pre>/org/gnome/login-screen/disable-restart-buttons</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A user who is at the console can reboot the system at the login screen. If restart or shutdown buttons
are pressed at the login screen, this can create the risk of short-term loss of availability of systems
due to reboot.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_disable_restart_shutdown"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/login-screen\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/distro.d/00-security-settings"
DBDIR="/etc/dconf/db/distro.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/login-screen]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "disable-restart-buttons" "true" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
    if grep -q "^\\s*disable-restart-buttons\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*disable-restart-buttons\\s*=\\s*.*/disable-restart-buttons=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/login-screen\\]|a\\disable-restart-buttons=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/login-screen/disable-restart-buttons$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/distro.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/login-screen/disable-restart-buttons" &gt;&gt; "/etc/dconf/db/distro.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_disable_restart_shutdown" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_restart_shutdown
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Disable the GNOME3 Login Restart and Shutdown Buttons
  ini_file:
    dest: /etc/dconf/db/distro.d/00-security-settings
    section: org/gnome/login-screen
    option: disable-restart-buttons
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_restart_shutdown
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME disablement of Login Restart and Shutdown
    Buttons
  lineinfile:
    path: /etc/dconf/db/distro.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/login-screen/disable-restart-buttons
    line: /org/gnome/login-screen/disable-restart-buttons
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_restart_shutdown
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_restart_shutdown
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_disable_restart_shutdown:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_disable_restart_shutdown_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list" severity="medium">
                <xccdf-1.2:title>Disable the GNOME3 Login User List</xccdf-1.2:title>
                <xccdf-1.2:description>In the default graphical environment, users logging directly into the
system are greeted with a login screen that displays all known users.
This functionality should be disabled by setting <html:code>disable-user-list</html:code>
to <html:code>true</html:code>.
<html:br/><html:br/>
To disable, add or edit <html:code>disable-user-list</html:code> to
<html:code>/etc/dconf/db/distro.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/login-screen]
disable-user-list=true</html:pre>
Once the setting has been added, add a lock to
<html:code>/etc/dconf/db/distro.d/locks/00-security-settings-lock</html:code> to prevent
user modification. For example:
<html:pre>/org/gnome/login-screen/disable-user-list</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-23</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Leaving the user list enabled is a security risk since it allows anyone
with physical access to the system to quickly enumerate known user accounts
without logging in.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_disable_user_list"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/login-screen\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/distro.d/00-security-settings"
DBDIR="/etc/dconf/db/distro.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/login-screen]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "disable-user-list" "true" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
    if grep -q "^\\s*disable-user-list\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*disable-user-list\\s*=\\s*.*/disable-user-list=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/login-screen\\]|a\\disable-user-list=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/login-screen/disable-user-list$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/distro.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/login-screen/disable-user-list" &gt;&gt; "/etc/dconf/db/distro.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_disable_user_list" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-23
    - NIST-800-53-CM-6(a)
    - dconf_gnome_disable_user_list
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Disable the GNOME3 Login User List
  ini_file:
    dest: /etc/dconf/db/distro.d/00-security-settings
    section: org/gnome/login-screen
    option: disable-user-list
    value: 'true'
    no_extra_spaces: true
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-23
    - NIST-800-53-CM-6(a)
    - dconf_gnome_disable_user_list
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME3 disablement of Login User List
  lineinfile:
    path: /etc/dconf/db/distro.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/login-screen/disable-user-list$
    line: /org/gnome/login-screen/disable-user-list
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-23
    - NIST-800-53-CM-6(a)
    - dconf_gnome_disable_user_list
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-23
    - NIST-800-53-CM-6(a)
    - dconf_gnome_disable_user_list
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_disable_user_list:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_disable_user_list_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_enable_smartcard_auth" severity="medium">
                <xccdf-1.2:title>Enable the GNOME3 Login Smartcard Authentication</xccdf-1.2:title>
                <xccdf-1.2:description>In the default graphical environment, smart card authentication
can be enabled on the login screen by setting <html:code>enable-smartcard-authentication</html:code>
to <html:code>true</html:code>.
<html:br/><html:br/>
To enable, add or edit <html:code>enable-smartcard-authentication</html:code> to
<html:code>/etc/dconf/db/distro.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/login-screen]
enable-smartcard-authentication=true</html:pre>
Once the setting has been added, add a lock to
<html:code>/etc/dconf/db/distro.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/login-screen/enable-smartcard-authentication</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000765</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000766</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000767</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000768</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000771</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000772</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001948</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001954</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(8)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(11)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00160</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000376-GPOS-00161</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000377-GPOS-00162</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Smart card login provides two-factor authentication stronger than
that provided by a username and password combination. Smart cards leverage PKI
(public key infrastructure) in order to provide and verify credentials.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_enable_smartcard_auth"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/login-screen\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/distro.d/00-security-settings"
DBDIR="/etc/dconf/db/distro.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/login-screen]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "enable-smartcard-authentication" "true" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
    if grep -q "^\\s*enable-smartcard-authentication\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*enable-smartcard-authentication\\s*=\\s*.*/enable-smartcard-authentication=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/login-screen\\]|a\\enable-smartcard-authentication=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/login-screen/enable-smartcard-authentication$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/distro.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/login-screen/enable-smartcard-authentication" &gt;&gt; "/etc/dconf/db/distro.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_enable_smartcard_auth" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(8)
    - NIST-800-53-IA-2(9)
    - PCI-DSS-Req-8.3
    - dconf_gnome_enable_smartcard_auth
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Enable the GNOME3 Login Smartcard Authentication
  ini_file:
    dest: /etc/dconf/db/distro.d/00-security-settings
    section: org/gnome/login-screen
    option: enable-smartcard-authentication
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(8)
    - NIST-800-53-IA-2(9)
    - PCI-DSS-Req-8.3
    - dconf_gnome_enable_smartcard_auth
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME3 disablement of Smartcard Authentication
  lineinfile:
    path: /etc/dconf/db/distro.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/login-screen/enable-smartcard-authentication$
    line: /org/gnome/login-screen/enable-smartcard-authentication
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(8)
    - NIST-800-53-IA-2(9)
    - PCI-DSS-Req-8.3
    - dconf_gnome_enable_smartcard_auth
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(8)
    - NIST-800-53-IA-2(9)
    - PCI-DSS-Req-8.3
    - dconf_gnome_enable_smartcard_auth
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_enable_smartcard_auth:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_enable_smartcard_auth_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_lock_screen_on_smartcard_removal" severity="medium">
                <xccdf-1.2:title>Enable the GNOME3 Screen Locking On Smartcard Removal</xccdf-1.2:title>
                <xccdf-1.2:description>In the default graphical environment, screen locking on smartcard removal
can be enabled by setting <html:code>removal-action</html:code>
to <html:code>'lock-screen'</html:code>.
<html:br/><html:br/>
To enable, add or edit <html:code>removal-action</html:code> to
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/settings-daemon/peripherals/smartcard]
removal-action='lock-screen'</html:pre>
Once the setting has been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/settings-daemon/peripherals/smartcard/removal-action</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000056</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000028-GPOS-00009</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000030-GPOS-00011</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Locking the screen automatically when removing the smartcard can
prevent undesired access to system.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_lock_screen_on_smartcard_removal"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/settings-daemon/peripherals/smartcard\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/settings-daemon/peripherals/smartcard]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "removal-action" "'lock-screen'" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "'lock-screen'")"
    if grep -q "^\\s*removal-action\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*removal-action\\s*=\\s*.*/removal-action=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/settings-daemon/peripherals/smartcard\\]|a\\removal-action=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/settings-daemon/peripherals/smartcard/removal-action$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/settings-daemon/peripherals/smartcard/removal-action" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_lock_screen_on_smartcard_removal" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - dconf_gnome_lock_screen_on_smartcard_removal
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Detect if removal-action can be found on /etc/dconf/db/local.d/
  find:
    path: /etc/dconf/db/local.d/
    contains: ^\s*removal-action
  register: dconf_gnome_lock_screen_on_smartcard_removal_config_files
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - dconf_gnome_lock_screen_on_smartcard_removal
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Configure removal-action - default file
  ini_file:
    dest: /etc/dconf/db/local.d//00-security-settings
    section: org/gnome/settings-daemon/peripherals/smartcard
    option: removal-action
    value: '''lock-screen'''
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - dconf_gnome_lock_screen_on_smartcard_removal_config_files is defined and dconf_gnome_lock_screen_on_smartcard_removal_config_files.matched
      == 0
  tags:
    - dconf_gnome_lock_screen_on_smartcard_removal
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Configure removal-action - existing files
  ini_file:
    dest: '{{ item.path }}'
    section: org/gnome/settings-daemon/peripherals/smartcard
    option: removal-action
    value: '''lock-screen'''
    create: true
  with_items: '{{ dconf_gnome_lock_screen_on_smartcard_removal_config_files.files
    }}'
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - dconf_gnome_lock_screen_on_smartcard_removal_config_files is defined and dconf_gnome_lock_screen_on_smartcard_removal_config_files.matched
      &gt; 0
  tags:
    - dconf_gnome_lock_screen_on_smartcard_removal
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Detect if lock for removal-action can be found on /etc/dconf/db/local.d/
  find:
    path: /etc/dconf/db/local.d/locks
    contains: ^\s*removal-action
  register: dconf_gnome_lock_screen_on_smartcard_removal_lock_files
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - dconf_gnome_lock_screen_on_smartcard_removal
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification removal-action - default file
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/settings-daemon/peripherals/smartcard/removal-action$
    line: /org/gnome/settings-daemon/peripherals/smartcard/removal-action
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - dconf_gnome_lock_screen_on_smartcard_removal_lock_files is defined and dconf_gnome_lock_screen_on_smartcard_removal_lock_files.matched
      == 0
  tags:
    - dconf_gnome_lock_screen_on_smartcard_removal
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification removal-action - existing files
  lineinfile:
    path: '{{ item.path }}'
    regexp: ^/org/gnome/settings-daemon/peripherals/smartcard/removal-action$
    line: /org/gnome/settings-daemon/peripherals/smartcard/removal-action
    create: true
  with_items: '{{ dconf_gnome_lock_screen_on_smartcard_removal_lock_files.files }}'
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - dconf_gnome_lock_screen_on_smartcard_removal_lock_files is defined and dconf_gnome_lock_screen_on_smartcard_removal_lock_files.matched
      &gt; 0
  tags:
    - dconf_gnome_lock_screen_on_smartcard_removal
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update - removal-action
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - dconf_gnome_lock_screen_on_smartcard_removal
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_lock_screen_on_smartcard_removal:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_lock_screen_on_smartcard_removal_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_login_retries" severity="medium">
                <xccdf-1.2:title>Set the GNOME3 Login Number of Failures</xccdf-1.2:title>
                <xccdf-1.2:description>In the default graphical environment, the GNOME3 login
screen and be configured to restart the authentication process after
a configured number of attempts. This can be configured by setting
<html:code>allowed-failures</html:code> to <html:code>3</html:code> or less.
<html:br/><html:br/>
To enable, add or edit <html:code>allowed-failures</html:code> to
<html:code>/etc/dconf/db/distro.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/login-screen]
allowed-failures=3</html:pre>
Once the setting has been added, add a lock to
<html:code>/etc/dconf/db/distro.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/login-screen/allowed-failures</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Setting the password retry prompts that are permitted on a per-session basis to a low value
requires some software, such as SSH, to re-connect. This can slow down and
draw additional attention to some types of password-guessing attacks.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_login_retries"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/login-screen\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/distro.d/00-security-settings"
DBDIR="/etc/dconf/db/distro.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/login-screen]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "allowed-failures" "3" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "3")"
    if grep -q "^\\s*allowed-failures\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*allowed-failures\\s*=\\s*.*/allowed-failures=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/login-screen\\]|a\\allowed-failures=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/login-screen/allowed-failures$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/distro.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/login-screen/allowed-failures" &gt;&gt; "/etc/dconf/db/distro.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_login_retries" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.8
    - dconf_gnome_login_retries
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Enable the GNOME3 Login Number of Failures
  ini_file:
    dest: /etc/dconf/db/distro.d/00-security-settings
    section: org/gnome/login-screen
    option: allowed-failures
    value: '3'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.8
    - dconf_gnome_login_retries
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME3 Login Number of Failures
  lineinfile:
    path: /etc/dconf/db/distro.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/login-screen/allowed-failures$
    line: /org/gnome/login-screen/allowed-failures
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.8
    - dconf_gnome_login_retries
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.8
    - dconf_gnome_login_retries
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_login_retries:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_login_retries_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_automatic_login" severity="high">
                <xccdf-1.2:title>Disable GDM Automatic Login</xccdf-1.2:title>
                <xccdf-1.2:description>The GNOME Display Manager (GDM) can allow users to automatically login without
user interaction or credentials. User should always be required to authenticate themselves
to the system that they are authorized to use. To disable user ability to automatically
login to the system, set the <html:code>AutomaticLoginEnable</html:code> to <html:code>false</html:code> in the
<html:code>[daemon]</html:code> section in <html:code>/etc/gdm/custom.conf</html:code>. For example:
<html:pre>[daemon]
AutomaticLoginEnable=false</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00229</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Failure to restrict system access to authenticated users negatively impacts operating
system security.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="gnome_gdm_disable_automatic_login"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

if rpm --quiet -q gdm
then
	if ! grep -q "^AutomaticLoginEnable=" /etc/gdm/custom.conf
	then
		sed -i "/^\[daemon\]/a \
		AutomaticLoginEnable=False" /etc/gdm/custom.conf
	else
		sed -i "s/^AutomaticLoginEnable=.*/AutomaticLoginEnable=False/g" /etc/gdm/custom.conf
	fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="gnome_gdm_disable_automatic_login" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.1
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - gnome_gdm_disable_automatic_login
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Disable GDM Automatic Login
  ini_file:
    dest: /etc/gdm/custom.conf
    section: daemon
    option: AutomaticLoginEnable
    value: 'false'
    no_extra_spaces: true
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.1
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - gnome_gdm_disable_automatic_login
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-gnome_gdm_disable_automatic_login:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-gnome_gdm_disable_automatic_login_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_guest_login" severity="high">
                <xccdf-1.2:title>Disable GDM Guest Login</xccdf-1.2:title>
                <xccdf-1.2:description>The GNOME Display Manager (GDM) can allow users to login without credentials
which can be useful for public kiosk scenarios. Allowing users to login without credentials
or "guest" account access has inherent security risks and should be disabled. To do disable
timed logins or guest account access, set the <html:code>TimedLoginEnable</html:code> to <html:code>false</html:code> in
the <html:code>[daemon]</html:code> section in <html:code>/etc/gdm/custom.conf</html:code>. For example:
<html:pre>[daemon]
TimedLoginEnable=false</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00229</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Failure to restrict system access to authenticated users negatively impacts operating
system security.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="gnome_gdm_disable_guest_login"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

if rpm --quiet -q gdm
then
	if ! grep -q "^TimedLoginEnable=" /etc/gdm/custom.conf
	then
		sed -i "/^\[daemon\]/a \
		TimedLoginEnable=False" /etc/gdm/custom.conf
	else
		sed -i "s/^TimedLoginEnable=.*/TimedLoginEnable=False/g" /etc/gdm/custom.conf
	fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="gnome_gdm_disable_guest_login" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.1
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-IA-2
    - gnome_gdm_disable_guest_login
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Disable GDM Guest Login
  ini_file:
    dest: /etc/gdm/custom.conf
    section: daemon
    option: TimedLoginEnable
    value: 'false'
    no_extra_spaces: true
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.1
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-IA-2
    - gnome_gdm_disable_guest_login
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-gnome_gdm_disable_guest_login:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-gnome_gdm_disable_guest_login_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_xdmcp" severity="high">
                <xccdf-1.2:title>Disable XDMCP in GDM</xccdf-1.2:title>
                <xccdf-1.2:description>XDMCP is an unencrypted protocol, and therefore, presents a security risk, see e.g.
<html:a href="https://help.gnome.org/admin/gdm/stable/security.html.en_GB#xdmcpsecurity">XDMCP Gnome docs</html:a>.

To disable XDMCP support in Gnome, set <html:code>Enable</html:code> to <html:code>false</html:code> under the <html:code>[xdmcp]</html:code> configuration section in <html:code>/etc/gdm/custom.conf</html:code>. For example:
<html:pre>
[xdmcp]
Enable=false
</html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale>XDMCP provides unencrypted remote access through the Gnome Display Manager (GDM) which does
not provide for the confidentiality and integrity of user passwords or the
remote session. If a privileged user were to login using XDMCP, the
privileged user password could be compromised due to typed XEvents
and keystrokes will traversing over the network in clear text.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#gdm"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="gnome_gdm_disable_xdmcp"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm; then

# Try find '[xdmcp]' and 'Enable' in '/etc/gdm/custom.conf', if it exists, set
# to 'false', if it isn't here, add it, if '[xdmcp]' doesn't exist, add it there
if grep -qzosP '[[:space:]]*\[xdmcp]([^\n\[]*\n+)+?[[:space:]]*Enable' '/etc/gdm/custom.conf'; then
    
    sed -i 's/Enable[^(\n)]*/Enable=false/' '/etc/gdm/custom.conf'
elif grep -qs '[[:space:]]*\[xdmcp]' '/etc/gdm/custom.conf'; then
    sed -i '/[[:space:]]*\[xdmcp]/a Enable=false' '/etc/gdm/custom.conf'
else
    if test -d "/etc/gdm"; then
        printf '%s\n' '[xdmcp]' 'Enable=false' &gt;&gt; '/etc/gdm/custom.conf'
    else
        echo "Config file directory '/etc/gdm' doesnt exist, not remediating, assuming non-applicability." &gt;&amp;2
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="gnome_gdm_disable_xdmcp" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - gnome_gdm_disable_xdmcp
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Disable XDMCP in GDM
  ini_file:
    path: /etc/gdm/custom.conf
    section: xdmcp
    option: Enable
    value: 'false'
    create: true
    mode: 420
  when: '"gdm" in ansible_facts.packages'
  tags:
    - gnome_gdm_disable_xdmcp
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-gnome_gdm_disable_xdmcp:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-gnome_gdm_disable_xdmcp_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gnome_media_settings">
              <xccdf-1.2:title>GNOME Media Settings</xccdf-1.2:title>
              <xccdf-1.2:description>GNOME media settings that apply to the graphical interface.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#gdm"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount" severity="medium">
                <xccdf-1.2:title>Disable GNOME3 Automounting</xccdf-1.2:title>
                <xccdf-1.2:description>The system's default desktop environment, GNOME3, will mount
devices and removable media (such as DVDs, CDs and USB flash drives) whenever
they are inserted into the system. To disable automount within GNOME3, add or set
<html:code>automount</html:code> to <html:code>false</html:code> in <html:code>/etc/dconf/db/local.d/00-security-settings</html:code>.
For example:
<html:pre>[org/gnome/desktop/media-handling]
automount=false</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/desktop/media-handling/automount</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000778</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001958</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000114-GPOS-00059</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Disabling automatic mounting in GNOME3 can prevent
the introduction of malware via removable media.
It will, however, also prevent desktop users from legitimate use
of removable media.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_disable_automount"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/media-handling\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/desktop/media-handling]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "automount" "false" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "false")"
    if grep -q "^\\s*automount\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*automount\\s*=\\s*.*/automount=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/desktop/media-handling\\]|a\\automount=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/media-handling/automount$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/media-handling/automount" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_disable_automount" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_automount
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Disable GNOME3 Automounting - automount
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/media-handling
    option: automount
    value: 'false'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_automount
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME3 Automounting - automount
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/media-handling/automount$
    line: /org/gnome/desktop/media-handling/automount
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_automount
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_automount
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_disable_automount:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_disable_automount_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount_open" severity="medium">
                <xccdf-1.2:title>Disable GNOME3 Automount Opening</xccdf-1.2:title>
                <xccdf-1.2:description>The system's default desktop environment, GNOME3, will mount
devices and removable media (such as DVDs, CDs and USB flash drives) whenever
they are inserted into the system. To disable automount-open within GNOME3, add or set
<html:code>automount-open</html:code> to <html:code>false</html:code> in <html:code>/etc/dconf/db/local.d/00-security-settings</html:code>.
For example:
<html:pre>[org/gnome/desktop/media-handling]
automount-open=false</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/desktop/media-handling/automount-open</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000778</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001958</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000114-GPOS-00059</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity.
Disabling automatic mounting in GNOME3 can prevent
the introduction of malware via removable media.
It will, however, also prevent desktop users from legitimate use
of removable media.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_disable_automount_open"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/media-handling\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/desktop/media-handling]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "automount-open" "false" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "false")"
    if grep -q "^\\s*automount-open\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*automount-open\\s*=\\s*.*/automount-open=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/desktop/media-handling\\]|a\\automount-open=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/media-handling/automount-open$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/media-handling/automount-open" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_disable_automount_open" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_automount_open
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Disable GNOME3 Automounting - automount-open
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/media-handling
    option: automount-open
    value: 'false'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_automount_open
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME3 Automounting - automount-open
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/media-handling/automount-open$
    line: /org/gnome/desktop/media-handling/automount-open
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_automount_open
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_automount_open
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_disable_automount_open:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_disable_automount_open_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_autorun" severity="medium">
                <xccdf-1.2:title>Disable GNOME3 Automount running</xccdf-1.2:title>
                <xccdf-1.2:description>The system's default desktop environment, GNOME3, will mount
devices and removable media (such as DVDs, CDs and USB flash drives) whenever
they are inserted into the system. To disable autorun-never within GNOME3, add or set
<html:code>autorun-never</html:code> to <html:code>true</html:code> in <html:code>/etc/dconf/db/local.d/00-security-settings</html:code>.
For example:
<html:pre>[org/gnome/desktop/media-handling]
autorun-never=true</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/desktop/media-handling/autorun-never</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000778</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001958</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000114-GPOS-00059</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity.
Disabling automatic mount running in GNOME3 can prevent
the introduction of malware via removable media.
It will, however, also prevent desktop users from legitimate use
of removable media.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_disable_autorun"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/media-handling\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/desktop/media-handling]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "autorun-never" "true" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
    if grep -q "^\\s*autorun-never\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*autorun-never\\s*=\\s*.*/autorun-never=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/desktop/media-handling\\]|a\\autorun-never=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/media-handling/autorun-never$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/media-handling/autorun-never" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_disable_autorun" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_autorun
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Disable GNOME3 Automounting - autorun-never
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/media-handling
    option: autorun-never
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_autorun
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME3 Automounting - autorun-never
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/media-handling/autorun-never$
    line: /org/gnome/desktop/media-handling/autorun-never
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_autorun
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_autorun
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_disable_autorun:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_disable_autorun_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_thumbnailers" severity="unknown">
                <xccdf-1.2:title>Disable All GNOME3 Thumbnailers</xccdf-1.2:title>
                <xccdf-1.2:description>The system's default desktop environment, GNOME3, uses
a number of different thumbnailer programs to generate thumbnails
for any new or modified content in an opened folder. To disable the
execution of these thumbnail applications, add or set <html:code>disable-all</html:code>
to <html:code>true</html:code> in <html:code>/etc/dconf/db/local.d/00-security-settings</html:code>.
For example:
<html:pre>[org/gnome/desktop/thumbnailers]
disable-all=true</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/desktop/thumbnailers/disable-all</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.
This effectively prevents an attacker from gaining access to a
system through a flaw in GNOME3's Nautilus thumbnail creators.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An attacker with knowledge of a flaw in a GNOME3 thumbnailer application could craft a malicious
file to exploit this flaw. Assuming the attacker could place the malicious file on the local filesystem
(via a web upload for example) and assuming a user browses the same location using Nautilus, the
malicious file would exploit the thumbnailer with the potential for malicious code execution. It
is best to disable these thumbnailer applications unless they are explicitly required.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_disable_thumbnailers"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/thumbnailers\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/desktop/thumbnailers]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "disable-all" "true" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
    if grep -q "^\\s*disable-all\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*disable-all\\s*=\\s*.*/disable-all=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/desktop/thumbnailers\\]|a\\disable-all=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/thumbnailers/disable-all$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/thumbnailers/disable-all" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_disable_thumbnailers" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_thumbnailers
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_severity
    - unknown_strategy

- name: Disable All GNOME3 Thumbnailers
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/thumbnailers
    option: disable-all
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_thumbnailers
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_severity
    - unknown_strategy

- name: Prevent user modification of GNOME3 Thumbnailers
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/thumbnailers/disable-all$
    line: /org/gnome/desktop/thumbnailers/disable-all
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_thumbnailers
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_severity
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_thumbnailers
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_severity
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_disable_thumbnailers:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_disable_thumbnailers_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gnome_network_settings">
              <xccdf-1.2:title>GNOME Network Settings</xccdf-1.2:title>
              <xccdf-1.2:description>GNOME network settings that apply to the graphical interface.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#gdm"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_create" severity="medium">
                <xccdf-1.2:title>Disable WIFI Network Connection Creation in GNOME3</xccdf-1.2:title>
                <xccdf-1.2:description><html:code>GNOME</html:code> allows users to create ad-hoc wireless connections through the
<html:code>NetworkManager</html:code> applet. Wireless connections should be disabled by
adding or setting <html:code>disable-wifi-create</html:code> to <html:code>true</html:code> in
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/nm-applet]
disable-wifi-create=true
</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/nm-applet/disable-wifi-create</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.16</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Wireless network connections should not be allowed to be configured by general
users on a given system as it could open the system to backdoor attacks.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_disable_wifi_create"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/nm-applet\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/nm-applet]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "disable-wifi-create" "true" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
    if grep -q "^\\s*disable-wifi-create\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*disable-wifi-create\\s*=\\s*.*/disable-wifi-create=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/nm-applet\\]|a\\disable-wifi-create=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/nm-applet/disable-wifi-create$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/nm-applet/disable-wifi-create" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_disable_wifi_create" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.16
    - dconf_gnome_disable_wifi_create
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Disable WiFi Network Connection Creation in GNOME3
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/nm-applet
    option: disable-wifi-create
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.16
    - dconf_gnome_disable_wifi_create
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME3 disablement of WiFi
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/nm-applet/disable-wifi-create$
    line: /org/gnome/nm-applet/disable-wifi-create
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.16
    - dconf_gnome_disable_wifi_create
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.16
    - dconf_gnome_disable_wifi_create
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_disable_wifi_create:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_disable_wifi_create_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_notification" severity="medium">
                <xccdf-1.2:title>Disable WIFI Network Notification in GNOME3</xccdf-1.2:title>
                <xccdf-1.2:description>By default, <html:code>GNOME</html:code> disables WIFI notification. This should be permanently set
so that users do not connect to a wireless network when the system finds one.
While useful for mobile devices, this setting should be disabled for all other systems.
To configure the system to disable the WIFI notication, add or set
<html:code>suppress-wireless-networks-available</html:code> to <html:code>true</html:code> in
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/nm-applet]
suppress-wireless-networks-available=true
</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/nm-applet/suppress-wireless-networks-available</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.16</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Wireless network connections should not be allowed to be configured by general
users on a given system as it could open the system to backdoor attacks.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_disable_wifi_notification"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/nm-applet\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/nm-applet]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "suppress-wireless-networks-available" "true" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
    if grep -q "^\\s*suppress-wireless-networks-available\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*suppress-wireless-networks-available\\s*=\\s*.*/suppress-wireless-networks-available=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/nm-applet\\]|a\\suppress-wireless-networks-available=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/nm-applet/suppress-wireless-networks-available$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/nm-applet/suppress-wireless-networks-available" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_disable_wifi_notification" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.16
    - dconf_gnome_disable_wifi_notification
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Disable WiFi Network Notification in GNOME3
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/nm-applet
    option: suppress-wireless-networks-available
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.16
    - dconf_gnome_disable_wifi_notification
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME3 disablement of WiFi
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/nm-applet/suppress-wireless-networks-available$
    line: /org/gnome/nm-applet/suppress-wireless-networks-available
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.16
    - dconf_gnome_disable_wifi_notification
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.16
    - dconf_gnome_disable_wifi_notification
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_disable_wifi_notification:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_disable_wifi_notification_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gnome_remote_access_settings">
              <xccdf-1.2:title>GNOME Remote Access Settings</xccdf-1.2:title>
              <xccdf-1.2:description>GNOME remote access settings that apply to the graphical interface.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#gdm"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_credential_prompt" severity="medium">
                <xccdf-1.2:title>Require Credential Prompting for Remote Access in GNOME3</xccdf-1.2:title>
                <xccdf-1.2:description>By default, <html:code>GNOME</html:code> does not require credentials when using <html:code>Vino</html:code> for
remote access. To configure the system to require remote credentials, add or set
<html:code>authentication-methods</html:code> to <html:code>['vnc']</html:code> in
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/Vino]
authentication-methods=['vnc']
</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/Vino/authentication-methods</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Username and password prompting is required for remote access. Otherwise, non-authorized
and nefarious users can access the system freely.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_remote_access_credential_prompt"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/Vino\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/Vino]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "authentication-methods" "['vnc']" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "['vnc']")"
    if grep -q "^\\s*authentication-methods\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*authentication-methods\\s*=\\s*.*/authentication-methods=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/Vino\\]|a\\authentication-methods=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/Vino/authentication-methods$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/Vino/authentication-methods" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_remote_access_credential_prompt" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.12
    - dconf_gnome_remote_access_credential_prompt
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Require Credential Prompting for Remote Access in GNOME3
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/Vino
    option: authentication-methods
    value: '[''vnc'']'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.12
    - dconf_gnome_remote_access_credential_prompt
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME3 Credential Prompting for Remote Access
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/Vino/authentication-methods$
    line: /org/gnome/Vino/authentication-methods
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.12
    - dconf_gnome_remote_access_credential_prompt
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.12
    - dconf_gnome_remote_access_credential_prompt
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_remote_access_credential_prompt:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_remote_access_credential_prompt_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_encryption" severity="medium">
                <xccdf-1.2:title>Require Encryption for Remote Access in GNOME3</xccdf-1.2:title>
                <xccdf-1.2:description>By default, <html:code>GNOME</html:code> requires encryption when using <html:code>Vino</html:code> for remote access.
To prevent remote access encryption from being disabled, add or set
<html:code>require-encryption</html:code> to <html:code>true</html:code> in
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/Vino]
require-encryption=true
</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/Vino/require-encryption</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.08</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI07.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Open X displays allow an attacker to capture keystrokes and to execute commands
remotely.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_remote_access_encryption"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/Vino\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/Vino]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "require-encryption" "true" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
    if grep -q "^\\s*require-encryption\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*require-encryption\\s*=\\s*.*/require-encryption=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/Vino\\]|a\\require-encryption=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/Vino/require-encryption$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/Vino/require-encryption" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_remote_access_encryption" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.13
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - dconf_gnome_remote_access_encryption
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Require Encryption for Remote Access in GNOME3
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/Vino
    option: require-encryption
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.13
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - dconf_gnome_remote_access_encryption
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME3 Encryption for Remote Access
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/Vino/require-encryption$
    line: /org/gnome/Vino/require-encryption
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.13
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - dconf_gnome_remote_access_encryption
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.13
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - dconf_gnome_remote_access_encryption
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_remote_access_encryption:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_remote_access_encryption_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gnome_screen_locking">
              <xccdf-1.2:title>Configure GNOME Screen Locking</xccdf-1.2:title>
              <xccdf-1.2:description>In the default GNOME3 desktop, the screen can be locked
by selecting the user name in the far right corner of the main panel and
selecting <html:b>Lock</html:b>.
<html:br/><html:br/>
The following sections detail commands to enforce idle activation of the screensaver,
screen locking, a blank-screen screensaver, and an idle activation time.
<html:br/><html:br/>
Because users should be trained to lock the screen when they
step away from the computer, the automatic locking feature is only
meant as a backup.
<html:br/><html:br/>
The root account can be screen-locked; however, the root account should
<html:i>never</html:i> be used to log into an X Windows environment and should only
be used to for direct login via console in emergency circumstances.
<html:br/><html:br/>
For more information about enforcing preferences in the GNOME3 environment using the DConf
configuration system, see <html:b><html:a href="http://wiki.gnome.org/dconf">http://wiki.gnome.org/dconf</html:a></html:b> and
the man page <html:code>dconf(1)</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#gdm"/>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_inactivity_timeout_value" type="number">
                <xccdf-1.2:title>Screensaver Inactivity timeout</xccdf-1.2:title>
                <xccdf-1.2:description>Choose allowed duration (in seconds) of inactive graphical sessions</xccdf-1.2:description>
                <xccdf-1.2:value selector="10_minutes">600</xccdf-1.2:value>
                <xccdf-1.2:value selector="15_minutes">900</xccdf-1.2:value>
                <xccdf-1.2:value selector="30_minutes">1800</xccdf-1.2:value>
                <xccdf-1.2:value selector="5_minutes">300</xccdf-1.2:value>
                <xccdf-1.2:value>900</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_screensaver_lock_delay" type="number">
                <xccdf-1.2:title>Screensaver Lock Delay</xccdf-1.2:title>
                <xccdf-1.2:description>Choose allowed duration (in seconds) after a screensaver becomes active before displaying an authentication prompt</xccdf-1.2:description>
                <xccdf-1.2:value selector="10_seconds">10</xccdf-1.2:value>
                <xccdf-1.2:value selector="5_seconds">5</xccdf-1.2:value>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="immediate">0</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled" severity="medium">
                <xccdf-1.2:title>Enable GNOME3 Screensaver Idle Activation</xccdf-1.2:title>
                <xccdf-1.2:description>To activate the screensaver in the GNOME3 desktop after a period of inactivity,
add or set <html:code>idle-activation-enabled</html:code> to <html:code>true</html:code> in
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/desktop/screensaver]
idle-activation-enabled=true</html:pre>
Once the setting has been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/desktop/screensaver/idle-activation-enabled</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-11(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate
physical vicinity of the information system but does not logout because of the temporary nature of the absence.
Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,
GNOME desktops can be configured to identify when a user's session has idled and take action to initiate the
session lock.
<html:br/><html:br/>
Enabling idle activation of the screensaver ensures the screensaver will
be activated after the idle delay.  Applications requiring continuous,
real-time screen display (such as network management products) require the
login session does not have administrator rights and the display station is located in a
controlled-access area.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_screensaver_idle_activation_enabled"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/screensaver\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/desktop/screensaver]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "idle-activation-enabled" "true" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
    if grep -q "^\\s*idle-activation-enabled\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*idle-activation-enabled\\s*=\\s*.*/idle-activation-enabled=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/desktop/screensaver\\]|a\\idle-activation-enabled=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/idle-activation-enabled$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/screensaver/idle-activation-enabled" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_screensaver_idle_activation_enabled" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_activation_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Enable GNOME3 Screensaver Idle Activation
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/screensaver
    option: idle-activation-enabled
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_activation_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME idle-activation-enabled
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/screensaver/idle-activation-enabled$
    line: /org/gnome/desktop/screensaver/idle-activation-enabled
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_activation_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_activation_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_screensaver_idle_activation_enabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_screensaver_idle_activation_enabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_locked" severity="medium">
                <xccdf-1.2:title>Ensure Users Cannot Change GNOME3 Screensaver Idle Activation</xccdf-1.2:title>
                <xccdf-1.2:description>If not already configured, ensure that users cannot change GNOME3 screensaver lock settings
by adding <html:pre>/org/gnome/desktop/screensaver/idle-activation-enabled</html:pre>
to <html:code>/etc/dconf/db/local.d/00-security-settings</html:code>.
For example:
<html:pre>/org/gnome/desktop/screensaver/idle-activation-enabled</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity
of the information system but does not want to logout because of the temporary nature of the absense.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#gdm"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_screensaver_idle_activation_locked"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm; then

# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/idle-activation-enabled$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/screensaver/idle-activation-enabled" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_screensaver_idle_activation_locked" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_activation_locked
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME Screensaver idle-activation-enabled
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/screensaver/idle-activation-enabled$
    line: /org/gnome/desktop/screensaver/idle-activation-enabled
    create: true
  when: '"gdm" in ansible_facts.packages'
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_activation_locked
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when: '"gdm" in ansible_facts.packages'
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_activation_locked
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_screensaver_idle_activation_locked:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_screensaver_idle_activation_locked_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay" severity="medium">
                <xccdf-1.2:title>Set GNOME3 Screensaver Inactivity Timeout</xccdf-1.2:title>
                <xccdf-1.2:description>The idle time-out value for inactivity in the GNOME3 desktop is configured via the <html:code>idle-delay</html:code>
setting must be set under an appropriate configuration file(s) in the <html:code>/etc/dconf/db/local.d</html:code> directory
and locked in <html:code>/etc/dconf/db/local.d/locks</html:code> directory to prevent user modification.
<html:br/><html:br/>
For example, to configure the system for a 15 minute delay, add the following to
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>:
<html:pre>[org/gnome/desktop/session]
idle-delay=uint32 900</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-11(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000031-GPOS-00012</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A session time-out lock is a temporary action taken when a user stops work and moves away from
the immediate physical vicinity of the information system but does not logout because of the
temporary nature of the absence. Rather than relying on the user to manually lock their operating
system session prior to vacating the vicinity, GNOME3 can be configured to identify when
a user's session has idled and take action to initiate a session lock.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_screensaver_idle_delay"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

inactivity_timeout_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_inactivity_timeout_value" use="legacy"/>'


# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/session\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/desktop/session]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "idle-delay" "uint32 ${inactivity_timeout_value}" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "uint32 ${inactivity_timeout_value}")"
    if grep -q "^\\s*idle-delay\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*idle-delay\\s*=\\s*.*/idle-delay=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/desktop/session\\]|a\\idle-delay=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_screensaver_idle_delay" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_delay
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
- name: XCCDF Value inactivity_timeout_value # promote to variable
  set_fact:
    inactivity_timeout_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_inactivity_timeout_value" use="legacy"/>
  tags:
    - always

- name: Set GNOME3 Screensaver Inactivity Timeout
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/session
    option: idle-delay
    value: uint32 {{ inactivity_timeout_value }}
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_delay
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_delay
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-inactivity_timeout_value:var:1" value-id="xccdf_org.ssgproject.content_value_inactivity_timeout_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_screensaver_idle_delay:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_screensaver_idle_delay_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay" severity="medium">
                <xccdf-1.2:title>Set GNOME3 Screensaver Lock Delay After Activation Period</xccdf-1.2:title>
                <xccdf-1.2:description>To activate the locking delay of the screensaver in the GNOME3 desktop when
the screensaver is activated, add or set <html:code>lock-delay</html:code> to <html:code>uint32 <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_screensaver_lock_delay" use="legacy"/></html:code> in
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/desktop/screensaver]
lock-delay=uint32 <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_screensaver_lock_delay" use="legacy"/>
</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000056</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-11(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity
of the information system but does not want to logout because of the temporary nature of the absense.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_screensaver_lock_delay"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

var_screensaver_lock_delay='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_screensaver_lock_delay" use="legacy"/>'


# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/screensaver\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/desktop/screensaver]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "lock-delay" "uint32 ${var_screensaver_lock_delay}" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "uint32 ${var_screensaver_lock_delay}")"
    if grep -q "^\\s*lock-delay\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*lock-delay\\s*=\\s*.*/lock-delay=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/desktop/screensaver\\]|a\\lock-delay=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_screensaver_lock_delay" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_delay
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
- name: XCCDF Value var_screensaver_lock_delay # promote to variable
  set_fact:
    var_screensaver_lock_delay: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_screensaver_lock_delay" use="legacy"/>
  tags:
    - always

- name: Set GNOME3 Screensaver Lock Delay After Activation Period
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/screensaver
    option: lock-delay
    value: uint32 {{ var_screensaver_lock_delay }}
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_delay
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_delay
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_screensaver_lock_delay:var:1" value-id="xccdf_org.ssgproject.content_value_var_screensaver_lock_delay"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_screensaver_lock_delay:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_screensaver_lock_delay_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled" severity="medium">
                <xccdf-1.2:title>Enable GNOME3 Screensaver Lock After Idle Period</xccdf-1.2:title>
                <xccdf-1.2:description>
To activate locking of the screensaver in the GNOME3 desktop when it is activated,
add or set <html:code>lock-enabled</html:code> to <html:code>true</html:code> in
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/desktop/screensaver]
lock-enabled=true
</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/desktop/screensaver/lock-enabled</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000056</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000058</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000060</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000028-GPOS-00009</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000030-GPOS-00011</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity
of the information system but does not want to logout because of the temporary nature of the absense.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_screensaver_lock_enabled"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/screensaver\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/desktop/screensaver]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "lock-enabled" "true" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
    if grep -q "^\\s*lock-enabled\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*lock-enabled\\s*=\\s*.*/lock-enabled=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/desktop/screensaver\\]|a\\lock-enabled=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/lock-enabled$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/screensaver/lock-enabled" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_screensaver_lock_enabled" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ansible_distribution == 'SLES'
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Enable GNOME3 Screensaver Lock After Idle Period
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/screensaver
    option: lock-enabled
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME lock-enabled
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/screensaver/lock-enabled$
    line: /org/gnome/desktop/screensaver/lock-enabled
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Check GNOME3 screenserver disable-lock-screen false
  command: gsettings get org.gnome.desktop.lockdown disable-lock-screen
  register: cmd_out
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ansible_distribution == 'SLES'
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Update GNOME3 screenserver disable-lock-screen false
  command: gsettings set org.gnome.desktop.lockdown disable-lock-screen false
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ansible_distribution == 'SLES'
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_screensaver_lock_enabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_screensaver_lock_enabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_locked" severity="medium">
                <xccdf-1.2:title>Ensure Users Cannot Change GNOME3 Screensaver Lock After Idle Period</xccdf-1.2:title>
                <xccdf-1.2:description>If not already configured, ensure that users cannot change GNOME3 screensaver lock settings
by adding <html:pre>/org/gnome/desktop/screensaver/lock-enabled</html:pre>
to <html:code>/etc/dconf/db/local.d/00-security-settings</html:code>.
For example:
<html:pre>/org/gnome/desktop/screensaver/lock-enabled</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000056</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000028-GPOS-00009</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000030-GPOS-00011</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity
of the information system but does not want to logout because of the temporary nature of the absense.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#gdm"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_screensaver_lock_locked"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm; then

# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/lock-enabled$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/screensaver/lock-enabled" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_screensaver_lock_locked" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_locked
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME Screensaver lock-enabled
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/screensaver/lock-enabled$
    line: /org/gnome/desktop/screensaver/lock-enabled
    create: true
  when: '"gdm" in ansible_facts.packages'
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_locked
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when: '"gdm" in ansible_facts.packages'
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_locked
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_screensaver_lock_locked:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_screensaver_lock_locked_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank" severity="medium">
                <xccdf-1.2:title>Implement Blank Screensaver</xccdf-1.2:title>
                <xccdf-1.2:description>


To set the screensaver mode in the GNOME3 desktop to a blank screen,
add or set <html:code>picture-uri</html:code> to <html:code>string ''</html:code> in
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/desktop/screensaver]
picture-uri=''
</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/desktop/screensaver/picture-uri</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000060</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-11(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-11(1).1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000031-GPOS-00012</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Setting the screensaver mode to blank-only conceals the
contents of the display from passersby.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_screensaver_mode_blank"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/screensaver\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/desktop/screensaver]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "picture-uri" "string ''" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "string ''")"
    if grep -q "^\\s*picture-uri\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*picture-uri\\s*=\\s*.*/picture-uri=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/desktop/screensaver\\]|a\\picture-uri=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/picture-uri$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/screensaver/picture-uri" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_screensaver_mode_blank" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(1)
    - NIST-800-53-AC-11(1).1
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_mode_blank
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Implement Blank Screensaver
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/screensaver
    option: picture-uri
    value: string ''
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(1)
    - NIST-800-53-AC-11(1).1
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_mode_blank
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME picture-uri
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/screensaver/picture-uri$
    line: /org/gnome/desktop/screensaver/picture-uri
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(1)
    - NIST-800-53-AC-11(1).1
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_mode_blank
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(1)
    - NIST-800-53-AC-11(1).1
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_mode_blank
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_screensaver_mode_blank:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_screensaver_mode_blank_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_info" severity="medium">
                <xccdf-1.2:title>Disable Full User Name on Splash Shield</xccdf-1.2:title>
                <xccdf-1.2:description>By default when the screen is locked, the splash shield will show the user's
full name. This should be disabled to prevent casual observers from seeing
who has access to the system. This can be disabled by adding or setting
<html:code>show-full-name-in-top-bar</html:code> to <html:code>false</html:code> in
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/desktop/screensaver]
show-full-name-in-top-bar=false
</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/desktop/screensaver/show-full-name-in-top-bar</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Setting the splash screen to not reveal the logged in user's name
conceals who has access to the system from passersby.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_screensaver_user_info"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/screensaver\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/desktop/screensaver]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "show-full-name-in-top-bar" "false" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "false")"
    if grep -q "^\\s*show-full-name-in-top-bar\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*show-full-name-in-top-bar\\s*=\\s*.*/show-full-name-in-top-bar=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/desktop/screensaver\\]|a\\show-full-name-in-top-bar=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/show-full-name-in-top-bar$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/screensaver/show-full-name-in-top-bar" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_screensaver_user_info" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - dconf_gnome_screensaver_user_info
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Disable Full Username on Splash Screen
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/screensaver
    option: show-full-name-in-top-bar
    value: 'false'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - dconf_gnome_screensaver_user_info
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME show-full-name-in-top-bar
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/screensaver/show-full-name-in-top-bar$
    line: /org/gnome/desktop/screensaver/show-full-name-in-top-bar
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - dconf_gnome_screensaver_user_info
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - dconf_gnome_screensaver_user_info
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_screensaver_user_info:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_screensaver_user_info_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_locks" severity="medium">
                <xccdf-1.2:title>Ensure Users Cannot Change GNOME3 Screensaver Settings</xccdf-1.2:title>
                <xccdf-1.2:description>If not already configured, ensure that users cannot change GNOME3 screensaver lock settings
by adding <html:code>/org/gnome/desktop/screensaver/lock-delay</html:code>
to <html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/desktop/screensaver/lock-delay</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate
physical vicinity of the information system but does not logout because of the temporary nature of the absence.
Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,
GNOME desktops can be configured to identify when a user's session has idled and take action to initiate the
session lock. As such, users should not be allowed to change session settings.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_screensaver_user_locks"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/lock-delay$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/screensaver/lock-delay" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_screensaver_user_locks" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - dconf_gnome_screensaver_user_locks
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME lock-delay
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/screensaver/lock-delay$
    line: /org/gnome/desktop/screensaver/lock-delay
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - dconf_gnome_screensaver_user_locks
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - dconf_gnome_screensaver_user_locks
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_screensaver_user_locks:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_screensaver_user_locks_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_session_idle_user_locks" severity="medium">
                <xccdf-1.2:title>Ensure Users Cannot Change GNOME3 Session Idle Settings</xccdf-1.2:title>
                <xccdf-1.2:description>If not already configured, ensure that users cannot change GNOME3 session idle settings
by adding <html:code>/org/gnome/desktop/session/idle-delay</html:code>
to <html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/desktop/session/idle-delay</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000031-GPOS-00012</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate
physical vicinity of the information system but does not logout because of the temporary nature of the absence.
Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,
GNOME desktops can be configured to identify when a user's session has idled and take action to initiate the
session lock. As such, users should not be allowed to change session settings.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_session_idle_user_locks"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/session/idle-delay$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/session/idle-delay" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_session_idle_user_locks" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - dconf_gnome_session_idle_user_locks
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME Session idle-delay
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/session/idle-delay$
    line: /org/gnome/desktop/session/idle-delay
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - dconf_gnome_session_idle_user_locks
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - dconf_gnome_session_idle_user_locks
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_session_idle_user_locks:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_session_idle_user_locks_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gnome_system_settings">
              <xccdf-1.2:title>GNOME System Settings</xccdf-1.2:title>
              <xccdf-1.2:description>GNOME provides configuration and functionality to a graphical desktop environment
that changes grahical configurations or allow a user to perform
actions that users normally would not be able to do in non-graphical mode such as
remote access configuration, power policies, Geo-location, etc.
Configuring such settings in GNOME will prevent accidential graphical configuration
changes by users from taking place.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#gdm"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_ctrlaltdel_reboot" severity="high">
                <xccdf-1.2:title>Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3</xccdf-1.2:title>
                <xccdf-1.2:description>By default, <html:code>GNOME</html:code> will reboot the system if the
<html:code>Ctrl-Alt-Del</html:code> key sequence is pressed.
<html:br/><html:br/>
To configure the system to ignore the <html:code>Ctrl-Alt-Del</html:code> key sequence
from the Graphical User Interface (GUI) instead of rebooting the system,
add or set <html:code>logout</html:code> to <html:code>''</html:code> in
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/settings-daemon/plugins/media-keys]
logout=''</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent
user modification. For example:
<html:pre>/org/gnome/settings-daemon/plugins/media-keys/logout</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A locally logged-in user who presses Ctrl-Alt-Del, when at the console,
can reboot the system. If accidentally pressed, as could happen in
the case of mixed OS environment, this can create the risk of short-term
loss of availability of systems due to unintentional reboot.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_disable_ctrlaltdel_reboot"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/settings-daemon/plugins/media-keys\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/settings-daemon/plugins/media-keys]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "logout" "''" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "''")"
    if grep -q "^\\s*logout\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*logout\\s*=\\s*.*/logout=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/settings-daemon/plugins/media-keys\\]|a\\logout=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/settings-daemon/plugins/media-keys/logout$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/settings-daemon/plugins/media-keys/logout" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_disable_ctrlaltdel_reboot" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_ctrlaltdel_reboot
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/settings-daemon/plugins/media-keys
    option: logout
    value: ''''''
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_ctrlaltdel_reboot
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME disablement of Ctrl-Alt-Del
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/settings-daemon/plugins/media-keys/logout$
    line: /org/gnome/settings-daemon/plugins/media-keys/logout
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_ctrlaltdel_reboot
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_ctrlaltdel_reboot
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_disable_ctrlaltdel_reboot:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_disable_ctrlaltdel_reboot_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_geolocation" severity="medium">
                <xccdf-1.2:title>Disable Geolocation in GNOME3</xccdf-1.2:title>
                <xccdf-1.2:description><html:code>GNOME</html:code> allows the clock and applications to track and access
location information. This setting should be disabled as applications
should not track system location. To configure the system to disable
location tracking, add or set <html:code>enabled</html:code> to <html:code>false</html:code> in
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/system/location]
enabled=false</html:pre>
To configure the clock to disable location tracking, add or set
<html:code>geolocation</html:code> to <html:code>false</html:code> in
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/clocks]
geolocation=false</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent
user modification. For example:
<html:pre>/org/gnome/system/location/enabled
/org/gnome/clocks/geolocation</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:rationale>Power settings should not be enabled on systems that are not mobile devices.
Enabling power settings on non-mobile devices could have unintended processing
consequences on standard systems.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_disable_geolocation"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/system/location\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/system/location]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "enabled" "false" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "false")"
    if grep -q "^\\s*enabled\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*enabled\\s*=\\s*.*/enabled=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/system/location\\]|a\\enabled=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/clocks\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/clocks]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "geolocation" "false" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "false")"
    if grep -q "^\\s*geolocation\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*geolocation\\s*=\\s*.*/geolocation=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/clocks\\]|a\\geolocation=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/system/location/enabled$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/system/location/enabled" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/clocks/geolocation$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/clocks/geolocation" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_disable_geolocation" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - dconf_gnome_disable_geolocation
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Disable Geolocation in GNOME3 - location tracking
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/system/location
    option: enabled
    value: 'false'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - dconf_gnome_disable_geolocation
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Disable Geolocation in GNOME3 - clock location tracking
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/clocks
    option: gelocation
    value: 'false'
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - dconf_gnome_disable_geolocation
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME geolocation - location tracking
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/system/location/enabled$
    line: /org/gnome/system/location/enabled
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - dconf_gnome_disable_geolocation
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME geolocation - clock location tracking
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/clocks/geolocation$
    line: /org/gnome/clocks/geolocation
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - dconf_gnome_disable_geolocation
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - dconf_gnome_disable_geolocation
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_disable_geolocation:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_disable_geolocation_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_power_settings" severity="medium">
                <xccdf-1.2:title>Disable Power Settings in GNOME3</xccdf-1.2:title>
                <xccdf-1.2:description>By default, <html:code>GNOME</html:code> enables a power profile designed for mobile devices
with battery usage. While useful for mobile devices, this setting should be disabled
for all other systems. To configure the system to disable the power setting, add or set
<html:code>active</html:code> to <html:code>false</html:code> in
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/settings-daemon/plugins/power]
active=false
</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/settings-daemon/plugins/power</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:rationale>Power settings should not be enabled on systems that are not mobile devices.
Enabling power settings on non-mobile devices could have unintended processing
consequences on standard systems.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_disable_power_settings:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_disable_power_settings_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_admin" severity="high">
                <xccdf-1.2:title>Disable User Administration in GNOME3</xccdf-1.2:title>
                <xccdf-1.2:description>By default, <html:code>GNOME</html:code> will allow all users to have some administratrion
capability. This should be disabled so that non-administrative users are not making
configuration changes. To configure the system to disable user administration
capability in the Graphical User Interface (GUI), add or set
<html:code>user-administration-disabled</html:code> to <html:code>true</html:code> in
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/desktop/lockdown]
user-administration-disabled=true
</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/desktop/lockdown/user-administration-disabled</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOD_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Allowing all users to have some administratrive capabilities to the system through
the Graphical User Interface (GUI) when they would not have them otherwise could allow
unintended configuration changes as well as a nefarious user the capability to make system
changes such as adding new accounts, etc.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_disable_user_admin"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/lockdown\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/desktop/lockdown]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "user-administration-disabled" "true" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
    if grep -q "^\\s*user-administration-disabled\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*user-administration-disabled\\s*=\\s*.*/user-administration-disabled=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/desktop/lockdown\\]|a\\user-administration-disabled=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/lockdown/user-administration-disabled$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/lockdown/user-administration-disabled" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_disable_user_admin" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.5
    - dconf_gnome_disable_user_admin
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Detect if user-administration-disabled can be found on /etc/dconf/db/local.d/
  find:
    path: /etc/dconf/db/local.d/
    contains: ^\s*user-administration-disabled
  register: dconf_gnome_disable_user_admin_config_files
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.5
    - dconf_gnome_disable_user_admin
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Configure user-administration-disabled - default file
  ini_file:
    dest: /etc/dconf/db/local.d//00-security-settings
    section: org/gnome/desktop/lockdown
    option: user-administration-disabled
    value: 'true'
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - dconf_gnome_disable_user_admin_config_files is defined and dconf_gnome_disable_user_admin_config_files.matched
      == 0
  tags:
    - NIST-800-171-3.1.5
    - dconf_gnome_disable_user_admin
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Configure user-administration-disabled - existing files
  ini_file:
    dest: '{{ item.path }}'
    section: org/gnome/desktop/lockdown
    option: user-administration-disabled
    value: 'true'
    create: true
  with_items: '{{ dconf_gnome_disable_user_admin_config_files.files }}'
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - dconf_gnome_disable_user_admin_config_files is defined and dconf_gnome_disable_user_admin_config_files.matched
      &gt; 0
  tags:
    - NIST-800-171-3.1.5
    - dconf_gnome_disable_user_admin
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Detect if lock for user-administration-disabled can be found on /etc/dconf/db/local.d/
  find:
    path: /etc/dconf/db/local.d/locks
    contains: ^\s*user-administration-disabled
  register: dconf_gnome_disable_user_admin_lock_files
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.5
    - dconf_gnome_disable_user_admin
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification user-administration-disabled - default file
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/lockdown/user-administration-disabled$
    line: /org/gnome/desktop/lockdown/user-administration-disabled
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - dconf_gnome_disable_user_admin_lock_files is defined and dconf_gnome_disable_user_admin_lock_files.matched
      == 0
  tags:
    - NIST-800-171-3.1.5
    - dconf_gnome_disable_user_admin
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification user-administration-disabled - existing files
  lineinfile:
    path: '{{ item.path }}'
    regexp: ^/org/gnome/desktop/lockdown/user-administration-disabled$
    line: /org/gnome/desktop/lockdown/user-administration-disabled
    create: true
  with_items: '{{ dconf_gnome_disable_user_admin_lock_files.files }}'
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - dconf_gnome_disable_user_admin_lock_files is defined and dconf_gnome_disable_user_admin_lock_files.matched
      &gt; 0
  tags:
    - NIST-800-171-3.1.5
    - dconf_gnome_disable_user_admin
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update - user-administration-disabled
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.5
    - dconf_gnome_disable_user_admin
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_disable_user_admin:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_disable_user_admin_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_sap_host">
            <xccdf-1.2:title>SAP Specific Requirement</xccdf-1.2:title>
            <xccdf-1.2:description>SAP (Systems, Applications and Products in Data Processing) is enterprise
software to manage business operations and customer relations. The
following section contains SAP specific requirement that is not part
of standard or common OS setting.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_sudo">
            <xccdf-1.2:title>Sudo</xccdf-1.2:title>
            <xccdf-1.2:description><html:code>Sudo</html:code>, which stands for "su 'do'", provides the ability to delegate authority
to certain users, groups of users, or system administrators. When configured for system
users and/or groups, <html:code>Sudo</html:code> can allow a user or group to execute privileged commands
that normally only <html:code>root</html:code> is allowed to execute.
<html:br/><html:br/>
For more information on <html:code>Sudo</html:code> and addition <html:code>Sudo</html:code> configuration options, see
<html:b><html:a href="https://www.sudo.ws">https://www.sudo.ws</html:a></html:b>.</xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sudo_dedicated_group" type="string" interactive="true">
              <xccdf-1.2:title>Group name dedicated to the use of sudo</xccdf-1.2:title>
              <xccdf-1.2:description>Specify the name of the group that should own /usr/bin/sudo.</xccdf-1.2:description>
              <xccdf-1.2:value>root</xccdf-1.2:value>
              <xccdf-1.2:value selector="sudogrp">sudogrp</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sudo_logfile" type="string" interactive="true">
              <xccdf-1.2:title>Sudo - logfile value</xccdf-1.2:title>
              <xccdf-1.2:description>Specify the sudo logfile to use. The default value used here matches the example
location from CIS, which uses /var/log/sudo.log.</xccdf-1.2:description>
              <xccdf-1.2:value>/var/log/sudo.log</xccdf-1.2:value>
              <xccdf-1.2:value selector="var_log_sudo_log">/var/log/sudo.log</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sudo_passwd_timeout" type="string">
              <xccdf-1.2:title>Sudo - passwd_timeout value</xccdf-1.2:title>
              <xccdf-1.2:description>Defines the number of minutes before the <html:code>sudo</html:code> password prompt times out.
Defining 0 means no timeout. The default timeout value is 5 minutes.</xccdf-1.2:description>
              <xccdf-1.2:value>5</xccdf-1.2:value>
              <xccdf-1.2:value selector="infinite">0</xccdf-1.2:value>
              <xccdf-1.2:value selector="1_minute">1</xccdf-1.2:value>
              <xccdf-1.2:value selector="2_minutes">2</xccdf-1.2:value>
              <xccdf-1.2:value selector="3_minutes">3</xccdf-1.2:value>
              <xccdf-1.2:value selector="5_minutes">5</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sudo_timestamp_timeout" type="string">
              <xccdf-1.2:title>Sudo - timestamp_timeout value</xccdf-1.2:title>
              <xccdf-1.2:description>Defines the number of minutes that can elapse before <html:code>sudo</html:code> will ask for a passwd again.
If set to a value less than 0 the user's time stamp will never expire. Defining 0 means always prompt for a 
password. The default timeout value is 5 minutes.</xccdf-1.2:description>
              <xccdf-1.2:value>5</xccdf-1.2:value>
              <xccdf-1.2:value selector="always_prompt">0</xccdf-1.2:value>
              <xccdf-1.2:value selector="1_minute">1</xccdf-1.2:value>
              <xccdf-1.2:value selector="2_minutes">2</xccdf-1.2:value>
              <xccdf-1.2:value selector="3_minutes">3</xccdf-1.2:value>
              <xccdf-1.2:value selector="5_minutes">5</xccdf-1.2:value>
              <xccdf-1.2:value selector="15_minutes">15</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sudo_umask" type="string">
              <xccdf-1.2:title>Sudo - umask value</xccdf-1.2:title>
              <xccdf-1.2:description>Specify the sudo umask to use. The actual umask value that is used is the union
of the user's umask and the sudo umask.
The default sudo umask is 0022. This guarantess sudo never lowers the umask when
running a command.</xccdf-1.2:description>
              <xccdf-1.2:value>0022</xccdf-1.2:value>
              <xccdf-1.2:value selector="0022">0022</xccdf-1.2:value>
              <xccdf-1.2:value selector="0027">0027</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_sudo_installed" severity="medium">
              <xccdf-1.2:title>Install sudo Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>sudo</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install sudo</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R19)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1382</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1384</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1386</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000324-GPOS-00125</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>sudo</html:code> is a program designed to allow a system administrator to give
limited root privileges to users and log root activity. The basic philosophy
is to give as few privileges as possible but still allow system users to
get their work done.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_sudo_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "sudo" ; then
    dnf install -y "sudo"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_sudo_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure sudo is installed
  package:
    name: sudo
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_sudo_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_sudo_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_sudo

class install_sudo {
  package { 'sudo':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_sudo_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=sudo
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_sudo_installed">
[[packages]]
name = "sudo"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_sudo_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_sudo_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudo_add_noexec" severity="high">
              <xccdf-1.2:title>Ensure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC</xccdf-1.2:title>
              <xccdf-1.2:description>The sudo <html:code>NOEXEC</html:code> tag, when specified, prevents user executed
commands from executing other commands, like a shell for example.
This should be enabled by making sure that the <html:code>NOEXEC</html:code> tag exists in
<html:code>/etc/sudoers</html:code> configuration file or any sudo configuration snippets
in <html:code>/etc/sudoers.d/</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R58)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Restricting the capability of sudo allowed commands to execute sub-commands
prevents users from running programs with privileges they wouldn't have otherwise.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sudo_add_noexec" complexity="low" disruption="low" reboot="false" strategy="restrict">
if /usr/sbin/visudo -qcf /etc/sudoers; then
    cp /etc/sudoers /etc/sudoers.bak
    if ! grep -P '^[\s]*Defaults.*\bnoexec\b.*$' /etc/sudoers; then
        # sudoers file doesn't define Option noexec
        echo "Defaults noexec" &gt;&gt; /etc/sudoers
    fi
    
    # Check validity of sudoers and cleanup bak
    if /usr/sbin/visudo -qcf /etc/sudoers; then
        rm -f /etc/sudoers.bak
    else
        echo "Fail to validate remediated /etc/sudoers, reverting to original file."
        mv /etc/sudoers.bak /etc/sudoers
        false
    fi
else
    echo "Skipping remediation, /etc/sudoers failed to validate"
    false
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sudo_add_noexec" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Ensure noexec is enabled in /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    regexp: ^[\s]*Defaults.*\bnoexec\b.*$
    line: Defaults noexec
    validate: /usr/sbin/visudo -cf %s
  tags:
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
    - sudo_add_noexec
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sudo_add_noexec:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sudo_add_noexec_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudo_add_requiretty" severity="medium">
              <xccdf-1.2:title>Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo requiretty</xccdf-1.2:title>
              <xccdf-1.2:description>The sudo <html:code>requiretty</html:code> tag, when specified, will only execute sudo
commands from users logged in to a real tty.
This should be enabled by making sure that the <html:code>requiretty</html:code> tag exists in
<html:code>/etc/sudoers</html:code> configuration file or any sudo configuration snippets
in <html:code>/etc/sudoers.d/</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R58)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Restricting the use cases in which a user is allowed to execute sudo commands
reduces the attack surface.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sudo_add_requiretty" complexity="low" disruption="low" reboot="false" strategy="restrict">
if /usr/sbin/visudo -qcf /etc/sudoers; then
    cp /etc/sudoers /etc/sudoers.bak
    if ! grep -P '^[\s]*Defaults.*\brequiretty\b.*$' /etc/sudoers; then
        # sudoers file doesn't define Option requiretty
        echo "Defaults requiretty" &gt;&gt; /etc/sudoers
    fi
    
    # Check validity of sudoers and cleanup bak
    if /usr/sbin/visudo -qcf /etc/sudoers; then
        rm -f /etc/sudoers.bak
    else
        echo "Fail to validate remediated /etc/sudoers, reverting to original file."
        mv /etc/sudoers.bak /etc/sudoers
        false
    fi
else
    echo "Skipping remediation, /etc/sudoers failed to validate"
    false
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sudo_add_requiretty" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Ensure requiretty is enabled in /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    regexp: ^[\s]*Defaults.*\brequiretty\b.*$
    line: Defaults requiretty
    validate: /usr/sbin/visudo -cf %s
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_add_requiretty
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sudo_add_requiretty:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sudo_add_requiretty_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudo_add_use_pty" severity="medium">
              <xccdf-1.2:title>Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty</xccdf-1.2:title>
              <xccdf-1.2:description>The sudo <html:code>use_pty</html:code> tag, when specified, will only execute sudo
commands from users logged in to a real tty.
This should be enabled by making sure that the <html:code>use_pty</html:code> tag exists in
<html:code>/etc/sudoers</html:code> configuration file or any sudo configuration snippets
in <html:code>/etc/sudoers.d/</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R58)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Requiring that sudo commands be run in a pseudo-terminal can prevent an attacker from retaining
access to the user's terminal after the main program has finished executing.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sudo_add_use_pty" complexity="low" disruption="low" reboot="false" strategy="restrict">
if /usr/sbin/visudo -qcf /etc/sudoers; then
    cp /etc/sudoers /etc/sudoers.bak
    if ! grep -P '^[\s]*Defaults.*\buse_pty\b.*$' /etc/sudoers; then
        # sudoers file doesn't define Option use_pty
        echo "Defaults use_pty" &gt;&gt; /etc/sudoers
    fi
    
    # Check validity of sudoers and cleanup bak
    if /usr/sbin/visudo -qcf /etc/sudoers; then
        rm -f /etc/sudoers.bak
    else
        echo "Fail to validate remediated /etc/sudoers, reverting to original file."
        mv /etc/sudoers.bak /etc/sudoers
        false
    fi
else
    echo "Skipping remediation, /etc/sudoers failed to validate"
    false
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sudo_add_use_pty" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Ensure use_pty is enabled in /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    regexp: ^[\s]*Defaults.*\buse_pty\b.*$
    line: Defaults use_pty
    validate: /usr/sbin/visudo -cf %s
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_add_use_pty
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sudo_add_use_pty:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sudo_add_use_pty_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudo_custom_logfile" severity="low">
              <xccdf-1.2:title>Ensure Sudo Logfile Exists - sudo logfile</xccdf-1.2:title>
              <xccdf-1.2:description>A custom log sudo file can be configured with the 'logfile' tag. This rule configures
a sudo custom logfile at the default location suggested by CIS, which uses
/var/log/sudo.log.</xccdf-1.2:description>
              <xccdf-1.2:rationale>A sudo log file simplifies auditing of sudo commands.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sudo_custom_logfile" complexity="low" disruption="low" reboot="false" strategy="restrict">

var_sudo_logfile='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sudo_logfile" use="legacy"/>'


if /usr/sbin/visudo -qcf /etc/sudoers; then
    cp /etc/sudoers /etc/sudoers.bak
    if ! grep -P '^[\s]*Defaults.*\blogfile=("(?:\\"|\\\\|[^"\\\n])*"\B|[^"](?:(?:\\,|\\"|\\ |\\\\|[^", \\\n])*)\b)\b.*$' /etc/sudoers; then
        # sudoers file doesn't define Option logfile
        echo "Defaults logfile=${var_sudo_logfile}" &gt;&gt; /etc/sudoers
    else
        # sudoers file defines Option logfile, remediate if appropriate value is not set
        if ! grep -P "^[\s]*Defaults.*\blogfile=${var_sudo_logfile}\b.*$" /etc/sudoers; then
            
            sed -Ei "s/(^[\s]*Defaults.*\blogfile=)[-]?\w+(\b.*$)/\1${var_sudo_logfile}\2/" /etc/sudoers
        fi
    fi
    
    # Check validity of sudoers and cleanup bak
    if /usr/sbin/visudo -qcf /etc/sudoers; then
        rm -f /etc/sudoers.bak
    else
        echo "Fail to validate remediated /etc/sudoers, reverting to original file."
        mv /etc/sudoers.bak /etc/sudoers
        false
    fi
else
    echo "Skipping remediation, /etc/sudoers failed to validate"
    false
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sudo_custom_logfile" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: XCCDF Value var_sudo_logfile # promote to variable
  set_fact:
    var_sudo_logfile: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sudo_logfile" use="legacy"/>
  tags:
    - always

- name: Ensure logfile is enabled with the appropriate value in /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    regexp: ^[\s]*Defaults\s(.*)\blogfile=[-]?\w+\b(.*)$
    line: Defaults \1logfile={{ var_sudo_logfile }}\2
    validate: /usr/sbin/visudo -cf %s
    backrefs: true
  register: edit_sudoers_logfile_option
  tags:
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_custom_logfile

- name: Enable logfile option with appropriate value in /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    line: Defaults logfile={{ var_sudo_logfile }}
    validate: /usr/sbin/visudo -cf %s
  when: edit_sudoers_logfile_option is defined and not edit_sudoers_logfile_option.changed
  tags:
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_custom_logfile
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_sudo_logfile:var:1" value-id="xccdf_org.ssgproject.content_value_var_sudo_logfile"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sudo_custom_logfile:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sudo_custom_logfile_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudo_remove_no_authenticate" severity="medium">
              <xccdf-1.2:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</xccdf-1.2:title>
              <xccdf-1.2:description>The sudo <html:code>!authenticate</html:code> option, when specified, allows a user to execute commands using
sudo without having to authenticate. This should be disabled by making sure that the
<html:code>!authenticate</html:code> option does not exist in <html:code>/etc/sudoers</html:code> configuration file or
any sudo configuration snippets in <html:code>/etc/sudoers.d/</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R59)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002038</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00156</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00157</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00158</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000373-VMM-001470</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000373-VMM-001480</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000373-VMM-001490</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Without re-authentication, users may access resources or perform tasks for which they
do not have authorization.
<html:br/><html:br/>
When operating systems provide the capability to escalate a functional capability, it
is critical that the user re-authenticate.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sudo_remove_no_authenticate" complexity="low" disruption="low" reboot="false" strategy="restrict">
for f in /etc/sudoers /etc/sudoers.d/* ; do
  if [ ! -e "$f" ] ; then
    continue
  fi
  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "!authenticate" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"

    /usr/sbin/visudo -cf $f &amp;&gt; /dev/null || echo "Fail to validate $f with visudo"
  fi
done
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sudo_remove_no_authenticate" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Find /etc/sudoers.d/ files
  find:
    paths:
      - /etc/sudoers.d/
  register: sudoers
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-11
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_remove_no_authenticate

- name: Remove lines containing !authenticate from sudoers files
  replace:
    regexp: (^(?!#).*[\s]+\!authenticate.*$)
    replace: '# \g&lt;1&gt;'
    path: '{{ item.path }}'
    validate: /usr/sbin/visudo -cf %s
  with_items:
    - path: /etc/sudoers
    - '{{ sudoers.files }}'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-11
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_remove_no_authenticate
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sudo_remove_no_authenticate:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sudo_remove_no_authenticate_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd" severity="medium">
              <xccdf-1.2:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</xccdf-1.2:title>
              <xccdf-1.2:description>The sudo <html:code>NOPASSWD</html:code> tag, when specified, allows a user to execute
commands using sudo without having to authenticate. This should be disabled
by making sure that the <html:code>NOPASSWD</html:code> tag does not exist in
<html:code>/etc/sudoers</html:code> configuration file or any sudo configuration snippets
in <html:code>/etc/sudoers.d/</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R59)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002038</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00156</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00157</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00158</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000373-VMM-001470</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000373-VMM-001480</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000373-VMM-001490</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Without re-authentication, users may access resources or perform tasks for which they
do not have authorization.
<html:br/><html:br/>
When operating systems provide the capability to escalate a functional capability, it
is critical that the user re-authenticate.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sudo_remove_nopasswd" complexity="low" disruption="low" reboot="false" strategy="restrict">
for f in /etc/sudoers /etc/sudoers.d/* ; do
  if [ ! -e "$f" ] ; then
    continue
  fi
  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "NOPASSWD" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"

    /usr/sbin/visudo -cf $f &amp;&gt; /dev/null || echo "Fail to validate $f with visudo"
  fi
done
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sudo_remove_nopasswd" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Find /etc/sudoers.d/ files
  find:
    paths:
      - /etc/sudoers.d/
  register: sudoers
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-11
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_remove_nopasswd

- name: Remove lines containing NOPASSWD from sudoers files
  replace:
    regexp: (^(?!#).*[\s]+NOPASSWD[\s]*\:.*$)
    replace: '# \g&lt;1&gt;'
    path: '{{ item.path }}'
    validate: /usr/sbin/visudo -cf %s
  with_items:
    - path: /etc/sudoers
    - '{{ sudoers.files }}'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-11
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_remove_nopasswd
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sudo_remove_nopasswd:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sudo_remove_nopasswd_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudo_require_authentication" severity="medium">
              <xccdf-1.2:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo</xccdf-1.2:title>
              <xccdf-1.2:description>The sudo <html:code>NOPASSWD</html:code> and <html:code>!authenticate</html:code> option, when
specified, allows a user to execute commands using sudo without having to
authenticate. This should be disabled by making sure that
<html:code>NOPASSWD</html:code> and/or <html:code>!authenticate</html:code> do not exist in
<html:code>/etc/sudoers</html:code> configuration file or any sudo configuration snippets
in <html:code>/etc/sudoers.d/</html:code>."</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002038</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00156</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Without re-authentication, users may access resources or perform tasks for which they
do not have authorization.
<html:br/><html:br/>
When operating systems provide the capability to escalate a functional capability, it
is critical that the user re-authenticate.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sudo_require_authentication" complexity="low" disruption="low" reboot="false" strategy="restrict">
for f in /etc/sudoers /etc/sudoers.d/* ; do
  if [ ! -e "$f" ] ; then
    continue
  fi
  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "NOPASSWD" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"

    /usr/sbin/visudo -cf $f &amp;&gt; /dev/null || echo "Fail to validate $f with visudo"
  fi
done

for f in /etc/sudoers /etc/sudoers.d/* ; do
  if [ ! -e "$f" ] ; then
    continue
  fi
  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "!authenticate" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"

    /usr/sbin/visudo -cf $f &amp;&gt; /dev/null || echo "Fail to validate $f with visudo"
  fi
done
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sudo_require_authentication" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Find /etc/sudoers.d/ files
  find:
    paths:
      - /etc/sudoers.d/
  register: sudoers
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-11
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_require_authentication

- name: Remove lines containing NOPASSWD from sudoers files
  replace:
    regexp: (^(?!#).*[\s]+NOPASSWD[\s]*\:.*$)
    replace: '# \g&lt;1&gt;'
    path: '{{ item.path }}'
    validate: /usr/sbin/visudo -cf %s
  with_items:
    - path: /etc/sudoers
    - '{{ sudoers.files }}'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-11
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_require_authentication

- name: Find /etc/sudoers.d/ files
  find:
    paths:
      - /etc/sudoers.d/
  register: sudoers
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-11
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_require_authentication

- name: Remove lines containing !authenticate from sudoers files
  replace:
    regexp: (^(?!#).*[\s]+\!authenticate.*$)
    replace: '# \g&lt;1&gt;'
    path: '{{ item.path }}'
    validate: /usr/sbin/visudo -cf %s
  with_items:
    - path: /etc/sudoers
    - '{{ sudoers.files }}'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-11
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_require_authentication
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sudo_require_authentication:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sudo_require_authentication_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudo_vdsm_nopasswd" severity="medium">
              <xccdf-1.2:title>Only the VDSM User Can Use sudo NOPASSWD</xccdf-1.2:title>
              <xccdf-1.2:description>The sudo <html:code>NOPASSWD</html:code> tag, when specified, allows a user to execute commands using sudo without having to authenticate. Only the <html:code>vdsm</html:code> user should have this capability in any sudo configuration snippets in <html:code>/etc/sudoers.d/</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:rationale>Without re-authentication, users may access resources or perform tasks for which they
do not have authorization.
<html:br/><html:br/>
When operating systems provide the capability to escalate a functional capability, it
is critical that the user re-authenticate.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sudo_vdsm_nopasswd:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sudo_vdsm_nopasswd_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudoers_default_includedir" severity="medium">
              <xccdf-1.2:title>Ensure sudo only includes the default configuration directory</xccdf-1.2:title>
              <xccdf-1.2:description>Administrators can configure authorized <html:code>sudo</html:code> users via drop-in files, and it is possible to include
other directories and configuration files from the file currently being parsed.

Make sure that <html:code>/etc/sudoers</html:code> only includes drop-in configuration files from <html:code>/etc/sudoers.d</html:code>.
The <html:code>/etc/sudoers</html:code> should contain only one <html:code>#includedir</html:code> directive pointing to
<html:code>/etc/sudoers.d</html:code>, and no file in <html:code>/etc/sudoers.d/</html:code> should include other files or directories.
Note that the '#' character doesn't denote a comment in the configuration file.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Some <html:code>sudo</html:code> configurtion options allow users to run programs without re-authenticating.
Use of these configuration options makes it easier for one compromised accound to be used to
compromise other accounts.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sudoers_default_includedir">
sudoers_config_file="/etc/sudoers"
sudoers_config_dir="/etc/sudoers.d"
sudoers_includedir_count=$(grep -c "#includedir" "$sudoers_config_file")
if [ "$sudoers_includedir_count" -gt 1 ]; then
    sed -i "/#includedir.*/d" "$sudoers_config_file"
    echo "#includedir /etc/sudoers.d" &gt;&gt; "$sudoers_config_file"
elif [ "$sudoers_includedir_count" -eq 0 ]; then
    echo "#includedir /etc/sudoers.d" &gt;&gt; "$sudoers_config_file"
else
    if ! grep -q "^#includedir /etc/sudoers.d" "$sudoers_config_file"; then
        sed -i "s|^#includedir.*|#includedir /etc/sudoers.d|g" "$sudoers_config_file"
    fi
fi

sed -i "/^#include\s\+.*/d" "$sudoers_config_file"

if grep -Pr "^#include(dir)? .*" "$sudoers_config_dir" ; then
    sed -i "/^#include\(dir\)\?\s\+.*/d" "$sudoers_config_dir"/*
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sudoers_default_includedir" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Check for duplicate values
  lineinfile:
    path: /etc/sudoers
    create: false
    regexp: ^#includedir.*$
    state: absent
  check_mode: true
  changed_when: false
  register: dupes
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - sudoers_default_includedir

- name: Deduplicate values from /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    create: false
    regexp: ^#includedir.*$
    state: absent
  when: dupes.found is defined and dupes.found &gt; 1
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - sudoers_default_includedir

- name: Insert correct line into /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    create: false
    regexp: ^#includedir.*$
    line: '#includedir /etc/sudoers.d'
    state: present
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - sudoers_default_includedir

- name: Ensure sudoers doesn't include other non-default file
  lineinfile:
    path: /etc/sudoers
    create: false
    regexp: ^#include[\s]+.*$
    state: absent
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - sudoers_default_includedir

- name: Find out if /etc/sudoers.d/* files contain file or directory includes
  find:
    path: /etc/sudoers.d
    patterns: '*'
    contains: ^#include(dir)?\s.*$
  register: sudoers_d_includes
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - sudoers_default_includedir

- name: Remove found occurrences of file and directory includes from /etc/sudoers.d/*
    files
  lineinfile:
    path: '{{ item.path }}'
    regexp: ^#include(dir)?\s.*$
    state: absent
  with_items: '{{ sudoers_d_includes.files }}'
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - sudoers_default_includedir
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sudoers_default_includedir:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sudoers_default_includedir_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudoers_explicit_command_args" severity="medium">
              <xccdf-1.2:title>Explicit arguments in sudo specifications</xccdf-1.2:title>
              <xccdf-1.2:description>All commands in the sudoers file must strictly specify the arguments allowed to be used for a given user.
If the command is supposed to be executed only without arguments, pass "" as an argument in the corresponding user specification.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This rule doesn't come with a remediation, as absence of arguments in the user spec doesn't mean that the command is intended to be executed with no arguments.</xccdf-1.2:warning>
              <xccdf-1.2:warning category="general">The rule can produce false findings when an argument contains a comma - sudoers syntax allows comma escaping using backslash, but the check doesn't support that. For example, <html:code>root ALL=(ALL) echo 1\,2</html:code> allows root to execute <html:code>echo 1,2</html:code>, but the check would interpret it as two commands <html:code>echo 1\</html:code> and <html:code>2</html:code>.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R63)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Any argument can modify quite significantly the behavior of a program, whether regarding the
realized operation (read, write, delete, etc.) or accessed resources (path in a file system tree). To
avoid any possibility of misuse of a command by a user, the ambiguities must be removed at the
level of its specification.

For example, on some systems, the kernel messages are only accessible by root.
If a user nevertheless must have the privileges to read them, the argument of the dmesg command has to be restricted
in order to prevent the user from flushing the buffer through the -c option:
<html:pre>
user ALL = dmesg ""
</html:pre></xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#sudo"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sudoers_explicit_command_args:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sudoers_explicit_command_args_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudoers_no_command_negation" severity="medium">
              <xccdf-1.2:title>Don't define allowed commands in sudoers by means of exclusion</xccdf-1.2:title>
              <xccdf-1.2:description>Policies applied by sudo through the sudoers file should not involve negation.

Each user specification in the <html:code>sudoers</html:code> file contains a comma-delimited list of command specifications.
The definition can make use glob patterns, as well as of negations.
Indirect definition of those commands by means of exclusion of a set of commands is trivial to bypass, so it is not allowed to use such constructs.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This rule doesn't come with a remediation, as negations indicate design issues with the sudoers user specifications design. Just removing negations doesn't increase the security - you typically have to rethink the definition of allowed commands to fix the issue.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R61)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Specifying access right using negation is inefficient and can be easily circumvented.
For example, it is expected that a specification like <html:pre>
# To avoid absolutely , this rule can be easily circumvented!
user ALL = ALL ,!/ bin/sh
</html:pre> prevents the execution of the shell
but that’s not the case: just copy the binary <html:code>/bin/sh</html:code> to a different name to make it executable
again through the rule keyword <html:code>ALL</html:code>.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#sudo"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sudoers_no_command_negation:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sudoers_no_command_negation_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudoers_no_root_target" severity="medium">
              <xccdf-1.2:title>Don't target root user in the sudoers file</xccdf-1.2:title>
              <xccdf-1.2:description>The targeted users of a user specification should be, as much as possible, non privileged users (i.e.: non-root).

User specifications have to explicitly list the runas spec (i.e. the list of target users that can be impersonated), and <html:code>ALL</html:code> or <html:code>root</html:code> should not be used.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This rule doesn't come with a remediation, as the exact requirement allows exceptions, and removing lines from the sudoers file can make the system non-administrable.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R60)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>It is common that the command to be executed does not require superuser rights (editing a file
whose the owner is not root, sending a signal to an unprivileged process,etc.). In order to limit
any attempt of privilege escalation through a command, it is better to apply normal user rights.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#sudo"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sudoers_no_root_target:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sudoers_no_root_target_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudoers_validate_passwd" severity="medium">
              <xccdf-1.2:title>Ensure invoking users password for privilege escalation when using sudo</xccdf-1.2:title>
              <xccdf-1.2:description>The sudoers security policy requires that users authenticate themselves before they can use sudo.
When sudoers requires authentication, it validates the invoking user's credentials.
The expected output for:
<html:pre>sudo egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#'</html:pre>
<html:pre> /etc/sudoers:Defaults !targetpw
      /etc/sudoers:Defaults !rootpw
      /etc/sudoers:Defaults !runaspw </html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6.1(iv)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If the rootpw, targetpw, or runaspw flags are defined and not disabled, by default the operating system will prompt
the invoking user for the "root" user password.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sudoers_validate_passwd">if grep -x '^Defaults !targetpw$' /etc/sudoers.d/*; then
    find /etc/sudoers.d/ -type f -exec sed -i "/Defaults !targetpw/d" {} \;
fi
if grep -x '^Defaults !rootpw$' /etc/sudoers.d/*; then
    find /etc/sudoers.d/ -type f -exec sed -i "/Defaults !rootpw/d" {} \;
fi
if grep -x '^Defaults !runaspw$' /etc/sudoers.d/*; then
    find /etc/sudoers.d/ -type f -exec sed -i "/Defaults !runaspw/d" {} \;
fi

if [ -e "/etc/sudoers" ] ; then
    
    LC_ALL=C sed -i "/Defaults !targetpw/d" "/etc/sudoers"
else
    touch "/etc/sudoers"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/sudoers"

cp "/etc/sudoers" "/etc/sudoers.bak"
# Insert at the end of the file
printf '%s\n' "Defaults !targetpw" &gt;&gt; "/etc/sudoers"
# Clean up after ourselves.
rm "/etc/sudoers.bak"
if [ -e "/etc/sudoers" ] ; then
    
    LC_ALL=C sed -i "/Defaults !rootpw/d" "/etc/sudoers"
else
    touch "/etc/sudoers"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/sudoers"

cp "/etc/sudoers" "/etc/sudoers.bak"
# Insert at the end of the file
printf '%s\n' "Defaults !rootpw" &gt;&gt; "/etc/sudoers"
# Clean up after ourselves.
rm "/etc/sudoers.bak"
if [ -e "/etc/sudoers" ] ; then
    
    LC_ALL=C sed -i "/Defaults !runaspw/d" "/etc/sudoers"
else
    touch "/etc/sudoers"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/sudoers"

cp "/etc/sudoers" "/etc/sudoers.bak"
# Insert at the end of the file
printf '%s\n' "Defaults !runaspw" &gt;&gt; "/etc/sudoers"
# Clean up after ourselves.
rm "/etc/sudoers.bak"
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sudoers_validate_passwd" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Find out if /etc/sudoers.d/* files contain Defaults !targetpw to be deduplicated
  find:
    path: /etc/sudoers.d
    patterns: '*'
    contains: ^Defaults !targetpw$
  register: sudoers_d_defaults
  tags:
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

- name: Remove found occurrences of Defaults !targetpw from /etc/sudoers.d/* files
  lineinfile:
    path: '{{ item.path }}'
    regexp: ^Defaults !targetpw$
    state: absent
  with_items: '{{ sudoers_d_defaults.files }}'
  tags:
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

- name: Find out if /etc/sudoers.d/* files contain Defaults !rootpw to be deduplicated
  find:
    path: /etc/sudoers.d
    patterns: '*'
    contains: ^Defaults !rootpw$
  register: sudoers_d_defaults
  tags:
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

- name: Remove found occurrences of Defaults !rootpw from /etc/sudoers.d/* files
  lineinfile:
    path: '{{ item.path }}'
    regexp: ^Defaults !rootpw$
    state: absent
  with_items: '{{ sudoers_d_defaults.files }}'
  tags:
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

- name: Find out if /etc/sudoers.d/* files contain Defaults !runaspw to be deduplicated
  find:
    path: /etc/sudoers.d
    patterns: '*'
    contains: ^Defaults !runaspw$
  register: sudoers_d_defaults
  tags:
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

- name: Remove found occurrences of Defaults !runaspw from /etc/sudoers.d/* files
  lineinfile:
    path: '{{ item.path }}'
    regexp: ^Defaults !runaspw$
    state: absent
  with_items: '{{ sudoers_d_defaults.files }}'
  tags:
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

- name: Check for duplicate values
  lineinfile:
    path: /etc/sudoers
    create: false
    regexp: ^Defaults !targetpw$
    state: absent
  check_mode: true
  changed_when: false
  register: dupes
  tags:
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

- name: Deduplicate values from /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    create: false
    regexp: ^Defaults !targetpw$
    state: absent
  when: dupes.found is defined and dupes.found &gt; 1
  tags:
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

- name: Insert correct line into /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    create: false
    regexp: ^Defaults !targetpw$
    line: Defaults !targetpw
    state: present
  tags:
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

- name: Check for duplicate values
  lineinfile:
    path: /etc/sudoers
    create: false
    regexp: ^Defaults !rootpw$
    state: absent
  check_mode: true
  changed_when: false
  register: dupes
  tags:
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

- name: Deduplicate values from /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    create: false
    regexp: ^Defaults !rootpw$
    state: absent
  when: dupes.found is defined and dupes.found &gt; 1
  tags:
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

- name: Insert correct line into /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    create: false
    regexp: ^Defaults !rootpw$
    line: Defaults !rootpw
    state: present
  tags:
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

- name: Check for duplicate values
  lineinfile:
    path: /etc/sudoers
    create: false
    regexp: ^Defaults !runaspw$
    state: absent
  check_mode: true
  changed_when: false
  register: dupes
  tags:
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

- name: Deduplicate values from /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    create: false
    regexp: ^Defaults !runaspw$
    state: absent
  when: dupes.found is defined and dupes.found &gt; 1
  tags:
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

- name: Insert correct line into /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    create: false
    regexp: ^Defaults !runaspw$
    line: Defaults !runaspw
    state: present
  tags:
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sudoers_validate_passwd:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sudoers_validate_passwd_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_system-tools">
            <xccdf-1.2:title>System Tooling / Utilities</xccdf-1.2:title>
            <xccdf-1.2:description>The following checks evaluate the system for recommended base packages -- both for installation
and removal.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_binutils_installed" severity="medium">
              <xccdf-1.2:title>Install binutils Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>binutils</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install binutils</html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale><html:code>binutils</html:code> is a collection of binary utilities required for
foundational system operator activities, such as <html:code>ld</html:code>,
<html:code>nm</html:code>, <html:code>objcopy</html:code> and <html:code>readelf</html:code>.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_binutils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
if ! rpm -q --quiet "binutils" ; then
    dnf install -y "binutils"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_binutils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure binutils is installed
  package:
    name: binutils
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_binutils_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_binutils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_binutils

class install_binutils {
  package { 'binutils':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_binutils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=binutils
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_binutils_installed">
[[packages]]
name = "binutils"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_binutils_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_binutils_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_cryptsetup-luks_installed" severity="medium">
              <xccdf-1.2:title>Install cryptsetup-luks Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>cryptsetup-luks</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install cryptsetup-luks</html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale>LUKS is the upcoming standard for Linux hard disk encryption. By providing a standard
on-disk format, it does not only facilitate compatibility among distributions, but also
provide secure management of multiple user passwords. In contrast to existing solution,
LUKS stores all necessary setup information in the partition header, enabling the user
to transport or migrate their data seamlessly. LUKS for dm-crypt is implemented in
<html:code>cryptsetup</html:code>. <html:code>cryptsetup-luks</html:code> is intended as a complete replacement for the
original <html:code>cryptsetup</html:code>. It provides all the functionality of the original
version plus all LUKS features, that are accessible by luks* action.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_cryptsetup-luks_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
if ! rpm -q --quiet "cryptsetup-luks" ; then
    dnf install -y "cryptsetup-luks"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_cryptsetup-luks_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure cryptsetup-luks is installed
  package:
    name: cryptsetup-luks
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_cryptsetup-luks_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_cryptsetup-luks_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_cryptsetup-luks

class install_cryptsetup-luks {
  package { 'cryptsetup-luks':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_cryptsetup-luks_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=cryptsetup-luks
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_cryptsetup-luks_installed">
[[packages]]
name = "cryptsetup-luks"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_cryptsetup-luks_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_cryptsetup-luks_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_gnutls-utils_installed" severity="medium">
              <xccdf-1.2:title>Ensure gnutls-utils is installed</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>gnutls-utils</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install gnutls-utils</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_X509_EXT</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>GnuTLS is a secure communications library implementing the SSL, TLS and DTLS
protocols and technologies around them. It provides a simple C language
application programming interface (API) to access the secure communications
protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and
other required structures.
This package contains command line TLS client and server and certificate
manipulation tools.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_gnutls-utils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
if ! rpm -q --quiet "gnutls-utils" ; then
    dnf install -y "gnutls-utils"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_gnutls-utils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure gnutls-utils is installed
  package:
    name: gnutls-utils
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_gnutls-utils_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_gnutls-utils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_gnutls-utils

class install_gnutls-utils {
  package { 'gnutls-utils':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_gnutls-utils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=gnutls-utils
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_gnutls-utils_installed">
[[packages]]
name = "gnutls-utils"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_gnutls-utils_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_gnutls-utils_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_libcap-ng-utils_installed" severity="medium">
              <xccdf-1.2:title>Install libcap-ng-utils Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>libcap-ng-utils</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install libcap-ng-utils</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000445-GPOS-00199</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>libcap-ng-utils</html:code> contains applications to analyze the posix
posix capabilities of all the programs running on a system.
<html:code>libcap-ng-utils</html:code> also lets system operators set the file
system based capabilities.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_libcap-ng-utils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
if ! rpm -q --quiet "libcap-ng-utils" ; then
    dnf install -y "libcap-ng-utils"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_libcap-ng-utils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure libcap-ng-utils is installed
  package:
    name: libcap-ng-utils
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_libcap-ng-utils_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_libcap-ng-utils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_libcap-ng-utils

class install_libcap-ng-utils {
  package { 'libcap-ng-utils':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_libcap-ng-utils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=libcap-ng-utils
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_libcap-ng-utils_installed">
[[packages]]
name = "libcap-ng-utils"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_libcap-ng-utils_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_libcap-ng-utils_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_nss-tools_installed" severity="medium">
              <xccdf-1.2:title>Ensure nss-tools is installed</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nss-tools</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install nss-tools</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Network Security Services (NSS) is a set of libraries designed to
support cross-platform development of security-enabled client and
server applications. Install the <html:code>nss-tools</html:code> package
to install command-line tools to manipulate the NSS certificate
and key database.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_nss-tools_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
if ! rpm -q --quiet "nss-tools" ; then
    dnf install -y "nss-tools"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_nss-tools_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure nss-tools is installed
  package:
    name: nss-tools
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_nss-tools_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_nss-tools_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_nss-tools

class install_nss-tools {
  package { 'nss-tools':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_nss-tools_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=nss-tools
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_nss-tools_installed">
[[packages]]
name = "nss-tools"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_nss-tools_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_nss-tools_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_openscap-scanner_installed" severity="medium">
              <xccdf-1.2:title>Install openscap-scanner Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>openscap-scanner</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install openscap-scanner</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000191-GPOS-00080</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>openscap-scanner</html:code> contains the <html:code>oscap</html:code> command line tool. This tool is a
configuration and vulnerability scanner, capable of performing compliance checking using
SCAP content.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_openscap-scanner_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
if ! rpm -q --quiet "openscap-scanner" ; then
    dnf install -y "openscap-scanner"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_openscap-scanner_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure openscap-scanner is installed
  package:
    name: openscap-scanner
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_openscap-scanner_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_openscap-scanner_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_openscap-scanner

class install_openscap-scanner {
  package { 'openscap-scanner':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_openscap-scanner_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=openscap-scanner
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_openscap-scanner_installed">
[[packages]]
name = "openscap-scanner"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_openscap-scanner_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_openscap-scanner_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_rear_installed" severity="medium">
              <xccdf-1.2:title>Install rear Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>rear</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install rear</html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale><html:code>rear</html:code> contains the Relax-and-Recover (ReaR) utility. ReaR produces a bootable
image of a system and restores from backup using this image.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_rear_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
if ! rpm -q --quiet "rear" ; then
    dnf install -y "rear"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_rear_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure rear is installed
  package:
    name: rear
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_rear_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_rear_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_rear

class install_rear {
  package { 'rear':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_rear_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=rear
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_rear_installed">
[[packages]]
name = "rear"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_rear_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_rear_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_rng-tools_installed" severity="low">
              <xccdf-1.2:title>Install rng-tools Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>rng-tools</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install rng-tools</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>rng-tools</html:code> provides hardware random number generator tools,
such as those used in the formation of x509/PKI certificates.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_rng-tools_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
if ! rpm -q --quiet "rng-tools" ; then
    dnf install -y "rng-tools"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_rng-tools_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure rng-tools is installed
  package:
    name: rng-tools
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_rng-tools_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_rng-tools_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_rng-tools

class install_rng-tools {
  package { 'rng-tools':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_rng-tools_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=rng-tools
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_rng-tools_installed">
[[packages]]
name = "rng-tools"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_rng-tools_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_rng-tools_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_scap-security-guide_installed" severity="medium">
              <xccdf-1.2:title>Install scap-security-guide Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>scap-security-guide</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install scap-security-guide</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>scap-security-guide</html:code> package provides a guide for configuration of the system
from the final system's security point of view. The guidance is specified in the Security
Content Automation Protocol (SCAP) format and constitutes a catalog of practical hardening
advice, linked to government requirements where applicable. The SCAP Security Guide project
bridges the gap between generalized policy requirements and specific implementation guidelines.
A system administrator can use the <html:code>oscap</html:code> CLI tool from the <html:code>openscap-scanner</html:code>
package, or the SCAP Workbench GUI tool from the <html:code>scap-workbench</html:code> package, to verify
that the system conforms to provided guidelines. Refer to the scap-security-guide(8) manual
page for futher information.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_scap-security-guide_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
if ! rpm -q --quiet "scap-security-guide" ; then
    dnf install -y "scap-security-guide"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_scap-security-guide_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure scap-security-guide is installed
  package:
    name: scap-security-guide
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_scap-security-guide_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_scap-security-guide_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_scap-security-guide

class install_scap-security-guide {
  package { 'scap-security-guide':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_scap-security-guide_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=scap-security-guide
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_scap-security-guide_installed">
[[packages]]
name = "scap-security-guide"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_scap-security-guide_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_scap-security-guide_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_tar_installed" severity="medium">
              <xccdf-1.2:title>Install tar Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>tar</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install tar</html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale>The GNU <html:code>tar</html:code> program saves many files together into one archive and
can restore individual files (or all of the files) from the archive. <html:code>tar</html:code>
includes multivolume support, automatic archive compression/decompression, the
the ability to perform incremental and full backups. If </xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_tar_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
if ! rpm -q --quiet "tar" ; then
    dnf install -y "tar"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_tar_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure tar is installed
  package:
    name: tar
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_tar_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_tar_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_tar

class install_tar {
  package { 'tar':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_tar_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=tar
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_tar_installed">
[[packages]]
name = "tar"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_tar_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_tar_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_vim_installed" severity="low">
              <xccdf-1.2:title>Install vim Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>vim-enhanced</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install vim-enhanced</html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale>Vim (Vi IMproved) is an almost compatible version of the UNIX editor <html:code>vi</html:code>. </xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_vim_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
if ! rpm -q --quiet "vim-enhanced" ; then
    dnf install -y "vim-enhanced"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_vim_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure vim-enhanced is installed
  package:
    name: vim-enhanced
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_vim_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_vim_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_vim-enhanced

class install_vim-enhanced {
  package { 'vim-enhanced':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_vim_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=vim-enhanced
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_vim_installed">
[[packages]]
name = "vim-enhanced"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_vim_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_vim_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_abrt-addon-ccpp_removed" severity="low">
              <xccdf-1.2:title>Uninstall abrt-addon-ccpp Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>abrt-addon-ccpp</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase abrt-addon-ccpp</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>abrt-addon-ccpp</html:code> contains hooks for C/C++ crashed programs and <html:code>abrt</html:code>'s
C/C++ analyzer plugin.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_abrt-addon-ccpp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove abrt-addon-ccpp
#	   from the system, and may remove any packages
#	   that depend on abrt-addon-ccpp. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "abrt-addon-ccpp" ; then

    dnf remove -y "abrt-addon-ccpp"

fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_abrt-addon-ccpp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure abrt-addon-ccpp is removed
  package:
    name: abrt-addon-ccpp
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_abrt-addon-ccpp_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_abrt-addon-ccpp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_abrt-addon-ccpp

class remove_abrt-addon-ccpp {
  package { 'abrt-addon-ccpp':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_abrt-addon-ccpp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=abrt-addon-ccpp
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_abrt-addon-ccpp_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_abrt-addon-ccpp_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_abrt-addon-kerneloops_removed" severity="low">
              <xccdf-1.2:title>Uninstall abrt-addon-kerneloops Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>abrt-addon-kerneloops</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase abrt-addon-kerneloops</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>abrt-addon-kerneloops</html:code> contains plugins for collecting kernel crash information and
reporter plugin which sends this information to a specified server, usually to kerneloops.org.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_abrt-addon-kerneloops_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove abrt-addon-kerneloops
#	   from the system, and may remove any packages
#	   that depend on abrt-addon-kerneloops. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "abrt-addon-kerneloops" ; then

    dnf remove -y "abrt-addon-kerneloops"

fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_abrt-addon-kerneloops_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure abrt-addon-kerneloops is removed
  package:
    name: abrt-addon-kerneloops
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_abrt-addon-kerneloops_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_abrt-addon-kerneloops_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_abrt-addon-kerneloops

class remove_abrt-addon-kerneloops {
  package { 'abrt-addon-kerneloops':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_abrt-addon-kerneloops_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=abrt-addon-kerneloops
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_abrt-addon-kerneloops_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_abrt-addon-kerneloops_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_abrt-cli_removed" severity="low">
              <xccdf-1.2:title>Uninstall abrt-cli Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>abrt-cli</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase abrt-cli</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>abrt-cli</html:code> contains a command line client for controlling abrt daemon
over sockets.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_abrt-cli_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove abrt-cli
#	   from the system, and may remove any packages
#	   that depend on abrt-cli. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "abrt-cli" ; then

    dnf remove -y "abrt-cli"

fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_abrt-cli_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure abrt-cli is removed
  package:
    name: abrt-cli
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_abrt-cli_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_abrt-cli_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_abrt-cli

class remove_abrt-cli {
  package { 'abrt-cli':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_abrt-cli_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=abrt-cli
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_abrt-cli_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_abrt-cli_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_abrt-plugin-logger_removed" severity="low">
              <xccdf-1.2:title>Uninstall abrt-plugin-logger Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>abrt-plugin-logger</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase abrt-plugin-logger</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>abrt-plugin-logger</html:code> is an ABRT plugin which writes a report
to a specified file.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_abrt-plugin-logger_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove abrt-plugin-logger
#	   from the system, and may remove any packages
#	   that depend on abrt-plugin-logger. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "abrt-plugin-logger" ; then

    dnf remove -y "abrt-plugin-logger"

fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_abrt-plugin-logger_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure abrt-plugin-logger is removed
  package:
    name: abrt-plugin-logger
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_abrt-plugin-logger_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_abrt-plugin-logger_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_abrt-plugin-logger

class remove_abrt-plugin-logger {
  package { 'abrt-plugin-logger':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_abrt-plugin-logger_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=abrt-plugin-logger
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_abrt-plugin-logger_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_abrt-plugin-logger_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_abrt-plugin-rhtsupport_removed" severity="low">
              <xccdf-1.2:title>Uninstall abrt-plugin-rhtsupport Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>abrt-plugin-rhtsupport</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase abrt-plugin-rhtsupport</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>abrt-plugin-rhtsupport</html:code> is a ABRT plugin to report bugs into the
Red Hat Support system.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_abrt-plugin-rhtsupport_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove abrt-plugin-rhtsupport
#	   from the system, and may remove any packages
#	   that depend on abrt-plugin-rhtsupport. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "abrt-plugin-rhtsupport" ; then

    dnf remove -y "abrt-plugin-rhtsupport"

fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_abrt-plugin-rhtsupport_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure abrt-plugin-rhtsupport is removed
  package:
    name: abrt-plugin-rhtsupport
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_abrt-plugin-rhtsupport_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_abrt-plugin-rhtsupport_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_abrt-plugin-rhtsupport

class remove_abrt-plugin-rhtsupport {
  package { 'abrt-plugin-rhtsupport':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_abrt-plugin-rhtsupport_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=abrt-plugin-rhtsupport
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_abrt-plugin-rhtsupport_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_abrt-plugin-rhtsupport_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_abrt-plugin-sosreport_removed" severity="low">
              <xccdf-1.2:title>Uninstall abrt-plugin-sosreport Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>abrt-plugin-sosreport</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase abrt-plugin-sosreport</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>abrt-plugin-sosreport</html:code> provides a plugin to include an sosreport in an ABRT report.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_abrt-plugin-sosreport_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove abrt-plugin-sosreport
#	   from the system, and may remove any packages
#	   that depend on abrt-plugin-sosreport. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "abrt-plugin-sosreport" ; then

    dnf remove -y "abrt-plugin-sosreport"

fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_abrt-plugin-sosreport_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure abrt-plugin-sosreport is removed
  package:
    name: abrt-plugin-sosreport
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_abrt-plugin-sosreport_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_abrt-plugin-sosreport_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_abrt-plugin-sosreport

class remove_abrt-plugin-sosreport {
  package { 'abrt-plugin-sosreport':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_abrt-plugin-sosreport_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=abrt-plugin-sosreport
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_abrt-plugin-sosreport_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_abrt-plugin-sosreport_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_geolite2-city_removed" severity="low">
              <xccdf-1.2:title>Uninstall geolite2-city Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>geolite2-city</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase geolite2-city</html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale><html:code>geolite2-city</html:code> is part of the GeoLite2 database packages, offering geolocation databases and tooling.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_geolite2-city_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove geolite2-city
#	   from the system, and may remove any packages
#	   that depend on geolite2-city. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "geolite2-city" ; then

    dnf remove -y "geolite2-city"

fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_geolite2-city_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure geolite2-city is removed
  package:
    name: geolite2-city
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_geolite2-city_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_geolite2-city_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_geolite2-city

class remove_geolite2-city {
  package { 'geolite2-city':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_geolite2-city_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=geolite2-city
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_geolite2-city_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_geolite2-city_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_geolite2-country_removed" severity="low">
              <xccdf-1.2:title>Uninstall geolite2-country Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>geolite2-country</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase geolite2-country</html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale><html:code>geolite2-country</html:code> is part of the GeoLite2 database packages, offering geolocation databases and tooling.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_geolite2-country_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove geolite2-country
#	   from the system, and may remove any packages
#	   that depend on geolite2-country. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "geolite2-country" ; then

    dnf remove -y "geolite2-country"

fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_geolite2-country_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure geolite2-country is removed
  package:
    name: geolite2-country
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_geolite2-country_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_geolite2-country_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_geolite2-country

class remove_geolite2-country {
  package { 'geolite2-country':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_geolite2-country_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=geolite2-country
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_geolite2-country_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_geolite2-country_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_gssproxy_removed" severity="medium">
              <xccdf-1.2:title>Uninstall gssproxy Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>gssproxy</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase gssproxy</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>gssproxy</html:code> is a proxy for GSS API credential handling.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_gssproxy_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove gssproxy
#	   from the system, and may remove any packages
#	   that depend on gssproxy. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "gssproxy" ; then

    dnf remove -y "gssproxy"

fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_gssproxy_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure gssproxy is removed
  package:
    name: gssproxy
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_gssproxy_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_gssproxy_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_gssproxy

class remove_gssproxy {
  package { 'gssproxy':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_gssproxy_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_gssproxy_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_iprutils_removed" severity="medium">
              <xccdf-1.2:title>Uninstall iprutils Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>iprutils</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase iprutils</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>iprutils</html:code> provides a suite of utlilities to manage and configure SCSI devices
supported by the ipr SCSI storage device driver.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_iprutils_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove iprutils
#	   from the system, and may remove any packages
#	   that depend on iprutils. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "iprutils" ; then

    dnf remove -y "iprutils"

fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_iprutils_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure iprutils is removed
  package:
    name: iprutils
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_iprutils_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_iprutils_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_iprutils

class remove_iprutils {
  package { 'iprutils':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_iprutils_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=iprutils
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_iprutils_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_iprutils_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_krb5-workstation_removed" severity="medium">
              <xccdf-1.2:title>Uninstall krb5-workstation Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>krb5-workstation</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase krb5-workstation</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000803</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Kerberos is a network authentication system. The <html:code>krb5-workstation</html:code> package contains the basic
Kerberos programs (<html:code>kinit</html:code>, <html:code>klist</html:code>, <html:code>kdestroy</html:code>, <html:code>kpasswd</html:code>).

Currently, Kerberos does not utilize FIPS 140-2 cryptography and is not permitted on Government networks,
nor is it permitted in many regulatory environments such as HIPAA.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_krb5-workstation_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove krb5-workstation
#	   from the system, and may remove any packages
#	   that depend on krb5-workstation. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "krb5-workstation" ; then

    dnf remove -y "krb5-workstation"

fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_krb5-workstation_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure krb5-workstation is removed
  package:
    name: krb5-workstation
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_krb5-workstation_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_krb5-workstation_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_krb5-workstation

class remove_krb5-workstation {
  package { 'krb5-workstation':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_krb5-workstation_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=krb5-workstation
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_krb5-workstation_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_krb5-workstation_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_libreport-plugin-logger_removed" severity="low">
              <xccdf-1.2:title>Uninstall libreport-plugin-logger Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>libreport-plugin-logger</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase libreport-plugin-logger</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>libreport-plugin-logger</html:code> is a ABRT plugin to report bugs into the
Red Hat Support system.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_libreport-plugin-logger_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove libreport-plugin-logger
#	   from the system, and may remove any packages
#	   that depend on libreport-plugin-logger. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "libreport-plugin-logger" ; then

    dnf remove -y "libreport-plugin-logger"

fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_libreport-plugin-logger_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure libreport-plugin-logger is removed
  package:
    name: libreport-plugin-logger
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_libreport-plugin-logger_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_libreport-plugin-logger_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_libreport-plugin-logger

class remove_libreport-plugin-logger {
  package { 'libreport-plugin-logger':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_libreport-plugin-logger_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=libreport-plugin-logger
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_libreport-plugin-logger_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_libreport-plugin-logger_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_libreport-plugin-rhtsupport_removed" severity="low">
              <xccdf-1.2:title>Uninstall libreport-plugin-rhtsupport Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>libreport-plugin-rhtsupport</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase libreport-plugin-rhtsupport</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>libreport-plugin-rhtsupport</html:code> is a ABRT plugin to report bugs into the
Red Hat Support system.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_libreport-plugin-rhtsupport_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove libreport-plugin-rhtsupport
#	   from the system, and may remove any packages
#	   that depend on libreport-plugin-rhtsupport. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "libreport-plugin-rhtsupport" ; then

    dnf remove -y "libreport-plugin-rhtsupport"

fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_libreport-plugin-rhtsupport_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure libreport-plugin-rhtsupport is removed
  package:
    name: libreport-plugin-rhtsupport
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_libreport-plugin-rhtsupport_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_libreport-plugin-rhtsupport_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_libreport-plugin-rhtsupport

class remove_libreport-plugin-rhtsupport {
  package { 'libreport-plugin-rhtsupport':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_libreport-plugin-rhtsupport_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=libreport-plugin-rhtsupport
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_libreport-plugin-rhtsupport_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_libreport-plugin-rhtsupport_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_python3-abrt-addon_removed" severity="low">
              <xccdf-1.2:title>Uninstall python3-abrt-addon Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>python3-abrt-addon</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase python3-abrt-addon</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>python3-abrt-addon</html:code> contains python hook and python analyzer
plugin for handling uncaught exceptions in python programs.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_python3-abrt-addon_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove python3-abrt-addon
#	   from the system, and may remove any packages
#	   that depend on python3-abrt-addon. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "python3-abrt-addon" ; then

    dnf remove -y "python3-abrt-addon"

fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_python3-abrt-addon_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure python3-abrt-addon is removed
  package:
    name: python3-abrt-addon
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_python3-abrt-addon_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_python3-abrt-addon_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_python3-abrt-addon

class remove_python3-abrt-addon {
  package { 'python3-abrt-addon':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_python3-abrt-addon_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=python3-abrt-addon
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_python3-abrt-addon_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_python3-abrt-addon_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_tuned_removed" severity="medium">
              <xccdf-1.2:title>Uninstall tuned Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>tuned</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase tuned</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>tuned</html:code> contains a daemon that tunes the system settings dynamically.
It does so by monitoring the usage of several system components periodically. Based
on that information, components will then be put into lower or higher power savings
modes to adapt to the current usage.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_tuned_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove tuned
#	   from the system, and may remove any packages
#	   that depend on tuned. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "tuned" ; then

    dnf remove -y "tuned"

fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_tuned_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure tuned is removed
  package:
    name: tuned
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_tuned_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_tuned_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_tuned

class remove_tuned {
  package { 'tuned':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_tuned_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=tuned
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_tuned_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_tuned_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_updating">
            <xccdf-1.2:title>Updating Software</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>dnf</html:code> command line tool is used to install and
update software packages. The system also provides a graphical
software update tool in the <html:b>System</html:b> menu, in the <html:b>Administration</html:b> submenu,
called <html:b>Software Update</html:b>.
<html:br/><html:br/>
Fedora systems contain an installed software catalog called
the RPM database, which records metadata of installed packages. Consistently using
<html:code>dnf</html:code> or the graphical <html:b>Software Update</html:b> for all software installation
allows for insight into the current inventory of installed software on the system.
<html:br/><html:br/></xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed" severity="medium">
              <xccdf-1.2:title>Install dnf-automatic Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>dnf-automatic</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install dnf-automatic</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R8)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000191-GPOS-00080</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>dnf-automatic</html:code> is an alternative command line interface (CLI)
to <html:code>dnf upgrade</html:code> suitable for automatic, regular execution.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_dnf-automatic_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
if ! rpm -q --quiet "dnf-automatic" ; then
    dnf install -y "dnf-automatic"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_dnf-automatic_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure dnf-automatic is installed
  package:
    name: dnf-automatic
    state: present
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_dnf-automatic_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_dnf-automatic_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_dnf-automatic

class install_dnf-automatic {
  package { 'dnf-automatic':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_dnf-automatic_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=dnf-automatic
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_dnf-automatic_installed">
[[packages]]
name = "dnf-automatic"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_dnf-automatic_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_dnf-automatic_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_clean_components_post_updating" severity="low">
              <xccdf-1.2:title>Ensure dnf Removes Previous Package Versions</xccdf-1.2:title>
              <xccdf-1.2:description><html:code>dnf</html:code> should be configured to remove previous software components after
new versions have been installed. To configure <html:code>dnf</html:code> to remove the

previous software components after updating, set the <html:code>clean_requirements_on_remove</html:code>


to <html:code>1</html:code> in <html:code>/etc/dnf/dnf.conf</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">20</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002617</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(6)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.RA-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000437-GPOS-00194</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000437-VMM-001760</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Previous versions of software components that are not removed from the information
system after updates have been installed may be exploited by some adversaries.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#yum"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="clean_components_post_updating"># Remediation is applicable only in certain platforms
if rpm --quiet -q yum; then

if grep --silent ^clean_requirements_on_remove /etc/dnf/dnf.conf ; then
        sed -i "s/^clean_requirements_on_remove.*/clean_requirements_on_remove=1/g" /etc/dnf/dnf.conf
else
        echo -e "\n# Set clean_requirements_on_remove to 1 per security requirements" &gt;&gt; /etc/dnf/dnf.conf
        echo "clean_requirements_on_remove=1" &gt;&gt; /etc/dnf/dnf.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="clean_components_post_updating" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-2(6)
    - clean_components_post_updating
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy

- name: Ensure DNF Removes Previous Package Versions
  lineinfile:
    dest: /etc/dnf/dnf.conf
    regexp: ^#?clean_requirements_on_remove
    line: clean_requirements_on_remove=1
    insertafter: \[main\]
    create: true
  when: '"yum" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-2(6)
    - clean_components_post_updating
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-clean_components_post_updating:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-clean_components_post_updating_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dnf-automatic_apply_updates" severity="medium">
              <xccdf-1.2:title>Configure dnf-automatic to Install Available Updates Automatically</xccdf-1.2:title>
              <xccdf-1.2:description>To ensure that the packages comprising the available updates will be automatically installed by <html:code>dnf-automatic</html:code>, set <html:code>apply_updates</html:code> to <html:code>yes</html:code> under <html:code>[commands]</html:code> section in <html:code>/etc/dnf/automatic.conf</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R8)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0940</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1144</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1467</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1472</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1483</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1493</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1494</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1495</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000191-GPOS-00080</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Installing software updates is a fundamental mitigation against
the exploitation of publicly-known vulnerabilities. If the most
recent security patches and updates are not installed, unauthorized
users may take advantage of weaknesses in the unpatched software. The
lack of prompt attention to patching could result in a system compromise.
The automated installation of updates ensures that recent security patches
are applied in a timely manner.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dnf-automatic_apply_updates">
found=false

# set value in all files if they contain section or key
for f in $(echo -n "/etc/dnf/automatic.conf"); do
    if [ ! -e "$f" ]; then
        continue
    fi

    # find key in section and change value
    if grep -qzosP "[[:space:]]*\[commands\]([^\n\[]*\n+)+?[[:space:]]*apply_updates" "$f"; then
            sed -i "s/apply_updates[^(\n)]*/apply_updates = yes/" "$f"
            found=true

    # find section and add key = value to it
    elif grep -qs "[[:space:]]*\[commands\]" "$f"; then
            sed -i "/[[:space:]]*commands/a apply_updates = yes" "$f"
            found=true
    fi
done

# if section not in any file, append section with key = value to FIRST file in files parameter
if ! $found ; then
    file=$(echo "/etc/dnf/automatic.conf" | cut -f1 -d' ')
    mkdir -p "$(dirname "$file")"
    echo -e "[commands]\napply_updates = yes" &gt;&gt; "$file"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dnf-automatic_apply_updates" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Configure dnf-automatic to Install Available Updates Automatically
  ini_file:
    dest: /etc/dnf/automatic.conf
    section: commands
    option: apply_updates
    value: 'yes'
    create: true
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-2(5)
    - NIST-800-53-SI-2(c)
    - dnf-automatic_apply_updates
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dnf-automatic_apply_updates:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dnf-automatic_apply_updates_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dnf-automatic_security_updates_only" severity="low">
              <xccdf-1.2:title>Configure dnf-automatic to Install Only Security Updates</xccdf-1.2:title>
              <xccdf-1.2:description>To configure <html:code>dnf-automatic</html:code> to install only security updates
automatically, set <html:code>upgrade_type</html:code> to <html:code>security</html:code> under
<html:code>[commands]</html:code> section in <html:code>/etc/dnf/automatic.conf</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R8)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000191-GPOS-00080</xccdf-1.2:reference>
              <xccdf-1.2:rationale>By default, <html:code>dnf-automatic</html:code> installs all available updates.
Reducing the amount of updated packages only to updates that were
issued as a part of a security advisory increases the system stability.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dnf-automatic_security_updates_only">
found=false

# set value in all files if they contain section or key
for f in $(echo -n "/etc/dnf/automatic.conf"); do
    if [ ! -e "$f" ]; then
        continue
    fi

    # find key in section and change value
    if grep -qzosP "[[:space:]]*\[commands\]([^\n\[]*\n+)+?[[:space:]]*upgrade_type" "$f"; then
            sed -i "s/upgrade_type[^(\n)]*/upgrade_type = security/" "$f"
            found=true

    # find section and add key = value to it
    elif grep -qs "[[:space:]]*\[commands\]" "$f"; then
            sed -i "/[[:space:]]*commands/a upgrade_type = security" "$f"
            found=true
    fi
done

# if section not in any file, append section with key = value to FIRST file in files parameter
if ! $found ; then
    file=$(echo "/etc/dnf/automatic.conf" | cut -f1 -d' ')
    mkdir -p "$(dirname "$file")"
    echo -e "[commands]\nupgrade_type = security" &gt;&gt; "$file"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dnf-automatic_security_updates_only" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Configure dnf-automatic to Install Only Security Updates
  ini_file:
    dest: /etc/dnf/automatic.conf
    section: commands
    option: upgrade_type
    value: security
    create: true
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-2(5)
    - NIST-800-53-SI-2(c)
    - dnf-automatic_security_updates_only
    - low_complexity
    - low_severity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dnf-automatic_security_updates_only:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dnf-automatic_security_updates_only_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ensure_fedora_gpgkey_installed" severity="high">
              <xccdf-1.2:title>Ensure Fedora GPG Key Installed</xccdf-1.2:title>
              <xccdf-1.2:description>To ensure the system can cryptographically verify base software
packages come from Fedora (and to connect to the Fedora Network to
receive them), the Fedora GPG key must properly be installed.
To install the Fedora GPG key, run one of the commands below, depending on your Fedora vesion:
<html:pre>$ sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-35-primary</html:pre>"
<html:pre>$ sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-34-primary</html:pre>"</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001749</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-6.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Changes to software components can have significant effects on the
overall security of the operating system. This requirement ensures
the software has not been tampered with and that it has been provided
by a trusted vendor. The Fedora GPG key is necessary to
cryptographically verify packages are from Fedora."</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="ensure_fedora_gpgkey_installed">
dnf install -y gpg

fedora_version=$(grep -oP '[[:digit:]]+' /etc/redhat-release)

function get_release_fingerprint {
    if [ "${fedora_version}" -eq "37" ]; then
        readonly FEDORA_RELEASE_FINGERPRINT="ACB5EE4E831C74BB7C168D27F55AD3FB5323552A"
    elif [ "${fedora_version}" -eq "35" ]; then
        readonly FEDORA_RELEASE_FINGERPRINT="787EA6AE1147EEE56C40B30CDB4639719867C58F"
    elif [ "${fedora_version}" -eq "34" ]; then
        readonly FEDORA_RELEASE_FINGERPRINT="8C5BA6990BDB26E19F2A1A801161AE6945719A39"
    elif [ "${fedora_version}" -eq "36" ]; then
        readonly FEDORA_RELEASE_FINGERPRINT="53DED2CB922D8B8D9E63FD18999F7CBF38AB71F4"
    else
        printf '%s\n' "This Fedora version '$fedora_version' is not supported anymore, please upgrade to a newer version." &gt;&amp;2
        return 1
    fi
}

# Location of the key we would like to import (once it's integrity verified)
readonly REDHAT_RELEASE_KEY="/etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-${fedora_version}-primary"

RPM_GPG_DIR_PERMS=$(stat -c %a "$(dirname "$REDHAT_RELEASE_KEY")")

function remediate_gpgkey_installed {
    # Return if there was an issue getting the release fingerprint
    get_release_fingerprint || return 1
    # Verify /etc/pki/rpm-gpg directory permissions are safe
    if [ "${RPM_GPG_DIR_PERMS}" -le "755" ]; then
        # If they are safe, try to obtain fingerprints from the key file
        # (to ensure there won't be e.g. CRC error).
        readarray -t GPG_OUT &lt; &lt;(gpg --show-keys --with-fingerprint --with-colons "${REDHAT_RELEASE_KEY}" | grep '^fpr' | cut -d ":" -f 10)
        GPG_RESULT=$?
        # No CRC error, safe to proceed
        if [ "${GPG_RESULT}" -eq "0" ]; then
            echo "${GPG_OUT[*]}" | grep -vE "${FEDORA_RELEASE_FINGERPRINT}" || {
            # If file doesn't contain any keys with unknown fingerprint, import it
            rpm --import "${REDHAT_RELEASE_KEY}"
            }
        fi
    fi
}

remediate_gpgkey_installed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-ensure_fedora_gpgkey_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-ensure_fedora_gpgkey_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" severity="high">
              <xccdf-1.2:title>Ensure gpgcheck Enabled In Main dnf Configuration</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>gpgcheck</html:code> option controls whether
RPM packages' signatures are always checked prior to installation.
To configure dnf to check package signatures before installing
them, ensure the following line appears in <html:code>/etc/dnf/dnf.conf</html:code> in
the <html:code>[main]</html:code> section:
<html:pre>gpgcheck=1</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R15)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001749</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12(10)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000366-GPOS-00153</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000366-VMM-001430</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000370-VMM-001460</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000404-VMM-001650</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Changes to any software components can have significant effects on the
overall security of the operating system. This requirement ensures the
software has not been tampered with and that it has been provided by a
trusted vendor.
<html:br/>
Accordingly, patches, service packs, device drivers, or operating system
components must be signed with a certificate recognized and approved by the
organization.
<html:br/>Verifying the authenticity of the software prior to installation
validates the integrity of the patch or upgrade received from a vendor.
This ensures the software has not been tampered with and that it has been
provided by a trusted vendor. Self-signed certificates are disallowed by
this requirement. Certificates used to verify the software must be from an
approved Certificate Authority (CA).</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#yum"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="ensure_gpgcheck_globally_activated"># Remediation is applicable only in certain platforms
if rpm --quiet -q yum; then

# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/dnf/dnf.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^gpgcheck")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^gpgcheck\\&gt;" "/etc/dnf/dnf.conf"; then
    "${sed_command[@]}" "s/^gpgcheck\\&gt;.*/$formatted_output/gi" "/etc/dnf/dnf.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/dnf/dnf.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="ensure_gpgcheck_globally_activated" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SA-12
    - NIST-800-53-SA-12(10)
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SI-7
    - PCI-DSS-Req-6.2
    - configure_strategy
    - ensure_gpgcheck_globally_activated
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed

- name: Ensure GPG check is globally activated
  ini_file:
    dest: /etc/dnf/dnf.conf
    section: main
    option: gpgcheck
    value: 1
    no_extra_spaces: true
    create: false
  when: '"yum" in ansible_facts.packages'
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SA-12
    - NIST-800-53-SA-12(10)
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SI-7
    - PCI-DSS-Req-6.2
    - configure_strategy
    - ensure_gpgcheck_globally_activated
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-ensure_gpgcheck_globally_activated:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-ensure_gpgcheck_globally_activated_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_local_packages" severity="high">
              <xccdf-1.2:title>Ensure gpgcheck Enabled for Local Packages</xccdf-1.2:title>
              <xccdf-1.2:description><html:code>dnf</html:code> should be configured to verify the signature(s) of local packages
prior to installation. To configure <html:code>dnf</html:code> to verify signatures of local
packages, set the <html:code>localpkg_gpgcheck</html:code> to <html:code>1</html:code> in <html:code>/etc/dnf/dnf.conf</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R15)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001749</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12(10)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000366-GPOS-00153</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000366-VMM-001430</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000370-VMM-001460</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000404-VMM-001650</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Changes to any software components can have significant effects to the overall security
of the operating system. This requirement ensures the software has not been tampered and
has been provided by a trusted vendor.
<html:br/><html:br/>
Accordingly, patches, service packs, device drivers, or operating system components must
be signed with a certificate recognized and approved by the organization.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#yum"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="ensure_gpgcheck_local_packages"># Remediation is applicable only in certain platforms
if rpm --quiet -q yum; then

# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/dnf/dnf.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^localpkg_gpgcheck")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^localpkg_gpgcheck\\&gt;" "/etc/dnf/dnf.conf"; then
    "${sed_command[@]}" "s/^localpkg_gpgcheck\\&gt;.*/$formatted_output/gi" "/etc/dnf/dnf.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/dnf/dnf.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="ensure_gpgcheck_local_packages" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SA-12
    - NIST-800-53-SA-12(10)
    - ensure_gpgcheck_local_packages
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Ensure GPG check Enabled for Local Packages (Yum)
  ini_file:
    dest: /etc/dnf/dnf.conf
    section: main
    option: localpkg_gpgcheck
    value: 1
    no_extra_spaces: true
    create: true
  when: '"yum" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SA-12
    - NIST-800-53-SA-12(10)
    - ensure_gpgcheck_local_packages
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-ensure_gpgcheck_local_packages:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-ensure_gpgcheck_local_packages_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled" severity="high">
              <xccdf-1.2:title>Ensure gpgcheck Enabled for All dnf Package Repositories</xccdf-1.2:title>
              <xccdf-1.2:description>To ensure signature checking is not disabled for
any repos, remove any lines from files in <html:code>/etc/yum.repos.d</html:code> of the form:
<html:pre>gpgcheck=0</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R15)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001749</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12(10)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000366-GPOS-00153</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000366-VMM-001430</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000370-VMM-001460</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000404-VMM-001650</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Verifying the authenticity of the software prior to installation validates
the integrity of the patch or upgrade received from a vendor. This ensures
the software has not been tampered with and that it has been provided by a
trusted vendor. Self-signed certificates are disallowed by this
requirement. Certificates used to verify the software must be from an
approved Certificate Authority (CA)."</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="ensure_gpgcheck_never_disabled">sed -i 's/gpgcheck\s*=.*/gpgcheck=1/g' /etc/yum.repos.d/*
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="ensure_gpgcheck_never_disabled" complexity="low" disruption="medium" reboot="false" strategy="enable">- name: Grep for dnf repo section names
  shell: |
    set -o pipefail
    grep -HEr '^\[.+\]' -r /etc/yum.repos.d/
  register: repo_grep_results
  ignore_errors: true
  changed_when: false
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SA-12
    - NIST-800-53-SA-12(10)
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SI-7
    - PCI-DSS-Req-6.2
    - enable_strategy
    - ensure_gpgcheck_never_disabled
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed

- name: Set gpgcheck=1 for each dnf repo
  ini_file:
    path: '{{ item[0] }}'
    section: '{{ item[1] }}'
    option: gpgcheck
    value: '1'
    no_extra_spaces: true
  loop: '{{ repo_grep_results.stdout | regex_findall( ''(.+\.repo):\[(.+)\]\n?'' )
    }}'
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SA-12
    - NIST-800-53-SA-12(10)
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SI-7
    - PCI-DSS-Req-6.2
    - enable_strategy
    - ensure_gpgcheck_never_disabled
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-ensure_gpgcheck_never_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-ensure_gpgcheck_never_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_repo_metadata" severity="high">
              <xccdf-1.2:title>Ensure gpgcheck Enabled for Repository Metadata</xccdf-1.2:title>
              <xccdf-1.2:description>Verify the operating system prevents the installation of patches,
service packs, device drivers, or operating system components of
local packages without verification of the repository metadata.
Check that <html:code>dnf</html:code> verifies the repository
metadata prior to install with the following command.
This should be configured by setting <html:code>repo_gpgcheck</html:code> to <html:code>1</html:code>
in <html:code>/etc/dnf/dnf.conf</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001749</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12(10)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000366-GPOS-00153</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Changes to any software components can have significant effects to the
overall security of the operating system. This requirement ensures the
software has not been tampered and has been provided by a trusted vendor.
Accordingly, patches, service packs, device drivers, or operating system
components must be signed with a certificate recognized and approved by
the organization. Verifying the authenticity of the software prior to
installation validates the integrity of the patch or upgrade received from
a vendor. This ensures the software has not been tampered with and that it
has been provided by a trusted vendor. Self-signed certificates are
disallowed by this requirement. The operating system should not have
to verify the software again. NOTE: For U.S. Military systems, this
requirement does not mandate DoD certificates for this purpose; however,
the certificate used to verify the software must be from an approved
Certificate Authority.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#yum"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-ensure_gpgcheck_repo_metadata:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-ensure_gpgcheck_repo_metadata_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_security_patches_up_to_date" severity="medium">
              <xccdf-1.2:title>Ensure Software Patches Installed</xccdf-1.2:title>
              <xccdf-1.2:description><html:br/><html:br/>
NOTE: U.S. Defense systems are required to be patched within 30 days or sooner as local policy
dictates.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Fedora does not have a corresponding OVAL CVE Feed. Therefore, this will result in a "not checked" result during a scan.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R08)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">20</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.RA-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000480-VMM-002000</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Installing software updates is a fundamental mitigation against
the exploitation of publicly-known vulnerabilities. If the most
recent security patches and updates are not installed, unauthorized
users may take advantage of weaknesses in the unpatched software. The
lack of prompt attention to patching could result in a system compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="security_patches_up_to_date" complexity="low" disruption="high" reboot="true" strategy="patch">- name: Security patches are up to date
  package:
    name: '*'
    state: latest
  tags:
    - CJIS-5.10.4.1
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-2(5)
    - NIST-800-53-SI-2(c)
    - PCI-DSS-Req-6.2
    - high_disruption
    - low_complexity
    - medium_severity
    - patch_strategy
    - reboot_required
    - security_patches_up_to_date
    - skip_ansible_lint
</xccdf-1.2:fix>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_timer_dnf-automatic_enabled" severity="medium">
              <xccdf-1.2:title>Enable dnf-automatic Timer</xccdf-1.2:title>
              <xccdf-1.2:description>
The <html:code>dnf-automatic</html:code> timer can be enabled with the following command:
<html:pre>$ sudo systemctl enable dnf-automatic.timer</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R8)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000191-GPOS-00080</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>dnf-automatic</html:code> is an alternative command line interface (CLI) to <html:code>dnf upgrade</html:code> with specific facilities to make it suitable to be executed automatically and regularly from systemd timers, cron jobs and similar.
The tool is controlled by <html:code>dnf-automatic.timer</html:code> SystemD timer.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="timer_dnf-automatic_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" start 'dnf-automatic.timer'
"$SYSTEMCTL_EXEC" enable 'dnf-automatic.timer'
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="timer_dnf-automatic_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Enable timer dnf-automatic
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable timer dnf-automatic
      systemd:
        name: dnf-automatic.timer
        enabled: 'yes'
        state: started
      when:
        - '"dnf-automatic" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-2(5)
    - NIST-800-53-SI-2(c)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - timer_dnf-automatic_enabled
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-timer_dnf-automatic_enabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-timer_dnf-automatic_enabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_accounts">
          <xccdf-1.2:title>Account and Access Control</xccdf-1.2:title>
          <xccdf-1.2:description>In traditional Unix security, if an attacker gains
shell access to a certain login account, they can perform any action
or access any file to which that account has access. Therefore,
making it more difficult for unauthorized people to gain shell
access to accounts, particularly to privileged accounts, is a
necessary part of securing a system. This section introduces
mechanisms for restricting access to accounts under
Fedora.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_accounts-banners">
            <xccdf-1.2:title>Warning Banners for System Accesses</xccdf-1.2:title>
            <xccdf-1.2:description>Each system should expose as little information about
itself as possible.
<html:br/><html:br/>
System banners, which are typically displayed just before a
login prompt, give out information about the service or the host's
operating system. This might include the distribution name and the
system kernel version, and the particular version of a network
service. This information can assist intruders in gaining access to
the system as it can reveal whether the system is running
vulnerable software. Most network services can be configured to
limit what information is displayed.
<html:br/><html:br/>
Many organizations implement security policies that require a
system banner provide notice of the system's ownership, provide
warning to unauthorized users, and remind authorized users of their
consent to monitoring.</xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_login_banner_text" type="string">
              <xccdf-1.2:title>Login Banner Verbiage</xccdf-1.2:title>
              <xccdf-1.2:description>Enter an appropriate login banner for your organization. Please note that new lines must
be expressed by the '\n' character and special characters like parentheses and quotation marks must be escaped with '\\'.</xccdf-1.2:description>
              <xccdf-1.2:value selector="cis_banners">^(Authorized[\s\n]+uses[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.|^(?!.*(\\|fedora|rhel|sle|ubuntu)).*)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="cis_default">^Authorized[\s\n]+uses[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.$</xccdf-1.2:value>
              <xccdf-1.2:value selector="dod_banners">^(You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\)\,[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including\,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to\,[\s\n]+penetration[\s\n]+testing\,[\s\n]+COMSEC[\s\n]+monitoring\,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense\,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\)\,[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\)\,[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time\,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using\,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on\,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private\,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring\,[\s\n]+interception\,[\s\n]+and[\s\n]+search\,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.\,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above\,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM\,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications\,[\s\n]+or[\s\n]+work[\s\n]+product\,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys\,[\s\n]+psychotherapists\,[\s\n]+or[\s\n]+clergy\,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.|I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="dod_default">^You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\)\,[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including\,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to\,[\s\n]+penetration[\s\n]+testing\,[\s\n]+COMSEC[\s\n]+monitoring\,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense\,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\)\,[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\)\,[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time\,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using\,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on\,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private\,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring\,[\s\n]+interception\,[\s\n]+and[\s\n]+search\,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.\,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above\,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM\,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications\,[\s\n]+or[\s\n]+work[\s\n]+product\,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys\,[\s\n]+psychotherapists\,[\s\n]+or[\s\n]+clergy\,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.$</xccdf-1.2:value>
              <xccdf-1.2:value selector="dod_short">^I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.$</xccdf-1.2:value>
              <xccdf-1.2:value selector="dss_odaa_default">^Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.[\s\n]+This[\s\n]+is[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+and[\s\n]+related[\s\n]+equipment[\s\n]+are[\s\n]+intended[\s\n]+for[\s\n]+the[\s\n]+communication\,[\s\n]+transmission\,[\s\n]+processing\,[\s\n]+and[\s\n]+storage[\s\n]+of[\s\n]+official[\s\n]+U\.S\.[\s\n]+Government[\s\n]+or[\s\n]+other[\s\n]+authorized[\s\n]+information[\s\n]+only\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times[\s\n]+to[\s\n]+ensure[\s\n]+proper[\s\n]+functioning[\s\n]+of[\s\n]+equipment[\s\n]+and[\s\n]+systems[\s\n]+including[\s\n]+security[\s\n]+devices[\s\n]+and[\s\n]+systems\,[\s\n]+to[\s\n]+prevent[\s\n]+unauthorized[\s\n]+use[\s\n]+and[\s\n]+violations[\s\n]+of[\s\n]+statutes[\s\n]+and[\s\n]+security[\s\n]+regulations\,[\s\n]+to[\s\n]+deter[\s\n]+criminal[\s\n]+activity\,[\s\n]+and[\s\n]+for[\s\n]+other[\s\n]+similar[\s\n]+purposes\.[\s\n]+Any[\s\n]+user[\s\n]+of[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+should[\s\n]+be[\s\n]+aware[\s\n]+that[\s\n]+any[\s\n]+information[\s\n]+placed[\s\n]+in[\s\n]+the[\s\n]+system[\s\n]+is[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+not[\s\n]+subject[\s\n]+to[\s\n]+any[\s\n]+expectation[\s\n]+of[\s\n]+privacy\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+violation[\s\n]+of[\s\n]+criminal[\s\n]+statutes\,[\s\n]+this[\s\n]+evidence[\s\n]+and[\s\n]+any[\s\n]+other[\s\n]+related[\s\n]+information\,[\s\n]+including[\s\n]+identification[\s\n]+information[\s\n]+about[\s\n]+the[\s\n]+user\,[\s\n]+may[\s\n]+be[\s\n]+provided[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+reveals[\s\n]+violations[\s\n]+of[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+unauthorized[\s\n]+use\,[\s\n]+employees[\s\n]+who[\s\n]+violate[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+make[\s\n]+unauthorized[\s\n]+use[\s\n]+of[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+appropriate[\s\n]+disciplinary[\s\n]+action\.[\s\n]+Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.$</xccdf-1.2:value>
              <xccdf-1.2:value selector="usgcb_default">^\-\-[\s\n]+WARNING[\s\n]+\-\-[\s\n]+This[\s\n]+system[\s\n]+is[\s\n]+for[\s\n]+the[\s\n]+use[\s\n]+of[\s\n]+authorized[\s\n]+users[\s\n]+only\.[\s\n]+Individuals[\s\n]+using[\s\n]+this[\s\n]+computer[\s\n]+system[\s\n]+without[\s\n]+authority[\s\n]+or[\s\n]+in[\s\n]+excess[\s\n]+of[\s\n]+their[\s\n]+authority[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+having[\s\n]+all[\s\n]+their[\s\n]+activities[\s\n]+on[\s\n]+this[\s\n]+system[\s\n]+monitored[\s\n]+and[\s\n]+recorded[\s\n]+by[\s\n]+system[\s\n]+personnel\.[\s\n]+Anyone[\s\n]+using[\s\n]+this[\s\n]+system[\s\n]+expressly[\s\n]+consents[\s\n]+to[\s\n]+such[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+advised[\s\n]+that[\s\n]+if[\s\n]+such[\s\n]+monitoring[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+criminal[\s\n]+activity[\s\n]+system[\s\n]+personal[\s\n]+may[\s\n]+provide[\s\n]+the[\s\n]+evidence[\s\n]+of[\s\n]+such[\s\n]+monitoring[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.$</xccdf-1.2:value>
              <xccdf-1.2:value>^Authorized[\s\n]+uses[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.$</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_banner_etc_issue" severity="medium">
              <xccdf-1.2:title>Modify the System Login Banner</xccdf-1.2:title>
              <xccdf-1.2:description>
To configure the system login banner edit <html:code>/etc/issue</html:code>. Replace the
default text with a message compliant with the local site policy or a legal
disclaimer.


The DoD required text is either:
<html:br/><html:br/>
<html:code>You are accessing a U.S. Government (USG) Information System (IS) that
is provided for USG-authorized use only. By using this IS (which includes
any device attached to this IS), you consent to the following conditions:
<html:br/>-The USG routinely intercepts and monitors communications on this IS
for purposes including, but not limited to, penetration testing, COMSEC
monitoring, network operations and defense, personnel misconduct (PM), law
enforcement (LE), and counterintelligence (CI) investigations.
<html:br/>-At any time, the USG may inspect and seize data stored on this IS.
<html:br/>-Communications using, or data stored on, this IS are not private,
are subject to routine monitoring, interception, and search, and may be
disclosed or used for any USG-authorized purpose.
<html:br/>-This IS includes security measures (e.g., authentication and access
controls) to protect USG interests -- not for your personal benefit or
privacy.
<html:br/>-Notwithstanding the above, using this IS does not constitute consent
to PM, LE or CI investigative searching or monitoring of the content of
privileged communications, or work product, related to personal
representation or services by attorneys, psychotherapists, or clergy, and
their assistants. Such communications and work product are private and
confidential. See User Agreement for details.</html:code>
<html:br/><html:br/>
OR:
<html:br/><html:br/>
<html:code>I've read &amp; consent to terms in IS user agreem't.</html:code></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000048</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000050</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000023-GPOS-00006</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000228-GPOS-00088</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000023-VMM-000060</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000024-VMM-000070</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.
<html:br/><html:br/>
System use notifications are required only for access via login interfaces
with human users and are not required when such human interfaces do not
exist.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="banner_etc_issue"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

login_banner_text='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_login_banner_text" use="legacy"/>'


# Multiple regexes transform the banner regex into a usable banner
# 0 - Remove anchors around the banner text
login_banner_text=$(echo "$login_banner_text" | sed 's/^\^\(.*\)\$$/\1/g')
# 1 - Keep only the first banners if there are multiple
#    (dod_banners contains the long and short banner)
login_banner_text=$(echo "$login_banner_text" | sed 's/^(\(.*\.\)|.*)$/\1/g')
# 2 - Add spaces ' '. (Transforms regex for "space or newline" into a " ")
login_banner_text=$(echo "$login_banner_text" | sed 's/\[\\s\\n\]+/ /g')
# 3 - Adds newlines. (Transforms "(?:\[\\n\]+|(?:\\n)+)" into "\n")
login_banner_text=$(echo "$login_banner_text" | sed 's/(?:\[\\n\]+|(?:\\\\n)+)/\n/g')
# 4 - Remove any leftover backslash. (From any parethesis in the banner, for example).
login_banner_text=$(echo "$login_banner_text" | sed 's/\\//g')
formatted=$(echo "$login_banner_text" | fold -sw 80)

cat &lt;&lt;EOF &gt;/etc/issue
$formatted
EOF

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="banner_etc_issue" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: XCCDF Value login_banner_text # promote to variable
  set_fact:
    login_banner_text: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_login_banner_text" use="legacy"/>
  tags:
    - always

- name: Modify the System Login Banner - ensure correct banner
  copy:
    dest: /etc/issue
    content: '{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*\.)\|.*\)$",
      "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
      "\n") | regex_replace("\\", "") | wordwrap() }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - banner_etc_issue
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-login_banner_text:var:1" value-id="xccdf_org.ssgproject.content_value_login_banner_text"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-banner_etc_issue:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-banner_etc_issue_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_banner_etc_motd" severity="medium">
              <xccdf-1.2:title>Modify the System Message of the Day Banner</xccdf-1.2:title>
              <xccdf-1.2:description>To configure the system message banner edit <html:code>/etc/motd</html:code>. Replace the
default text with a message compliant with the local site policy or a legal
disclaimer.

The DoD required text is either:
<html:br/><html:br/>
<html:code>You are accessing a U.S. Government (USG) Information System (IS) that
is provided for USG-authorized use only. By using this IS (which includes
any device attached to this IS), you consent to the following conditions:
<html:br/>-The USG routinely intercepts and monitors communications on this IS
for purposes including, but not limited to, penetration testing, COMSEC
monitoring, network operations and defense, personnel misconduct (PM), law
enforcement (LE), and counterintelligence (CI) investigations.
<html:br/>-At any time, the USG may inspect and seize data stored on this IS.
<html:br/>-Communications using, or data stored on, this IS are not private,
are subject to routine monitoring, interception, and search, and may be
disclosed or used for any USG-authorized purpose.
<html:br/>-This IS includes security measures (e.g., authentication and access
controls) to protect USG interests -- not for your personal benefit or
privacy.
<html:br/>-Notwithstanding the above, using this IS does not constitute consent
to PM, LE or CI investigative searching or monitoring of the content of
privileged communications, or work product, related to personal
representation or services by attorneys, psychotherapists, or clergy, and
their assistants. Such communications and work product are private and
confidential. See User Agreement for details.</html:code>
<html:br/><html:br/>
OR:
<html:br/><html:br/>
<html:code>I've read &amp; consent to terms in IS user agreem't.</html:code></xccdf-1.2:description>
              <xccdf-1.2:rationale>Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.
<html:br/><html:br/>
System use notifications are required only for access via login interfaces
with human users and are not required when such human interfaces do not
exist.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="banner_etc_motd"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

login_banner_text='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_login_banner_text" use="legacy"/>'


# Multiple regexes transform the banner regex into a usable banner
# 0 - Remove anchors around the banner text
login_banner_text=$(echo "$login_banner_text" | sed 's/^\^\(.*\)\$$/\1/g')
# 1 - Keep only the first banners if there are multiple
#    (dod_banners contains the long and short banner)
login_banner_text=$(echo "$login_banner_text" | sed 's/^(\(.*\.\)|.*)$/\1/g')
# 2 - Add spaces ' '. (Transforms regex for "space or newline" into a " ")
login_banner_text=$(echo "$login_banner_text" | sed 's/\[\\s\\n\]+/ /g')
# 3 - Adds newlines. (Transforms "(?:\[\\n\]+|(?:\\n)+)" into "\n")
login_banner_text=$(echo "$login_banner_text" | sed 's/(?:\[\\n\]+|(?:\\\\n)+)/\n/g')
# 4 - Remove any leftover backslash. (From any parethesis in the banner, for example).
login_banner_text=$(echo "$login_banner_text" | sed 's/\\//g')
formatted=$(echo "$login_banner_text" | fold -sw 80)

cat &lt;&lt;EOF &gt;/etc/motd
$formatted
EOF

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="banner_etc_motd" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: XCCDF Value login_banner_text # promote to variable
  set_fact:
    login_banner_text: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_login_banner_text" use="legacy"/>
  tags:
    - always

- name: Modify the System Message of the Day Banner - ensure correct banner
  copy:
    dest: /etc/motd
    content: '{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*\.)\|.*\)$",
      "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
      "\n") | regex_replace("\\", "") | wordwrap() }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - banner_etc_motd
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-login_banner_text:var:1" value-id="xccdf_org.ssgproject.content_value_login_banner_text"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-banner_etc_motd:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-banner_etc_motd_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue" severity="medium">
              <xccdf-1.2:title>Verify Group Ownership of System Login Banner</xccdf-1.2:title>
              <xccdf-1.2:description>
To properly set the group owner of <html:code>/etc/issue</html:code>, run the command:
<html:pre>$ sudo chgrp root /etc/issue</html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale>Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.<html:br/>
Proper group ownership will ensure that only root user can modify the banner.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_etc_issue" complexity="low" disruption="low" reboot="false" strategy="configure">


chgrp 0 /etc/issue
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_etc_issue" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/issue
  stat:
    path: /etc/issue
  register: file_exists
  tags:
    - configure_strategy
    - file_groupowner_etc_issue
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /etc/issue
  file:
    path: /etc/issue
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_groupowner_etc_issue
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_groupowner_etc_issue:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_groupowner_etc_issue_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_motd" severity="medium">
              <xccdf-1.2:title>Verify Group Ownership of Message of the Day Banner</xccdf-1.2:title>
              <xccdf-1.2:description>
To properly set the group owner of <html:code>/etc/motd</html:code>, run the command:
<html:pre>$ sudo chgrp root /etc/motd</html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale>Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.<html:br/>
Proper group ownership will ensure that only root user can modify the banner.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_etc_motd" complexity="low" disruption="low" reboot="false" strategy="configure">


chgrp 0 /etc/motd
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_etc_motd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/motd
  stat:
    path: /etc/motd
  register: file_exists
  tags:
    - configure_strategy
    - file_groupowner_etc_motd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /etc/motd
  file:
    path: /etc/motd
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_groupowner_etc_motd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_groupowner_etc_motd:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_groupowner_etc_motd_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_etc_issue" severity="medium">
              <xccdf-1.2:title>Verify ownership of System Login Banner</xccdf-1.2:title>
              <xccdf-1.2:description>
To properly set the owner of <html:code>/etc/issue</html:code>, run the command:
<html:pre>$ sudo chown root /etc/issue </html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale>Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.<html:br/>
Proper ownership will ensure that only root user can modify the banner.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_etc_issue" complexity="low" disruption="low" reboot="false" strategy="configure">


chown 0 /etc/issue
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_etc_issue" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/issue
  stat:
    path: /etc/issue
  register: file_exists
  tags:
    - configure_strategy
    - file_owner_etc_issue
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /etc/issue
  file:
    path: /etc/issue
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_owner_etc_issue
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_owner_etc_issue:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_owner_etc_issue_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_etc_motd" severity="medium">
              <xccdf-1.2:title>Verify ownership of Message of the Day Banner</xccdf-1.2:title>
              <xccdf-1.2:description>
To properly set the owner of <html:code>/etc/motd</html:code>, run the command:
<html:pre>$ sudo chown root /etc/motd </html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale>Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.<html:br/>
Proper ownership will ensure that only root user can modify the banner.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_etc_motd" complexity="low" disruption="low" reboot="false" strategy="configure">


chown 0 /etc/motd
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_etc_motd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/motd
  stat:
    path: /etc/motd
  register: file_exists
  tags:
    - configure_strategy
    - file_owner_etc_motd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /etc/motd
  file:
    path: /etc/motd
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_owner_etc_motd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_owner_etc_motd:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_owner_etc_motd_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_etc_issue" severity="medium">
              <xccdf-1.2:title>Verify permissions on System Login Banner</xccdf-1.2:title>
              <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/issue</html:code>, run the command:
<html:pre>$ sudo chmod 0644 /etc/issue</html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale>Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.<html:br/>
Proper permissions will ensure that only root user can modify the banner.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_issue" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xs,g-xws,o-xwt /etc/issue
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_issue" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/issue
  stat:
    path: /etc/issue
  register: file_exists
  tags:
    - configure_strategy
    - file_permissions_etc_issue
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwt on /etc/issue
  file:
    path: /etc/issue
    mode: u-xs,g-xws,o-xwt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_permissions_etc_issue
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_etc_issue:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_etc_issue_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_etc_motd" severity="medium">
              <xccdf-1.2:title>Verify permissions on Message of the Day Banner</xccdf-1.2:title>
              <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/motd</html:code>, run the command:
<html:pre>$ sudo chmod 0644 /etc/motd</html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale>Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.<html:br/>
Proper permissions will ensure that only root user can modify the banner.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_motd" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xs,g-xws,o-xwt /etc/motd
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_motd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/motd
  stat:
    path: /etc/motd
  register: file_exists
  tags:
    - configure_strategy
    - file_permissions_etc_motd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwt on /etc/motd
  file:
    path: /etc/motd
    mode: u-xs,g-xws,o-xwt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_permissions_etc_motd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_etc_motd:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_etc_motd_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gui_login_banner">
              <xccdf-1.2:title>Implement a GUI Warning Banner</xccdf-1.2:title>
              <xccdf-1.2:description>In the default graphical environment, users logging
directly into the system are greeted with a login screen provided
by the GNOME Display Manager (GDM). The warning banner should be
displayed in this graphical environment for these users.
The following sections describe how to configure the GDM login
banner.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#gdm"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled" severity="medium">
                <xccdf-1.2:title>Enable GNOME3 Login Warning Banner</xccdf-1.2:title>
                <xccdf-1.2:description>In the default graphical environment, displaying a login warning banner
in the GNOME Display Manager's login screen can be enabled on the login
screen by setting <html:code>banner-message-enable</html:code> to <html:code>true</html:code>.
<html:br/><html:br/>
To enable, add or edit <html:code>banner-message-enable</html:code> to
<html:code>/etc/dconf/db/distro.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/login-screen]
banner-message-enable=true</html:pre>
Once the setting has been added, add a lock to
<html:code>/etc/dconf/db/distro.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/login-screen/banner-message-enable</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.
The banner text must also be set.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000048</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000050</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001384</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001385</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001386</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001387</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001388</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000023-GPOS-00006</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000228-GPOS-00088</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Display of a standardized and approved use notification before granting access to the operating system
ensures privacy and security notification verbiage used is consistent with applicable federal laws,
Executive Orders, directives, policies, regulations, standards, and guidance.
<html:br/><html:br/>
For U.S. Government systems, system use notifications are required only for access via login interfaces
with human users and are not required when such human interfaces do not exist.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#gdm"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_banner_enabled"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/login-screen\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/distro.d/00-security-settings"
DBDIR="/etc/dconf/db/distro.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/login-screen]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "banner-message-enable" "true" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
    if grep -q "^\\s*banner-message-enable\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*banner-message-enable\\s*=\\s*.*/banner-message-enable=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/login-screen\\]|a\\banner-message-enable=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/login-screen/banner-message-enable$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/distro.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/login-screen/banner-message-enable" &gt;&gt; "/etc/dconf/db/distro.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_banner_enabled" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(b)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_banner_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Enable GNOME3 Login Warning Banner
  ini_file:
    dest: /etc/dconf/db/distro.d/00-security-settings
    section: org/gnome/login-screen
    option: banner-message-enable
    value: 'true'
    create: true
    no_extra_spaces: true
  when: '"gdm" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(b)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_banner_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME banner-message-enabled
  lineinfile:
    path: /etc/dconf/db/distro.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/login-screen/banner-message-enable$
    line: /org/gnome/login-screen/banner-message-enable
    create: true
  when: '"gdm" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(b)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_banner_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when: '"gdm" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(b)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_banner_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_banner_enabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_banner_enabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text" severity="medium">
                <xccdf-1.2:title>Set the GNOME3 Login Warning Banner Text</xccdf-1.2:title>
                <xccdf-1.2:description>In the default graphical environment, configuring the login warning banner text
in the GNOME Display Manager's login screen can be configured on the login
screen by setting <html:code>banner-message-text</html:code> to <html:code>'<html:i>APPROVED_BANNER</html:i>'</html:code>
where <html:i>APPROVED_BANNER</html:i> is the approved banner for your environment.
<html:br/><html:br/>
To enable, add or edit <html:code>banner-message-text</html:code> to

<html:code>/etc/dconf/db/distro.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/login-screen]
banner-message-text='<html:i>APPROVED_BANNER</html:i>'</html:pre>
Once the setting has been added, add a lock to
<html:code>/etc/dconf/db/distro.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/login-screen/banner-message-text</html:pre>

After the settings have been set, run <html:code>dconf update</html:code>.
When entering a warning banner that spans several lines, remember
to begin and end the string with <html:code>'</html:code> and use <html:code>\n</html:code> for new lines.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000048</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000023-GPOS-00006</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000228-GPOS-00088</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An appropriate warning message reinforces policy awareness during the logon
process and facilitates possible legal action against attackers.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#gdm"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_login_banner_text"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm; then

login_banner_text='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_login_banner_text" use="legacy"/>'


# Multiple regexes transform the banner regex into a usable banner
# 0 - Remove anchors around the banner text
login_banner_text=$(echo "$login_banner_text" | sed 's/^\^\(.*\)\$$/\1/g')
# 1 - Keep only the first banners if there are multiple
#    (dod_banners contains the long and short banner)
login_banner_text=$(echo "$login_banner_text" | sed 's/^(\(.*\.\)|.*)$/\1/g')
# 2 - Add spaces ' '. (Transforms regex for "space or newline" into a " ")
login_banner_text=$(echo "$login_banner_text" | sed 's/\[\\s\\n\]+/ /g')
# 3 - Adds newline "tokens". (Transforms "(?:\[\\n\]+|(?:\\n)+)" into "(n)*")
login_banner_text=$(echo "$login_banner_text" | sed 's/(?:\[\\n\]+|(?:\\\\n)+)/(n)*/g')
# 4 - Remove any leftover backslash. (From any parethesis in the banner, for example).
login_banner_text=$(echo "$login_banner_text" | sed 's/\\//g')
# 5 - Removes the newline "token." (Transforms them into newline escape sequences "\n").
#    ( Needs to be done after 4, otherwise the escapce sequence will become just "n".
login_banner_text=$(echo "$login_banner_text" | sed 's/(n)\*/\\n/g')

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/login-screen\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/distro.d/00-security-settings"
DBDIR="/etc/dconf/db/distro.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/login-screen]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "banner-message-text" "'${login_banner_text}'" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "'${login_banner_text}'")"
    if grep -q "^\\s*banner-message-text\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*banner-message-text\\s*=\\s*.*/banner-message-text=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/login-screen\\]|a\\banner-message-text=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/login-screen/banner-message-text$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/distro.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/login-screen/banner-message-text" &gt;&gt; "/etc/dconf/db/distro.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_login_banner_text" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_login_banner_text
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
- name: XCCDF Value login_banner_text # promote to variable
  set_fact:
    login_banner_text: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_login_banner_text" use="legacy"/>
  tags:
    - always

- name: Set the GNOME3 Login Warning Banner Text
  file:
    path: /etc/dconf/db/{{ item }}
    owner: root
    group: root
    mode: 493
    state: directory
  with_items:
    - distro.d
    - distro.d/locks
  when: '"gdm" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_login_banner_text
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Set the GNOME3 Login Warning Banner Text
  file:
    path: /etc/dconf/db/distro.d/{{ item }}
    owner: root
    group: root
    mode: 420
    state: touch
  with_items:
    - 00-security-settings
    - locks/00-security-settings-lock
  when: '"gdm" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_login_banner_text
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Set the GNOME3 Login Warning Banner Text
  ini_file:
    dest: /etc/dconf/db/distro.d/00-security-settings
    section: org/gnome/login-screen
    option: banner-message-text
    value: '''{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*\.)\|.*\)$",
      "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
      "(n)*") | regex_replace("\\", "") | regex_replace("\(n\)\*", "\\n") }}'''
    create: true
    no_extra_spaces: true
  when: '"gdm" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_login_banner_text
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of the GNOME3 Login Warning Banner Text
  lineinfile:
    path: /etc/dconf/db/distro.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/login-screen/banner-message-text$
    line: /org/gnome/login-screen/banner-message-text
    create: true
    state: present
  when: '"gdm" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_login_banner_text
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when: '"gdm" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_login_banner_text
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-login_banner_text:var:1" value-id="xccdf_org.ssgproject.content_value_login_banner_text"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dconf_gnome_login_banner_text:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dconf_gnome_login_banner_text_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_accounts-pam">
            <xccdf-1.2:title>Protect Accounts by Configuring PAM</xccdf-1.2:title>
            <xccdf-1.2:description>PAM, or Pluggable Authentication Modules, is a system
which implements modular authentication for Linux programs. PAM provides
a flexible and configurable architecture for authentication, and it should be configured
to minimize exposure to unnecessary risk. This section contains
guidance on how to accomplish that.
<html:br/><html:br/>
PAM is implemented as a set of shared objects which are
loaded and invoked whenever an application wishes to authenticate a
user. Typically, the application must be running as root in order
to take advantage of PAM, because PAM's modules often need to be able
to access sensitive stores of account information, such as /etc/shadow.
Traditional privileged network listeners
(e.g. sshd) or SUID programs (e.g. sudo) already meet this
requirement. An SUID root application, userhelper, is provided so
that programs which are not SUID or privileged themselves can still
take advantage of PAM.
<html:br/><html:br/>
PAM looks in the directory <html:code>/etc/pam.d</html:code> for
application-specific configuration information. For instance, if
the program login attempts to authenticate a user, then PAM's
libraries follow the instructions in the file <html:code>/etc/pam.d/login</html:code>
to determine what actions should be taken.
<html:br/><html:br/>
One very important file in <html:code>/etc/pam.d</html:code> is
<html:code>/etc/pam.d/system-auth</html:code>. This file, which is included by
many other PAM configuration files, defines 'default' system authentication
measures. Modifying this file is a good way to make far-reaching
authentication changes, for instance when implementing a
centralized authentication service.</xccdf-1.2:description>
            <xccdf-1.2:warning category="functionality">Be careful when making changes to PAM's configuration files.
The syntax for these files is complex, and modifications can
have unexpected consequences. The default configurations shipped
with applications should be sufficient for most users.</xccdf-1.2:warning>
            <xccdf-1.2:warning category="functionality">Running <html:code>authconfig</html:code> or <html:code>system-config-authentication</html:code>
will re-write the PAM configuration files, destroying any manually
made changes and replacing them with a series of system defaults.
One reference to the configuration file syntax can be found at

<html:a href="http://www.linux-pam.org/Linux-PAM-html/sag-configuration-file.html">http://www.linux-pam.org/Linux-PAM-html/sag-configuration-file.html</html:a>.</xccdf-1.2:warning>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm" type="string">
              <xccdf-1.2:title>Password Hashing algorithm</xccdf-1.2:title>
              <xccdf-1.2:description>Specify the system default encryption algorithm for encrypting passwords.
Defines the value set as ENCRYPT_METHOD in /etc/login.defs.</xccdf-1.2:description>
              <xccdf-1.2:value>SHA512</xccdf-1.2:value>
              <xccdf-1.2:value selector="SHA512">SHA512</xccdf-1.2:value>
              <xccdf-1.2:value selector="SHA256">SHA256</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember" type="number">
              <xccdf-1.2:title>remember</xccdf-1.2:title>
              <xccdf-1.2:description>The last n passwords for each user are saved in
<html:code>/etc/security/opasswd</html:code> in order to force password change history and
keep the user from alternating between the same password too
frequently.</xccdf-1.2:description>
              <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
              <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
              <xccdf-1.2:value selector="24">24</xccdf-1.2:value>
              <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
              <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
              <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
              <xccdf-1.2:value>5</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_disallow_bypass_password_sudo" severity="medium">
              <xccdf-1.2:title>Disallow Configuration to Bypass Password Requirements for Privilege Escalation</xccdf-1.2:title>
              <xccdf-1.2:description>Verify the operating system is not configured to bypass password requirements for privilege
escalation. Check the configuration of the "/etc/pam.d/sudo" file with the following command:
<html:pre>$ sudo grep pam_succeed_if /etc/pam.d/sudo</html:pre>
If any occurrences of "pam_succeed_if" is returned from the command, this is a finding.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002038</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00156</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00157</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00158</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Without re-authentication, users may access resources or perform tasks for which they do not
have authorization. When operating systems provide the capability to escalate a functional
capability, it is critical the user re-authenticate.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#pam"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-disallow_bypass_password_sudo:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-disallow_bypass_password_sudo_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_display_login_attempts" severity="low">
              <xccdf-1.2:title>Ensure PAM Displays Last Logon/Access Notification</xccdf-1.2:title>
              <xccdf-1.2:description>To configure the system to notify users of last logon/access
using <html:code>pam_lastlog</html:code>, add or correct the <html:code>pam_lastlog</html:code>
settings in
<html:code>/etc/pam.d/postlogin</html:code> to read as follows:
<html:pre>session     required pam_lastlog.so showfailed</html:pre>
And make sure that the <html:code>silent</html:code> option is not set.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0582</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0584</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">05885</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0586</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0846</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0957</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-9(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Users need to be aware of activity that occurs regarding
their account. Providing users with information regarding the number
of unsuccessful attempts that were made to login to their account
allows the user to determine if any unauthorized activity has occurred
and gives them an opportunity to notify administrators.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#pam"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="display_login_attempts"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

if [ -f /usr/bin/authselect ]; then
    if authselect check; then
        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # Standard profiles delivered with authselect should not be modified.
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            # Ensure a backup before changing the profile
            authselect apply-changes -b --backup=before-pwhistory-hardening.backup
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
        fi
        # Include the desired configuration in the custom profile
        CUSTOM_POSTLOGIN="/etc/authselect/$CURRENT_PROFILE/postlogin"
        # The line should be included on the top of postlogin file
        if [ "$(grep -c "^\s*session.*required.*pam_lastlog.so\s\+showfailed\s*$" $CUSTOM_POSTLOGIN)" -eq 0 ]; then
            sed -i --follow-symlinks '0,/^session.*/s/^session.*/session     required                   pam_lastlog.so showfailed\n&amp;/' $CUSTOM_POSTLOGIN
        fi
        if grep -q "^\s*session.*required.*pam_lastlog.so.*silent.*" $CUSTOM_POSTLOGIN; then
            # remove 'silent' option
            sed -i --follow-symlinks 's/^\(session.*required.*pam_lastlog.so\).*/\1 showfailed/g' $CUSTOM_POSTLOGIN
        fi
        authselect apply-changes -b --backup=after-pwhistory-hardening.backup
    else
        echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because the authselect profile is not intact.
It is not recommended to manually edit the PAM files when authselect is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        false
    fi
else
    
    
    

    if [ "$(grep -c "^\s*session.*required.*pam_lastlog.so\s\+showfailed\s*$" /etc/pam.d/postlogin)" -eq 0 ]; then
        sed -i --follow-symlinks '0,/^session.*/s/^session.*/session     required                   pam_lastlog.so showfailed\n&amp;/' /etc/pam.d/postlogin
    fi
    if grep -q "^\s*session.*required.*pam_lastlog.so.*silent.*" /etc/pam.d/postlogin; then
        # remove 'silent' option
        sed -i --follow-symlinks 's/^\(session.*required.*pam_lastlog.so\).*/\1 showfailed/g' /etc/pam.d/postlogin
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="display_login_attempts" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.2
    - NIST-800-53-AC-9(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.4
    - configure_strategy
    - display_login_attempts
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed

- name: Check for expected pam_lastlog.so entry
  ansible.builtin.lineinfile:
    path: /etc/pam.d/postlogin
    create: false
    regexp: ^\s*session.*required.*pam_lastlog.so\s\+showfailed\s*$
    state: absent
  check_mode: true
  changed_when: false
  register: result_pam_lastlog_present
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.2
    - NIST-800-53-AC-9(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.4
    - configure_strategy
    - display_login_attempts
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed

- name: Check if system relies on authselect
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.2
    - NIST-800-53-AC-9(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.4
    - configure_strategy
    - display_login_attempts
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed

- name: Remediation where authselect tool is present
  block:

    - name: Check the integrity of the current authselect profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      ignore_errors: true

    - name: Informative message based on the authselect integrity check result
      ansible.builtin.assert:
        that:
          - result_authselect_check_cmd is success
        fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because the authselect profile is
            not intact.
          - It is not recommended to manually edit the PAM files when authselect is
            available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
        success_msg:
          - authselect integrity check passed

    - name: Get authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
        - result_authselect_check_cmd is success

    - name: Define the current authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

    - name: Define the new authselect custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

    - name: Get authselect current features to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

    - name: Check if any custom profile with the same name was already created in
        the past
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
        - authselect_current_profile is not match("custom/")

    - name: Create a custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("custom/")
        - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure the silent option is not present in the custom profile
      ansible.builtin.replace:
        dest: /etc/authselect/{{ authselect_custom_profile }}/postlogin
        regexp: ^(session.*required.*pam_lastlog.so).*$
        replace: \g&lt;1&gt; showfailed
      when:
        - result_authselect_profile is not skipped

    - name: Ensure the desired configuration is present in the custom profile
      ansible.builtin.lineinfile:
        dest: /etc/authselect/{{ authselect_custom_profile }}/postlogin
        insertbefore: ^session.*
        firstmatch: true
        line: session     required                   pam_lastlog.so showfailed
      when:
        - result_authselect_profile is not skipped

    - name: Ensure a backup of current authselect profile before selecting the custom
        profile
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-pwhistory-hardening.backup
      register: result_authselect_backup
      when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure the custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }} --force
      register: result_pam_authselect_select_profile
      when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

    - name: Restore the authselect features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

    - name: Ensure the custom profile changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-pwhistory-hardening.backup
      when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
  when:
    - '"pam" in ansible_facts.packages'
    - result_pam_lastlog_present.found == 0
    - result_authselect_present.stat.exists
  tags:
    - CJIS-5.5.2
    - NIST-800-53-AC-9(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.4
    - configure_strategy
    - display_login_attempts
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed

- name: Remediation where authselect tool is not present and PAM files are directly
    edited
  block:

    - name: Ensure the silent option is not present in PAM files
      ansible.builtin.replace:
        dest: /etc/pam.d/postlogin
        regexp: ^(session.*required.*pam_lastlog.so).*$
        replace: \g&lt;1&gt; showfailed

    - name: Ensure the desired configuration is present in PAM files
      ansible.builtin.lineinfile:
        dest: /etc/pam.d/postlogin
        insertbefore: ^session.*
        firstmatch: true
        line: session     required                   pam_lastlog.so showfailed
  when:
    - '"pam" in ansible_facts.packages'
    - result_pam_lastlog_present.found == 0
    - not result_authselect_present.stat.exists
  tags:
    - CJIS-5.5.2
    - NIST-800-53-AC-9(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.4
    - configure_strategy
    - display_login_attempts
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-display_login_attempts:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-display_login_attempts_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_enable_pam_namespace" severity="low">
              <xccdf-1.2:title>Set Up a Private Namespace in PAM Configuration</xccdf-1.2:title>
              <xccdf-1.2:description>To setup a private namespace add the following line to <html:code>/etc/pam.d/login</html:code>:
<html:pre>session    required     pam_namespace.so</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R39)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The pam_namespace PAM module sets up a private namespace for a
session with polyinstantiated directories. A polyinstantiated directory
provides a different instance of itself based on user name, or when using
SELinux, user name, security context or both. The polyinstatied directories
can be used to dedicate separate temporary directories to each account.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#pam"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="enable_pam_namespace"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

if ! grep -Eq '^\s*session\s+required\s+pam_namespace.so\s*$' '/etc/pam.d/login' ; then
    echo "session    required     pam_namespace.so" &gt;&gt; "/etc/pam.d/login"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="enable_pam_namespace" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - enable_pam_namespace
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy

- name: Make changes to /etc/pam.d/login
  lineinfile:
    path: /etc/pam.d/login
    create: false
    regexp: ^\s*session\s+required\s+pam_namespace.so\s*$
    line: session    required     pam_namespace.so
    state: present
  when: '"pam" in ansible_facts.packages'
  tags:
    - enable_pam_namespace
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-enable_pam_namespace:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-enable_pam_namespace_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_locking_out_password_attempts">
              <xccdf-1.2:title>Set Lockouts for Failed Password Attempts</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>pam_faillock</html:code> PAM module provides the capability to
lock out user accounts after a number of failed login attempts. Its
documentation is available in
<html:code>/usr/share/doc/pam-VERSION/txts/README.pam_faillock</html:code>.
<html:br/><html:br/></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Locking out user accounts presents the
risk of a denial-of-service attack. The lockout policy
must weigh whether the risk of such a
denial-of-service attack outweighs the benefits of thwarting
password guessing attacks.</xccdf-1.2:warning>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" type="number">
                <xccdf-1.2:title>fail_deny</xccdf-1.2:title>
                <xccdf-1.2:description>Number of failed login attempts before account lockout</xccdf-1.2:description>
                <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
                <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
                <xccdf-1.2:value selector="6">6</xccdf-1.2:value>
                <xccdf-1.2:value>3</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" type="number">
                <xccdf-1.2:title>fail_interval</xccdf-1.2:title>
                <xccdf-1.2:description>Interval for counting failed login attempts before account lockout</xccdf-1.2:description>
                <xccdf-1.2:value selector="100000000">100000000</xccdf-1.2:value>
                <xccdf-1.2:value selector="1800">1800</xccdf-1.2:value>
                <xccdf-1.2:value selector="3600">3600</xccdf-1.2:value>
                <xccdf-1.2:value selector="86400">86400</xccdf-1.2:value>
                <xccdf-1.2:value selector="900">900</xccdf-1.2:value>
                <xccdf-1.2:value>900</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" type="number">
                <xccdf-1.2:title>fail_unlock_time</xccdf-1.2:title>
                <xccdf-1.2:description>Seconds before automatic unlocking or permanently locking after excessive failed logins</xccdf-1.2:description>
                <xccdf-1.2:value selector="1800">1800</xccdf-1.2:value>
                <xccdf-1.2:value selector="3600">3600</xccdf-1.2:value>
                <xccdf-1.2:value selector="600">600</xccdf-1.2:value>
                <xccdf-1.2:value selector="604800">604800</xccdf-1.2:value>
                <xccdf-1.2:value selector="86400">86400</xccdf-1.2:value>
                <xccdf-1.2:value selector="900">900</xccdf-1.2:value>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="never">0</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_delay" type="number">
                <xccdf-1.2:title>faildelay_delay</xccdf-1.2:title>
                <xccdf-1.2:description>Delay next login attempt after a failed login</xccdf-1.2:description>
                <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="4000000">4000000</xccdf-1.2:value>
                <xccdf-1.2:value>4000000</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_remember" type="number">
                <xccdf-1.2:title>pwhistory_remember</xccdf-1.2:title>
                <xccdf-1.2:description>Prevent password re-use using password history lookup</xccdf-1.2:description>
                <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
                <xccdf-1.2:value selector="6">6</xccdf-1.2:value>
                <xccdf-1.2:value selector="7">7</xccdf-1.2:value>
                <xccdf-1.2:value selector="8">8</xccdf-1.2:value>
                <xccdf-1.2:value selector="9">9</xccdf-1.2:value>
                <xccdf-1.2:value>5</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag" type="string">
                <xccdf-1.2:title>PAM pwhistory remember - control flag</xccdf-1.2:title>
                <xccdf-1.2:description>Specify the control flag required for password remember requirement.</xccdf-1.2:description>
                <xccdf-1.2:value selector="required">required</xccdf-1.2:value>
                <xccdf-1.2:value selector="optional">optional</xccdf-1.2:value>
                <xccdf-1.2:value selector="requisite">requisite</xccdf-1.2:value>
                <xccdf-1.2:value selector="sufficient">sufficient</xccdf-1.2:value>
                <xccdf-1.2:value selector="binding">binding</xccdf-1.2:value>
                <xccdf-1.2:value>requisite</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_tally2" type="number">
                <xccdf-1.2:title>tally2</xccdf-1.2:title>
                <xccdf-1.2:description>Number of failed login attempts</xccdf-1.2:description>
                <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
                <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
                <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
                <xccdf-1.2:value>3</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth" severity="medium">
                <xccdf-1.2:title>Limit Password Reuse: password-auth</xccdf-1.2:title>
                <xccdf-1.2:description>Do not allow users to reuse recent passwords. This can be accomplished by using the
<html:code>remember</html:code> option for the <html:code>pam_pwhistory</html:code> PAM module.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">If the system relies on <html:code>authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code>authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code>authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000200</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000077-GPOS-00045</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000077-VMM-000440</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_pwhistory_remember_password_auth"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_remember='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_remember" use="legacy"/>'
var_password_pam_remember_control_flag='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag" use="legacy"/>'


# control required is for rhel8, while requisite is for other distros
CONTROL=${var_password_pam_remember_control_flag}

if [ -f /usr/bin/authselect ]; then
    if authselect check; then
        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # Standard profiles delivered with authselect should not be modified.
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            # Ensure a backup before changing the profile
            authselect apply-changes -b --backup=before-pwhistory-hardening.backup
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
        fi
        # Include the desired configuration in the custom profile
        CUSTOM_PASSWORD_AUTH="/etc/authselect/$CURRENT_PROFILE/password-auth"
		if grep -q "^password.*pam_pwhistory.so.*" $CUSTOM_PASSWORD_AUTH; then
			if ! grep -q "^[^#].*pam_pwhistory.so.*remember=" $CUSTOM_PASSWORD_AUTH; then
				sed -i --follow-symlinks "/pam_pwhistory.so/ s/$/ remember=$var_password_pam_remember/" $CUSTOM_PASSWORD_AUTH
			else
				sed -r -i --follow-symlinks "s/(.*pam_pwhistory.so.*)(remember=[[:digit:]]+)\s(.*)/\1remember=$var_password_pam_remember \3/g" $CUSTOM_PASSWORD_AUTH
			fi
			# Ensure correct control is being used per os requirement
			if ! grep -q "^password.*$CONTROL.*pam_pwhistory.so.*" $CUSTOM_PASSWORD_AUTH; then
				# Replace incorrect value
				sed -r -i --follow-symlinks "s/(^password.*)(required|requisite)(.*pam_pwhistory\.so.*)$/\1$CONTROL\3/" $CUSTOM_PASSWORD_AUTH
			fi
		else
			sed -i --follow-symlinks "/^password.*requisite.*pam_pwquality.so/a password    $CONTROL     pam_pwhistory.so remember=$var_password_pam_remember use_authtok" $CUSTOM_PASSWORD_AUTH
		fi
        authselect apply-changes -b --backup=after-pwhistory-hardening.backup
    else
        echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because the authselect profile is not intact.
It is not recommended to manually edit the PAM files when authselect is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        false
    fi
else
	pamFile="/etc/pam.d/password-auth"
	# is 'password required|requisite pam_pwhistory.so' here?
	if grep -q "^password.*pam_pwhistory.so.*" $pamFile; then
		# is the remember option set?
		option=$(sed -rn 's/^(.*pam_pwhistory\.so.*)(remember=[0-9]+)(.*)$/\2/p' $pamFile)
		if [[ -z $option ]]; then
			# option is not set, append to module
			sed -i --follow-symlinks "/pam_pwhistory.so/ s/$/ remember=$var_password_pam_remember/" $pamFile
		else
			# option is set, replace value
			sed -r -i --follow-symlinks "s/^(.*pam_pwhistory\.so.*)(remember=[0-9]+)(.*)$/\1remember=$var_password_pam_remember\3/" $pamFile
		fi
		# ensure correct control is being used per os requirement
		if ! grep -q "^password.*$CONTROL.*pam_pwhistory.so.*" $pamFile; then
			#replace incorrect value
			sed -r -i --follow-symlinks "s/(^password.*)(required|requisite)(.*pam_pwhistory\.so.*)$/\1$CONTROL\3/" $pamFile
		fi
	else
		# no 'password required|requisite pam_pwhistory.so', add it
		sed -i --follow-symlinks "/^password.*pam_unix.so.*/i password $CONTROL pam_pwhistory.so use_authtok remember=$var_password_pam_remember" $pamFile
	fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_pwhistory_remember_password_auth" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_pwhistory_remember_password_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
- name: XCCDF Value var_password_pam_remember # promote to variable
  set_fact:
    var_password_pam_remember: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_remember" use="legacy"/>
  tags:
    - always
- name: XCCDF Value var_password_pam_remember_control_flag # promote to variable
  set_fact:
    var_password_pam_remember_control_flag: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag" use="legacy"/>
  tags:
    - always

- name: Check for existing pam_pwhistory.so entry
  ansible.builtin.lineinfile:
    path: /etc/pam.d/password-auth
    create: false
    regexp: ^password.*pam_pwhistory.so.*
    state: absent
  check_mode: true
  changed_when: false
  register: result_pam_pwhistory_present
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_pwhistory_remember_password_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Check for existing remember parameter entry
  ansible.builtin.lineinfile:
    path: /etc/pam.d/password-auth
    create: false
    regexp: ^password.*pam_pwhistory.so.*remember=
    state: absent
  check_mode: true
  changed_when: false
  register: result_pam_pwhistory_remember_present
  when:
    - '"pam" in ansible_facts.packages'
    - result_pam_pwhistory_present.found == 1
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_pwhistory_remember_password_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Check if system relies on authselect
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_pwhistory_remember_password_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Remediation where authselect tool is present
  block:

    - name: Check the integrity of the current authselect profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      ignore_errors: true

    - name: Informative message based on the authselect integrity check result
      ansible.builtin.assert:
        that:
          - result_authselect_check_cmd is success
        fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because the authselect profile is
            not intact.
          - It is not recommended to manually edit the PAM files when authselect is
            available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
        success_msg:
          - authselect integrity check passed

    - name: Get authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
        - result_authselect_check_cmd is success

    - name: Define the current authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

    - name: Define the new authselect custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

    - name: Get authselect current features to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

    - name: Check if any custom profile with the same name was already created in
        the past
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
        - authselect_current_profile is not match("custom/")

    - name: Create a custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("custom/")
        - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure the desired remember value is updated in the custom profile
      ansible.builtin.replace:
        dest: /etc/authselect/{{ authselect_custom_profile }}/password-auth
        regexp: (.*pam_pwhistory.so.*remember=)(\S+)(.*)$
        replace: \g&lt;1&gt;{{ var_password_pam_remember }}\g&lt;3&gt;
      when:
        - result_authselect_profile is not skipped
        - result_pam_pwhistory_present.found == 1
        - result_pam_pwhistory_remember_present.found == 1

    - name: Ensure the remember parameter is included in the custom profile
      ansible.builtin.replace:
        dest: /etc/authselect/{{ authselect_custom_profile }}/password-auth
        regexp: (.*pam_pwhistory.so.*)(?! remember=\S+)(.*)$
        replace: \g&lt;1&gt; \g&lt;2&gt; remember={{ var_password_pam_remember }}
      when:
        - result_authselect_profile is not skipped
        - result_pam_pwhistory_present.found == 1
        - result_pam_pwhistory_remember_present.found == 0

    - name: Ensure the desired control value is updated in the custom profile
      ansible.builtin.replace:
        dest: /etc/authselect/{{ authselect_custom_profile }}/password-auth
        regexp: ^(password\s+)((?:(?:requisite)|(?:required)))(\s+pam_pwhistory\.so\s.*)$
        replace: \g&lt;1&gt;{{ var_password_pam_remember_control_flag }}\g&lt;3&gt;
      when:
        - result_authselect_profile is not skipped
        - result_pam_pwhistory_present.found == 1

    - name: Ensure the desired configuration is present in the custom profile
      ansible.builtin.lineinfile:
        dest: /etc/authselect/{{ authselect_custom_profile }}/password-auth
        insertafter: ^password.*requisite.*pam_pwquality.so.*
        line: password    {{ var_password_pam_remember_control_flag }}     pam_pwhistory.so
          remember={{ var_password_pam_remember }} use_authtok
      when:
        - result_authselect_profile is not skipped
        - result_pam_pwhistory_present.found == 0

    - name: Ensure a backup of current authselect profile before selecting the custom
        profile
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-pwhistory-hardening.backup
      register: result_authselect_backup
      when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure the custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }} --force
      register: result_pam_authselect_select_profile
      when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

    - name: Restore the authselect features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

    - name: Ensure the custom profile changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-pwhistory-hardening.backup
      when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
  when:
    - '"pam" in ansible_facts.packages'
    - result_authselect_present.stat.exists
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_pwhistory_remember_password_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Remediation where authselect tool is not present and PAM files are directly
    edited
  block:

    - name: Ensure the desired remember value is updated in the custom profile
      ansible.builtin.replace:
        dest: /etc/pam.d/password-auth
        regexp: (.*pam_pwhistory.so.*remember=)(\S+)(.*)$
        replace: \g&lt;1&gt;{{ var_password_pam_remember }}\g&lt;3&gt;
      when:
        - result_pam_pwhistory_present.found == 1

    - name: Ensure the remember parameter is included in the custom profile
      ansible.builtin.replace:
        dest: /etc/pam.d/password-auth
        regexp: (.*pam_pwhistory.so.*)(?! remember=\S+)(.*)$
        replace: \g&lt;1&gt; \g&lt;2&gt; remember={{ var_password_pam_remember }}
      when:
        - result_pam_pwhistory_present.found == 1
        - result_pam_pwhistory_remember_present.found == 0

    - name: Ensure the desired control value is updated in the custom profile
      ansible.builtin.replace:
        dest: /etc/pam.d/password-auth
        regexp: ^(password\s+)((?:(?:requisite)|(?:required)))(\s+pam_pwhistory\.so\s.*)$
        replace: \g&lt;1&gt;{{ var_password_pam_remember_control_flag }}\g&lt;3&gt;
      when:
        - result_pam_pwhistory_present.found == 1

    - name: Ensure the desired configuration is present in the custom profile
      ansible.builtin.lineinfile:
        dest: /etc/pam.d/password-auth
        insertafter: ^password.*requisite.*pam_pwquality.so.*
        line: password    {{ var_password_pam_remember_control_flag }}     pam_pwhistory.so
          remember={{ var_password_pam_remember }} use_authtok
      when:
        - result_pam_pwhistory_present.found == 0
  when:
    - '"pam" in ansible_facts.packages'
    - not result_authselect_present.stat.exists
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_pwhistory_remember_password_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_remember_control_flag:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag"/>
                  <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_remember:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_remember"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_password_pam_pwhistory_remember_password_auth:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_password_pam_pwhistory_remember_password_auth_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth" severity="medium">
                <xccdf-1.2:title>Limit Password Reuse: system-auth</xccdf-1.2:title>
                <xccdf-1.2:description>Do not allow users to reuse recent passwords. This can be accomplished by using the
<html:code>remember</html:code> option for the <html:code>pam_pwhistory</html:code> PAM module.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">If the system relies on <html:code>authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code>authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code>authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000200</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000077-GPOS-00045</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000077-VMM-000440</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_pwhistory_remember_system_auth"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_remember='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_remember" use="legacy"/>'
var_password_pam_remember_control_flag='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag" use="legacy"/>'


# control required is for rhel8, while requisite is for other distros
CONTROL=${var_password_pam_remember_control_flag}

if [ -f /usr/bin/authselect ]; then
    if authselect check; then
        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # Standard profiles delivered with authselect should not be modified.
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            # Ensure a backup before changing the profile
            authselect apply-changes -b --backup=before-pwhistory-hardening.backup
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
        fi
        # Include the desired configuration in the custom profile
        CUSTOM_SYSTEM_AUTH="/etc/authselect/$CURRENT_PROFILE/system-auth"
		if grep -q "^password.*pam_pwhistory.so.*" $CUSTOM_SYSTEM_AUTH; then
			if ! grep -q "^[^#].*pam_pwhistory.so.*remember=" $CUSTOM_SYSTEM_AUTH; then
				sed -i --follow-symlinks "/pam_pwhistory.so/ s/$/ remember=$var_password_pam_remember/" $CUSTOM_SYSTEM_AUTH
			else
				sed -r -i --follow-symlinks "s/(.*pam_pwhistory.so.*)(remember=[[:digit:]]+)\s(.*)/\1remember=$var_password_pam_remember \3/g" $CUSTOM_SYSTEM_AUTH
			fi
			# Ensure correct control is being used per os requirement
			if ! grep -q "^password.*$CONTROL.*pam_pwhistory.so.*" $CUSTOM_SYSTEM_AUTH; then
				# Replace incorrect value
				sed -r -i --follow-symlinks "s/(^password.*)(required|requisite)(.*pam_pwhistory\.so.*)$/\1$CONTROL\3/" $CUSTOM_SYSTEM_AUTH
			fi
		else
			sed -i --follow-symlinks "/^password.*requisite.*pam_pwquality.so/a password    $CONTROL     pam_pwhistory.so remember=$var_password_pam_remember use_authtok" $CUSTOM_SYSTEM_AUTH
		fi
        authselect apply-changes -b --backup=after-pwhistory-hardening.backup
    else
        echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because the authselect profile is not intact.
It is not recommended to manually edit the PAM files when authselect is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        false
    fi
else
	pamFile="/etc/pam.d/system-auth"
	# is 'password required|requisite pam_pwhistory.so' here?
	if grep -q "^password.*pam_pwhistory.so.*" $pamFile; then
		# is the remember option set?
		option=$(sed -rn 's/^(.*pam_pwhistory\.so.*)(remember=[0-9]+)(.*)$/\2/p' $pamFile)
		if [[ -z $option ]]; then
			# option is not set, append to module
			sed -i --follow-symlinks "/pam_pwhistory.so/ s/$/ remember=$var_password_pam_remember/" $pamFile
		else
			# option is set, replace value
			sed -r -i --follow-symlinks "s/^(.*pam_pwhistory\.so.*)(remember=[0-9]+)(.*)$/\1remember=$var_password_pam_remember\3/" $pamFile
		fi
		# ensure correct control is being used per os requirement
		if ! grep -q "^password.*$CONTROL.*pam_pwhistory.so.*" $pamFile; then
			#replace incorrect value
			sed -r -i --follow-symlinks "s/(^password.*)(required|requisite)(.*pam_pwhistory\.so.*)$/\1$CONTROL\3/" $pamFile
		fi
	else
		# no 'password required|requisite pam_pwhistory.so', add it
		sed -i --follow-symlinks "/^password.*pam_unix.so.*/i password $CONTROL pam_pwhistory.so use_authtok remember=$var_password_pam_remember" $pamFile
	fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_pwhistory_remember_system_auth" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_pwhistory_remember_system_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
- name: XCCDF Value var_password_pam_remember # promote to variable
  set_fact:
    var_password_pam_remember: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_remember" use="legacy"/>
  tags:
    - always
- name: XCCDF Value var_password_pam_remember_control_flag # promote to variable
  set_fact:
    var_password_pam_remember_control_flag: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag" use="legacy"/>
  tags:
    - always

- name: Check for existing pam_pwhistory.so entry
  ansible.builtin.lineinfile:
    path: /etc/pam.d/system-auth
    create: false
    regexp: ^password.*pam_pwhistory.so.*
    state: absent
  check_mode: true
  changed_when: false
  register: result_pam_pwhistory_present
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_pwhistory_remember_system_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Check for existing remember parameter entry
  ansible.builtin.lineinfile:
    path: /etc/pam.d/system-auth
    create: false
    regexp: ^password.*pam_pwhistory.so.*remember=
    state: absent
  check_mode: true
  changed_when: false
  register: result_pam_pwhistory_remember_present
  when:
    - '"pam" in ansible_facts.packages'
    - result_pam_pwhistory_present.found == 1
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_pwhistory_remember_system_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Check if system relies on authselect
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_pwhistory_remember_system_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Remediation where authselect tool is present
  block:

    - name: Check the integrity of the current authselect profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      ignore_errors: true

    - name: Informative message based on the authselect integrity check result
      ansible.builtin.assert:
        that:
          - result_authselect_check_cmd is success
        fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because the authselect profile is
            not intact.
          - It is not recommended to manually edit the PAM files when authselect is
            available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
        success_msg:
          - authselect integrity check passed

    - name: Get authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
        - result_authselect_check_cmd is success

    - name: Define the current authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

    - name: Define the new authselect custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

    - name: Get authselect current features to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

    - name: Check if any custom profile with the same name was already created in
        the past
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
        - authselect_current_profile is not match("custom/")

    - name: Create a custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("custom/")
        - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure the desired remember value is updated in the custom profile
      ansible.builtin.replace:
        dest: /etc/authselect/{{ authselect_custom_profile }}/system-auth
        regexp: (.*pam_pwhistory.so.*remember=)(\S+)(.*)$
        replace: \g&lt;1&gt;{{ var_password_pam_remember }}\g&lt;3&gt;
      when:
        - result_authselect_profile is not skipped
        - result_pam_pwhistory_present.found == 1
        - result_pam_pwhistory_remember_present.found == 1

    - name: Ensure the remember parameter is included in the custom profile
      ansible.builtin.replace:
        dest: /etc/authselect/{{ authselect_custom_profile }}/system-auth
        regexp: (.*pam_pwhistory.so.*)(?! remember=\S+)(.*)$
        replace: \g&lt;1&gt; \g&lt;2&gt; remember={{ var_password_pam_remember }}
      when:
        - result_authselect_profile is not skipped
        - result_pam_pwhistory_present.found == 1
        - result_pam_pwhistory_remember_present.found == 0

    - name: Ensure the desired control value is updated in the custom profile
      ansible.builtin.replace:
        dest: /etc/authselect/{{ authselect_custom_profile }}/system-auth
        regexp: ^(password\s+)((?:(?:requisite)|(?:required)))(\s+pam_pwhistory\.so\s.*)$
        replace: \g&lt;1&gt;{{ var_password_pam_remember_control_flag }}\g&lt;3&gt;
      when:
        - result_authselect_profile is not skipped
        - result_pam_pwhistory_present.found == 1

    - name: Ensure the desired configuration is present in the custom profile
      ansible.builtin.lineinfile:
        dest: /etc/authselect/{{ authselect_custom_profile }}/system-auth
        insertafter: ^password.*requisite.*pam_pwquality.so.*
        line: password    {{ var_password_pam_remember_control_flag }}     pam_pwhistory.so
          remember={{ var_password_pam_remember }} use_authtok
      when:
        - result_authselect_profile is not skipped
        - result_pam_pwhistory_present.found == 0

    - name: Ensure a backup of current authselect profile before selecting the custom
        profile
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-pwhistory-hardening.backup
      register: result_authselect_backup
      when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure the custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }} --force
      register: result_pam_authselect_select_profile
      when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

    - name: Restore the authselect features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

    - name: Ensure the custom profile changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-pwhistory-hardening.backup
      when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
  when:
    - '"pam" in ansible_facts.packages'
    - result_authselect_present.stat.exists
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_pwhistory_remember_system_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Remediation where authselect tool is not present and PAM files are directly
    edited
  block:

    - name: Ensure the desired remember value is updated in the custom profile
      ansible.builtin.replace:
        dest: /etc/pam.d/system-auth
        regexp: (.*pam_pwhistory.so.*remember=)(\S+)(.*)$
        replace: \g&lt;1&gt;{{ var_password_pam_remember }}\g&lt;3&gt;
      when:
        - result_pam_pwhistory_present.found == 1

    - name: Ensure the remember parameter is included in the custom profile
      ansible.builtin.replace:
        dest: /etc/pam.d/system-auth
        regexp: (.*pam_pwhistory.so.*)(?! remember=\S+)(.*)$
        replace: \g&lt;1&gt; \g&lt;2&gt; remember={{ var_password_pam_remember }}
      when:
        - result_pam_pwhistory_present.found == 1
        - result_pam_pwhistory_remember_present.found == 0

    - name: Ensure the desired control value is updated in the custom profile
      ansible.builtin.replace:
        dest: /etc/pam.d/system-auth
        regexp: ^(password\s+)((?:(?:requisite)|(?:required)))(\s+pam_pwhistory\.so\s.*)$
        replace: \g&lt;1&gt;{{ var_password_pam_remember_control_flag }}\g&lt;3&gt;
      when:
        - result_pam_pwhistory_present.found == 1

    - name: Ensure the desired configuration is present in the custom profile
      ansible.builtin.lineinfile:
        dest: /etc/pam.d/system-auth
        insertafter: ^password.*requisite.*pam_pwquality.so.*
        line: password    {{ var_password_pam_remember_control_flag }}     pam_pwhistory.so
          remember={{ var_password_pam_remember }} use_authtok
      when:
        - result_pam_pwhistory_present.found == 0
  when:
    - '"pam" in ansible_facts.packages'
    - not result_authselect_present.stat.exists
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_pwhistory_remember_system_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_remember_control_flag:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag"/>
                  <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_remember:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_remember"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_password_pam_pwhistory_remember_system_auth:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_password_pam_pwhistory_remember_system_auth_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember" severity="medium">
                <xccdf-1.2:title>Limit Password Reuse</xccdf-1.2:title>
                <xccdf-1.2:description>Do not allow users to reuse recent passwords. This can be accomplished by using the
<html:code>remember</html:code> option for the <html:code>pam_unix</html:code> or <html:code>pam_pwhistory</html:code> PAM modules.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">If the system relies on <html:code>authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code>authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code>authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000200</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000077-GPOS-00045</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000077-VMM-000440</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_unix_remember"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_unix_remember='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember" use="legacy"/>'


if [ -f /usr/bin/authselect ]; then
    if authselect check; then
        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # Standard profiles delivered with authselect should not be modified.
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            # Ensure a backup before changing the profile
            authselect apply-changes -b --backup=before-pwhistory-hardening.backup
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
        fi
        # Include the desired configuration in the custom profile
        CUSTOM_SYSTEM_AUTH="/etc/authselect/$CURRENT_PROFILE/system-auth"
        CUSTOM_PASSWORD_AUTH="/etc/authselect/$CURRENT_PROFILE/password-auth"
        for custom_pam_file in $CUSTOM_SYSTEM_AUTH $CUSTOM_PASSWORD_AUTH; do
            if ! grep -q "^[^#].*pam_pwhistory.so.*remember=" $custom_pam_file; then
                sed -i --follow-symlinks "/^password.*requisite.*pam_pwquality.so/a password    requisite     pam_pwhistory.so remember=$var_password_pam_unix_remember use_authtok" $custom_pam_file
            else
                sed -i --follow-symlinks "s/\(.*pam_pwhistory.so.*remember=\)[[:digit:]]\+\s\(.*\)/\1$var_password_pam_unix_remember \2/g" $custom_pam_file
            fi
        done
        authselect apply-changes -b --backup=after-pwhistory-hardening.backup
    else
        echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because the authselect profile is not intact.
It is not recommended to manually edit the PAM files when authselect is available
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        false
    fi
else
    
    AUTH_FILES[0]="/etc/pam.d/system-auth"
    
    AUTH_FILES[1]="/etc/pam.d/password-auth"

    for pamFile in "${AUTH_FILES[@]}"; do
        if grep -q "pam_unix.so.*" $pamFile; then
            if [ -e "$pamFile" ] ; then
    valueRegex="$var_password_pam_unix_remember" defaultValue="$var_password_pam_unix_remember"
    # non-empty values need to be preceded by an equals sign
    [ -n "${valueRegex}" ] &amp;&amp; valueRegex="=${valueRegex}"
    # add an equals sign to non-empty values
    [ -n "${defaultValue}" ] &amp;&amp; defaultValue="=${defaultValue}"

    # fix the value for 'option' if one exists but does not match 'valueRegex'
    if grep -q -P "^\\s*password\\s+sufficient\\s+pam_unix.so(\\s.+)?\\s+remember(?"'!'"${valueRegex}(\\s|\$))" &lt; "$pamFile" ; then
        sed --follow-symlinks -i -E -e "s/^(\\s*password\\s+sufficient\\s+pam_unix.so(\\s.+)?\\s)remember=[^[:space:]]*/\\1remember${defaultValue}/" "$pamFile"

    # add 'option=default' if option is not set
    elif grep -q -E "^\\s*password\\s+sufficient\\s+pam_unix.so" &lt; "$pamFile" &amp;&amp;
            grep    -E "^\\s*password\\s+sufficient\\s+pam_unix.so" &lt; "$pamFile" | grep -q -E -v "\\sremember(=|\\s|\$)" ; then

        sed --follow-symlinks -i -E -e "s/^(\\s*password\\s+sufficient\\s+pam_unix.so[^\\n]*)/\\1 remember${defaultValue}/" "$pamFile"
    # add a new entry if none exists
    elif ! grep -q -P "^\\s*password\\s+sufficient\\s+pam_unix.so(\\s.+)?\\s+remember${valueRegex}(\\s|\$)" &lt; "$pamFile" ; then
        echo "password sufficient pam_unix.so remember${defaultValue}" &gt;&gt; "$pamFile"
    fi
else
    echo "$pamFile doesn't exist" &gt;&amp;2
fi
        fi
        if grep -q "pam_pwhistory.so.*" $pamFile; then
            if [ -e "$pamFile" ] ; then
    valueRegex="$var_password_pam_unix_remember" defaultValue="$var_password_pam_unix_remember"
    # non-empty values need to be preceded by an equals sign
    [ -n "${valueRegex}" ] &amp;&amp; valueRegex="=${valueRegex}"
    # add an equals sign to non-empty values
    [ -n "${defaultValue}" ] &amp;&amp; defaultValue="=${defaultValue}"

    # fix the value for 'option' if one exists but does not match 'valueRegex'
    if grep -q -P "^\\s*password\\s+required\\s+pam_pwhistory.so(\\s.+)?\\s+remember(?"'!'"${valueRegex}(\\s|\$))" &lt; "$pamFile" ; then
        sed --follow-symlinks -i -E -e "s/^(\\s*password\\s+required\\s+pam_pwhistory.so(\\s.+)?\\s)remember=[^[:space:]]*/\\1remember${defaultValue}/" "$pamFile"

    # add 'option=default' if option is not set
    elif grep -q -E "^\\s*password\\s+required\\s+pam_pwhistory.so" &lt; "$pamFile" &amp;&amp;
            grep    -E "^\\s*password\\s+required\\s+pam_pwhistory.so" &lt; "$pamFile" | grep -q -E -v "\\sremember(=|\\s|\$)" ; then

        sed --follow-symlinks -i -E -e "s/^(\\s*password\\s+required\\s+pam_pwhistory.so[^\\n]*)/\\1 remember${defaultValue}/" "$pamFile"
    # add a new entry if none exists
    elif ! grep -q -P "^\\s*password\\s+required\\s+pam_pwhistory.so(\\s.+)?\\s+remember${valueRegex}(\\s|\$)" &lt; "$pamFile" ; then
        echo "password required pam_pwhistory.so remember${defaultValue}" &gt;&gt; "$pamFile"
    fi
else
    echo "$pamFile doesn't exist" &gt;&amp;2
fi
        fi
    done
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_unix_remember" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
- name: XCCDF Value var_password_pam_unix_remember # promote to variable
  set_fact:
    var_password_pam_unix_remember: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember" use="legacy"/>
  tags:
    - always

- name: Check if system relies on authselect
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Check the integrity of the current authselect profile
  ansible.builtin.command:
    cmd: authselect check
  register: result_authselect_check_cmd
  changed_when: false
  ignore_errors: true
  when:
    - '"pam" in ansible_facts.packages'
    - result_authselect_present.stat.exists
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Informative message based on the authselect integrity check result
  ansible.builtin.assert:
    that:
      - result_authselect_check_cmd is success
    fail_msg:
      - authselect integrity check failed. Remediation aborted!
      - This remediation could not be applied because the authselect profile is not
        intact.
      - It is not recommended to manually edit the PAM files when authselect is available
      - In cases where the default authselect profile does not cover a specific demand,
        a custom authselect profile is recommended.
    success_msg:
      - authselect integrity check passed
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Get authselect current profile
  ansible.builtin.shell:
    cmd: authselect current -r | awk '{ print $1 }'
  register: result_authselect_profile
  changed_when: false
  when:
    - '"pam" in ansible_facts.packages'
    - result_authselect_present.stat.exists
    - result_authselect_check_cmd is success
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Define the current authselect profile as a local fact
  ansible.builtin.set_fact:
    authselect_current_profile: '{{ result_authselect_profile.stdout }}'
    authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
  when:
    - '"pam" in ansible_facts.packages'
    - result_authselect_profile is not skipped
    - result_authselect_profile.stdout is match("custom/")
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Define the new authselect custom profile as a local fact
  ansible.builtin.set_fact:
    authselect_current_profile: '{{ result_authselect_profile.stdout }}'
    authselect_custom_profile: custom/hardening
  when:
    - '"pam" in ansible_facts.packages'
    - result_authselect_profile is not skipped
    - result_authselect_profile.stdout is not match("custom/")
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Get authselect current features to also enable them in the custom profile
  ansible.builtin.shell:
    cmd: authselect current | tail -n+3 | awk '{ print $2 }'
  register: result_authselect_features
  changed_when: false
  when:
    - '"pam" in ansible_facts.packages'
    - result_authselect_profile is not skipped
    - authselect_current_profile is not match("custom/")
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Check if any custom profile with the same name was already created in the
    past
  ansible.builtin.stat:
    path: /etc/authselect/{{ authselect_custom_profile }}
  register: result_authselect_custom_profile_present
  changed_when: false
  when:
    - '"pam" in ansible_facts.packages'
    - result_authselect_present.stat.exists
    - authselect_current_profile is not match("custom/")
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Create a custom profile based on the current profile
  ansible.builtin.command:
    cmd: authselect create-profile hardening -b sssd
  register: result_authselect_create_profile
  when:
    - '"pam" in ansible_facts.packages'
    - result_authselect_present.stat.exists
    - result_authselect_check_cmd is success
    - authselect_current_profile is not match("custom/")
    - not result_authselect_custom_profile_present.stat.exists
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure the desired configuration is updated in the custom profile
  ansible.builtin.replace:
    dest: '{{ item }}'
    regexp: (.*pam_pwhistory.so.*remember=)(\S+)(.*)$
    replace: \g&lt;1&gt;{{ var_password_pam_unix_remember }}\g&lt;3&gt;
  loop:
    - /etc/authselect/{{ authselect_custom_profile }}/system-auth
    - /etc/authselect/{{ authselect_custom_profile }}/password-auth
  when:
    - '"pam" in ansible_facts.packages'
    - result_authselect_profile is not skipped
    - authselect_custom_profile is match("custom/")
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure the desired configuration in present in the custom profile
  ansible.builtin.lineinfile:
    dest: '{{ item }}'
    insertafter: ^password.*requisite.*pam_pwquality.so.*
    line: password    requisite     pam_pwhistory.so remember={{ var_password_pam_unix_remember
      }} use_authtok
  loop:
    - /etc/authselect/{{ authselect_custom_profile }}/system-auth
    - /etc/authselect/{{ authselect_custom_profile }}/password-auth
  when:
    - '"pam" in ansible_facts.packages'
    - result_authselect_profile is not skipped
    - authselect_custom_profile is match("custom/")
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure a backup of current authselect profile before select the custom profile
  ansible.builtin.command:
    cmd: authselect apply-changes -b --backup=before-pwhistory-hardening.backup
  register: result_authselect_backup
  when:
    - '"pam" in ansible_facts.packages'
    - result_authselect_check_cmd is success
    - result_authselect_profile is not skipped
    - authselect_current_profile is not match("custom/")
    - authselect_custom_profile is not match(authselect_current_profile)
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure the custom profile is selected
  ansible.builtin.command:
    cmd: authselect select {{ authselect_custom_profile }} --force
  register: result_pam_authselect_select_profile
  when:
    - '"pam" in ansible_facts.packages'
    - result_authselect_check_cmd is success
    - result_authselect_profile is not skipped
    - authselect_current_profile is not match("custom/")
    - authselect_custom_profile is not match(authselect_current_profile)
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Restore the authselect features in the custom profile
  ansible.builtin.command:
    cmd: authselect enable-feature {{ item }}
  register: result_pam_authselect_select_features
  loop: '{{ result_authselect_features.stdout_lines }}'
  when:
    - '"pam" in ansible_facts.packages'
    - result_authselect_profile is not skipped
    - result_authselect_features is not skipped
    - result_pam_authselect_select_profile is not skipped
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure the custom profile changes are applied
  ansible.builtin.command:
    cmd: authselect apply-changes -b --backup=after-pwhistory-hardening.backup
  when:
    - '"pam" in ansible_facts.packages'
    - result_authselect_check_cmd is success
    - result_authselect_profile is not skipped
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Do not allow users to reuse recent passwords - system-auth (change)
  replace:
    dest: /etc/pam.d/system-auth
    regexp: ^(password\s+sufficient\s+pam_unix\.so\s.*remember\s*=\s*)(\S+)(.*)$
    replace: \g&lt;1&gt;{{ var_password_pam_unix_remember }}\g&lt;3&gt;
  when:
    - '"pam" in ansible_facts.packages'
    - not result_authselect_present.stat.exists
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Do not allow users to reuse recent passwords - system-auth (add)
  replace:
    dest: /etc/pam.d/system-auth
    regexp: ^password\s+sufficient\s+pam_unix\.so\s(?!.*remember\s*=\s*).*$
    replace: \g&lt;0&gt; remember={{ var_password_pam_unix_remember }}
  when:
    - '"pam" in ansible_facts.packages'
    - not result_authselect_present.stat.exists
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Do not allow users to reuse recent passwords - system-auth (change)
  replace:
    dest: /etc/pam.d/system-auth
    regexp: ^(password\s+(?:(?:requisite)|(?:required))\s+pam_pwhistory\.so\s.*remember\s*=\s*)(\S+)(.*)$
    replace: \g&lt;1&gt;{{ var_password_pam_unix_remember }}\g&lt;3&gt;
  when:
    - '"pam" in ansible_facts.packages'
    - not result_authselect_present.stat.exists
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Do not allow users to reuse recent passwords - system-auth (add)
  replace:
    dest: /etc/pam.d/system-auth
    regexp: ^password\s+(?:(?:requisite)|(?:required))\s+pam_pwhistory\.so\s(?!.*remember\s*=\s*).*$
    replace: \g&lt;0&gt; remember={{ var_password_pam_unix_remember }}
  when:
    - '"pam" in ansible_facts.packages'
    - not result_authselect_present.stat.exists
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_unix_remember:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_password_pam_unix_remember:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_password_pam_unix_remember_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny" severity="medium">
                <xccdf-1.2:title>Lock Accounts After Failed Password Attempts</xccdf-1.2:title>
                <xccdf-1.2:description>This rule configures the system to lock out accounts after a number of incorrect login attempts
using <html:code>pam_faillock.so</html:code>.

pam_faillock.so module requires multiple entries in pam files. These entries must be carefully
defined to work as expected. In order to avoid errors when manually editing these files, it is
recommended to use the appropriate tools, such as <html:code>authselect</html:code> or <html:code>authconfig</html:code>,
depending on the OS version.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">If the system relies on <html:code>authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code>authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code>authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.
If the system supports the <html:code>/etc/security/faillock.conf</html:code> file, the pam_faillock
parameters should be defined in <html:code>faillock.conf</html:code> file.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000044</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002236</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002237</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002238</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0421</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0422</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0431</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0974</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1173</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1401</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1504</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1505</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1546</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1557</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1558</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1559</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1560</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1561</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_AFL.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000329-GPOS-00128</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000021-GPOS-00005</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000021-VMM-000050</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Locking out user accounts after a number of incorrect attempts prevents direct password
guessing attacks. In combination with the <html:code>silent</html:code> option, user enumeration attacks
are also mitigated.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_passwords_pam_faillock_deny"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_accounts_passwords_pam_faillock_deny='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" use="legacy"/>'


if [ -f /usr/bin/authselect ]; then
    if authselect check; then
    authselect enable-feature with-faillock
    authselect apply-changes
else
    echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
It is not recommended to manually edit the PAM files when authselect tool is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
    false
fi
else
    AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
for pam_file in "${AUTH_FILES[@]}"
do
    if ! grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+(preauth silent|authfail).*$' "$pam_file" ; then
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix.so.*/i auth        required      pam_faillock.so preauth silent' "$pam_file"
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix.so.*/a auth        required      pam_faillock.so authfail' "$pam_file"
        sed -i --follow-symlinks '/^account.*required.*pam_unix.so.*/i account     required      pam_faillock.so' "$pam_file"
    fi
    sed -Ei 's/(auth.*)(\[default=die\])(.*pam_faillock.so)/\1required     \3/g' "$pam_file"
done
fi
FAILLOCK_CONF="/etc/security/faillock.conf"
if [ -f $FAILLOCK_CONF ]; then
    regex="^\s*deny\s*="
    line="deny = $var_accounts_passwords_pam_faillock_deny"
    if ! grep -q $regex $FAILLOCK_CONF; then
        echo $line &gt;&gt; $FAILLOCK_CONF
    else
        sed -i --follow-symlinks 's/^\s*\(deny\s*=\s*\)\([0-9]\+\)/\1'"$var_accounts_passwords_pam_faillock_deny"'/g' $FAILLOCK_CONF
    fi
else
    AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
    for pam_file in "${AUTH_FILES[@]}"
    do
        if ! grep -qE '^\s*auth.*pam_faillock.so (preauth|authfail).*deny' "$pam_file"; then
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock.so.*preauth.*silent.*/ s/$/ deny='"$var_accounts_passwords_pam_faillock_deny"'/' "$pam_file"
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock.so.*authfail.*/ s/$/ deny='"$var_accounts_passwords_pam_faillock_deny"'/' "$pam_file"
        else
            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock.so.*preauth.*silent.*\)\('"deny"'=\)[0-9]\+\(.*\)/\1\2'"$var_accounts_passwords_pam_faillock_deny"'\3/' "$pam_file"
            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock.so.*authfail.*\)\('"deny"'=\)[0-9]\+\(.*\)/\1\2'"$var_accounts_passwords_pam_faillock_deny"'\3/' "$pam_file"
        fi
    done
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_passwords_pam_faillock_deny" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Lock Accounts After Failed Password Attempts - Check if system relies on authselect
    tool
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Lock Accounts After Failed Password Attempts - Remediation where authselect
    tool is present
  block:

    - name: Lock Accounts After Failed Password Attempts - Check integrity of authselect
        current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      ignore_errors: true

    - name: Lock Accounts After Failed Password Attempts - Informative message based
        on the authselect integrity check result
      ansible.builtin.assert:
        that:
          - result_authselect_check_cmd is success
        fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
        success_msg:
          - authselect integrity check passed

    - name: Lock Accounts After Failed Password Attempts - Get authselect current
        features
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
        - result_authselect_check_cmd is success

    - name: Lock Accounts After Failed Password Attempts - Ensure with-faillock feature
        is enabled using authselect tool
      ansible.builtin.command:
        cmd: authselect enable-feature with-faillock
      register: result_authselect_cmd
      when:
        - result_authselect_check_cmd is success
        - result_authselect_features.stdout is not search("with-faillock")
  when:
    - '"pam" in ansible_facts.packages'
    - result_authselect_present.stat.exists
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Lock Accounts After Failed Password Attempts - Remediation where authselect
    tool is not present
  block:

    - name: Lock Accounts After Failed Password Attempts - Check if pam_faillock.so
        is already enabled
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock.so (preauth|authfail)
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_is_enabled

    - name: Lock Accounts After Failed Password Attempts - Enable pam_faillock.so
        preauth editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so preauth
        insertbefore: ^auth.*sufficient.*pam_unix.so.*
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_is_enabled.found == 0

    - name: Lock Accounts After Failed Password Attempts - Enable pam_faillock.so
        authfail editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so authfail
        insertafter: ^auth.*sufficient.*pam_unix.so.*
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_is_enabled.found == 0

    - name: Lock Accounts After Failed Password Attempts - Enable pam_faillock.so
        account section editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: account     required      pam_faillock.so
        insertbefore: ^account.*required.*pam_unix.so.*
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_is_enabled.found == 0
  when:
    - '"pam" in ansible_facts.packages'
    - not result_authselect_present.stat.exists
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_accounts_passwords_pam_faillock_deny # promote to variable
  set_fact:
    var_accounts_passwords_pam_faillock_deny: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" use="legacy"/>
  tags:
    - always

- name: Lock Accounts After Failed Password Attempts - Check the presence of /etc/security/faillock.conf
    file
  ansible.builtin.stat:
    path: /etc/security/faillock.conf
  register: result_faillock_conf_check
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Lock Accounts After Failed Password Attempts - Ensure the pam_faillock.so
    deny parameter in /etc/security/faillock.conf
  ansible.builtin.lineinfile:
    path: /etc/security/faillock.conf
    regexp: ^\s*deny\s*=
    line: deny = {{ var_accounts_passwords_pam_faillock_deny }}
    state: present
  when:
    - '"pam" in ansible_facts.packages'
    - result_faillock_conf_check.stat.exists
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Lock Accounts After Failed Password Attempts - Ensure the pam_faillock.so
    deny parameter in PAM files
  block:

    - name: Lock Accounts After Failed Password Attempts - Check if pam_faillock.so
        deny parameter is already enabled in pam files
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock.so (preauth|authfail).*deny
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_deny_parameter_is_present

    - name: Lock Accounts After Failed Password Attempts - Ensure the inclusion of
        pam_faillock.so preauth deny parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)
        line: \1required\3 deny={{ var_accounts_passwords_pam_faillock_deny }}
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_deny_parameter_is_present.found == 0

    - name: Lock Accounts After Failed Password Attempts - Ensure the inclusion of
        pam_faillock.so authfail deny parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)
        line: \1required\3 deny={{ var_accounts_passwords_pam_faillock_deny }}
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_deny_parameter_is_present.found == 0

    - name: Lock Accounts After Failed Password Attempts - Ensure the desired value
        for pam_faillock.so preauth deny parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)(deny)=[0-9]+(.*)
        line: \1required\3\4={{ var_accounts_passwords_pam_faillock_deny }}\5
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_deny_parameter_is_present.found &gt; 0

    - name: Lock Accounts After Failed Password Attempts - Ensure the desired value
        for pam_faillock.so authfail deny parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)(deny)=[0-9]+(.*)
        line: \1required\3\4={{ var_accounts_passwords_pam_faillock_deny }}\5
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_deny_parameter_is_present.found &gt; 0
  when:
    - '"pam" in ansible_facts.packages'
    - not result_faillock_conf_check.stat.exists
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_passwords_pam_faillock_deny:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_passwords_pam_faillock_deny_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root" severity="medium">
                <xccdf-1.2:title>Configure the root Account for Failed Password Attempts</xccdf-1.2:title>
                <xccdf-1.2:description>This rule configures the system to lock out the <html:code>root</html:code> account after a number of
incorrect login attempts using <html:code>pam_faillock.so</html:code>.

pam_faillock.so module requires multiple entries in pam files. These entries must be carefully
defined to work as expected. In order to avoid errors when manually editing these files, it is
recommended to use the appropriate tools, such as <html:code>authselect</html:code> or <html:code>authconfig</html:code>,
depending on the OS version.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">If the system relies on <html:code>authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code>authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code>authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.
If the system supports the <html:code>/etc/security/faillock.conf</html:code> file, the pam_faillock
parameters should be defined in <html:code>faillock.conf</html:code> file.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002238</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000044</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0421</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0422</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0431</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0974</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1173</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1401</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1504</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1505</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1546</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1557</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1558</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1559</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1560</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1561</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000329-GPOS-00128</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000021-GPOS-00005</xccdf-1.2:reference>
                <xccdf-1.2:rationale>By limiting the number of failed logon attempts, the risk of unauthorized system access via
user password guessing, also known as brute-forcing, is reduced. Limits are imposed by locking
the account.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_passwords_pam_faillock_deny_root"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

if [ -f /usr/bin/authselect ]; then
    if authselect check; then
    authselect enable-feature with-faillock
    authselect apply-changes
else
    echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
It is not recommended to manually edit the PAM files when authselect tool is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
    false
fi
else
    AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
for pam_file in "${AUTH_FILES[@]}"
do
    if ! grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+(preauth silent|authfail).*$' "$pam_file" ; then
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix.so.*/i auth        required      pam_faillock.so preauth silent' "$pam_file"
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix.so.*/a auth        required      pam_faillock.so authfail' "$pam_file"
        sed -i --follow-symlinks '/^account.*required.*pam_unix.so.*/i account     required      pam_faillock.so' "$pam_file"
    fi
    sed -Ei 's/(auth.*)(\[default=die\])(.*pam_faillock.so)/\1required     \3/g' "$pam_file"
done
fi
FAILLOCK_CONF="/etc/security/faillock.conf"
if [ -f $FAILLOCK_CONF ]; then
    regex="^\s*even_deny_root"
    line="even_deny_root"
    if ! grep -q $regex $FAILLOCK_CONF; then
        echo $line &gt;&gt; $FAILLOCK_CONF
    fi
else
    AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
    for pam_file in "${AUTH_FILES[@]}"
    do
        if ! grep -qE '^\s*auth.*pam_faillock.so (preauth|authfail).*even_deny_root' "$pam_file"; then
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock.so.*preauth.*silent.*/ s/$/ even_deny_root/' "$pam_file"
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock.so.*authfail.*/ s/$/ even_deny_root/' "$pam_file"
        fi
    done
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_passwords_pam_faillock_deny_root" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(c)
    - accounts_passwords_pam_faillock_deny_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Configure the root Account for Failed Password Attempts - Check if system
    relies on authselect tool
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(c)
    - accounts_passwords_pam_faillock_deny_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Configure the root Account for Failed Password Attempts - Remediation where
    authselect tool is present
  block:

    - name: Configure the root Account for Failed Password Attempts - Check integrity
        of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      ignore_errors: true

    - name: Configure the root Account for Failed Password Attempts - Informative
        message based on the authselect integrity check result
      ansible.builtin.assert:
        that:
          - result_authselect_check_cmd is success
        fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
        success_msg:
          - authselect integrity check passed

    - name: Configure the root Account for Failed Password Attempts - Get authselect
        current features
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
        - result_authselect_check_cmd is success

    - name: Configure the root Account for Failed Password Attempts - Ensure with-faillock
        feature is enabled using authselect tool
      ansible.builtin.command:
        cmd: authselect enable-feature with-faillock
      register: result_authselect_cmd
      when:
        - result_authselect_check_cmd is success
        - result_authselect_features.stdout is not search("with-faillock")
  when:
    - '"pam" in ansible_facts.packages'
    - result_authselect_present.stat.exists
  tags:
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(c)
    - accounts_passwords_pam_faillock_deny_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Configure the root Account for Failed Password Attempts - Remediation where
    authselect tool is not present
  block:

    - name: Configure the root Account for Failed Password Attempts - Check if pam_faillock.so
        is already enabled
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock.so (preauth|authfail)
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_is_enabled

    - name: Configure the root Account for Failed Password Attempts - Enable pam_faillock.so
        preauth editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so preauth
        insertbefore: ^auth.*sufficient.*pam_unix.so.*
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_is_enabled.found == 0

    - name: Configure the root Account for Failed Password Attempts - Enable pam_faillock.so
        authfail editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so authfail
        insertafter: ^auth.*sufficient.*pam_unix.so.*
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_is_enabled.found == 0

    - name: Configure the root Account for Failed Password Attempts - Enable pam_faillock.so
        account section editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: account     required      pam_faillock.so
        insertbefore: ^account.*required.*pam_unix.so.*
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_is_enabled.found == 0
  when:
    - '"pam" in ansible_facts.packages'
    - not result_authselect_present.stat.exists
  tags:
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(c)
    - accounts_passwords_pam_faillock_deny_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Configure the root Account for Failed Password Attempts - Check the presence
    of /etc/security/faillock.conf file
  ansible.builtin.stat:
    path: /etc/security/faillock.conf
  register: result_faillock_conf_check
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(c)
    - accounts_passwords_pam_faillock_deny_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Configure the root Account for Failed Password Attempts - Ensure the pam_faillock.so
    even_deny_root parameter in /etc/security/faillock.conf
  ansible.builtin.lineinfile:
    path: /etc/security/faillock.conf
    regexp: ^\s*even_deny_root
    line: even_deny_root
    state: present
  when:
    - '"pam" in ansible_facts.packages'
    - result_faillock_conf_check.stat.exists
  tags:
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(c)
    - accounts_passwords_pam_faillock_deny_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Configure the root Account for Failed Password Attempts - Ensure the pam_faillock.so
    even_deny_root parameter in PAM files
  block:

    - name: Configure the root Account for Failed Password Attempts - Check if pam_faillock.so
        even_deny_root parameter is already enabled in pam files
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock.so (preauth|authfail).*even_deny_root
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_even_deny_root_parameter_is_present

    - name: Configure the root Account for Failed Password Attempts - Ensure the inclusion
        of pam_faillock.so preauth even_deny_root parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)
        line: \1required\3 even_deny_root
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_even_deny_root_parameter_is_present.found == 0

    - name: Configure the root Account for Failed Password Attempts - Ensure the inclusion
        of pam_faillock.so authfail even_deny_root parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)
        line: \1required\3 even_deny_root
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_even_deny_root_parameter_is_present.found == 0
  when:
    - '"pam" in ansible_facts.packages'
    - not result_faillock_conf_check.stat.exists
  tags:
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(c)
    - accounts_passwords_pam_faillock_deny_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_passwords_pam_faillock_deny_root:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_passwords_pam_faillock_deny_root_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local" severity="medium">
                <xccdf-1.2:title>Enforce pam_faillock for Local Accounts Only</xccdf-1.2:title>
                <xccdf-1.2:description>The pam_faillock module's <html:code>local_users_only</html:code> parameter controls requirements for
enforcing failed lockout attempts only for local user accounts and ignoring centralized user
account management failed attempt configurations.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">If the system relies on <html:code>authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code>authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code>authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.
If the system supports the <html:code>/etc/security/faillock.conf</html:code> file, the pam_faillock
parameters should be defined in <html:code>faillock.conf</html:code> file.</xccdf-1.2:warning>
                <xccdf-1.2:warning category="management">Using this rule bypasses pam_faillock's functionality and should be used in cases
where centralized management such as LDAP or Active Directory is in use.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000001-GPOS-00001</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The operating system must provide automated mechanisms for supporting account management
functions. Enterprise environments make application account management challenging and
complex. A manual process for account management functions adds the risk of a potential
oversight or other error. Locking out remote accounts may cause unintentional DoS.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_passwords_pam_faillock_enforce_local"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

if [ -f /usr/bin/authselect ]; then
    if authselect check; then
    authselect enable-feature with-faillock
    authselect apply-changes
else
    echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
It is not recommended to manually edit the PAM files when authselect tool is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
    false
fi
else
    AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
for pam_file in "${AUTH_FILES[@]}"
do
    if ! grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+(preauth silent|authfail).*$' "$pam_file" ; then
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix.so.*/i auth        required      pam_faillock.so preauth silent' "$pam_file"
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix.so.*/a auth        required      pam_faillock.so authfail' "$pam_file"
        sed -i --follow-symlinks '/^account.*required.*pam_unix.so.*/i account     required      pam_faillock.so' "$pam_file"
    fi
    sed -Ei 's/(auth.*)(\[default=die\])(.*pam_faillock.so)/\1required     \3/g' "$pam_file"
done
fi
FAILLOCK_CONF="/etc/security/faillock.conf"
if [ -f $FAILLOCK_CONF ]; then
    regex="^\s*local_users_only"
    line="local_users_only"
    if ! grep -q $regex $FAILLOCK_CONF; then
        echo $line &gt;&gt; $FAILLOCK_CONF
    fi
else
    AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
    for pam_file in "${AUTH_FILES[@]}"
    do
        if ! grep -qE '^\s*auth.*pam_faillock.so (preauth|authfail).*local_users_only' "$pam_file"; then
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock.so.*preauth.*silent.*/ s/$/ local_users_only/' "$pam_file"
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock.so.*authfail.*/ s/$/ local_users_only/' "$pam_file"
        fi
    done
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_passwords_pam_faillock_enforce_local" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-2(1)
    - accounts_passwords_pam_faillock_enforce_local
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Enforce pam_faillock for Local Accounts Only - Check if system relies on authselect
    tool
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(1)
    - accounts_passwords_pam_faillock_enforce_local
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Enforce pam_faillock for Local Accounts Only - Remediation where authselect
    tool is present
  block:

    - name: Enforce pam_faillock for Local Accounts Only - Check integrity of authselect
        current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      ignore_errors: true

    - name: Enforce pam_faillock for Local Accounts Only - Informative message based
        on the authselect integrity check result
      ansible.builtin.assert:
        that:
          - result_authselect_check_cmd is success
        fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
        success_msg:
          - authselect integrity check passed

    - name: Enforce pam_faillock for Local Accounts Only - Get authselect current
        features
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
        - result_authselect_check_cmd is success

    - name: Enforce pam_faillock for Local Accounts Only - Ensure with-faillock feature
        is enabled using authselect tool
      ansible.builtin.command:
        cmd: authselect enable-feature with-faillock
      register: result_authselect_cmd
      when:
        - result_authselect_check_cmd is success
        - result_authselect_features.stdout is not search("with-faillock")
  when:
    - '"pam" in ansible_facts.packages'
    - result_authselect_present.stat.exists
  tags:
    - NIST-800-53-AC-2(1)
    - accounts_passwords_pam_faillock_enforce_local
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Enforce pam_faillock for Local Accounts Only - Remediation where authselect
    tool is not present
  block:

    - name: Enforce pam_faillock for Local Accounts Only - Check if pam_faillock.so
        is already enabled
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock.so (preauth|authfail)
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_is_enabled

    - name: Enforce pam_faillock for Local Accounts Only - Enable pam_faillock.so
        preauth editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so preauth
        insertbefore: ^auth.*sufficient.*pam_unix.so.*
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_is_enabled.found == 0

    - name: Enforce pam_faillock for Local Accounts Only - Enable pam_faillock.so
        authfail editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so authfail
        insertafter: ^auth.*sufficient.*pam_unix.so.*
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_is_enabled.found == 0

    - name: Enforce pam_faillock for Local Accounts Only - Enable pam_faillock.so
        account section editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: account     required      pam_faillock.so
        insertbefore: ^account.*required.*pam_unix.so.*
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_is_enabled.found == 0
  when:
    - '"pam" in ansible_facts.packages'
    - not result_authselect_present.stat.exists
  tags:
    - NIST-800-53-AC-2(1)
    - accounts_passwords_pam_faillock_enforce_local
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Enforce pam_faillock for Local Accounts Only - Check the presence of /etc/security/faillock.conf
    file
  ansible.builtin.stat:
    path: /etc/security/faillock.conf
  register: result_faillock_conf_check
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(1)
    - accounts_passwords_pam_faillock_enforce_local
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Enforce pam_faillock for Local Accounts Only - Ensure the pam_faillock.so
    local_users_only parameter in /etc/security/faillock.conf
  ansible.builtin.lineinfile:
    path: /etc/security/faillock.conf
    regexp: ^\s*local_users_only
    line: local_users_only
    state: present
  when:
    - '"pam" in ansible_facts.packages'
    - result_faillock_conf_check.stat.exists
  tags:
    - NIST-800-53-AC-2(1)
    - accounts_passwords_pam_faillock_enforce_local
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Enforce pam_faillock for Local Accounts Only - Ensure the pam_faillock.so
    local_users_only parameter in PAM files
  block:

    - name: Enforce pam_faillock for Local Accounts Only - Check if pam_faillock.so
        local_users_only parameter is already enabled in pam files
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock.so (preauth|authfail).*local_users_only
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_local_users_only_parameter_is_present

    - name: Enforce pam_faillock for Local Accounts Only - Ensure the inclusion of
        pam_faillock.so preauth local_users_only parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)
        line: \1required\3 local_users_only
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_local_users_only_parameter_is_present.found == 0

    - name: Enforce pam_faillock for Local Accounts Only - Ensure the inclusion of
        pam_faillock.so authfail local_users_only parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)
        line: \1required\3 local_users_only
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_local_users_only_parameter_is_present.found == 0
  when:
    - '"pam" in ansible_facts.packages'
    - not result_faillock_conf_check.stat.exists
  tags:
    - NIST-800-53-AC-2(1)
    - accounts_passwords_pam_faillock_enforce_local
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_passwords_pam_faillock_enforce_local:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_passwords_pam_faillock_enforce_local_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval" severity="medium">
                <xccdf-1.2:title>Set Interval For Counting Failed Password Attempts</xccdf-1.2:title>
                <xccdf-1.2:description>Utilizing <html:code>pam_faillock.so</html:code>, the <html:code>fail_interval</html:code> directive configures the system
to lock out an account after a number of incorrect login attempts within a specified time
period.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">If the system relies on <html:code>authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code>authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code>authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.
If the system supports the <html:code>/etc/security/faillock.conf</html:code> file, the pam_faillock
parameters should be defined in <html:code>faillock.conf</html:code> file.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000044</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002236</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002237</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002238</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0421</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0422</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0431</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0974</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1173</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1401</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1504</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1505</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1546</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1557</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1558</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1559</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1560</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1561</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_AFL.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000329-GPOS-00128</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000021-GPOS-00005</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000021-VMM-000050</xccdf-1.2:reference>
                <xccdf-1.2:rationale>By limiting the number of failed logon attempts the risk of unauthorized system
access via user password guessing, otherwise known as brute-forcing, is reduced.
Limits are imposed by locking the account.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_passwords_pam_faillock_interval"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_accounts_passwords_pam_faillock_fail_interval='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" use="legacy"/>'


if [ -f /usr/bin/authselect ]; then
    if authselect check; then
    authselect enable-feature with-faillock
    authselect apply-changes
else
    echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
It is not recommended to manually edit the PAM files when authselect tool is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
    false
fi
else
    AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
for pam_file in "${AUTH_FILES[@]}"
do
    if ! grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+(preauth silent|authfail).*$' "$pam_file" ; then
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix.so.*/i auth        required      pam_faillock.so preauth silent' "$pam_file"
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix.so.*/a auth        required      pam_faillock.so authfail' "$pam_file"
        sed -i --follow-symlinks '/^account.*required.*pam_unix.so.*/i account     required      pam_faillock.so' "$pam_file"
    fi
    sed -Ei 's/(auth.*)(\[default=die\])(.*pam_faillock.so)/\1required     \3/g' "$pam_file"
done
fi
FAILLOCK_CONF="/etc/security/faillock.conf"
if [ -f $FAILLOCK_CONF ]; then
    regex="^\s*fail_interval\s*="
    line="fail_interval = $var_accounts_passwords_pam_faillock_fail_interval"
    if ! grep -q $regex $FAILLOCK_CONF; then
        echo $line &gt;&gt; $FAILLOCK_CONF
    else
        sed -i --follow-symlinks 's/^\s*\(fail_interval\s*=\s*\)\([0-9]\+\)/\1'"$var_accounts_passwords_pam_faillock_fail_interval"'/g' $FAILLOCK_CONF
    fi
else
    AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
    for pam_file in "${AUTH_FILES[@]}"
    do
        if ! grep -qE '^\s*auth.*pam_faillock.so (preauth|authfail).*fail_interval' "$pam_file"; then
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock.so.*preauth.*silent.*/ s/$/ fail_interval='"$var_accounts_passwords_pam_faillock_fail_interval"'/' "$pam_file"
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock.so.*authfail.*/ s/$/ fail_interval='"$var_accounts_passwords_pam_faillock_fail_interval"'/' "$pam_file"
        else
            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock.so.*preauth.*silent.*\)\('"fail_interval"'=\)[0-9]\+\(.*\)/\1\2'"$var_accounts_passwords_pam_faillock_fail_interval"'\3/' "$pam_file"
            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock.so.*authfail.*\)\('"fail_interval"'=\)[0-9]\+\(.*\)/\1\2'"$var_accounts_passwords_pam_faillock_fail_interval"'\3/' "$pam_file"
        fi
    done
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_passwords_pam_faillock_interval" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - accounts_passwords_pam_faillock_interval
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set Interval For Counting Failed Password Attempts - Check if system relies
    on authselect tool
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - accounts_passwords_pam_faillock_interval
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set Interval For Counting Failed Password Attempts - Remediation where authselect
    tool is present
  block:

    - name: Set Interval For Counting Failed Password Attempts - Check integrity of
        authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      ignore_errors: true

    - name: Set Interval For Counting Failed Password Attempts - Informative message
        based on the authselect integrity check result
      ansible.builtin.assert:
        that:
          - result_authselect_check_cmd is success
        fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
        success_msg:
          - authselect integrity check passed

    - name: Set Interval For Counting Failed Password Attempts - Get authselect current
        features
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
        - result_authselect_check_cmd is success

    - name: Set Interval For Counting Failed Password Attempts - Ensure with-faillock
        feature is enabled using authselect tool
      ansible.builtin.command:
        cmd: authselect enable-feature with-faillock
      register: result_authselect_cmd
      when:
        - result_authselect_check_cmd is success
        - result_authselect_features.stdout is not search("with-faillock")
  when:
    - '"pam" in ansible_facts.packages'
    - result_authselect_present.stat.exists
  tags:
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - accounts_passwords_pam_faillock_interval
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set Interval For Counting Failed Password Attempts - Remediation where authselect
    tool is not present
  block:

    - name: Set Interval For Counting Failed Password Attempts - Check if pam_faillock.so
        is already enabled
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock.so (preauth|authfail)
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_is_enabled

    - name: Set Interval For Counting Failed Password Attempts - Enable pam_faillock.so
        preauth editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so preauth
        insertbefore: ^auth.*sufficient.*pam_unix.so.*
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_is_enabled.found == 0

    - name: Set Interval For Counting Failed Password Attempts - Enable pam_faillock.so
        authfail editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so authfail
        insertafter: ^auth.*sufficient.*pam_unix.so.*
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_is_enabled.found == 0

    - name: Set Interval For Counting Failed Password Attempts - Enable pam_faillock.so
        account section editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: account     required      pam_faillock.so
        insertbefore: ^account.*required.*pam_unix.so.*
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_is_enabled.found == 0
  when:
    - '"pam" in ansible_facts.packages'
    - not result_authselect_present.stat.exists
  tags:
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - accounts_passwords_pam_faillock_interval
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_accounts_passwords_pam_faillock_fail_interval # promote to variable
  set_fact:
    var_accounts_passwords_pam_faillock_fail_interval: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" use="legacy"/>
  tags:
    - always

- name: Set Interval For Counting Failed Password Attempts - Check the presence of
    /etc/security/faillock.conf file
  ansible.builtin.stat:
    path: /etc/security/faillock.conf
  register: result_faillock_conf_check
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - accounts_passwords_pam_faillock_interval
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set Interval For Counting Failed Password Attempts - Ensure the pam_faillock.so
    fail_interval parameter in /etc/security/faillock.conf
  ansible.builtin.lineinfile:
    path: /etc/security/faillock.conf
    regexp: ^\s*fail_interval\s*=
    line: fail_interval = {{ var_accounts_passwords_pam_faillock_fail_interval }}
    state: present
  when:
    - '"pam" in ansible_facts.packages'
    - result_faillock_conf_check.stat.exists
  tags:
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - accounts_passwords_pam_faillock_interval
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set Interval For Counting Failed Password Attempts - Ensure the pam_faillock.so
    fail_interval parameter in PAM files
  block:

    - name: Set Interval For Counting Failed Password Attempts - Check if pam_faillock.so
        fail_interval parameter is already enabled in pam files
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock.so (preauth|authfail).*fail_interval
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_fail_interval_parameter_is_present

    - name: Set Interval For Counting Failed Password Attempts - Ensure the inclusion
        of pam_faillock.so preauth fail_interval parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)
        line: \1required\3 fail_interval={{ var_accounts_passwords_pam_faillock_fail_interval
          }}
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_fail_interval_parameter_is_present.found == 0

    - name: Set Interval For Counting Failed Password Attempts - Ensure the inclusion
        of pam_faillock.so authfail fail_interval parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)
        line: \1required\3 fail_interval={{ var_accounts_passwords_pam_faillock_fail_interval
          }}
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_fail_interval_parameter_is_present.found == 0

    - name: Set Interval For Counting Failed Password Attempts - Ensure the desired
        value for pam_faillock.so preauth fail_interval parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)(fail_interval)=[0-9]+(.*)
        line: \1required\3\4={{ var_accounts_passwords_pam_faillock_fail_interval
          }}\5
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_fail_interval_parameter_is_present.found &gt; 0

    - name: Set Interval For Counting Failed Password Attempts - Ensure the desired
        value for pam_faillock.so authfail fail_interval parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)(fail_interval)=[0-9]+(.*)
        line: \1required\3\4={{ var_accounts_passwords_pam_faillock_fail_interval
          }}\5
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_fail_interval_parameter_is_present.found &gt; 0
  when:
    - '"pam" in ansible_facts.packages'
    - not result_faillock_conf_check.stat.exists
  tags:
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - accounts_passwords_pam_faillock_interval
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_passwords_pam_faillock_interval:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_passwords_pam_faillock_interval_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time" severity="medium">
                <xccdf-1.2:title>Set Lockout Time for Failed Password Attempts</xccdf-1.2:title>
                <xccdf-1.2:description>This rule configures the system to lock out accounts during a specified time period after a
number of incorrect login attempts using <html:code>pam_faillock.so</html:code>.

pam_faillock.so module requires multiple entries in pam files. These entries must be carefully
defined to work as expected. In order to avoid any errors when manually editing these files,
it is recommended to use the appropriate tools, such as <html:code>authselect</html:code> or <html:code>authconfig</html:code>,
depending on the OS version.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">If the system supports the new <html:code>/etc/security/faillock.conf</html:code> file but the
pam_faillock.so parameters are defined directly in <html:code>/etc/pam.d/system-auth</html:code> and
<html:code>/etc/pam.d/password-auth</html:code>, the remediation will migrate the <html:code>unlock_time</html:code> parameter
to <html:code>/etc/security/faillock.conf</html:code> to ensure compatibility with <html:code>authselect</html:code> tool.
The parameters <html:code>deny</html:code> and <html:code>fail_interval</html:code>, if used, also have to be migrated
by their respective remediation.</xccdf-1.2:warning>
                <xccdf-1.2:warning category="general">If the system relies on <html:code>authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code>authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code>authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.
If the system supports the <html:code>/etc/security/faillock.conf</html:code> file, the pam_faillock
parameters should be defined in <html:code>faillock.conf</html:code> file.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000044</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002236</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002237</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002238</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0421</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0422</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0431</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0974</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1173</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1401</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1504</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1505</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1546</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1557</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1558</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1559</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1560</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1561</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_AFL.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000329-GPOS-00128</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000021-GPOS-00005</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000329-VMM-001180</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Locking out user accounts after a number of incorrect attempts prevents direct password
guessing attacks. Ensuring that an administrator is involved in unlocking locked accounts
draws appropriate attention to such situations.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_passwords_pam_faillock_unlock_time"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_accounts_passwords_pam_faillock_unlock_time='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" use="legacy"/>'


if [ -f /usr/bin/authselect ]; then
    if authselect check; then
    authselect enable-feature with-faillock
    authselect apply-changes
else
    echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
It is not recommended to manually edit the PAM files when authselect tool is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
    false
fi
else
    AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
for pam_file in "${AUTH_FILES[@]}"
do
    if ! grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+(preauth silent|authfail).*$' "$pam_file" ; then
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix.so.*/i auth        required      pam_faillock.so preauth silent' "$pam_file"
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix.so.*/a auth        required      pam_faillock.so authfail' "$pam_file"
        sed -i --follow-symlinks '/^account.*required.*pam_unix.so.*/i account     required      pam_faillock.so' "$pam_file"
    fi
    sed -Ei 's/(auth.*)(\[default=die\])(.*pam_faillock.so)/\1required     \3/g' "$pam_file"
done
fi
FAILLOCK_CONF="/etc/security/faillock.conf"
if [ -f $FAILLOCK_CONF ]; then
    regex="^\s*unlock_time\s*="
    line="unlock_time = $var_accounts_passwords_pam_faillock_unlock_time"
    if ! grep -q $regex $FAILLOCK_CONF; then
        echo $line &gt;&gt; $FAILLOCK_CONF
    else
        sed -i --follow-symlinks 's/^\s*\(unlock_time\s*=\s*\)\([0-9]\+\)/\1'"$var_accounts_passwords_pam_faillock_unlock_time"'/g' $FAILLOCK_CONF
    fi
else
    AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
    for pam_file in "${AUTH_FILES[@]}"
    do
        if ! grep -qE '^\s*auth.*pam_faillock.so (preauth|authfail).*unlock_time' "$pam_file"; then
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock.so.*preauth.*silent.*/ s/$/ unlock_time='"$var_accounts_passwords_pam_faillock_unlock_time"'/' "$pam_file"
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock.so.*authfail.*/ s/$/ unlock_time='"$var_accounts_passwords_pam_faillock_unlock_time"'/' "$pam_file"
        else
            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock.so.*preauth.*silent.*\)\('"unlock_time"'=\)[0-9]\+\(.*\)/\1\2'"$var_accounts_passwords_pam_faillock_unlock_time"'\3/' "$pam_file"
            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock.so.*authfail.*\)\('"unlock_time"'=\)[0-9]\+\(.*\)/\1\2'"$var_accounts_passwords_pam_faillock_unlock_time"'\3/' "$pam_file"
        fi
    done
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_passwords_pam_faillock_unlock_time" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set Lockout Time for Failed Password Attempts - Check if system relies on
    authselect tool
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set Lockout Time for Failed Password Attempts - Remediation where authselect
    tool is present
  block:

    - name: Set Lockout Time for Failed Password Attempts - Check integrity of authselect
        current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      ignore_errors: true

    - name: Set Lockout Time for Failed Password Attempts - Informative message based
        on the authselect integrity check result
      ansible.builtin.assert:
        that:
          - result_authselect_check_cmd is success
        fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
        success_msg:
          - authselect integrity check passed

    - name: Set Lockout Time for Failed Password Attempts - Get authselect current
        features
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
        - result_authselect_check_cmd is success

    - name: Set Lockout Time for Failed Password Attempts - Ensure with-faillock feature
        is enabled using authselect tool
      ansible.builtin.command:
        cmd: authselect enable-feature with-faillock
      register: result_authselect_cmd
      when:
        - result_authselect_check_cmd is success
        - result_authselect_features.stdout is not search("with-faillock")
  when:
    - '"pam" in ansible_facts.packages'
    - result_authselect_present.stat.exists
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set Lockout Time for Failed Password Attempts - Remediation where authselect
    tool is not present
  block:

    - name: Set Lockout Time for Failed Password Attempts - Check if pam_faillock.so
        is already enabled
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock.so (preauth|authfail)
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_is_enabled

    - name: Set Lockout Time for Failed Password Attempts - Enable pam_faillock.so
        preauth editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so preauth
        insertbefore: ^auth.*sufficient.*pam_unix.so.*
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_is_enabled.found == 0

    - name: Set Lockout Time for Failed Password Attempts - Enable pam_faillock.so
        authfail editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so authfail
        insertafter: ^auth.*sufficient.*pam_unix.so.*
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_is_enabled.found == 0

    - name: Set Lockout Time for Failed Password Attempts - Enable pam_faillock.so
        account section editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: account     required      pam_faillock.so
        insertbefore: ^account.*required.*pam_unix.so.*
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_is_enabled.found == 0
  when:
    - '"pam" in ansible_facts.packages'
    - not result_authselect_present.stat.exists
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_accounts_passwords_pam_faillock_unlock_time # promote to variable
  set_fact:
    var_accounts_passwords_pam_faillock_unlock_time: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" use="legacy"/>
  tags:
    - always

- name: Set Lockout Time for Failed Password Attempts - Check the presence of /etc/security/faillock.conf
    file
  ansible.builtin.stat:
    path: /etc/security/faillock.conf
  register: result_faillock_conf_check
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set Lockout Time for Failed Password Attempts - Ensure the pam_faillock.so
    unlock_time parameter in /etc/security/faillock.conf
  ansible.builtin.lineinfile:
    path: /etc/security/faillock.conf
    regexp: ^\s*unlock_time\s*=
    line: unlock_time = {{ var_accounts_passwords_pam_faillock_unlock_time }}
    state: present
  when:
    - '"pam" in ansible_facts.packages'
    - result_faillock_conf_check.stat.exists
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set Lockout Time for Failed Password Attempts - Ensure the pam_faillock.so
    unlock_time parameter in PAM files
  block:

    - name: Set Lockout Time for Failed Password Attempts - Check if pam_faillock.so
        unlock_time parameter is already enabled in pam files
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock.so (preauth|authfail).*unlock_time
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_unlock_time_parameter_is_present

    - name: Set Lockout Time for Failed Password Attempts - Ensure the inclusion of
        pam_faillock.so preauth unlock_time parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)
        line: \1required\3 unlock_time={{ var_accounts_passwords_pam_faillock_unlock_time
          }}
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_unlock_time_parameter_is_present.found == 0

    - name: Set Lockout Time for Failed Password Attempts - Ensure the inclusion of
        pam_faillock.so authfail unlock_time parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)
        line: \1required\3 unlock_time={{ var_accounts_passwords_pam_faillock_unlock_time
          }}
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_unlock_time_parameter_is_present.found == 0

    - name: Set Lockout Time for Failed Password Attempts - Ensure the desired value
        for pam_faillock.so preauth unlock_time parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)(unlock_time)=[0-9]+(.*)
        line: \1required\3\4={{ var_accounts_passwords_pam_faillock_unlock_time }}\5
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_unlock_time_parameter_is_present.found &gt; 0

    - name: Set Lockout Time for Failed Password Attempts - Ensure the desired value
        for pam_faillock.so authfail unlock_time parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)(unlock_time)=[0-9]+(.*)
        line: \1required\3\4={{ var_accounts_passwords_pam_faillock_unlock_time }}\5
        state: present
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - result_pam_faillock_unlock_time_parameter_is_present.found &gt; 0
  when:
    - '"pam" in ansible_facts.packages'
    - not result_faillock_conf_check.stat.exists
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_passwords_pam_faillock_unlock_time:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_password_quality">
              <xccdf-1.2:title>Set Password Quality Requirements</xccdf-1.2:title>
              <xccdf-1.2:description>The default <html:code>pam_pwquality</html:code> PAM module provides strength
checking for passwords. It performs a number of checks, such as
making sure passwords are not similar to dictionary words, are of
at least a certain length, are not the previous password reversed,
and are not simply a change of case from the previous password. It
can also require passwords to be in certain character classes. The
<html:code>pam_pwquality</html:code> module is the preferred way of configuring
password requirements.
<html:br/><html:br/>
The man pages <html:code>pam_pwquality(8)</html:code>
provide information on the capabilities and configuration of
each.</xccdf-1.2:description>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_password_quality_pamcracklib">
                <xccdf-1.2:title>Set Password Quality Requirements, if using
pam_cracklib</xccdf-1.2:title>
                <xccdf-1.2:description>The <html:code>pam_cracklib</html:code> PAM module can be configured to meet
requirements for a variety of policies.
<html:br/><html:br/>
For example, to configure <html:code>pam_cracklib</html:code> to require at least one uppercase
character, lowercase character, digit, and other (special)
character, locate the following line in <html:code>/etc/pam.d/system-auth</html:code>:
<html:pre>password requisite pam_cracklib.so try_first_pass retry=3</html:pre>
and then alter it to read:
<html:pre>password required pam_cracklib.so try_first_pass retry=3 maxrepeat=3 minlen=14 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 difok=4</html:pre>
If no such line exists, add one as the first line of the password section in <html:code>/etc/pam.d/system-auth</html:code>.
The arguments can be modified to ensure compliance with
your organization's security policy. Discussion of each parameter follows.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that the password quality requirements are not enforced for the
root account for some reason.</xccdf-1.2:warning>
              </xccdf-1.2:Group>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_password_quality_pwquality">
                <xccdf-1.2:title>Set Password Quality Requirements with pam_pwquality</xccdf-1.2:title>
                <xccdf-1.2:description>The <html:code>pam_pwquality</html:code> PAM module can be configured to meet
requirements for a variety of policies.
<html:br/><html:br/>
For example, to configure <html:code>pam_pwquality</html:code> to require at least one uppercase
character, lowercase character, digit, and other (special)
character, make sure that <html:code>pam_pwquality</html:code> exists in <html:code>/etc/pam.d/system-auth</html:code>:
<html:pre>password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=</html:pre>
If no such line exists, add one as the first line of the password section in <html:code>/etc/pam.d/system-auth</html:code>.
Next, modify the settings in <html:code>/etc/security/pwquality.conf</html:code> to match the following:
<html:pre>difok = 4
minlen = 14
dcredit = -1
ucredit = -1
lcredit = -1
ocredit = -1
maxrepeat = 3</html:pre>
The arguments can be modified to ensure compliance with
your organization's security policy. Discussion of each parameter follows.</xccdf-1.2:description>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_dcredit" type="number">
                  <xccdf-1.2:title>dcredit</xccdf-1.2:title>
                  <xccdf-1.2:description>Minimum number of digits in password</xccdf-1.2:description>
                  <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                  <xccdf-1.2:value selector="1">-1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">-2</xccdf-1.2:value>
                  <xccdf-1.2:value>-1</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_dictcheck" type="number">
                  <xccdf-1.2:title>dictcheck</xccdf-1.2:title>
                  <xccdf-1.2:description>Prevent the use of dictionary words for passwords.</xccdf-1.2:description>
                  <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                  <xccdf-1.2:value>1</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_difok" type="number">
                  <xccdf-1.2:title>difok</xccdf-1.2:title>
                  <xccdf-1.2:description>Minimum number of characters not present in old
password</xccdf-1.2:description>
                  <xccdf-1.2:value selector="15">15</xccdf-1.2:value>
                  <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
                  <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                  <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
                  <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
                  <xccdf-1.2:value selector="6">6</xccdf-1.2:value>
                  <xccdf-1.2:value selector="7">7</xccdf-1.2:value>
                  <xccdf-1.2:value selector="8">8</xccdf-1.2:value>
                  <xccdf-1.2:value>8</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_lcredit" type="number">
                  <xccdf-1.2:title>lcredit</xccdf-1.2:title>
                  <xccdf-1.2:description>Minimum number of lower case in password</xccdf-1.2:description>
                  <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                  <xccdf-1.2:value selector="1">-1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">-2</xccdf-1.2:value>
                  <xccdf-1.2:value>-1</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat" type="number">
                  <xccdf-1.2:title>maxclassrepeat</xccdf-1.2:title>
                  <xccdf-1.2:description>Maximum Number of Consecutive Repeating Characters in a Password From the Same Character Class</xccdf-1.2:description>
                  <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
                  <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                  <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
                  <xccdf-1.2:value>4</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat" type="number">
                  <xccdf-1.2:title>maxrepeat</xccdf-1.2:title>
                  <xccdf-1.2:description>Maximum Number of Consecutive Repeating Characters in a Password</xccdf-1.2:description>
                  <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
                  <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                  <xccdf-1.2:value>3</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_minclass" type="number">
                  <xccdf-1.2:title>minclass</xccdf-1.2:title>
                  <xccdf-1.2:description>Minimum number of categories of characters that must exist in a password</xccdf-1.2:description>
                  <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
                  <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                  <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
                  <xccdf-1.2:value>3</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_minlen" type="number">
                  <xccdf-1.2:title>minlen</xccdf-1.2:title>
                  <xccdf-1.2:description>Minimum number of characters in password</xccdf-1.2:description>
                  <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
                  <xccdf-1.2:value selector="12">12</xccdf-1.2:value>
                  <xccdf-1.2:value selector="14">14</xccdf-1.2:value>
                  <xccdf-1.2:value selector="15">15</xccdf-1.2:value>
                  <xccdf-1.2:value selector="18">18</xccdf-1.2:value>
                  <xccdf-1.2:value selector="20">20</xccdf-1.2:value>
                  <xccdf-1.2:value selector="6">6</xccdf-1.2:value>
                  <xccdf-1.2:value selector="7">7</xccdf-1.2:value>
                  <xccdf-1.2:value selector="8">8</xccdf-1.2:value>
                  <xccdf-1.2:value>15</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_ocredit" type="number">
                  <xccdf-1.2:title>ocredit</xccdf-1.2:title>
                  <xccdf-1.2:description>Minimum number of other (special characters) in
password</xccdf-1.2:description>
                  <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                  <xccdf-1.2:value selector="1">-1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">-2</xccdf-1.2:value>
                  <xccdf-1.2:value>-1</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_retry" type="number">
                  <xccdf-1.2:title>retry</xccdf-1.2:title>
                  <xccdf-1.2:description>Number of retry attempts before erroring out</xccdf-1.2:description>
                  <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
                  <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                  <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
                  <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
                  <xccdf-1.2:value>3</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_ucredit" type="number">
                  <xccdf-1.2:title>ucredit</xccdf-1.2:title>
                  <xccdf-1.2:description>Minimum number of upper case in password</xccdf-1.2:description>
                  <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                  <xccdf-1.2:value selector="1">-1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">-2</xccdf-1.2:value>
                  <xccdf-1.2:value>-1</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit" severity="medium">
                  <xccdf-1.2:title>Ensure PAM Enforces Password Requirements - Minimum Digit Characters</xccdf-1.2:title>
                  <xccdf-1.2:description>The pam_pwquality module's <html:code>dcredit</html:code> parameter controls requirements for
usage of digits in a password. When set to a negative number, any password will be required to
contain that many digits. When set to a positive number, pam_pwquality will grant +1 additional
length credit for each digit. Modify the <html:code>dcredit</html:code> setting in
<html:code>/etc/security/pwquality.conf</html:code> to require the use of a digit in passwords.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000194</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0421</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0422</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0431</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0974</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1173</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1401</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1504</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1505</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1546</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1557</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1558</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1559</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1560</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1561</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000071-GPOS-00039</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000071-VMM-000380</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Use of a complex password helps to increase the time and resources required
to compromise the password. Password complexity, or strength, is a measure of
the effectiveness of a password in resisting attempts at guessing and brute-force
attacks.
<html:br/><html:br/>
Password complexity is one factor of several that determines how long it takes
to crack a password. The more complex the password, the greater the number of
possible combinations that need to be tested before the password is compromised.
Requiring digits makes password guessing attacks more difficult by ensuring a larger
search space.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_dcredit" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_dcredit='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_dcredit" use="legacy"/>'


# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/security/pwquality.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^dcredit")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_dcredit"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^dcredit\\&gt;" "/etc/security/pwquality.conf"; then
    "${sed_command[@]}" "s/^dcredit\\&gt;.*/$formatted_output/gi" "/etc/security/pwquality.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_dcredit" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_dcredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_dcredit # promote to variable
  set_fact:
    var_password_pam_dcredit: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_dcredit" use="legacy"/>
  tags:
    - always

- name: Ensure PAM variable dcredit is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*dcredit
    line: dcredit = {{ var_password_pam_dcredit }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_dcredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_dcredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_dcredit"/>
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_password_pam_dcredit:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_password_pam_dcredit_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_dictcheck" severity="medium">
                  <xccdf-1.2:title>Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words</xccdf-1.2:title>
                  <xccdf-1.2:description>The pam_pwquality module's <html:code>dictcheck</html:code> check if passwords contains dictionary words. When
<html:code>dictcheck</html:code> is set to <html:code>1</html:code> passwords will be checked for dictionary words.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00225</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Use of a complex password helps to increase the time and resources required to compromise the password.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at
guessing and brute-force attacks.
<html:br/><html:br/>
Password complexity is one factor of several that determines how long it takes to crack a password. The more
complex the password, the greater the number of possible combinations that need to be tested before the
password is compromised.
<html:br/><html:br/>
Passwords with dictionary words may be more vulnerable to password-guessing attacks.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_dictcheck" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_dictcheck='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_dictcheck" use="legacy"/>'


# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/security/pwquality.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^dictcheck")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_dictcheck"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^dictcheck\\&gt;" "/etc/security/pwquality.conf"; then
    "${sed_command[@]}" "s/^dictcheck\\&gt;.*/$formatted_output/gi" "/etc/security/pwquality.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_dictcheck" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_dictcheck
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_dictcheck # promote to variable
  set_fact:
    var_password_pam_dictcheck: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_dictcheck" use="legacy"/>
  tags:
    - always

- name: Ensure PAM variable dictcheck is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*dictcheck
    line: dictcheck = {{ var_password_pam_dictcheck }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_dictcheck
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_dictcheck:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_dictcheck"/>
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_password_pam_dictcheck:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_password_pam_dictcheck_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_difok" severity="medium">
                  <xccdf-1.2:title>Ensure PAM Enforces Password Requirements - Minimum Different Characters</xccdf-1.2:title>
                  <xccdf-1.2:description>The pam_pwquality module's <html:code>difok</html:code> parameter sets the number of characters
in a password that must not be present in and old password during a password change.
<html:br/><html:br/>
Modify the <html:code>difok</html:code> setting in <html:code>/etc/security/pwquality.conf</html:code>
to equal <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_difok" use="legacy"/> to require differing characters
when changing passwords.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000195</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(b)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000072-GPOS-00040</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000072-VMM-000390</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Use of a complex password helps to increase the time and resources
required to compromise the password. Password complexity, or strength,
is a measure of the effectiveness of a password in resisting attempts
at guessing and brute–force attacks.
<html:br/><html:br/>
Password complexity is one factor of several that determines how long
it takes to crack a password. The more complex the password, the
greater the number of possible combinations that need to be tested
before the password is compromised.
<html:br/><html:br/>
Requiring a minimum number of different characters during password changes ensures that
newly changed passwords should not resemble previously compromised ones.
Note that passwords which are changed on compromised systems will still be compromised, however.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_difok" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_difok='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_difok" use="legacy"/>'


# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/security/pwquality.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^difok")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_difok"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^difok\\&gt;" "/etc/security/pwquality.conf"; then
    "${sed_command[@]}" "s/^difok\\&gt;.*/$formatted_output/gi" "/etc/security/pwquality.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_difok" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(b)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_difok
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_difok # promote to variable
  set_fact:
    var_password_pam_difok: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_difok" use="legacy"/>
  tags:
    - always

- name: Ensure PAM variable difok is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*difok
    line: difok = {{ var_password_pam_difok }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(b)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_difok
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_difok:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_difok"/>
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_password_pam_difok:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_password_pam_difok_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_enforce_local" severity="medium">
                  <xccdf-1.2:title>Ensure PAM Enforces Password Requirements - Enforce for Local Accounts Only</xccdf-1.2:title>
                  <xccdf-1.2:description>The pam_pwquality module's <html:code>local_users_only</html:code> parameter controls requirements for
enforcing password complexity by pam_pwquality only for local user accounts and ignoring
centralized user account management password complexity configurations. Enable the <html:code>local_users_only</html:code>
setting in <html:code>/etc/security/pwquality.conf</html:code> to require password complexity enforcement
for only local user accounts.</xccdf-1.2:description>
                  <xccdf-1.2:warning category="management">Using this rule bypasses pam_faillock's functionality and should be used in cases
where centralized management such as LDAP or Active Directory is in use.</xccdf-1.2:warning>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000015</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000001-GPOS-00001</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>The operating system must provide automated mechanisms for supporting account management
functions. Enterprise environments make application account management challenging and
complex. A manual process for account management functions adds the risk of a potential
oversight or other error.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_enforce_local" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

if [ -e "/etc/security/pwquality.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*local_users_only/Id" "/etc/security/pwquality.conf"
else
    touch "/etc/security/pwquality.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/security/pwquality.conf"

cp "/etc/security/pwquality.conf" "/etc/security/pwquality.conf.bak"
# Insert at the end of the file
printf '%s\n' "local_users_only" &gt;&gt; "/etc/security/pwquality.conf"
# Clean up after ourselves.
rm "/etc/security/pwquality.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_enforce_local" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-2(1)
    - accounts_password_pam_enforce_local
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Ensure PAM Enforces Password Requirements - Enforce for Local Accounts Only
  lineinfile:
    path: /etc/security/pwquality.conf
    create: true
    line: local_users_only
    state: present
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(1)
    - accounts_password_pam_enforce_local
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_password_pam_enforce_local:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_password_pam_enforce_local_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_enforce_root" severity="medium">
                  <xccdf-1.2:title>Ensure PAM Enforces Password Requirements - Enforce for root User</xccdf-1.2:title>
                  <xccdf-1.2:description>The pam_pwquality module's <html:code>enforce_for_root</html:code> parameter controls requirements for
enforcing password complexity for the root user. Enable the <html:code>enforce_for_root</html:code>
setting in <html:code>/etc/security/pwquality.conf</html:code> to require the <html:code>root</html:code> user
to use complex passwords.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000194</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000193</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001619</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000205</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000195</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000192</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000072-GPOS-00040</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000071-GPOS-00039</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000070-GPOS-00038</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000266-GPOS-00101</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000078-GPOS-00046</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00225</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000069-GPOS-00037</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Use of a complex password helps to increase the time and resources required to compromise
the password. Password complexity, or strength, is a measure of the effectiveness of a
password in resisting attempts at guessing and brute-force attacks.

Password complexity is one factor of several that determines how long it takes to crack a
password. The more complex the password, the greater the number of possible combinations
that need to be tested before the password is compromised.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_enforce_root" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

if [ -e "/etc/security/pwquality.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*enforce_for_root/Id" "/etc/security/pwquality.conf"
else
    touch "/etc/security/pwquality.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/security/pwquality.conf"

cp "/etc/security/pwquality.conf" "/etc/security/pwquality.conf.bak"
# Insert at the end of the file
printf '%s\n' "enforce_for_root" &gt;&gt; "/etc/security/pwquality.conf"
# Clean up after ourselves.
rm "/etc/security/pwquality.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_enforce_root" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_enforce_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Ensure PAM Enforces Password Requirements - Enforce for root User
  lineinfile:
    path: /etc/security/pwquality.conf
    create: true
    line: enforce_for_root
    state: present
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_enforce_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_password_pam_enforce_root:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_password_pam_enforce_root_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit" severity="medium">
                  <xccdf-1.2:title>Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters</xccdf-1.2:title>
                  <xccdf-1.2:description>The pam_pwquality module's <html:code>lcredit</html:code> parameter controls requirements for
usage of lowercase letters in a password. When set to a negative number, any password will be required to
contain that many lowercase characters. When set to a positive number, pam_pwquality will grant +1 additional
length credit for each lowercase character. Modify the <html:code>lcredit</html:code> setting in
<html:code>/etc/security/pwquality.conf</html:code> to require the use of a lowercase character in passwords.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000193</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0421</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0422</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0431</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0974</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1173</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1401</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1504</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1505</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1546</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1557</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1558</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1559</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1560</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1561</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000070-GPOS-00038</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000070-VMM-000370</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Use of a complex password helps to increase the time and resources required
to compromise the password. Password complexity, or strength, is a measure of
the effectiveness of a password in resisting attempts at guessing and brute-force
attacks.
<html:br/>
Password complexity is one factor of several that determines how long it takes
to crack a password. The more complex the password, the greater the number of
possble combinations that need to be tested before the password is compromised.
Requiring a minimum number of lowercase characters makes password guessing attacks
more difficult by ensuring a larger search space.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_lcredit" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_lcredit='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_lcredit" use="legacy"/>'


# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/security/pwquality.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^lcredit")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_lcredit"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^lcredit\\&gt;" "/etc/security/pwquality.conf"; then
    "${sed_command[@]}" "s/^lcredit\\&gt;.*/$formatted_output/gi" "/etc/security/pwquality.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_lcredit" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_lcredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_lcredit # promote to variable
  set_fact:
    var_password_pam_lcredit: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_lcredit" use="legacy"/>
  tags:
    - always

- name: Ensure PAM variable lcredit is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*lcredit
    line: lcredit = {{ var_password_pam_lcredit }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_lcredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_lcredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_lcredit"/>
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_password_pam_lcredit:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_password_pam_lcredit_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_maxclassrepeat" severity="medium">
                  <xccdf-1.2:title>Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class</xccdf-1.2:title>
                  <xccdf-1.2:description>The pam_pwquality module's <html:code>maxclassrepeat</html:code> parameter controls requirements for
consecutive repeating characters from the same character class. When set to a positive number, it will reject passwords
which contain more than that number of consecutive characters from the same character class. Modify the
<html:code>maxclassrepeat</html:code> setting in <html:code>/etc/security/pwquality.conf</html:code> to equal <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat" use="legacy"/>
to prevent a run of (<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat" use="legacy"/> + 1) or more identical characters.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000195</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000072-GPOS-00040</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Use of a complex password helps to increase the time and resources required to compromise the password.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting
attempts at guessing and brute-force attacks.
<html:br/>
Password complexity is one factor of several that determines how long it takes to crack a password. The
more complex a password, the greater the number of possible combinations that need to be tested before the
password is compromised.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_maxclassrepeat" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_maxclassrepeat='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat" use="legacy"/>'


# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/security/pwquality.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^maxclassrepeat")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_maxclassrepeat"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^maxclassrepeat\\&gt;" "/etc/security/pwquality.conf"; then
    "${sed_command[@]}" "s/^maxclassrepeat\\&gt;.*/$formatted_output/gi" "/etc/security/pwquality.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_maxclassrepeat" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_maxclassrepeat
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_maxclassrepeat # promote to variable
  set_fact:
    var_password_pam_maxclassrepeat: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat" use="legacy"/>
  tags:
    - always

- name: Ensure PAM variable maxclassrepeat is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*maxclassrepeat
    line: maxclassrepeat = {{ var_password_pam_maxclassrepeat }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_maxclassrepeat
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_maxclassrepeat:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat"/>
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_password_pam_maxclassrepeat:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_password_pam_maxclassrepeat_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_maxrepeat" severity="medium">
                  <xccdf-1.2:title>Set Password Maximum Consecutive Repeating Characters</xccdf-1.2:title>
                  <xccdf-1.2:description>The pam_pwquality module's <html:code>maxrepeat</html:code> parameter controls requirements for
consecutive repeating characters. When set to a positive number, it will reject passwords
which contain more than that number of consecutive characters. Modify the <html:code>maxrepeat</html:code> setting
in <html:code>/etc/security/pwquality.conf</html:code> to equal <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat" use="legacy"/> to prevent a
run of (<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat" use="legacy"/> + 1) or more identical characters.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000195</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000072-GPOS-00040</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Use of a complex password helps to increase the time and resources required to compromise the password.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at
guessing and brute-force attacks.
<html:br/><html:br/>
Password complexity is one factor of several that determines how long it takes to crack a password. The more
complex the password, the greater the number of possible combinations that need to be tested before the
password is compromised.
<html:br/><html:br/>
Passwords with excessive repeating characters may be more vulnerable to password-guessing attacks.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_maxrepeat" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_maxrepeat='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat" use="legacy"/>'


# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/security/pwquality.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^maxrepeat")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_maxrepeat"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^maxrepeat\\&gt;" "/etc/security/pwquality.conf"; then
    "${sed_command[@]}" "s/^maxrepeat\\&gt;.*/$formatted_output/gi" "/etc/security/pwquality.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_maxrepeat" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_maxrepeat
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_maxrepeat # promote to variable
  set_fact:
    var_password_pam_maxrepeat: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat" use="legacy"/>
  tags:
    - always

- name: Ensure PAM variable maxrepeat is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*maxrepeat
    line: maxrepeat = {{ var_password_pam_maxrepeat }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_maxrepeat
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_maxrepeat:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat"/>
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_password_pam_maxrepeat:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_password_pam_maxrepeat_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_minclass" severity="medium">
                  <xccdf-1.2:title>Ensure PAM Enforces Password Requirements - Minimum Different Categories</xccdf-1.2:title>
                  <xccdf-1.2:description>The pam_pwquality module's <html:code>minclass</html:code> parameter controls
requirements for usage of different character classes, or types, of character
that must exist in a password before it is considered valid. For example,
setting this value to three (3) requires that any password must have characters
from at least three different categories in order to be approved. The default
value is zero (0), meaning there are no required classes. There are four
categories available:
<html:pre>
* Upper-case characters
* Lower-case characters
* Digits
* Special characters (for example, punctuation)
</html:pre>
Modify the <html:code>minclass</html:code> setting in <html:code>/etc/security/pwquality.conf</html:code> entry
to require <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass" use="legacy"/>
differing categories of characters when changing passwords.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000195</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0421</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0422</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0431</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0974</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1173</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1401</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1504</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1505</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1546</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1557</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1558</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1559</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1560</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1561</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000072-GPOS-00040</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Use of a complex password helps to increase the time and resources required to compromise the password.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts
at guessing and brute-force attacks.
<html:br/><html:br/>
Password complexity is one factor of several that determines how long it takes to crack a password. The
more complex the password, the greater the number of possible combinations that need to be tested before
the password is compromised.
<html:br/><html:br/>
Requiring a minimum number of character categories makes password guessing attacks more difficult
by ensuring a larger search space.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_minclass" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_minclass='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass" use="legacy"/>'


# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/security/pwquality.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^minclass")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_minclass"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^minclass\\&gt;" "/etc/security/pwquality.conf"; then
    "${sed_command[@]}" "s/^minclass\\&gt;.*/$formatted_output/gi" "/etc/security/pwquality.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_minclass" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_minclass
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_minclass # promote to variable
  set_fact:
    var_password_pam_minclass: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass" use="legacy"/>
  tags:
    - always

- name: Ensure PAM variable minclass is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*minclass
    line: minclass = {{ var_password_pam_minclass }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_minclass
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_minclass:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_minclass"/>
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_password_pam_minclass:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_password_pam_minclass_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen" severity="medium">
                  <xccdf-1.2:title>Ensure PAM Enforces Password Requirements - Minimum Length</xccdf-1.2:title>
                  <xccdf-1.2:description>The pam_pwquality module's <html:code>minlen</html:code> parameter controls requirements for
minimum characters required in a password. Add <html:code>minlen=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" use="legacy"/></html:code>
after pam_pwquality to set minimum password length requirements.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000205</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0421</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0422</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0431</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0974</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1173</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1401</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1504</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1505</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1546</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1557</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1558</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1559</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1560</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1561</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000078-GPOS-00046</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000072-VMM-000390</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000078-VMM-000450</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>The shorter the password, the lower the number of possible combinations
that need to be tested before the password is compromised.
<html:br/>
Password complexity, or strength, is a measure of the effectiveness of a
password in resisting attempts at guessing and brute-force attacks.
Password length is one factor of several that helps to determine strength
and how long it takes to crack a password. Use of more characters in a password
helps to exponentially increase the time and/or resources required to
compromose the password.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_minlen" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_minlen='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" use="legacy"/>'


# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/security/pwquality.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^minlen")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_minlen"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^minlen\\&gt;" "/etc/security/pwquality.conf"; then
    "${sed_command[@]}" "s/^minlen\\&gt;.*/$formatted_output/gi" "/etc/security/pwquality.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_minlen" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_minlen
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_minlen # promote to variable
  set_fact:
    var_password_pam_minlen: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" use="legacy"/>
  tags:
    - always

- name: Ensure PAM variable minlen is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*minlen
    line: minlen = {{ var_password_pam_minlen }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_minlen
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_minlen:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_minlen"/>
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_password_pam_minlen:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_password_pam_minlen_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_ocredit" severity="medium">
                  <xccdf-1.2:title>Ensure PAM Enforces Password Requirements - Minimum Special Characters</xccdf-1.2:title>
                  <xccdf-1.2:description>The pam_pwquality module's <html:code>ocredit=</html:code> parameter controls requirements for
usage of special (or "other") characters in a password. When set to a negative number,
any password will be required to contain that many special characters.
When set to a positive number, pam_pwquality will grant +1
additional length credit for each special character. Modify the <html:code>ocredit</html:code> setting
in <html:code>/etc/security/pwquality.conf</html:code> to equal <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_ocredit" use="legacy"/>
to require use of a special character in passwords.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001619</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0421</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0422</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0431</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0974</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1173</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1401</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1504</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1505</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1546</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1557</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1558</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1559</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1560</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1561</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000266-GPOS-00101</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000266-VMM-000940</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Use of a complex password helps to increase the time and resources required
to compromise the password. Password complexity, or strength, is a measure of
the effectiveness of a password in resisting attempts at guessing and brute-force
attacks.
<html:br/><html:br/>
Password complexity is one factor of several that determines how long it takes
to crack a password. The more complex the password, the greater the number of
possible combinations that need to be tested before the password is compromised.
Requiring a minimum number of special characters makes password guessing attacks
more difficult by ensuring a larger search space.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_ocredit" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_ocredit='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_ocredit" use="legacy"/>'


# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/security/pwquality.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^ocredit")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_ocredit"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^ocredit\\&gt;" "/etc/security/pwquality.conf"; then
    "${sed_command[@]}" "s/^ocredit\\&gt;.*/$formatted_output/gi" "/etc/security/pwquality.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_ocredit" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_ocredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_ocredit # promote to variable
  set_fact:
    var_password_pam_ocredit: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_ocredit" use="legacy"/>
  tags:
    - always

- name: Ensure PAM variable ocredit is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*ocredit
    line: ocredit = {{ var_password_pam_ocredit }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_ocredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_ocredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_ocredit"/>
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_password_pam_ocredit:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_password_pam_ocredit_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_password_auth" severity="medium">
                  <xccdf-1.2:title>Ensure PAM password complexity module is enabled in password-auth</xccdf-1.2:title>
                  <xccdf-1.2:description>To enable PAM password complexity in password-auth file:
Edit the <html:code>password</html:code> section in
<html:code>/etc/pam.d/password-auth</html:code> to show
<html:code>password    requisite                                    pam_pwquality.so</html:code>.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Enabling PAM password complexity permits to enforce strong passwords and consequently
makes the system less prone to dictionary attacks.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_pwquality_password_auth"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

PAM_FILE="password-auth"

if [ -f /usr/bin/authselect ]; then
    if authselect check; then
        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # Standard profiles delivered with authselect should not be modified.
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! "$CURRENT_PROFILE" == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            authselect create-profile hardening -b "$CURRENT_PROFILE"
            CURRENT_PROFILE="custom/hardening"
            # Ensure a backup before changing the profile
            authselect apply-changes -b --backup=before-pwquality-hardening.backup
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
        fi
        # Include the desired configuration in the custom profile
        CUSTOM_FILE="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE"
        # The line should be included on the top password section
		if [ "$(grep -c "^\s*password.*requisite.*pam_pwquality.so" "$CUSTOM_FILE")" -eq 0 ]; then
		    sed -i --follow-symlinks '0,/^password.*/s/^password.*/password    requisite                                    pam_pwquality.so\n&amp;/' "$CUSTOM_FILE"
		fi
        authselect apply-changes -b --backup=after-pwquality-hardening.backup
    else
        echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because the authselect profile is not intact.
It is not recommended to manually edit the PAM files when authselect is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        false
    fi
else
    FILE_PATH="/etc/pam.d/$PAM_FILE"
    if [ "$(grep -c "^\s*password.*requisite.*pam_pwquality.so" "$FILE_PATH")" -eq 0 ]; then
        sed -i --follow-symlinks '0,/^password.*/s/^password.*/password    requisite                                    pam_pwquality.so\n&amp;/' "$FILE_PATH"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_pwquality_password_auth" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - accounts_password_pam_pwquality_password_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Check for existing pam_pwquality.so entry
  ansible.builtin.lineinfile:
    path: /etc/pam.d/password-auth
    create: false
    regexp: ^password.*pam_pwquality.so.*
    state: absent
  check_mode: true
  changed_when: false
  register: result_pam_pwquality_present
  when: '"pam" in ansible_facts.packages'
  tags:
    - accounts_password_pam_pwquality_password_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Check if system relies on authselect
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"pam" in ansible_facts.packages'
  tags:
    - accounts_password_pam_pwquality_password_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Remediation where authselect tool is present
  block:

    - name: Check the integrity of the current authselect profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      ignore_errors: true

    - name: Informative message based on the authselect integrity check result
      ansible.builtin.assert:
        that:
          - result_authselect_check_cmd is success
        fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because the authselect profile is
            not intact.
          - It is not recommended to manually edit the PAM files when authselect is
            available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
        success_msg:
          - authselect integrity check passed

    - name: Get authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
        - result_authselect_check_cmd is success

    - name: Define the current authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

    - name: Define the new authselect custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

    - name: Get authselect current features to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

    - name: Check if any custom profile with the same name was already created in
        the past
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
        - authselect_current_profile is not match("custom/")

    - name: Create a custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("custom/")
        - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure the desired configuration is present in the custom profile
      ansible.builtin.lineinfile:
        dest: /etc/authselect/{{ authselect_custom_profile }}/password-auth
        insertbefore: ^password.*sufficient.*pam_unix.so.*
        line: password    requisite                                    pam_pwquality.so
      when:
        - result_authselect_profile is not skipped
        - result_pam_pwquality_present.found == 0

    - name: Ensure a backup of current authselect profile before selecting the custom
        profile
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-pwquality-hardening.backup
      register: result_authselect_backup
      when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure the custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }} --force
      register: result_pam_authselect_select_profile
      when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

    - name: Restore the authselect features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

    - name: Ensure the custom profile changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-pwquality-hardening.backup
      when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
  when:
    - '"pam" in ansible_facts.packages'
    - result_authselect_present.stat.exists
  tags:
    - accounts_password_pam_pwquality_password_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Remediation where authselect tool is not present and PAM files are directly
    edited
  block:

    - name: Ensure the desired configuration is present in the custom profile
      ansible.builtin.lineinfile:
        dest: /etc/pam.d/password-auth
        insertbefore: ^password.*sufficient.*pam_unix.so.*
        line: password    requisite                                    pam_pwquality.so
      when:
        - result_pam_pwquality_present.found == 0
  when:
    - '"pam" in ansible_facts.packages'
    - not result_authselect_present.stat.exists
  tags:
    - accounts_password_pam_pwquality_password_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_password_pam_pwquality_password_auth:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_password_pam_pwquality_password_auth_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth" severity="medium">
                  <xccdf-1.2:title>Ensure PAM password complexity module is enabled in system-auth</xccdf-1.2:title>
                  <xccdf-1.2:description>To enable PAM password complexity in system-auth file:
Edit the <html:code>password</html:code> section in
<html:code>/etc/pam.d/system-auth</html:code> to show
<html:code>password    requisite                                    pam_pwquality.so</html:code>.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Enabling PAM password complexity permits to enforce strong passwords and consequently
makes the system less prone to dictionary attacks.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_pwquality_system_auth"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

PAM_FILE="system-auth"

if [ -f /usr/bin/authselect ]; then
    if authselect check; then
        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # Standard profiles delivered with authselect should not be modified.
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            # Ensure a backup before changing the profile
            authselect apply-changes -b --backup=before-pwquality-hardening.backup
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
        fi
        # Include the desired configuration in the custom profile
        CUSTOM_FILE="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE"
        # The line should be included on the top password section
		if [ "$(grep -c "^\s*password.*requisite.*pam_pwquality.so" $CUSTOM_FILE)" -eq 0 ]; then
  		  sed -i --follow-symlinks '0,/^password.*/s/^password.*/password    requisite                                    pam_pwquality.so\n&amp;/' $CUSTOM_FILE
		fi
        authselect apply-changes -b --backup=after-pwquality-hardening.backup
    else
        echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because the authselect profile is not intact.
It is not recommended to manually edit the PAM files when authselect is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        false
    fi
else
    FILE_PATH="/etc/pam.d/$PAM_FILE"
    if [ "$(grep -c "^\s*password.*requisite.*pam_pwquality.so" $FILE_PATH)" -eq 0 ]; then
        sed -i --follow-symlinks '0,/^password.*/s/^password.*/password    requisite                                    pam_pwquality.so\n&amp;/' $FILE_PATH
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_pwquality_system_auth" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - accounts_password_pam_pwquality_system_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Check for existing pam_pwquality.so entry
  ansible.builtin.lineinfile:
    path: /etc/pam.d/system-auth
    create: false
    regexp: ^password.*pam_pwquality.so.*
    state: absent
  check_mode: true
  changed_when: false
  register: result_pam_pwquality_present
  when: '"pam" in ansible_facts.packages'
  tags:
    - accounts_password_pam_pwquality_system_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Check if system relies on authselect
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"pam" in ansible_facts.packages'
  tags:
    - accounts_password_pam_pwquality_system_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Remediation where authselect tool is present
  block:

    - name: Check the integrity of the current authselect profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      ignore_errors: true

    - name: Informative message based on the authselect integrity check result
      ansible.builtin.assert:
        that:
          - result_authselect_check_cmd is success
        fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because the authselect profile is
            not intact.
          - It is not recommended to manually edit the PAM files when authselect is
            available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
        success_msg:
          - authselect integrity check passed

    - name: Get authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
        - result_authselect_check_cmd is success

    - name: Define the current authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

    - name: Define the new authselect custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

    - name: Get authselect current features to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

    - name: Check if any custom profile with the same name was already created in
        the past
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
        - authselect_current_profile is not match("custom/")

    - name: Create a custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("custom/")
        - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure the desired configuration is present in the custom profile
      ansible.builtin.lineinfile:
        dest: /etc/authselect/{{ authselect_custom_profile }}/system-auth
        insertbefore: ^password.*sufficient.*pam_unix.so.*
        line: password    requisite                                    pam_pwquality.so
      when:
        - result_authselect_profile is not skipped
        - result_pam_pwquality_present.found == 0

    - name: Ensure a backup of current authselect profile before selecting the custom
        profile
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-pwquality-hardening.backup
      register: result_authselect_backup
      when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure the custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }} --force
      register: result_pam_authselect_select_profile
      when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

    - name: Restore the authselect features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

    - name: Ensure the custom profile changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-pwquality-hardening.backup
      when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
  when:
    - '"pam" in ansible_facts.packages'
    - result_authselect_present.stat.exists
  tags:
    - accounts_password_pam_pwquality_system_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Remediation where authselect tool is not present and PAM files are directly
    edited
  block:

    - name: Ensure the desired configuration is present in the custom profile
      ansible.builtin.lineinfile:
        dest: /etc/pam.d/system-auth
        insertbefore: ^password.*sufficient.*pam_unix.so.*
        line: password    requisite                                    pam_pwquality.so
      when:
        - result_pam_pwquality_present.found == 0
  when:
    - '"pam" in ansible_facts.packages'
    - not result_authselect_present.stat.exists
  tags:
    - accounts_password_pam_pwquality_system_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_password_pam_pwquality_system_auth:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_password_pam_pwquality_system_auth_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_retry" severity="medium">
                  <xccdf-1.2:title>Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session</xccdf-1.2:title>
                  <xccdf-1.2:description>To configure the number of retry prompts that are permitted per-session:

Edit the <html:code>pam_pwquality.so</html:code> statement in

<html:code>/etc/pam.d/system-auth</html:code> to show


<html:code>retry=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_retry" use="legacy"/></html:code>, or a lower value if site
policy is more restrictive. The DoD requirement is a maximum of 3 prompts
per session.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000192</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000069-GPOS-00037</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Setting the password retry prompts that are permitted on a per-session basis to a low value
requires some software, such as SSH, to re-connect. This can slow down and
draw additional attention to some types of password-guessing attacks. Note that this
is different from account lockout, which is provided by the pam_faillock module.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_retry"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_retry='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_retry" use="legacy"/>'



	if grep -q "retry=" /etc/pam.d/system-auth ; then
		sed -i --follow-symlinks "s/\(retry *= *\).*/\1$var_password_pam_retry/" /etc/pam.d/system-auth
	else
		sed -i --follow-symlinks "/pam_pwquality.so/ s/$/ retry=$var_password_pam_retry/" /etc/pam.d/system-auth
	fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_retry" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.3
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - accounts_password_pam_retry
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
- name: XCCDF Value var_password_pam_retry # promote to variable
  set_fact:
    var_password_pam_retry: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_retry" use="legacy"/>
  tags:
    - always

- name: Set Password Retry Prompts Permitted Per-Session - system-auth (change)
  replace:
    dest: /etc/pam.d/system-auth
    regexp: (^.*\spam_pwquality.so\s.*retry\s*=\s*)(\S+)(.*$)
    replace: \g&lt;1&gt;{{ var_password_pam_retry }}\g&lt;3&gt;
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - accounts_password_pam_retry
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Set Password Retry Prompts Permitted Per-Session - system-auth (add)
  replace:
    dest: /etc/pam.d/system-auth
    regexp: ^.*\spam_pwquality.so\s(?!.*retry\s*=\s*).*$
    replace: \g&lt;0&gt; retry={{ var_password_pam_retry }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - accounts_password_pam_retry
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_retry:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_retry"/>
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_password_pam_retry:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_password_pam_retry_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit" severity="medium">
                  <xccdf-1.2:title>Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters</xccdf-1.2:title>
                  <xccdf-1.2:description>The pam_pwquality module's <html:code>ucredit=</html:code> parameter controls requirements for
usage of uppercase letters in a password. When set to a negative number, any password will be required to
contain that many uppercase characters. When set to a positive number, pam_pwquality will grant +1 additional
length credit for each uppercase character. Modify the <html:code>ucredit</html:code> setting in
<html:code>/etc/security/pwquality.conf</html:code> to require the use of an uppercase character in passwords.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000192</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0421</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0422</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0431</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0974</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1173</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1401</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1504</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1505</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1546</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1557</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1558</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1559</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1560</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1561</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000069-GPOS-00037</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000069-VMM-000360</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Use of a complex password helps to increase the time and resources required to compromise the password.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts
at guessing and brute-force attacks.
<html:br/><html:br/>
Password complexity is one factor of several that determines how long it takes to crack a password. The more
complex the password, the greater the number of possible combinations that need to be tested before
the password is compromised.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_ucredit" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_ucredit='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_ucredit" use="legacy"/>'


# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/security/pwquality.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^ucredit")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_ucredit"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^ucredit\\&gt;" "/etc/security/pwquality.conf"; then
    "${sed_command[@]}" "s/^ucredit\\&gt;.*/$formatted_output/gi" "/etc/security/pwquality.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_ucredit" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_ucredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_ucredit # promote to variable
  set_fact:
    var_password_pam_ucredit: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_ucredit" use="legacy"/>
  tags:
    - always

- name: Ensure PAM variable ucredit is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*ucredit
    line: ucredit = {{ var_password_pam_ucredit }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_ucredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_ucredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_ucredit"/>
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_password_pam_ucredit:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_password_pam_ucredit_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_set_password_hashing_algorithm">
              <xccdf-1.2:title>Set Password Hashing Algorithm</xccdf-1.2:title>
              <xccdf-1.2:description>The system's default algorithm for storing password hashes in
<html:code>/etc/shadow</html:code> is SHA-512. This can be configured in several
locations.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_libuserconf" severity="medium">
                <xccdf-1.2:title>Set Password Hashing Algorithm in /etc/libuser.conf</xccdf-1.2:title>
                <xccdf-1.2:description>In <html:code>/etc/libuser.conf</html:code>, add or correct the following line in its
<html:code>[defaults]</html:code> section to ensure the system will use the SHA-512
algorithm for password hashing:
<html:pre>crypt_style = sha512</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000196</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1055</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1402</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000480-VMM-002000</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Passwords need to be protected at all times, and encryption is the standard
method for protecting passwords. If passwords are not encrypted, they can
be plainly read (i.e., clear text) and easily compromised. Passwords that
are encrypted with a weak algorithm are no more protected than if they are
kepy in plain text.
<html:br/><html:br/>
This setting ensures user and group account administration utilities are
configured to store only encrypted representations of passwords.
Additionally, the <html:code>crypt_style</html:code> configuration option ensures the use
of a strong hashing algorithm that makes password cracking attacks more
difficult.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#libuser"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="set_password_hashing_algorithm_libuserconf"># Remediation is applicable only in certain platforms
if rpm --quiet -q libuser; then

LIBUSER_CONF="/etc/libuser.conf"
CRYPT_STYLE_REGEX='[[:space:]]*\[defaults](.*(\n)+)+?[[:space:]]*crypt_style[[:space:]]*'

# Try find crypt_style in [defaults] section. If it is here, then change algorithm to sha512.
# If it isn't here, then add it to [defaults] section.
if grep -qzosP $CRYPT_STYLE_REGEX $LIBUSER_CONF ; then
        sed -i "s/\(crypt_style[[:space:]]*=[[:space:]]*\).*/\1sha512/g" $LIBUSER_CONF
elif grep -qs "\[defaults]" $LIBUSER_CONF ; then
        sed -i "/[[:space:]]*\[defaults]/a crypt_style = sha512" $LIBUSER_CONF
else
        echo -e "[defaults]\ncrypt_style = sha512" &gt;&gt; $LIBUSER_CONF
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="set_password_hashing_algorithm_libuserconf" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.2
    - NIST-800-171-3.13.11
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.1
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - set_password_hashing_algorithm_libuserconf

- name: Set Password Hashing Algorithm in /etc/libuser.conf
  lineinfile:
    dest: /etc/libuser.conf
    insertafter: ^\s*\[defaults]
    regexp: ^#?crypt_style
    line: crypt_style = sha512
    state: present
    create: true
  when: '"libuser" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.2
    - NIST-800-171-3.13.11
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.1
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - set_password_hashing_algorithm_libuserconf
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-set_password_hashing_algorithm_libuserconf:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-set_password_hashing_algorithm_libuserconf_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs" severity="medium">
                <xccdf-1.2:title>Set Password Hashing Algorithm in /etc/login.defs</xccdf-1.2:title>
                <xccdf-1.2:description>In <html:code>/etc/login.defs</html:code>, add or correct the following line to ensure
the system will use SHA-512 as the hashing algorithm:
<html:pre>ENCRYPT_METHOD SHA512</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R32)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000196</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1055</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1402</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Passwords need to be protected at all times, and encryption is the standard method for protecting passwords.
If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords
that are encrypted with a weak algorithm are no more protected than if they are kept in plain text.
<html:br/><html:br/>
Using a stronger hashing algorithm makes password cracking attacks more difficult.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#login_defs"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="set_password_hashing_algorithm_logindefs"># Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then

var_password_hashing_algorithm='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm" use="legacy"/>'


if grep --silent ^ENCRYPT_METHOD /etc/login.defs ; then
	sed -i "s/^ENCRYPT_METHOD .*/ENCRYPT_METHOD $var_password_hashing_algorithm/g" /etc/login.defs
else
	echo "" &gt;&gt; /etc/login.defs
	echo "ENCRYPT_METHOD $var_password_hashing_algorithm" &gt;&gt; /etc/login.defs
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="set_password_hashing_algorithm_logindefs" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.2
    - NIST-800-171-3.13.11
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.1
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - set_password_hashing_algorithm_logindefs
- name: XCCDF Value var_password_hashing_algorithm # promote to variable
  set_fact:
    var_password_hashing_algorithm: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm" use="legacy"/>
  tags:
    - always

- name: Set Password Hashing Algorithm in /etc/login.defs
  lineinfile:
    dest: /etc/login.defs
    regexp: ^#?ENCRYPT_METHOD
    line: ENCRYPT_METHOD {{ var_password_hashing_algorithm }}
    state: present
    create: true
  when: '"shadow-utils" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.2
    - NIST-800-171-3.13.11
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.1
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - set_password_hashing_algorithm_logindefs
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_password_hashing_algorithm:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-set_password_hashing_algorithm_logindefs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-set_password_hashing_algorithm_logindefs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth" severity="medium">
                <xccdf-1.2:title>Set PAM's Password Hashing Algorithm - password-auth</xccdf-1.2:title>
                <xccdf-1.2:description>The PAM system service can be configured to only store encrypted
representations of passwords. In
<html:code>/etc/pam.d/password-auth</html:code>,
the
<html:code>password</html:code> section of the file controls which PAM modules execute
during a password change. Set the <html:code>pam_unix.so</html:code> module in the
<html:code>password</html:code> section to include the argument <html:code>sha512</html:code>, as shown
below:
<html:br/>
<html:pre>password    sufficient    pam_unix.so sha512 <html:i>other arguments...</html:i></html:pre>
<html:br/>
This will help ensure when local users change their passwords, hashes for
the new passwords will be generated using the SHA-512 algorithm. This is
the default.</xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R32)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000196</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1055</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1402</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000480-VMM-002000</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Passwords need to be protected at all times, and encryption is the standard
method for protecting passwords. If passwords are not encrypted, they can
be plainly read (i.e., clear text) and easily compromised. Passwords that
are encrypted with a weak algorithm are no more protected than if they are
kepy in plain text.
<html:br/><html:br/>
This setting ensures user and group account administration utilities are
configured to store only encrypted representations of passwords.
Additionally, the <html:code>crypt_style</html:code> configuration option ensures the use
of a strong hashing algorithm that makes password cracking attacks more
difficult.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="set_password_hashing_algorithm_passwordauth"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

if ! grep -q "^password.*sufficient.*pam_unix.so.*sha512" "/etc/pam.d/password-auth"; then
	sed -i --follow-symlinks "/^password.*sufficient.*pam_unix.so/ s/$/ sha512/" "/etc/pam.d/password-auth"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-set_password_hashing_algorithm_passwordauth:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-set_password_hashing_algorithm_passwordauth_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth" severity="medium">
                <xccdf-1.2:title>Set PAM's Password Hashing Algorithm</xccdf-1.2:title>
                <xccdf-1.2:description>The PAM system service can be configured to only store encrypted
representations of passwords. In "/etc/pam.d/password-auth", the
<html:code>password</html:code> section of the file controls which PAM modules execute
during a password change. Set the <html:code>pam_unix.so</html:code> module in the
<html:code>password</html:code> section to include the argument <html:code>sha512</html:code>, as shown
below:
<html:br/>

<html:pre>password    sufficient    pam_unix.so sha512 <html:i>other arguments...</html:i></html:pre>

<html:br/>
This will help ensure when local users change their passwords, hashes for
the new passwords will be generated using the SHA-512 algorithm. This is
the default.</xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R32)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000196</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1055</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1402</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000480-VMM-002000</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Passwords need to be protected at all times, and encryption is the standard
method for protecting passwords. If passwords are not encrypted, they can
be plainly read (i.e., clear text) and easily compromised. Passwords that
are encrypted with a weak algorithm are no more protected than if they are
kepy in plain text.
<html:br/><html:br/>
This setting ensures user and group account administration utilities are
configured to store only encrypted representations of passwords.
Additionally, the <html:code>crypt_style</html:code> configuration option ensures the use
of a strong hashing algorithm that makes password cracking attacks more
difficult.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="set_password_hashing_algorithm_systemauth"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

AUTH_FILES[0]="/etc/pam.d/system-auth"
for pamFile in "${AUTH_FILES[@]}"
do
	if ! grep -q "^password.*sufficient.*pam_unix.so.*sha512" $pamFile; then
		sed -i --follow-symlinks "/^password.*sufficient.*pam_unix.so/ s/$/ sha512/" $pamFile
	fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-set_password_hashing_algorithm_systemauth:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-set_password_hashing_algorithm_systemauth_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_accounts-physical">
            <xccdf-1.2:title>Protect Physical Console Access</xccdf-1.2:title>
            <xccdf-1.2:description>It is impossible to fully protect a system from an
attacker with physical access, so securing the space in which the
system is located should be considered a necessary step. However,
there are some steps which, if taken, make it more difficult for an
attacker to quickly or undetectably modify a system from its
console.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_debug-shell_disabled" severity="medium">
              <xccdf-1.2:title>Disable debug-shell SystemD Service</xccdf-1.2:title>
              <xccdf-1.2:description>SystemD's <html:code>debug-shell</html:code> service is intended to
diagnose SystemD related boot issues with various <html:code>systemctl</html:code>
commands. Once enabled and following a system reboot, the root shell
will be available on <html:code>tty9</html:code> which is access by pressing
<html:code>CTRL-ALT-F9</html:code>. The <html:code>debug-shell</html:code> service should only be used
for SystemD related issues and should otherwise be disabled.
<html:br/><html:br/>
By default, the <html:code>debug-shell</html:code> SystemD service is already disabled.

The <html:code>debug-shell</html:code> service can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now debug-shell.service</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000324-GPOS-00125</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>This prevents attackers with physical access from trivially bypassing security
on the machine through valid troubleshooting configurations and gaining root
access when the system is rebooted.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_debug-shell_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'debug-shell.service'
"$SYSTEMCTL_EXEC" disable 'debug-shell.service'
"$SYSTEMCTL_EXEC" mask 'debug-shell.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^debug-shell.socket'; then
    "$SYSTEMCTL_EXEC" stop 'debug-shell.socket'
    "$SYSTEMCTL_EXEC" mask 'debug-shell.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'debug-shell.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_debug-shell_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Disable service debug-shell
  block:

    - name: Disable service debug-shell
      systemd:
        name: debug-shell.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      ignore_errors: 'yes'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.5
    - NIST-800-53-CM-6
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_debug-shell_disabled

- name: Unit Socket Exists - debug-shell.socket
  command: systemctl list-unit-files debug-shell.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.5
    - NIST-800-53-CM-6
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_debug-shell_disabled

- name: Disable socket debug-shell
  systemd:
    name: debug-shell.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"debug-shell.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - NIST-800-171-3.4.5
    - NIST-800-53-CM-6
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_debug-shell_disabled
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_debug-shell_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_debug-shell

class disable_debug-shell {
  service {'debug-shell':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="service_debug-shell_disabled">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - enabled: false
        name: debug-shell.service
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_debug-shell_disabled">
[customizations.services]
disabled = ["debug-shell"]
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_debug-shell_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-service_debug-shell_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot" severity="high">
              <xccdf-1.2:title>Disable Ctrl-Alt-Del Reboot Activation</xccdf-1.2:title>
              <xccdf-1.2:description>By default, <html:code>SystemD</html:code> will reboot the system if the <html:code>Ctrl-Alt-Del</html:code>
key sequence is pressed.
<html:br/><html:br/>
To configure the system to ignore the <html:code>Ctrl-Alt-Del</html:code> key sequence from the

command line instead of rebooting the system, do either of the following:
<html:pre>ln -sf /dev/null /etc/systemd/system/ctrl-alt-del.target</html:pre>
or
<html:pre>systemctl mask ctrl-alt-del.target</html:pre>
<html:br/><html:br/>
Do not simply delete the <html:code>/usr/lib/systemd/system/ctrl-alt-del.service</html:code> file,
as this file may be restored during future system updates.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000324-GPOS-00125</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>A locally logged-in user who presses Ctrl-Alt-Del, when at the console,
can reboot the system. If accidentally pressed, as could happen in
the case of mixed OS environment, this can create the risk of short-term
loss of availability of systems due to unintentional reboot.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="disable_ctrlaltdel_reboot"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

systemctl disable --now ctrl-alt-del.target
systemctl mask --now ctrl-alt-del.target

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="disable_ctrlaltdel_reboot" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Disable Ctrl-Alt-Del Reboot Activation
  systemd:
    name: ctrl-alt-del.target
    force: true
    masked: true
    state: stopped
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_ctrlaltdel_reboot
    - disable_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="disable_ctrlaltdel_reboot" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: ctrl-alt-del.target
        mask: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-disable_ctrlaltdel_reboot:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-disable_ctrlaltdel_reboot_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_disable_interactive_boot" severity="medium">
              <xccdf-1.2:title>Verify that Interactive Boot is Disabled</xccdf-1.2:title>
              <xccdf-1.2:description>Fedora systems support an "interactive boot" option that can
be used to prevent services from being started. On a Fedora
system, interactive boot can be enabled by providing a <html:code>1</html:code>,
<html:code>yes</html:code>, <html:code>true</html:code>, or <html:code>on</html:code> value to the
<html:code>systemd.confirm_spawn</html:code> kernel argument in <html:code>/etc/default/grub</html:code>.
Remove any instance of <html:pre>systemd.confirm_spawn=(1|yes|true|on)</html:pre> from
the kernel arguments in that file to disable interactive boot.
Recovery booting must also be disabled. Confirm that
<html:code>GRUB_DISABLE_RECOVERY=true</html:code> is set in  <html:code>/etc/default/grub</html:code>.
It is also required to change the runtime configuration, run:

<html:pre>/sbin/grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn"</html:pre>

<html:pre>grub2-mkconfig -o /boot/grub2/grub.cfg</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000213</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-2(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Using interactive or recovery boot, the console user could disable auditing, firewalls,
or other services, weakening system security.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#grub2"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_disable_interactive_boot" complexity="low" disruption="low" reboot="true" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q grub2-common; then

# Verify that Interactive Boot is Disabled in /etc/default/grub
CONFIRM_SPAWN_YES="systemd.confirm_spawn=\(1\|yes\|true\|on\)"
CONFIRM_SPAWN_NO="systemd.confirm_spawn=no"

if grep -q "\(GRUB_CMDLINE_LINUX\|GRUB_CMDLINE_LINUX_DEFAULT\)" /etc/default/grub
then
	sed -i "s/${CONFIRM_SPAWN_YES}/${CONFIRM_SPAWN_NO}/" /etc/default/grub
fi

# make sure GRUB_DISABLE_RECOVERY=true
if grep -q '^GRUB_DISABLE_RECOVERY=.*'  '/etc/default/grub' ; then
       # modify the GRUB command-line if an GRUB_DISABLE_RECOVERY= arg already exists
       sed -i 's/GRUB_DISABLE_RECOVERY=.*/GRUB_DISABLE_RECOVERY=true/' /etc/default/grub
else
       # no GRUB_DISABLE_RECOVERY=arg is present, append it to file
       echo "GRUB_DISABLE_RECOVERY=true"  &gt;&gt; '/etc/default/grub'
fi



# Remove 'systemd.confirm_spawn' kernel argument also from runtime settings
/sbin/grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn"


#Regen grub.cfg handle updated GRUB_DISABLE_RECOVERY and confirm_spawn
grub2-mkconfig -o /boot/grub2/grub.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_disable_interactive_boot" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-171-3.4.5
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-2(1)
    - grub2_disable_interactive_boot
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Verify GRUB_DISABLE_RECOVERY=true
  lineinfile:
    path: /etc/default/grub
    regexp: ^GRUB_DISABLE_RECOVERY=.*
    line: GRUB_DISABLE_RECOVERY=true
    state: present
  when: '"grub2-common" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-171-3.4.5
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-2(1)
    - grub2_disable_interactive_boot
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Verify that Interactive Boot is Disabled in /etc/default/grub
  replace:
    dest: /etc/default/grub
    regexp: systemd.confirm_spawn=(1|yes|true|on)
    replace: systemd.confirm_spawn=no
  when: '"grub2-common" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-171-3.4.5
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-2(1)
    - grub2_disable_interactive_boot
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Verify that Interactive Boot is Disabled (runtime)
  command: /sbin/grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn"
  when: '"grub2-common" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-171-3.4.5
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-2(1)
    - grub2_disable_interactive_boot
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Regen grub.cfg handle updated GRUB_DISABLE_RECOVERY and confirm_spawn
  command: grub2-mkconfig -o  /boot/grub2/grub.cfg
  when: '"grub2-common" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-171-3.4.5
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-2(1)
    - grub2_disable_interactive_boot
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-grub2_disable_interactive_boot:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-grub2_disable_interactive_boot_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_require_emergency_target_auth" severity="medium">
              <xccdf-1.2:title>Require Authentication for Emergency Systemd Target</xccdf-1.2:title>
              <xccdf-1.2:description>Emergency mode is intended as a system recovery
method, providing a single user root access to the system
during a failed boot sequence.
<html:br/><html:br/>
By default, Emergency mode is protected by requiring a password and is set
in <html:code>/usr/lib/systemd/system/emergency.service</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000213</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0421</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0422</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0431</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0974</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1173</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1401</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1504</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1505</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1546</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1557</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1558</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1559</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1560</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1561</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000080-GPOS-00048</xccdf-1.2:reference>
              <xccdf-1.2:rationale>This prevents attackers with physical access from trivially bypassing security
on the machine and gaining root access. Such accesses are further prevented
by configuring the bootloader password.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="require_emergency_target_auth"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

service_file="/usr/lib/systemd/system/emergency.service"

sulogin="/usr/lib/systemd/systemd-sulogin-shell emergency"

if grep "^ExecStart=.*" "$service_file" ; then
    sed -i "s%^ExecStart=.*%ExecStart=-$sulogin%" "$service_file"
else
    echo "ExecStart=-$sulogin" &gt;&gt; "$service_file"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="require_emergency_target_auth" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: require emergency mode password
  lineinfile:
    create: true
    dest: /usr/lib/systemd/system/emergency.service
    regexp: ^#?ExecStart=
    line: ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.1
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - require_emergency_target_auth
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-require_emergency_target_auth:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-require_emergency_target_auth_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_require_singleuser_auth" severity="medium">
              <xccdf-1.2:title>Require Authentication for Single User Mode</xccdf-1.2:title>
              <xccdf-1.2:description>Single-user mode is intended as a system recovery
method, providing a single user root access to the system by
providing a boot option at startup. By default, no authentication
is performed if single-user mode is selected.
<html:br/><html:br/>
By default, single-user mode is protected by requiring a password and is set
in <html:code>/usr/lib/systemd/system/rescue.service</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000213</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0421</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0422</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0431</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0974</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1173</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1401</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1504</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1505</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1546</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1557</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1558</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1559</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1560</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1561</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000080-GPOS-00048</xccdf-1.2:reference>
              <xccdf-1.2:rationale>This prevents attackers with physical access from trivially bypassing security
on the machine and gaining root access. Such accesses are further prevented
by configuring the bootloader password.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="require_singleuser_auth"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

service_file="/usr/lib/systemd/system/rescue.service"

sulogin="/usr/lib/systemd/systemd-sulogin-shell rescue"

if grep "^ExecStart=.*" "$service_file" ; then
    sed -i "s%^ExecStart=.*%ExecStart=-$sulogin%" "$service_file"
else
    echo "ExecStart=-$sulogin" &gt;&gt; "$service_file"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="require_singleuser_auth" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: require single user mode password
  lineinfile:
    create: true
    dest: /usr/lib/systemd/system/rescue.service
    regexp: ^#?ExecStart=
    line: ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.1
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - require_singleuser_auth
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-require_singleuser_auth:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-require_singleuser_auth_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_screen_locking">
              <xccdf-1.2:title>Configure Screen Locking</xccdf-1.2:title>
              <xccdf-1.2:description>When a user must temporarily leave an account
logged-in, screen locking should be employed to prevent passersby
from abusing the account. User education and training is
particularly important for screen locking to be effective, and policies
can be implemented to reinforce this.
<html:br/><html:br/>
Automatic screen locking is only meant as a safeguard for
those cases where a user forgot to lock the screen.</xccdf-1.2:description>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_console_screen_locking">
                <xccdf-1.2:title>Configure Console Screen Locking</xccdf-1.2:title>
                <xccdf-1.2:description>A console screen locking mechanism is a temporary action taken when a user
stops work and moves away from the immediate physical vicinity of the
information system but does not logout because of the temporary nature of
the absence. Rather than relying on the user to manually lock their
operation system session prior to vacating the vicinity, operating systems
need to be able to identify when a user's session has idled and take action
to initiate the session lock.</xccdf-1.2:description>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_screen_installed" severity="medium">
                  <xccdf-1.2:title>Install the screen Package</xccdf-1.2:title>
                  <xccdf-1.2:description>To enable console screen locking, install the <html:code>screen</html:code> package.
The <html:code>screen</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install screen</html:pre>
Instruct users to begin new terminal sessions with the following command:
<html:pre>$ screen</html:pre>
The console can now be locked with the following key combination:
<html:pre>ctrl+a x</html:pre></xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000058</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000030-VMM-000110</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate
physical vicinity of the information system but does not logout because of the temporary nature of the absence.
Rather than relying on the user to manually lock their operation system session prior to vacating the vicinity,
operating systems need to be able to identify when a user's session has idled and take action to initiate the
session lock.
<html:br/><html:br/>
The <html:code>screen</html:code> package allows for a session lock to be implemented and configured.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#machine"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_screen_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "screen" ; then
    dnf install -y "screen"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_screen_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure screen is installed
  package:
    name: screen
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_screen_installed
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_screen_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_screen

class install_screen {
  package { 'screen':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_screen_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=screen
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_screen_installed">
[[packages]]
name = "screen"
version = "*"
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_screen_installed:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_screen_installed_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_tmux_installed" severity="medium">
                  <xccdf-1.2:title>Install the tmux Package</xccdf-1.2:title>
                  <xccdf-1.2:description>To enable console screen locking, install the <html:code>tmux</html:code> package.
A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence.
The session lock is implemented at the point where session activity can be determined.
Rather than be forced to wait for a period of time to expire before the user session can be locked, Fedora needs to provide users with the ability to manually invoke a session lock so users can secure their session if it is necessary to temporarily vacate the immediate physical vicinity.
Instruct users to begin new terminal sessions with the following command:
<html:pre>$ tmux</html:pre>
The console can now be locked with the following key combination:
<html:pre>ctrl+b :lock-session</html:pre></xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000058</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000056</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000030-GPOS-00011</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000028-GPOS-00009</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000030-VMM-000110</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate
physical vicinity of the information system but does not logout because of the temporary nature of the absence.
Rather than relying on the user to manually lock their operation system session prior to vacating the vicinity,
operating systems need to be able to identify when a user's session has idled and take action to initiate the
session lock.
<html:br/><html:br/>
The <html:code>tmux</html:code> package allows for a session lock to be implemented and configured.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#machine"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_tmux_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "tmux" ; then
    dnf install -y "tmux"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_tmux_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure tmux is installed
  package:
    name: tmux
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_tmux_installed
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_tmux_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_tmux

class install_tmux {
  package { 'tmux':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_tmux_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=tmux
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_tmux_installed">
[[packages]]
name = "tmux"
version = "*"
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_tmux_installed:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_tmux_installed_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configure_bashrc_exec_tmux" severity="medium">
                  <xccdf-1.2:title>Support session locking with tmux</xccdf-1.2:title>
                  <xccdf-1.2:description>The <html:code>tmux</html:code> terminal multiplexer is used to implement
automatic session locking. It should be started from
<html:code>/etc/bashrc</html:code> or drop-in files within <html:code>/etc/profile.d/</html:code>.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000056</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000031-GPOS-00012</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000028-GPOS-00009</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Unlike <html:code>bash</html:code> itself, the <html:code>tmux</html:code> terminal multiplexer
provides a mechanism to lock sessions after period of inactivity.
A session lock is a temporary action taken when a user stops work and moves away from the
immediate physical vicinity of the information system but does not want to
log out because of the temporary nature of the absence.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#machine"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="configure_bashrc_exec_tmux" complexity="low" disruption="low" reboot="true" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! grep -x '  case "$name" in sshd|login) exec tmux ;; esac' /etc/bashrc; then
    cat &gt;&gt; /etc/profile.d/tmux.sh &lt;&lt;'EOF'
if [ "$PS1" ]; then
  parent=$(ps -o ppid= -p $$)
  name=$(ps -o comm= -p $parent)
  case "$name" in sshd|login) exec tmux ;; esac
fi
EOF
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-configure_bashrc_exec_tmux:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-configure_bashrc_exec_tmux_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configure_tmux_lock_after_time" severity="medium">
                  <xccdf-1.2:title>Configure tmux to lock session after inactivity</xccdf-1.2:title>
                  <xccdf-1.2:description>To enable console screen locking in <html:code>tmux</html:code> terminal multiplexer
after a period of inactivity,
the <html:code>lock-after-time</html:code> option has to be set to nonzero value in
<html:code>/etc/tmux.conf</html:code>.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000031-GPOS-00012</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Locking the session after a period of inactivity limits the
potential exposure if the session is left unattended.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#machine"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="configure_tmux_lock_after_time"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

tmux_conf="/etc/tmux.conf"

if grep -qP '^\s*set\s+-g\s+lock-after-time' "$tmux_conf" ; then
    sed -i 's/^\s*set\s\+-g\s\+lock-after-time.*$/set -g lock-after-time 900/' "$tmux_conf"
else
    echo "set -g lock-after-time 900" &gt;&gt; "$tmux_conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="configure_tmux_lock_after_time" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Configure tmux to lock session after inactivity
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/tmux.conf
        create: false
        regexp: ^\s*set -g lock-after-time\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/tmux.conf
      lineinfile:
        path: /etc/tmux.conf
        create: false
        regexp: ^\s*set -g lock-after-time\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/tmux.conf
      lineinfile:
        path: /etc/tmux.conf
        create: true
        regexp: ^\s*set -g lock-after-time\s+
        line: set -g lock-after-time 900
        state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_tmux_lock_after_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-configure_tmux_lock_after_time:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-configure_tmux_lock_after_time_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configure_tmux_lock_command" severity="medium">
                  <xccdf-1.2:title>Configure the tmux Lock Command</xccdf-1.2:title>
                  <xccdf-1.2:description>To enable console screen locking in <html:code>tmux</html:code> terminal multiplexer,
the <html:code>vlock</html:code> command must be configured to be used as a locking
mechanism.
Add the following line to <html:code>/etc/tmux.conf</html:code>:
<html:pre>set -g lock-command vlock</html:pre>.
The console can now be locked with the following key combination:
<html:pre>ctrl+b :lock-session</html:pre></xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000056</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000058</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-11(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-11(b)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000028-GPOS-00009</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000028-VMM-000090</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000030-VMM-000110</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>The <html:code>tmux</html:code> package allows for a session lock to be implemented and configured.
However, the session lock is implemented by an external command. The <html:code>tmux</html:code>
default configuration does not contain an effective session lock.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#machine"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="configure_tmux_lock_command"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

tmux_conf="/etc/tmux.conf"

if grep -qP '^\s*set\s+-g\s+lock-command' "$tmux_conf" ; then
    sed -i 's/^\s*set\s\+-g\s\+lock-command.*$/set -g lock-command vlock/' "$tmux_conf"
else
    echo "set -g lock-command vlock" &gt;&gt; "$tmux_conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="configure_tmux_lock_command" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Configure the tmux Lock Command
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/tmux.conf
        create: false
        regexp: ^\s*set -g lock-command\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/tmux.conf
      lineinfile:
        path: /etc/tmux.conf
        create: false
        regexp: ^\s*set -g lock-command\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/tmux.conf
      lineinfile:
        path: /etc/tmux.conf
        create: true
        regexp: ^\s*set -g lock-command\s+
        line: set -g lock-command vlock
        state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-11(a)
    - NIST-800-53-AC-11(b)
    - NIST-800-53-CM-6(a)
    - configure_tmux_lock_command
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-configure_tmux_lock_command:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-configure_tmux_lock_command_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_tmux_in_shells" severity="low">
                  <xccdf-1.2:title>Prevent user from disabling the screen lock</xccdf-1.2:title>
                  <xccdf-1.2:description>The <html:code>tmux</html:code> terminal multiplexer is used to implement
automatic session locking. It should not be listed in
<html:code>/etc/shells</html:code>.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000056</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000324-GPOS-00125</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000028-GPOS-00009</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Not listing <html:code>tmux</html:code> among permitted shells
prevents malicious program running as user
from lowering security by disabling the screen lock.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#machine"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="no_tmux_in_shells"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if grep -q 'tmux\s*$' /etc/shells ; then
	sed -i '/tmux\s*$/d' /etc/shells
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="no_tmux_in_shells">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,/bin/sh%0A/bin/bash%0A/usr/bin/sh%0A/usr/bin/bash%0A
        mode: 0644
        path: /etc/shells
        overwrite: true
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-no_tmux_in_shells:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-no_tmux_in_shells_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
              </xccdf-1.2:Group>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_smart_card_login">
                <xccdf-1.2:title>Hardware Tokens for Authentication</xccdf-1.2:title>
                <xccdf-1.2:description>The use of hardware tokens such as smart cards for system login
provides stronger, two-factor authentication than using a username and password.

In Red Hat Enterprise Linux servers and workstations, hardware token login

is not enabled by default and must be enabled in the system settings.</xccdf-1.2:description>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_smartcard_drivers" type="string" interactive="true">
                  <xccdf-1.2:title>OpenSC Smart Card Drivers</xccdf-1.2:title>
                  <xccdf-1.2:description>Choose the Smart Card Driver in use by your organization.
<html:br/>For DoD, choose the <html:code>cac</html:code> driver.
<html:br/>If your driver is not listed and you don't want to use the
<html:code>default</html:code> driver, use the <html:code>other</html:code> option and
manually specify your driver.</xccdf-1.2:description>
                  <xccdf-1.2:value>default</xccdf-1.2:value>
                  <xccdf-1.2:value selector="acos5">acos5</xccdf-1.2:value>
                  <xccdf-1.2:value selector="akis">akis</xccdf-1.2:value>
                  <xccdf-1.2:value selector="asepcos">asepcos</xccdf-1.2:value>
                  <xccdf-1.2:value selector="atrust-acos">atrust-acos</xccdf-1.2:value>
                  <xccdf-1.2:value selector="authentic">authentic</xccdf-1.2:value>
                  <xccdf-1.2:value selector="belpic">belpic</xccdf-1.2:value>
                  <xccdf-1.2:value selector="cac">cac</xccdf-1.2:value>
                  <xccdf-1.2:value selector="cardos">cardos</xccdf-1.2:value>
                  <xccdf-1.2:value selector="coolkey">coolkey</xccdf-1.2:value>
                  <xccdf-1.2:value selector="cyberflex">cyberflex</xccdf-1.2:value>
                  <xccdf-1.2:value selector="dnie">dnie</xccdf-1.2:value>
                  <xccdf-1.2:value selector="entersafe">entersafe</xccdf-1.2:value>
                  <xccdf-1.2:value selector="epass2003">epass2003</xccdf-1.2:value>
                  <xccdf-1.2:value selector="flex">flex</xccdf-1.2:value>
                  <xccdf-1.2:value selector="gemsafeV1">gemsafeV1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="gids">gids</xccdf-1.2:value>
                  <xccdf-1.2:value selector="gpk">gpk</xccdf-1.2:value>
                  <xccdf-1.2:value selector="iasecc">iasecc</xccdf-1.2:value>
                  <xccdf-1.2:value selector="incrypto34">incrypto34</xccdf-1.2:value>
                  <xccdf-1.2:value selector="isoApplet">isoApplet</xccdf-1.2:value>
                  <xccdf-1.2:value selector="itacns">itacns</xccdf-1.2:value>
                  <xccdf-1.2:value selector="jpki">jpki</xccdf-1.2:value>
                  <xccdf-1.2:value selector="MaskTech">MaskTech</xccdf-1.2:value>
                  <xccdf-1.2:value selector="mcrd">mcrd</xccdf-1.2:value>
                  <xccdf-1.2:value selector="muscle">muscle</xccdf-1.2:value>
                  <xccdf-1.2:value selector="myeid">myeid</xccdf-1.2:value>
                  <xccdf-1.2:value selector="npa">npa</xccdf-1.2:value>
                  <xccdf-1.2:value selector="oberthur">oberthur</xccdf-1.2:value>
                  <xccdf-1.2:value selector="openpgp">openpgp</xccdf-1.2:value>
                  <xccdf-1.2:value selector="other">None</xccdf-1.2:value>
                  <xccdf-1.2:value selector="PIV-II">PIV-II</xccdf-1.2:value>
                  <xccdf-1.2:value selector="rutoken_ecp">rutoken_ecp</xccdf-1.2:value>
                  <xccdf-1.2:value selector="rutoken">rutoken</xccdf-1.2:value>
                  <xccdf-1.2:value selector="sc-hsm">sc-hsm</xccdf-1.2:value>
                  <xccdf-1.2:value selector="setcos">setcos</xccdf-1.2:value>
                  <xccdf-1.2:value selector="starcos">starcos</xccdf-1.2:value>
                  <xccdf-1.2:value selector="tcos">tcos</xccdf-1.2:value>
                  <xccdf-1.2:value selector="westcos">westcos</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_opensc_installed" severity="medium">
                  <xccdf-1.2:title>Install the opensc Package For Multifactor Authentication</xccdf-1.2:title>
                  <xccdf-1.2:description>
The <html:code>opensc</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install opensc</html:pre></xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001954</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001953</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1382</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1384</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1386</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00160</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000376-GPOS-00161</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000376-VMM-001520</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Using an authentication device, such as a CAC or token that is separate from
the information system, ensures that even if the information system is
compromised, that compromise will not affect credentials stored on the
authentication device.
<html:br/><html:br/>
Multifactor solutions that require devices separate from
information systems gaining access include, for example, hardware tokens
providing time-based or challenge-response authenticators and smart cards such
as the U.S. Government Personal Identity Verification card and the DoD Common
Access Card.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#machine"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_opensc_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "opensc" ; then
    dnf install -y "opensc"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_opensc_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure opensc is installed
  package:
    name: opensc
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_opensc_installed
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_opensc_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_opensc

class install_opensc {
  package { 'opensc':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_opensc_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=opensc
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_opensc_installed">
[[packages]]
name = "opensc"
version = "*"
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_opensc_installed:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_opensc_installed_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed" severity="medium">
                  <xccdf-1.2:title>Install the pcsc-lite package</xccdf-1.2:title>
                  <xccdf-1.2:description>The <html:code>pcsc-lite</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install pcsc-lite</html:pre></xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001954</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1382</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1384</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1386</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00160</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000377-VMM-001530</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>The pcsc-lite package must be installed if it is to be available for
multifactor authentication using smartcards.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#machine"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_pcsc-lite_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "pcsc-lite" ; then
    dnf install -y "pcsc-lite"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_pcsc-lite_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure pcsc-lite is installed
  package:
    name: pcsc-lite
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_pcsc-lite_installed
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_pcsc-lite_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_pcsc-lite

class install_pcsc-lite {
  package { 'pcsc-lite':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_pcsc-lite_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=pcsc-lite
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_pcsc-lite_installed">
[[packages]]
name = "pcsc-lite"
version = "*"
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_pcsc-lite_installed:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_pcsc-lite_installed_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_install_smartcard_packages" severity="medium">
                  <xccdf-1.2:title>Install Smart Card Packages For Multifactor Authentication</xccdf-1.2:title>
                  <xccdf-1.2:description>Configure the operating system to implement multifactor authentication by
installing the required package with the following command:

The <html:code>openssl-pkcs11</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install openssl-pkcs11</html:pre></xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000765</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001948</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001953</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001954</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000105-GPOS-00052</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00160</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00161</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000377-GPOS-00162</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Using an authentication device, such as a CAC or token that is separate from
the information system, ensures that even if the information system is
compromised, that compromise will not affect credentials stored on the
authentication device.
<html:br/><html:br/>
Multifactor solutions that require devices separate from
information systems gaining access include, for example, hardware tokens
providing time-based or challenge-response authenticators and smart cards such
as the U.S. Government Personal Identity Verification card and the DoD Common
Access Card.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#machine"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="install_smartcard_packages" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "openssl-pkcs11" ; then
    dnf install -y "openssl-pkcs11"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="install_smartcard_packages" complexity="low" disruption="low" reboot="false" strategy="enable">include install_openssl-pkcs11

class install_openssl-pkcs11 {
  package { 'openssl-pkcs11':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="install_smartcard_packages" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=openssl-pkcs11
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="install_smartcard_packages">
[[packages]]
name = "openssl-pkcs11"
version = "*"
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-install_smartcard_packages:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-install_smartcard_packages_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_pcscd_enabled" severity="medium">
                  <xccdf-1.2:title>Enable the pcscd Service</xccdf-1.2:title>
                  <xccdf-1.2:description>
The <html:code>pcscd</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable pcscd.service</html:pre></xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001954</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1382</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1384</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1386</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(2)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(3)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(6)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(7)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(11)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00160</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000377-VMM-001530</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Using an authentication device, such as a CAC or token that is separate from
the information system, ensures that even if the information system is
compromised, that compromise will not affect credentials stored on the
authentication device.
<html:br/><html:br/>
Multifactor solutions that require devices separate from
information systems gaining access include, for example, hardware tokens
providing time-based or challenge-response authenticators and smart cards such
as the U.S. Government Personal Identity Verification card and the DoD Common
Access Card.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#machine"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_pcscd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'pcscd.service'
"$SYSTEMCTL_EXEC" start 'pcscd.service'
"$SYSTEMCTL_EXEC" enable 'pcscd.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_pcscd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Enable service pcscd
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Start service pcscd
      service:
        name: pcscd
        state: started
        masked: 'no'
      when:
        - '"pcsc-lite" in ansible_facts.packages'

    - name: Enable service pcscd
      ansible.builtin.command:
        cmd: systemctl enable pcscd
      when:
        - '"pcsc-lite" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2(1)
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(2)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(6)
    - NIST-800-53-IA-2(7)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_pcscd_enabled
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_pcscd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_pcscd

class enable_pcscd {
  service {'pcscd':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_pcscd_enabled">
[customizations.services]
enabled = ["pcscd"]
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_pcscd_enabled:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-service_pcscd_enabled_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configure_opensc_card_drivers" severity="medium">
                  <xccdf-1.2:title>Configure opensc Smart Card Drivers</xccdf-1.2:title>
                  <xccdf-1.2:description>The OpenSC smart card tool can auto-detect smart card drivers; however,
setting the smart card drivers in use by your organization helps to prevent
users from using unauthorized smart cards. The default smart card driver for this
profile is <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/></html:code>.
To configure the OpenSC driver, edit the <html:code>/etc/opensc.conf</html:code>
and add the following line into the file in the <html:code>app default</html:code> block,
so it will look like:

<html:pre>
app default {
   ...
   card_drivers = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/>;
}
</html:pre></xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000765</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000766</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000767</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000768</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000771</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000772</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000884</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1382</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1384</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1386</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(2)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(3)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(6)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(7)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(11)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000104-GPOS-00051</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000106-GPOS-00053</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000107-GPOS-00054</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000109-GPOS-00056</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00055</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00057</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00058</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000376-VMM-001520</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Smart card login provides two-factor authentication stronger than
that provided by a username and password combination. Smart cards leverage PKI
(public key infrastructure) in order to provide and verify credentials.
Configuring the smart card driver in use by your organization helps to prevent
users from using unauthorized smart cards.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#machine"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="configure_opensc_card_drivers" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

var_smartcard_drivers='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/>'


OPENSC_TOOL="/usr/bin/opensc-tool"

if [ -f "${OPENSC_TOOL}" ]; then
    ${OPENSC_TOOL} -S app:default:card_drivers:$var_smartcard_drivers
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="configure_opensc_card_drivers" complexity="low" disruption="low" reboot="false" strategy="configure">- name: XCCDF Value var_smartcard_drivers # promote to variable
  set_fact:
    var_smartcard_drivers: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/>
  tags:
    - always

- name: Check existence of opensc conf
  stat:
    path: /etc/opensc-{{ ansible_architecture }}.conf
  register: opensc_conf_cd
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2(1)
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(2)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(6)
    - NIST-800-53-IA-2(7)
    - PCI-DSS-Req-8.3
    - configure_opensc_card_drivers
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Configure smartcard driver block
  block:

    - name: Check if card_drivers is defined
      command: /usr/bin/opensc-tool -G app:default:card_drivers
      changed_when: false
      register: card_drivers

    - name: Configure opensc Smart Card Drivers
      command: |
        /usr/bin/opensc-tool -S app:default:card_drivers:{{ var_smartcard_drivers }}
      when:
        - card_drivers.stdout != var_smartcard_drivers
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - opensc_conf_cd.stat.exists
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2(1)
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(2)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(6)
    - NIST-800-53-IA-2(7)
    - PCI-DSS-Req-8.3
    - configure_opensc_card_drivers
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_smartcard_drivers:var:1" value-id="xccdf_org.ssgproject.content_value_var_smartcard_drivers"/>
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-configure_opensc_card_drivers:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-configure_opensc_card_drivers_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configure_opensc_nss_db" severity="medium">
                  <xccdf-1.2:title>Configure NSS DB To Use opensc</xccdf-1.2:title>
                  <xccdf-1.2:description>The <html:code>opensc</html:code> module should be configured for use over the
<html:code>Coolkey PKCS#11</html:code> module in the NSS database. To configure the
NSS database to use the <html:code>opensc</html:code> module, run the following
command:
<html:pre>$ sudo pkcs11-switch opensc</html:pre></xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000765</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000766</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000767</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000768</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000771</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000772</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000884</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(2)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(3)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(6)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(7)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(11)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000104-GPOS-00051</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000106-GPOS-00053</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000107-GPOS-00054</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000109-GPOS-00056</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00055</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00057</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00058</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000376-VMM-001520</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000403-VMM-001640</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Smart card login provides two-factor authentication stronger than
that provided by a username and password combination. Smart cards leverage PKI
(public key infrastructure) in order to provide and verify credentials.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#machine"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="configure_opensc_nss_db" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

PKCSSW=$(/usr/bin/pkcs11-switch)

if [ ${PKCSSW} != "opensc" ] ; then
    ${PKCSSW} opensc
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="configure_opensc_nss_db" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Check existence of pkcs11-switch
  stat:
    path: /usr/bin/pkcs11-switch
  register: pkcs11switch
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2(1)
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(2)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(6)
    - NIST-800-53-IA-2(7)
    - PCI-DSS-Req-8.3
    - configure_opensc_nss_db
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Get NSS database smart card configuration
  command: /usr/bin/pkcs11-switch
  changed_when: true
  register: pkcsw_output
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - pkcs11switch.stat.exists
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2(1)
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(2)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(6)
    - NIST-800-53-IA-2(7)
    - PCI-DSS-Req-8.3
    - configure_opensc_nss_db
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Configure NSS DB To Use opensc
  command: /usr/bin/pkcs11-switch opensc
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - pkcs11switch.stat.exists and pkcsw_output.stdout != "opensc"
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2(1)
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(2)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(6)
    - NIST-800-53-IA-2(7)
    - PCI-DSS-Req-8.3
    - configure_opensc_nss_db
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-configure_opensc_nss_db:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-configure_opensc_nss_db_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_force_opensc_card_drivers" severity="medium">
                  <xccdf-1.2:title>Force opensc To Use Defined Smart Card Driver</xccdf-1.2:title>
                  <xccdf-1.2:description>The OpenSC smart card middleware can auto-detect smart card drivers; however by
forcing the smart card driver in use by your organization, opensc will no longer
autodetect or use other drivers unless specified. This helps to prevent
users from using unauthorized smart cards. The default smart card driver for this
profile is <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/></html:code>.
To force the OpenSC driver, edit the <html:code>/etc/opensc.conf</html:code>.
Look for a line similar to:
<html:pre># force_card_driver = customcos;</html:pre>
and change it to:
<html:pre>force_card_driver = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/>;</html:pre></xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000765</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000766</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000767</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000768</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000771</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000772</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000884</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1382</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1384</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1386</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(2)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(3)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(6)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(7)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(11)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000104-GPOS-00051</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000106-GPOS-00053</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000107-GPOS-00054</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000109-GPOS-00056</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00055</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00057</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00058</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000376-VMM-001520</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Smart card login provides two-factor authentication stronger than
that provided by a username and password combination. Smart cards leverage PKI
(public key infrastructure) in order to provide and verify credentials.
Forcing the smart card driver in use by your organization helps to prevent
users from using unauthorized smart cards.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#machine"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="force_opensc_card_drivers" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

var_smartcard_drivers='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/>'


OPENSC_TOOL="/usr/bin/opensc-tool"

if [ -f "${OPENSC_TOOL}" ]; then
    ${OPENSC_TOOL} -S app:default:force_card_driver:$var_smartcard_drivers
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="force_opensc_card_drivers" complexity="low" disruption="low" reboot="false" strategy="configure">- name: XCCDF Value var_smartcard_drivers # promote to variable
  set_fact:
    var_smartcard_drivers: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/>
  tags:
    - always

- name: Check existence of opensc conf
  stat:
    path: /etc/opensc-{{ ansible_architecture }}.conf
  register: opensc_conf_fcd
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2(1)
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(2)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(6)
    - NIST-800-53-IA-2(7)
    - PCI-DSS-Req-8.3
    - configure_strategy
    - force_opensc_card_drivers
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Force smartcard driver block
  block:

    - name: Check if force_card_driver is defined
      command: /usr/bin/opensc-tool -G app:default:force_card_driver
      changed_when: false
      register: force_card_driver

    - name: Force opensc To Use Defined Smart Card Driver
      command: |
        /usr/bin/opensc-tool -S app:default:force_card_driver:{{ var_smartcard_drivers }}
      when:
        - force_card_driver.stdout != var_smartcard_drivers
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - opensc_conf_fcd.stat.exists
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2(1)
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(2)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(6)
    - NIST-800-53-IA-2(7)
    - PCI-DSS-Req-8.3
    - configure_strategy
    - force_opensc_card_drivers
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_smartcard_drivers:var:1" value-id="xccdf_org.ssgproject.content_value_var_smartcard_drivers"/>
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-force_opensc_card_drivers:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-force_opensc_card_drivers_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_smartcard_auth" severity="medium">
                  <xccdf-1.2:title>Enable Smart Card Login</xccdf-1.2:title>
                  <xccdf-1.2:description>To enable smart card authentication, consult the documentation at:
<html:ul>

</html:ul>


For guidance on enabling SSH to authenticate against a Common Access Card (CAC), consult documentation at:
<html:ul><html:li><html:b><html:a href="https://access.redhat.com/solutions/82273">https://access.redhat.com/solutions/82273</html:a></html:b></html:li></html:ul></xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000764</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000765</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000766</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000767</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000768</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000770</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000771</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000772</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000884</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(2)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(3)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(6)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(7)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(11)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000104-GPOS-00051</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000106-GPOS-00053</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000107-GPOS-00054</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00055</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00057</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00058</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000109-GPOS-00056</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000376-GPOS-00161</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000377-GPOS-00162</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Smart card login provides two-factor authentication stronger than
that provided by a username and password combination. Smart cards leverage PKI
(public key infrastructure) in order to provide and verify credentials.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#machine"/>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-smartcard_auth:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-smartcard_auth_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_accounts-restrictions">
            <xccdf-1.2:title>Protect Accounts by Restricting Password-Based Login</xccdf-1.2:title>
            <xccdf-1.2:description>Conventionally, Unix shell accounts are accessed by
providing a username and password to a login program, which tests
these values for correctness using the <html:code>/etc/passwd</html:code> and
<html:code>/etc/shadow</html:code> files. Password-based login is vulnerable to
guessing of weak passwords, and to sniffing and man-in-the-middle
attacks against passwords entered over a network or at an insecure
console. Therefore, mechanisms for accessing accounts by entering
usernames and passwords should be restricted to those which are
operationally necessary.</xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_authorized_local_users_regex" type="string" operator="pattern match" interactive="true">
              <xccdf-1.2:title>Accounts Authorized Local Users on the Operating System</xccdf-1.2:title>
              <xccdf-1.2:description>List the user accounts that are authorized locally on the operating system. This list
includes both users requried by the operating system and by the installed applications.
Depending on the Operating System distribution, version, software groups and applications,
the user list is different and can be customized with scap-workbench.
OVAL regular expression is used for the user list.
The list starts with '^' and ends with '$' so that it matches exactly the
username, not any string that includes the username. Users are separated with '|'.
For example, three users: bin, oracle and sapadm are allowed, then the list is
<html:code>^(bin|oracle|sapadm)$</html:code>. The user <html:code>root</html:code> is the only user that is hard coded
in OVAL that is always allowed on the operating system.</xccdf-1.2:description>
              <xccdf-1.2:value selector="ol7">^(abrt|adm|avahi|bin|chrony|clevis|cockpit-ws|cockpit-wsinstance|colord|daemon|dbus|dnsmasq|flatpak|ftp|games|gdm|geoclue|gluster|gnome-initial-setup|halt|libstoragemgmt|lp|mail|nfsnobody|nobody|ntp|operator|oprofile|oracle|pcp|pegasus|pipewire|polkitd|postfix|pulse|qemu|radvd|rngd|root|rpc|rpcuser|rtkit|saned|saslauth|setroubleshoot|shutdown|sshd|sssd|sync|systemd-bus-proxy|systemd-coredump|systemd-network|systemd-resolve|tcpdump|tss|unbound|usbmuxd$|uuidd)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="ol8">^(abrt|adm|avahi|bin|chrony|clevis|cockpit-ws|cockpit-wsinstance|colord|daemon|dbus|dnsmasq|flatpak|ftp|games|gdm|geoclue|gluster|gnome-initial-setup|halt|libstoragemgmt|lp|mail|nfsnobody|nobody|ntp|operator|oprofile|oracle|pcp|pegasus|pipewire|polkitd|postfix|pulse|qemu|radvd|rngd|root|rpc|rpcuser|rtkit|saned|saslauth|setroubleshoot|shutdown|sshd|sssd|sync|systemd-bus-proxy|systemd-coredump|systemd-network|systemd-resolve|tcpdump|tss|unbound|usbmuxd$|uuidd)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="ol7forsap">^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="rhel7">^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|systemd-resolve|systemd-coredump|sssd|rngd)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="rhel8">^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|systemd-resolve|systemd-coredump|sssd|rngd)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="sle12">^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|systemd-resolve|systemd-coredump|sssd|rngd|man|systemd-timesync|scard|hacluster|statd|at|dockremap|vnc)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="sle15">^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|systemd-resolve|systemd-coredump|sssd|rngd|man|systemd-timesync|scard|hacluster|statd|at|dockremap|vnc)$</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_account_unique_id" severity="medium">
              <xccdf-1.2:title>Ensure All Accounts on the System Have Unique User IDs</xccdf-1.2:title>
              <xccdf-1.2:description>Change user IDs (UIDs), or delete accounts, so each has a unique name.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Automatic remediation of this control is not available due to unique requirements of each
system.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000804</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000104-GPOS-00051</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000121-GPOS-00062</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:rationale>To assure accountability and prevent unauthenticated access, interactive users must be identified and authenticated to prevent potential misuse and compromise of the system.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-account_unique_id:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-account_unique_id_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_authorized_local_users" severity="medium">
              <xccdf-1.2:title>Only Authorized Local User Accounts Exist on Operating System</xccdf-1.2:title>
              <xccdf-1.2:description>Enterprise Application tends to use the server or virtual machine exclusively.
Besides the default operating system user, there should be only authorized local
users required by the installed software groups and applications that exist on
the operating system. The authorized user list can be customized in the refine
value variable <html:code>var_accounts_authorized_local_users_regex</html:code>.
OVAL regular expression is used for the user list.
Configure the system so all accounts on the system are assigned to an active system,
application, or user account. Remove accounts that do not support approved system
activities or that allow for a normal user to perform administrative-level actions.
To remove unauthorized system accounts, use the following command:
<html:pre>$ sudo userdel <html:i>unauthorized_user</html:i></html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Accounts providing no operational purpose provide additional opportunities for
system compromise. Unnecessary accounts include user accounts for individuals not
requiring access to the system and application accounts for applications not installed
on the system.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_authorized_local_users_regex:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_authorized_local_users_regex"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_authorized_local_users:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_authorized_local_users_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_group_unique_id" severity="medium">
              <xccdf-1.2:title>Ensure All Groups on the System Have Unique Group ID</xccdf-1.2:title>
              <xccdf-1.2:description>Change the group name or delete groups, so each has a unique id.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Automatic remediation of this control is not available due to the unique requirements of each system.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000104-GPOS-00051</xccdf-1.2:reference>
              <xccdf-1.2:rationale>To assure accountability and prevent unauthenticated access, groups must be identified uniquely to prevent potential misuse and compromise of the system.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-group_unique_id:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-group_unique_id_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_group_unique_name" severity="medium">
              <xccdf-1.2:title>Ensure All Groups on the System Have Unique Group Names</xccdf-1.2:title>
              <xccdf-1.2:description>Change the group name or delete groups, so each has a unique name.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Automatic remediation of this control is not available due to the unique requirements of each system.</xccdf-1.2:warning>
              <xccdf-1.2:rationale>To assure accountability and prevent unauthenticated access, groups must be identified uniquely to prevent potential misuse and compromise of the system.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-group_unique_name:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-group_unique_name_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_account_expiration">
              <xccdf-1.2:title>Set Account Expiration Parameters</xccdf-1.2:title>
              <xccdf-1.2:description>Accounts can be configured to be automatically disabled
after a certain time period,
meaning that they will require administrator interaction to become usable again.
Expiration of accounts after inactivity can be set for all accounts by default
and also on a per-account basis, such as for accounts that are known to be temporary.
To configure automatic expiration of an account following
the expiration of its password (that is, after the password has expired and not been changed),
run the following command, substituting <html:code><html:i>NUM_DAYS</html:i></html:code> and <html:code><html:i>USER</html:i></html:code> appropriately:
<html:pre>$ sudo chage -I <html:i>NUM_DAYS USER</html:i></html:pre>
Accounts, such as temporary accounts, can also be configured to expire on an explicitly-set date with the
<html:code>-E</html:code> option.
The file <html:code>/etc/default/useradd</html:code> controls
default settings for all newly-created accounts created with the system's
normal command line utilities.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This will only apply to newly created accounts</xccdf-1.2:warning>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" type="number">
                <xccdf-1.2:title>number of days after a password expires until the account is permanently disabled</xccdf-1.2:title>
                <xccdf-1.2:description>The number of days to wait after a password expires, until the account will be permanently disabled.</xccdf-1.2:description>
                <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="180">180</xccdf-1.2:value>
                <xccdf-1.2:value selector="30">30</xccdf-1.2:value>
                <xccdf-1.2:value selector="35">35</xccdf-1.2:value>
                <xccdf-1.2:value selector="40">40</xccdf-1.2:value>
                <xccdf-1.2:value selector="60">60</xccdf-1.2:value>
                <xccdf-1.2:value selector="90">90</xccdf-1.2:value>
                <xccdf-1.2:value>35</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration" severity="medium">
                <xccdf-1.2:title>Set Account Expiration Following Inactivity</xccdf-1.2:title>
                <xccdf-1.2:description>To specify the number of days after a password expires (which
signifies inactivity) until an account is permanently disabled, add or correct
the following line in <html:code>/etc/default/useradd</html:code>:
<html:pre>INACTIVE=<html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/></html:i></html:pre>
If a password is currently on the verge of expiration, then
<html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/></html:code>
day(s) remain(s) until the account is automatically
disabled. However, if the password will not expire for another 60 days, then 60
days plus <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/></html:code> day(s) could
elapse until the account would be automatically disabled. See the
<html:code>useradd</html:code> man page for more information.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000017</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000795</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-4(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000118-GPOS-00060</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000003-VMM-000030</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000118-VMM-000590</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system.
Disabling inactive accounts ensures that accounts which may not have been responsibly removed are not available to attackers who may have compromised their credentials.
Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#login_defs"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="account_disable_post_pw_expiration"># Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then

var_account_disable_post_pw_expiration='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/>'


# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/default/useradd"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^INACTIVE")

# shellcheck disable=SC2059
printf -v formatted_output "%s=%s" "$stripped_key" "$var_account_disable_post_pw_expiration"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^INACTIVE\\&gt;" "/etc/default/useradd"; then
    "${sed_command[@]}" "s/^INACTIVE\\&gt;.*/$formatted_output/gi" "/etc/default/useradd"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/default/useradd"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="account_disable_post_pw_expiration" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.6
    - NIST-800-53-AC-2(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-4(e)
    - PCI-DSS-Req-8.1.4
    - account_disable_post_pw_expiration
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_account_disable_post_pw_expiration # promote to variable
  set_fact:
    var_account_disable_post_pw_expiration: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/>
  tags:
    - always

- name: Set Account Expiration Following Inactivity
  lineinfile:
    create: true
    dest: /etc/default/useradd
    regexp: ^INACTIVE
    line: INACTIVE={{ var_account_disable_post_pw_expiration }}
  when: '"shadow-utils" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.6
    - NIST-800-53-AC-2(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-4(e)
    - PCI-DSS-Req-8.1.4
    - account_disable_post_pw_expiration
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_account_disable_post_pw_expiration:var:1" value-id="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-account_disable_post_pw_expiration:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-account_disable_post_pw_expiration_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_account_emergency_expire_date" severity="medium">
                <xccdf-1.2:title>Assign Expiration Date to Emergency Accounts</xccdf-1.2:title>
                <xccdf-1.2:description>Emergency accounts are privileged accounts established in response to
crisis situations where the need for rapid account activation is required.
In the event emergency accounts are required, configure the system to
terminate them after a documented time period. For every emergency account,
run the following command to set an expiration date on it, substituting
<html:code><html:i>ACCOUNT_NAME</html:i></html:code> and <html:code><html:i>YYYY-MM-DD</html:i></html:code>
appropriately:
<html:pre>$ sudo chage -E <html:i>YYYY-MM-DD ACCOUNT_NAME</html:i></html:pre>
<html:code><html:i>YYYY-MM-DD</html:i></html:code> indicates the documented expiration date for the
account. For U.S. Government systems, the operating system must be
configured to automatically terminate these types of accounts after a
period of 72 hours.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Due to the unique requirements of each sysetem, automated
remediation is not available for this configuration check.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000016</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001682</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000123-GPOS-00064</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000002-GPOS-00002</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000002-VMM-000020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000123-VMM-000620</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If emergency user accounts remain active when no longer needed or for
an excessive period, these accounts may be used to gain unauthorized access.
To mitigate this risk, automated termination of all emergency accounts
must be set upon account creation.
<html:br/></xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-account_emergency_expire_date_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_account_temp_expire_date" severity="medium">
                <xccdf-1.2:title>Assign Expiration Date to Temporary Accounts</xccdf-1.2:title>
                <xccdf-1.2:description>Temporary accounts are established as part of normal account activation
procedures when there is a need for short-term accounts. In the event
temporary or emergency accounts are required, configure the system to
terminate them after a documented time period. For every temporary and
emergency account, run the following command to set an expiration date on
it, substituting <html:code><html:i>USER</html:i></html:code> and <html:code><html:i>YYYY-MM-DD</html:i></html:code>
appropriately:
<html:pre>$ sudo chage -E <html:i>YYYY-MM-DD USER</html:i></html:pre>
<html:code><html:i>YYYY-MM-DD</html:i></html:code> indicates the documented expiration date for the
account. For U.S. Government systems, the operating system must be
configured to automatically terminate these types of accounts after a
period of 72 hours.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000016</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001682</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000123-GPOS-00064</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000002-GPOS-00002</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000002-VMM-000020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000123-VMM-000620</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If temporary user accounts remain active when no longer needed or for
an excessive period, these accounts may be used to gain unauthorized access.
To mitigate this risk, automated termination of all temporary accounts
must be set upon account creation.
<html:br/></xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-account_temp_expire_date_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_account_unique_name" severity="medium">
                <xccdf-1.2:title>Ensure All Accounts on the System Have Unique Names</xccdf-1.2:title>
                <xccdf-1.2:description>Ensure accounts on the system have unique names.

To ensure all accounts have unique names, run the following command:
<html:pre>$ sudo getent passwd | awk -F: '{ print $1}' | uniq -d</html:pre>
If a username is returned, change or delete the username.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000770</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000804</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.1</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unique usernames allow for accountability on the system.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-account_unique_name:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-account_unique_name_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_account_use_centralized_automated_auth" severity="medium">
                <xccdf-1.2:title>Use Centralized and Automated Authentication</xccdf-1.2:title>
                <xccdf-1.2:description>Implement an automated system for managing user accounts that minimizes the
risk of errors, either intentional or deliberate. This system
should integrate with an existing enterprise user management system, such as
one based on Identity Management tools such as Active Directory, Kerberos,
Directory Server, etc.</xccdf-1.2:description>
                <xccdf-1.2:rationale>A comprehensive account management process that includes automation helps to
ensure the accounts designated as requiring attention are consistently and
promptly addressed. Enterprise environments make user account management
challenging and complex. A user management process requiring administrators to
manually address account management functions adds risk of potential
oversight.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-account_use_centralized_automated_auth_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_password_expiration">
              <xccdf-1.2:title>Set Password Expiration Parameters</xccdf-1.2:title>
              <xccdf-1.2:description>The file <html:code>/etc/login.defs</html:code> controls several
password-related settings. Programs such as <html:code>passwd</html:code>,
<html:code>su</html:code>, and
<html:code>login</html:code> consult <html:code>/etc/login.defs</html:code> to determine
behavior with regard to password aging, expiration warnings,
and length. See the man page <html:code>login.defs(5)</html:code> for more information.
<html:br/><html:br/>
Users should be forced to change their passwords, in order to
decrease the utility of compromised passwords. However, the need to
change passwords often should be balanced against the risk that
users will reuse or write down passwords if forced to change them
too often. Forcing password changes every 90-360 days, depending on
the environment, is recommended. Set the appropriate value as
<html:code>PASS_MAX_DAYS</html:code> and apply it to existing accounts with the
<html:code>-M</html:code> flag.
<html:br/><html:br/>
The <html:code>PASS_MIN_DAYS</html:code> (<html:code>-m</html:code>) setting prevents password
changes for 7 days after the first change, to discourage password
cycling. If you use this setting, train users to contact an administrator
for an emergency password change in case a new password becomes
compromised. The <html:code>PASS_WARN_AGE</html:code> (<html:code>-W</html:code>) setting gives
users 7 days of warnings at login time that their passwords are about to expire.
<html:br/><html:br/>
For example, for each existing human user <html:i>USER</html:i>, expiration parameters
could be adjusted to a 180 day maximum password age, 7 day minimum password
age, and 7 day warning period with the following command:
<html:pre>$ sudo chage -M 180 -m 7 -W 7 USER</html:pre></xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" type="number">
                <xccdf-1.2:title>maximum password age</xccdf-1.2:title>
                <xccdf-1.2:description>Maximum age of password in days</xccdf-1.2:description>
                <xccdf-1.2:value selector="365">365</xccdf-1.2:value>
                <xccdf-1.2:value selector="120">120</xccdf-1.2:value>
                <xccdf-1.2:value selector="180">180</xccdf-1.2:value>
                <xccdf-1.2:value selector="60">60</xccdf-1.2:value>
                <xccdf-1.2:value selector="90">90</xccdf-1.2:value>
                <xccdf-1.2:value>60</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" type="number">
                <xccdf-1.2:title>minimum password age</xccdf-1.2:title>
                <xccdf-1.2:description>Minimum age of password in days</xccdf-1.2:description>
                <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
                <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
                <xccdf-1.2:value selector="7">7</xccdf-1.2:value>
                <xccdf-1.2:value>7</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs" type="number">
                <xccdf-1.2:title>minimum password length</xccdf-1.2:title>
                <xccdf-1.2:description>Minimum number of characters in password</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">This will only check new passwords</xccdf-1.2:warning>
                <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
                <xccdf-1.2:value selector="12">12</xccdf-1.2:value>
                <xccdf-1.2:value selector="14">14</xccdf-1.2:value>
                <xccdf-1.2:value selector="15">15</xccdf-1.2:value>
                <xccdf-1.2:value selector="18">18</xccdf-1.2:value>
                <xccdf-1.2:value selector="20">20</xccdf-1.2:value>
                <xccdf-1.2:value selector="6">6</xccdf-1.2:value>
                <xccdf-1.2:value selector="8">8</xccdf-1.2:value>
                <xccdf-1.2:value>15</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" type="number">
                <xccdf-1.2:title>warning days before password expires</xccdf-1.2:title>
                <xccdf-1.2:description>The number of days' warning given before a password expires.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">This will only apply to newly created accounts</xccdf-1.2:warning>
                <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="14">14</xccdf-1.2:value>
                <xccdf-1.2:value selector="7">7</xccdf-1.2:value>
                <xccdf-1.2:value>7</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs" severity="medium">
                <xccdf-1.2:title>Set Password Maximum Age</xccdf-1.2:title>
                <xccdf-1.2:description>To specify password maximum age for new accounts,
edit the file <html:code>/etc/login.defs</html:code>
and add or correct the following line:
<html:pre>PASS_MAX_DAYS <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/></html:pre>
A value of 180 days is sufficient for many environments.
The DoD requirement is 60.
The profile requirement is <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/></html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000199</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1055</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1402</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000076-GPOS-00044</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Any password, no matter how complex, can eventually be cracked. Therefore, passwords
need to be changed periodically. If the operating system does not limit the lifetime
of passwords and force users to change their passwords, there is the risk that the
operating system passwords could be compromised.
<html:br/><html:br/>
Setting the password maximum age ensures users are required to
periodically change their passwords. Requiring shorter password lifetimes
increases the risk of users writing down the password in a convenient
location subject to physical compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#login_defs"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_maximum_age_login_defs"># Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then

var_accounts_maximum_age_login_defs='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/>'


grep -q ^PASS_MAX_DAYS /etc/login.defs &amp;&amp; \
  sed -i "s/PASS_MAX_DAYS.*/PASS_MAX_DAYS     $var_accounts_maximum_age_login_defs/g" /etc/login.defs
if ! [ $? -eq 0 ]; then
    echo "PASS_MAX_DAYS      $var_accounts_maximum_age_login_defs" &gt;&gt; /etc/login.defs
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_maximum_age_login_defs" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.1
    - NIST-800-171-3.5.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.4
    - accounts_maximum_age_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_accounts_maximum_age_login_defs # promote to variable
  set_fact:
    var_accounts_maximum_age_login_defs: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/>
  tags:
    - always

- name: Set Password Maximum Age
  lineinfile:
    create: true
    dest: /etc/login.defs
    regexp: ^#?PASS_MAX_DAYS
    line: PASS_MAX_DAYS {{ var_accounts_maximum_age_login_defs }}
  when: '"shadow-utils" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1
    - NIST-800-171-3.5.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.4
    - accounts_maximum_age_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_maximum_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_maximum_age_login_defs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_maximum_age_login_defs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs" severity="medium">
                <xccdf-1.2:title>Set Password Minimum Age</xccdf-1.2:title>
                <xccdf-1.2:description>To specify password minimum age for new accounts,
edit the file <html:code>/etc/login.defs</html:code>
and add or correct the following line:
<html:pre>PASS_MIN_DAYS <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" use="legacy"/></html:pre>
A value of 1 day is considered sufficient for many
environments. The DoD requirement is 1.
The profile requirement is <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" use="legacy"/></html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000198</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1055</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1402</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000075-GPOS-00043</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Enforcing a minimum password lifetime helps to prevent repeated password
changes to defeat the password reuse or history enforcement requirement. If
users are allowed to immediately and continually change their password,
then the password could be repeatedly changed in a short period of time to
defeat the organization's policy regarding password reuse.
<html:br/><html:br/>
Setting the minimum password age protects against users cycling back to a
favorite password after satisfying the password reuse requirement.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#login_defs"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_minimum_age_login_defs"># Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then

var_accounts_minimum_age_login_defs='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" use="legacy"/>'


grep -q ^PASS_MIN_DAYS /etc/login.defs &amp;&amp; \
  sed -i "s/PASS_MIN_DAYS.*/PASS_MIN_DAYS     $var_accounts_minimum_age_login_defs/g" /etc/login.defs
if ! [ $? -eq 0 ]; then
    echo "PASS_MIN_DAYS      $var_accounts_minimum_age_login_defs" &gt;&gt; /etc/login.defs
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_minimum_age_login_defs" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - accounts_minimum_age_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_accounts_minimum_age_login_defs # promote to variable
  set_fact:
    var_accounts_minimum_age_login_defs: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" use="legacy"/>
  tags:
    - always

- name: Set Password Minimum Age
  lineinfile:
    create: true
    dest: /etc/login.defs
    regexp: ^#?PASS_MIN_DAYS
    line: PASS_MIN_DAYS {{ var_accounts_minimum_age_login_defs }}
  when: '"shadow-utils" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - accounts_minimum_age_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_minimum_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_minimum_age_login_defs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_minimum_age_login_defs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs" severity="medium">
                <xccdf-1.2:title>Set Password Minimum Length in login.defs</xccdf-1.2:title>
                <xccdf-1.2:description>To specify password length requirements for new accounts, edit the file
<html:code>/etc/login.defs</html:code> and add or correct the following line:
<html:pre>PASS_MIN_LEN <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs" use="legacy"/></html:pre>
<html:br/><html:br/>
The DoD requirement is <html:code>15</html:code>.
The FISMA requirement is <html:code>12</html:code>.
The profile requirement is
<html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs" use="legacy"/></html:code>.
If a program consults <html:code>/etc/login.defs</html:code> and also another PAM module
(such as <html:code>pam_pwquality</html:code>) during a password change operation, then
the most restrictive must be satisfied. See PAM section for more
information about enforcing password quality requirements.</xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0421</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0422</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0431</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0974</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1173</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1401</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1504</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1505</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1546</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1557</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1558</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1559</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1560</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1561</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000078-GPOS-00046</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Requiring a minimum password length makes password
cracking attacks more difficult by ensuring a larger
search space. However, any security benefit from an onerous requirement
must be carefully weighed against usability problems, support costs, or counterproductive
behavior that may result.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#login_defs"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_minlen_login_defs"># Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then

var_accounts_password_minlen_login_defs='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs" use="legacy"/>'


grep -q ^PASS_MIN_LEN /etc/login.defs &amp;&amp; \
sed -i "s/PASS_MIN_LEN.*/PASS_MIN_LEN\t$var_accounts_password_minlen_login_defs/g" /etc/login.defs
if ! [ $? -eq 0 ]
then
  echo -e "PASS_MIN_LEN\t$var_accounts_password_minlen_login_defs" &gt;&gt; /etc/login.defs
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_minlen_login_defs" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.1
    - NIST-800-171-3.5.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(f)
    - accounts_password_minlen_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_accounts_password_minlen_login_defs # promote to variable
  set_fact:
    var_accounts_password_minlen_login_defs: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs" use="legacy"/>
  tags:
    - always

- name: Set Password Minimum Length in login.defs
  lineinfile:
    dest: /etc/login.defs
    regexp: ^PASS_MIN_LEN *[0-9]*
    state: present
    line: PASS_MIN_LEN        {{ var_accounts_password_minlen_login_defs }}
    create: true
  when: '"shadow-utils" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1
    - NIST-800-171-3.5.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(f)
    - accounts_password_minlen_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_password_minlen_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_password_minlen_login_defs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_password_minlen_login_defs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs" severity="medium">
                <xccdf-1.2:title>Set Password Warning Age</xccdf-1.2:title>
                <xccdf-1.2:description>To specify how many days prior to password
expiration that a warning will be issued to users,
edit the file <html:code>/etc/login.defs</html:code> and add or correct
 the following line:
<html:pre>PASS_WARN_AGE <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" use="legacy"/></html:pre>
The DoD requirement is 7.
The profile requirement is <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" use="legacy"/></html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1055</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1402</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Setting the password warning age enables users to
make the change at a practical time.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#login_defs"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_warn_age_login_defs"># Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then

var_accounts_password_warn_age_login_defs='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" use="legacy"/>'


grep -q ^PASS_WARN_AGE /etc/login.defs &amp;&amp; \
sed -i "s/PASS_WARN_AGE.*/PASS_WARN_AGE\t$var_accounts_password_warn_age_login_defs/g" /etc/login.defs
if ! [ $? -eq 0 ]
then
  echo -e "PASS_WARN_AGE\t$var_accounts_password_warn_age_login_defs" &gt;&gt; /etc/login.defs
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_warn_age_login_defs" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.5.8
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - accounts_password_warn_age_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_accounts_password_warn_age_login_defs # promote to variable
  set_fact:
    var_accounts_password_warn_age_login_defs: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" use="legacy"/>
  tags:
    - always

- name: Set Password Warning Age
  lineinfile:
    dest: /etc/login.defs
    regexp: ^PASS_WARN_AGE *[0-9]*
    state: present
    line: PASS_WARN_AGE        {{ var_accounts_password_warn_age_login_defs }}
    create: true
  when: '"shadow-utils" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.5.8
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - accounts_password_warn_age_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_password_warn_age_login_defs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_password_warn_age_login_defs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_password_storage">
              <xccdf-1.2:title>Verify Proper Storage and Existence of Password
Hashes</xccdf-1.2:title>
              <xccdf-1.2:description>By default, password hashes for local accounts are stored
in the second field (colon-separated) in
<html:code>/etc/shadow</html:code>. This file should be readable only by
processes running with root credentials, preventing users from
casually accessing others' password hashes and attempting
to crack them.
However, it remains possible to misconfigure the system
and store password hashes
in world-readable files such as <html:code>/etc/passwd</html:code>, or
to even store passwords themselves in plaintext on the system.
Using system-provided tools for password change/creation
should allow administrators to avoid such misconfiguration.</xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" type="number">
                <xccdf-1.2:title>Password Hashing algorithm</xccdf-1.2:title>
                <xccdf-1.2:description>Specify the number of SHA rounds for the system password encryption algorithm.
Defines the value set in <html:code>/etc/pam.d/system-auth</html:code> and <html:code>/etc/pam.d/password-auth</html:code></xccdf-1.2:description>
                <xccdf-1.2:value>5000</xccdf-1.2:value>
                <xccdf-1.2:value selector="5000">5000</xccdf-1.2:value>
                <xccdf-1.2:value selector="65536">65536</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed" severity="medium">
                <xccdf-1.2:title>Verify All Account Password Hashes are Shadowed</xccdf-1.2:title>
                <xccdf-1.2:description>If any password hashes are stored in <html:code>/etc/passwd</html:code> (in the second field,
instead of an <html:code>x</html:code> or <html:code>*</html:code>), the cause of this misconfiguration should be
investigated. The account should have its password reset and the hash should be
properly stored, or the account should be deleted entirely.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1410</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(h)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.1</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The hashes for all user account passwords should be stored in
the file <html:code>/etc/shadow</html:code> and never in <html:code>/etc/passwd</html:code>,
which is readable by all users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_password_all_shadowed:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_password_all_shadowed_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed_sha512" severity="medium">
                <xccdf-1.2:title>Verify All Account Password Hashes are Shadowed with SHA512</xccdf-1.2:title>
                <xccdf-1.2:description>Verify the operating system requires the shadow password suite
configuration be set to encrypt interactive user passwords using a strong
cryptographic hash.
Check that the interactive user account passwords are using a strong
password hash with the following command:
<html:pre>$ sudo cut -d: -f2 /etc/shadow
$6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7f5JPV6GaJhNC2aK5F3PZpE/BCCtwrxRc/AInKMNX3CdMw11m9STiql12f/</html:pre>
Password hashes <html:code>!</html:code> or <html:code>*</html:code> indicate inactive accounts not
available for logon and are not evaluated.
If any interactive user password hash does not begin with <html:code>$6</html:code>,
this is a finding.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000196</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000803</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1).1(v)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The system must use a strong hashing algorithm to store the password. The
system must use a sufficient number of hashing rounds to ensure the required
level of entropy.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_password_all_shadowed_sha512:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_password_all_shadowed_sha512_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth" severity="medium">
                <xccdf-1.2:title>Set number of Password Hashing Rounds - password-auth</xccdf-1.2:title>
                <xccdf-1.2:description>Configure the number or rounds for the password hashing algorithm. This can be
accomplished by using the <html:code>rounds</html:code> option for the <html:code>pam_unix</html:code> PAM module.
<html:br/><html:br/>
In file <html:code>/etc/pam.d/password-auth</html:code> append <html:code>rounds=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" use="legacy"/></html:code>
to the <html:code>pam_unix.so</html:code> entry, as shown below:
<html:pre>password sufficient pam_unix.so <html:i>...existing_options...</html:i> rounds=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" use="legacy"/></html:pre>
The system's default number of rounds is 5000.</xccdf-1.2:description>
                <xccdf-1.2:warning category="performance">Setting a high number of hashing rounds makes it more difficult to brute force the password,
but requires more CPU resources to authenticate users.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R32)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000196</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Using a higher number of rounds makes password cracking attacks more difficult.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_unix_rounds_password_auth"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_unix_rounds='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" use="legacy"/>'


if [ -f /usr/bin/authselect ]; then
    if authselect check; then
        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # Standard profiles delivered with authselect should not be modified.
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            # Ensure a backup before changing the profile
            authselect apply-changes -b --backup=before-rounds-hardening.backup
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
        fi
        # Include the desired configuration in the custom profile
        CUSTOM_PASSWORD_AUTH="/etc/authselect/$CURRENT_PROFILE/password-auth"
		if ! grep -q "^\s*password.*pam_unix.so.*rounds=" $CUSTOM_PASSWORD_AUTH; then
			sed -i --follow-symlinks "/^\s*password.*pam_unix.so/ s/$/ rounds=$var_password_pam_unix_rounds/" $CUSTOM_PASSWORD_AUTH
		else
			sed -r -i --follow-symlinks "s/(^\s*password.*pam_unix.so.*)(rounds=[[:digit:]]+)(.*)/\1rounds=$var_password_pam_unix_rounds \3/g" $CUSTOM_PASSWORD_AUTH
		fi
        authselect apply-changes -b --backup=after-rounds-hardening.backup
    else
        echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because the authselect profile is not intact.
It is not recommended to manually edit the PAM files when authselect is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        false
    fi
else

    pamFile="/etc/pam.d/password-auth"

    if grep -q "rounds=" $pamFile; then
        sed -iP --follow-symlinks "/password[[:space:]]\+sufficient[[:space:]]\+pam_unix\.so/ \
                                        s/rounds=[[:digit:]]\+/rounds=$var_password_pam_unix_rounds/" $pamFile
    else
        sed -iP --follow-symlinks "/password[[:space:]]\+sufficient[[:space:]]\+pam_unix\.so/ s/$/ rounds=$var_password_pam_unix_rounds/" $pamFile
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_unix_rounds_password_auth" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - accounts_password_pam_unix_rounds_password_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
- name: XCCDF Value var_password_pam_unix_rounds # promote to variable
  set_fact:
    var_password_pam_unix_rounds: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" use="legacy"/>
  tags:
    - always

- name: Check for existing rounds parameter
  ansible.builtin.lineinfile:
    path: /etc/pam.d/password-auth
    create: false
    regexp: ^password.*pam_unix.so.*rounds=
    state: absent
  check_mode: true
  changed_when: false
  register: result_pam_unix_rounds_present
  when: '"pam" in ansible_facts.packages'
  tags:
    - accounts_password_pam_unix_rounds_password_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Check if system relies on authselect
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"pam" in ansible_facts.packages'
  tags:
    - accounts_password_pam_unix_rounds_password_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Remediation where authselect tool is present
  block:

    - name: Check the integrity of the current authselect profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      ignore_errors: true

    - name: Informative message based on the authselect integrity check result
      ansible.builtin.assert:
        that:
          - result_authselect_check_cmd is success
        fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because the authselect profile is
            not intact.
          - It is not recommended to manually edit the PAM files when authselect is
            available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
        success_msg:
          - authselect integrity check passed

    - name: Get authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
        - result_authselect_check_cmd is success

    - name: Define the current authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

    - name: Define the new authselect custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

    - name: Get authselect current features to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

    - name: Check if any custom profile with the same name was already created in
        the past
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
        - authselect_current_profile is not match("custom/")

    - name: Create a custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("custom/")
        - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure the desired rounds value is updated in the custom profile
      ansible.builtin.replace:
        dest: /etc/authselect/{{ authselect_custom_profile }}/password-auth
        regexp: (^\s*password.*pam_unix.so.*rounds=)(\S+)(.*)$
        replace: \g&lt;1&gt;{{ var_password_pam_unix_rounds }}\g&lt;3&gt;
      when:
        - result_authselect_profile is not skipped
        - result_pam_unix_rounds_present.found == 1

    - name: Ensure the rounds parameter is included in the custom profile
      ansible.builtin.replace:
        dest: /etc/authselect/{{ authselect_custom_profile }}/password-auth
        regexp: (^\s*password.*pam_unix.so.*)(?! rounds=\S+)(.*)$
        replace: \g&lt;1&gt; \g&lt;2&gt; rounds={{ var_password_pam_unix_rounds }}
      when:
        - result_authselect_profile is not skipped
        - result_pam_unix_rounds_present.found == 0

    - name: Ensure a backup of current authselect profile before selecting the custom
        profile
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-rounds-hardening.backup
      when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure the custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }} --force
      register: result_pam_authselect_select_profile
      when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

    - name: Restore the authselect features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

    - name: Ensure the custom profile changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-rounds-hardening.backup
      when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
  when:
    - '"pam" in ansible_facts.packages'
    - result_authselect_present.stat.exists
  tags:
    - accounts_password_pam_unix_rounds_password_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Remediation where authselect tool is not present and PAM files are directly
    edited
  block:

    - name: Ensure the desired rounds value is updated in the custom profile
      ansible.builtin.replace:
        dest: /etc/pam.d/password-auth
        regexp: (^\s*password.*pam_unix.so.*rounds=)(\S+)(.*)$
        replace: \g&lt;1&gt;{{ var_password_pam_unix_rounds }}\g&lt;3&gt;

    - name: Ensure the remember parameter is included in the custom profile
      ansible.builtin.replace:
        dest: /etc/pam.d/password-auth
        regexp: (^\s*password.*pam_unix.so.*)(?! rounds=\S+)(.*)$
        replace: \g&lt;1&gt; \g&lt;2&gt; rounds={{ var_password_pam_unix_rounds }}
      when:
        - result_pam_unix_rounds_present.found == 0
  when:
    - '"pam" in ansible_facts.packages'
    - not result_authselect_present.stat.exists
  tags:
    - accounts_password_pam_unix_rounds_password_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_unix_rounds:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_password_pam_unix_rounds_password_auth:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_password_pam_unix_rounds_password_auth_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth" severity="medium">
                <xccdf-1.2:title>Set number of Password Hashing Rounds - system-auth</xccdf-1.2:title>
                <xccdf-1.2:description>Configure the number or rounds for the password hashing algorithm. This can be
accomplished by using the <html:code>rounds</html:code> option for the <html:code>pam_unix</html:code> PAM module.
<html:br/><html:br/>
In file <html:code>/etc/pam.d/system-auth</html:code> append <html:code>rounds=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" use="legacy"/></html:code>
to the <html:code>pam_unix.so</html:code> entry, as shown below:
<html:pre>password sufficient pam_unix.so <html:i>...existing_options...</html:i> rounds=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" use="legacy"/></html:pre>
The system's default number of rounds is 5000.</xccdf-1.2:description>
                <xccdf-1.2:warning category="performance">Setting a high number of hashing rounds makes it more difficult to brute force the password,
but requires more CPU resources to authenticate users.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R32)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000196</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Using a higher number of rounds makes password cracking attacks more difficult.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_unix_rounds_system_auth"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_unix_rounds='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" use="legacy"/>'


if [ -f /usr/bin/authselect ]; then
    if authselect check; then
        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # Standard profiles delivered with authselect should not be modified.
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            # Ensure a backup before changing the profile
            authselect apply-changes -b --backup=before-rounds-hardening.backup
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
        fi
        # Include the desired configuration in the custom profile
        CUSTOM_SYSTEM_AUTH="/etc/authselect/$CURRENT_PROFILE/system-auth"
		if ! grep -q "^\s*password.*pam_unix.so.*rounds=" $CUSTOM_SYSTEM_AUTH; then
			sed -i --follow-symlinks "/^\s*password.*pam_unix.so/ s/$/ rounds=$var_password_pam_unix_rounds/" $CUSTOM_SYSTEM_AUTH
		else
			sed -r -i --follow-symlinks "s/(^\s*password.*pam_unix.so.*)(rounds=[[:digit:]]+)(.*)/\1rounds=$var_password_pam_unix_rounds \3/g" $CUSTOM_SYSTEM_AUTH
		fi
        authselect apply-changes -b --backup=after-rounds-hardening.backup
    else
        echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because the authselect profile is not intact.
It is not recommended to manually edit the PAM files when authselect is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        false
    fi
else
    pamFile="/etc/pam.d/system-auth"
    if grep -q "rounds=" $pamFile; then
        sed -iP --follow-symlinks "/password[[:space:]]\+sufficient[[:space:]]\+pam_unix\.so/ \
                                        s/rounds=[[:digit:]]\+/rounds=$var_password_pam_unix_rounds/" $pamFile
    else
        sed -iP --follow-symlinks "/password[[:space:]]\+sufficient[[:space:]]\+pam_unix\.so/ s/$/ rounds=$var_password_pam_unix_rounds/" $pamFile
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_unix_rounds_system_auth" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - accounts_password_pam_unix_rounds_system_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
- name: XCCDF Value var_password_pam_unix_rounds # promote to variable
  set_fact:
    var_password_pam_unix_rounds: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" use="legacy"/>
  tags:
    - always

- name: Check for existing rounds parameter
  ansible.builtin.lineinfile:
    path: /etc/pam.d/system-auth
    create: false
    regexp: ^password.*pam_unix.so.*rounds=
    state: absent
  check_mode: true
  changed_when: false
  register: result_pam_unix_rounds_present
  when: '"pam" in ansible_facts.packages'
  tags:
    - accounts_password_pam_unix_rounds_system_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Check if system relies on authselect
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"pam" in ansible_facts.packages'
  tags:
    - accounts_password_pam_unix_rounds_system_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Remediation where authselect tool is present
  block:

    - name: Check the integrity of the current authselect profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      ignore_errors: true

    - name: Informative message based on the authselect integrity check result
      ansible.builtin.assert:
        that:
          - result_authselect_check_cmd is success
        fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because the authselect profile is
            not intact.
          - It is not recommended to manually edit the PAM files when authselect is
            available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
        success_msg:
          - authselect integrity check passed

    - name: Get authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
        - result_authselect_check_cmd is success

    - name: Define the current authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

    - name: Define the new authselect custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

    - name: Get authselect current features to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

    - name: Check if any custom profile with the same name was already created in
        the past
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
        - authselect_current_profile is not match("custom/")

    - name: Create a custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("custom/")
        - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure the desired rounds value is updated in the custom profile
      ansible.builtin.replace:
        dest: /etc/authselect/{{ authselect_custom_profile }}/system-auth
        regexp: (^\s*password.*pam_unix.so.*rounds=)(\S+)(.*)$
        replace: \g&lt;1&gt;{{ var_password_pam_unix_rounds }}\g&lt;3&gt;
      when:
        - result_authselect_profile is not skipped
        - result_pam_unix_rounds_present.found == 1

    - name: Ensure the rounds parameter is included in the custom profile
      ansible.builtin.replace:
        dest: /etc/authselect/{{ authselect_custom_profile }}/system-auth
        regexp: (^\s*password.*pam_unix.so.*)(?! rounds=\S+)(.*)$
        replace: \g&lt;1&gt; \g&lt;2&gt; rounds={{ var_password_pam_unix_rounds }}
      when:
        - result_authselect_profile is not skipped
        - result_pam_unix_rounds_present.found == 0

    - name: Ensure a backup of current authselect profile before selecting the custom
        profile
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-rounds-hardening.backup
      when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure the custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }} --force
      register: result_pam_authselect_select_profile
      when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

    - name: Restore the authselect features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

    - name: Ensure the custom profile changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-rounds-hardening.backup
      when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
  when:
    - '"pam" in ansible_facts.packages'
    - result_authselect_present.stat.exists
  tags:
    - accounts_password_pam_unix_rounds_system_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Remediation where authselect tool is not present and PAM files are directly
    edited
  block:

    - name: Ensure the desired rounds value is updated in the custom profile
      ansible.builtin.replace:
        dest: /etc/pam.d/system-auth
        regexp: (^\s*password.*pam_unix.so.*rounds=)(\S+)(.*)$
        replace: \g&lt;1&gt;{{ var_password_pam_unix_rounds }}\g&lt;3&gt;

    - name: Ensure the remember parameter is included in the custom profile
      ansible.builtin.replace:
        dest: /etc/pam.d/system-auth
        regexp: (^\s*password.*pam_unix.so.*)(?! rounds=\S+)(.*)$
        replace: \g&lt;1&gt; \g&lt;2&gt; rounds={{ var_password_pam_unix_rounds }}
      when:
        - result_pam_unix_rounds_present.found == 0
  when:
    - '"pam" in ansible_facts.packages'
    - not result_authselect_present.stat.exists
  tags:
    - accounts_password_pam_unix_rounds_system_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_unix_rounds:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_password_pam_unix_rounds_system_auth:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_password_pam_unix_rounds_system_auth_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_gid_passwd_group_same" severity="low">
                <xccdf-1.2:title>All GIDs referenced in /etc/passwd must be defined in /etc/group</xccdf-1.2:title>
                <xccdf-1.2:description>Add a group to the system for each GID referenced without a corresponding group.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000764</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.5.a</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000104-GPOS-00051</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If a user is assigned the Group Identifier (GID) of a group not existing on the system, and a group
with the Group Identifier (GID) is subsequently created, the user may have unintended rights to
any files associated with the group.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-gid_passwd_group_same:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-gid_passwd_group_same_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_empty_passwords" severity="high">
                <xccdf-1.2:title>Prevent Login to Accounts With Empty Password</xccdf-1.2:title>
                <xccdf-1.2:description>If an account is configured for password authentication
but does not have an assigned password, it may be possible to log
into the account without authentication. Remove any instances of the
<html:code>nullok</html:code> in

<html:code>/etc/pam.d/system-auth</html:code>

to prevent logins with empty passwords.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">If the system relies on <html:code>authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code>authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code>authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.
Note that this rule is not applicable for systems running within a
container. Having user with empty password within a container is not
considered a risk, because it should not be possible to directly login into
a container anyway.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If an account has an empty password, anyone could log in and
run commands with the privileges of that account. Accounts with
empty passwords should never be used in operational environments.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="no_empty_passwords" complexity="low" disruption="medium" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEM_AUTH="/etc/pam.d/system-auth"
PASSWORD_AUTH="/etc/pam.d/password-auth"
if [ -f /usr/bin/authselect ]; then
    if authselect check; then
        authselect enable-feature without-nullok
        authselect apply-changes
    else
        echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because the authselect profile is not intact.
It is not recommended to manually edit the PAM files when authselect is available
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        false
    fi
else
    sed --follow-symlinks -i 's/\&lt;nullok\&gt;//g' $SYSTEM_AUTH
    sed --follow-symlinks -i 's/\&lt;nullok\&gt;//g' $PASSWORD_AUTH
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="no_empty_passwords" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Check if system relies on authselect
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.2
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - configure_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_empty_passwords
    - no_reboot_needed

- name: Check integrity of authselect current profile
  ansible.builtin.command:
    cmd: authselect check
  register: result_authselect_check_cmd
  changed_when: false
  ignore_errors: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - result_authselect_present.stat.exists
  tags:
    - CJIS-5.5.2
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - configure_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_empty_passwords
    - no_reboot_needed

- name: Get authselect current features
  ansible.builtin.shell:
    cmd: authselect current | tail -n+3 | awk '{ print $2 }'
  register: result_authselect_features
  changed_when: false
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - result_authselect_present.stat.exists
    - result_authselect_check_cmd is success
  tags:
    - CJIS-5.5.2
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - configure_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_empty_passwords
    - no_reboot_needed

- name: Ensure nullok property is absent via authselect tool
  ansible.builtin.command:
    cmd: authselect enable-feature without-nullok
  register: result_authselect_cmd
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - result_authselect_present.stat.exists
    - result_authselect_check_cmd is success
    - result_authselect_features.stdout is not search("without-nullok")
  tags:
    - CJIS-5.5.2
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - configure_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_empty_passwords
    - no_reboot_needed

- name: Informative message based on the authselect integrity check result
  ansible.builtin.assert:
    that:
      - result_authselect_check_cmd is success
    fail_msg:
      - authselect integrity check failed. Remediation aborted!
      - This remediation could not be applied because the authselect profile is not
        intact.
      - It is not recommended to manually edit the PAM files when authselect is available
      - In cases where the default authselect profile does not cover a specific demand,
        a custom authselect profile is recommended.
    success_msg:
      - authselect integrity check passed
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.2
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - configure_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_empty_passwords
    - no_reboot_needed

- name: Ensure nullok property is absent by directly editing pam files
  replace:
    dest: '{{ item }}'
    regexp: nullok
  loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - not result_authselect_present.stat.exists
  tags:
    - CJIS-5.5.2
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - configure_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_empty_passwords
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="no_empty_passwords">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
        mode: 0644
        path: /etc/pam.d/password-auth
        overwrite: true
      - contents:
          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
        mode: 0644
        path: /etc/pam.d/system-auth
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-no_empty_passwords:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-no_empty_passwords_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_empty_passwords_etc_shadow" severity="high">
                <xccdf-1.2:title>Ensure There Are No Accounts With Blank or Null Passwords</xccdf-1.2:title>
                <xccdf-1.2:description>Check the "/etc/shadow" file for blank passwords with the
following command:
<html:pre>$ sudo awk -F: '!$2 {print $1}' /etc/shadow</html:pre>
If the command returns any results, this is a finding.
Configure all accounts on the system to have a password or lock
the account with the following commands:
Perform a password reset:
<html:pre>$ sudo passwd [username]</html:pre>
Lock an account:
<html:pre>$ sudo passwd -l [username]</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that this rule is not applicable for systems running within a container. Having user with empty password within a container is not considered a risk, because it should not be possible to directly login into a container anyway.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6.1(iv)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If an account has an empty password, anyone could log in and
run commands with the privileges of that account. Accounts with
empty passwords should never be used in operational environments.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="no_empty_passwords_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Collect users with no password
  command: |
    awk -F: '!$2 {print $1}' /etc/shadow
  register: users_nopasswd
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - high_severity
    - low_complexity
    - low_disruption
    - no_empty_passwords_etc_shadow
    - no_reboot_needed
    - restrict_strategy

- name: Lock users with no password
  command: |
    passwd -l {{ item }}
  with_items: '{{ users_nopasswd.stdout_lines }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - users_nopasswd.stdout_lines | length &gt; 0
  tags:
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - high_severity
    - low_complexity
    - low_disruption
    - no_empty_passwords_etc_shadow
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-no_empty_passwords_etc_shadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-no_empty_passwords_etc_shadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_legacy_plus_entries_etc_group" severity="medium">
                <xccdf-1.2:title>Ensure there are no legacy + NIS entries in /etc/group</xccdf-1.2:title>
                <xccdf-1.2:description>The <html:code>+</html:code> character in <html:code>/etc/group</html:code> file marks a place where
entries from a network information service (NIS) should be directly inserted.</xccdf-1.2:description>
                <xccdf-1.2:rationale>Using this method to include entries into <html:code>/etc/group</html:code> is considered legacy
and should be avoided. These entries may provide a way for an attacker
to gain access to the system.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="no_legacy_plus_entries_etc_group">
if grep -q '^\+' /etc/group; then
# backup old file to /etc/group-
	cp /etc/group /etc/group-
	sed -i '/^\+.*$/d' /etc/group
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="no_legacy_plus_entries_etc_group" complexity="low" disruption="medium" reboot="false" strategy="restrict">- name: Backup the old /etc/group file
  copy:
    src: /etc/group
    dest: /etc/group-
    remote_src: true
  tags:
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_legacy_plus_entries_etc_group
    - no_reboot_needed
    - restrict_strategy

- name: Remove lines starting with + from /etc/group
  lineinfile:
    regexp: ^\+.*$
    state: absent
    path: /etc/group
  tags:
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_legacy_plus_entries_etc_group
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-no_legacy_plus_entries_etc_group:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-no_legacy_plus_entries_etc_group_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_legacy_plus_entries_etc_passwd" severity="medium">
                <xccdf-1.2:title>Ensure there are no legacy + NIS entries in /etc/passwd</xccdf-1.2:title>
                <xccdf-1.2:description>The <html:code>+</html:code> character in <html:code>/etc/passwd</html:code> file marks a place where
entries from a network information service (NIS) should be directly inserted.</xccdf-1.2:description>
                <xccdf-1.2:rationale>Using this method to include entries into <html:code>/etc/passwd</html:code> is considered legacy
and should be avoided. These entries may provide a way for an attacker
to gain access to the system.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="no_legacy_plus_entries_etc_passwd">
if grep -q '^\+' /etc/passwd; then
# backup old file to /etc/passwd-
	cp /etc/passwd /etc/passwd-
	sed -i '/^\+.*$/d' /etc/passwd
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="no_legacy_plus_entries_etc_passwd" complexity="low" disruption="medium" reboot="false" strategy="restrict">- name: Backup the old /etc/passwd file
  copy:
    src: /etc/passwd
    dest: /etc/passwd-
    remote_src: true
  tags:
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_legacy_plus_entries_etc_passwd
    - no_reboot_needed
    - restrict_strategy

- name: Remove lines starting with + from /etc/passwd
  lineinfile:
    regexp: ^\+.*$
    state: absent
    path: /etc/passwd
  tags:
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_legacy_plus_entries_etc_passwd
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-no_legacy_plus_entries_etc_passwd:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-no_legacy_plus_entries_etc_passwd_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_legacy_plus_entries_etc_shadow" severity="medium">
                <xccdf-1.2:title>Ensure there are no legacy + NIS entries in /etc/shadow</xccdf-1.2:title>
                <xccdf-1.2:description>The <html:code>+</html:code> character in <html:code>/etc/shadow</html:code> file marks a place where
entries from a network information service (NIS) should be directly inserted.</xccdf-1.2:description>
                <xccdf-1.2:rationale>Using this method to include entries into <html:code>/etc/shadow</html:code> is considered legacy
and should be avoided. These entries may provide a way for an attacker
to gain access to the system.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="no_legacy_plus_entries_etc_shadow">
if grep -q '^\+' /etc/shadow; then
# backup old file to /etc/shadow-
	cp /etc/shadow /etc/shadow-
	sed -i '/^\+.*$/d' /etc/shadow
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="no_legacy_plus_entries_etc_shadow" complexity="low" disruption="medium" reboot="false" strategy="restrict">- name: Backup the old /etc/shadow file
  copy:
    src: /etc/shadow
    dest: /etc/shadow-
    remote_src: true
  tags:
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_legacy_plus_entries_etc_shadow
    - no_reboot_needed
    - restrict_strategy

- name: Remove lines starting with + from /etc/shadow
  lineinfile:
    regexp: ^\+.*$
    state: absent
    path: /etc/shadow
  tags:
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_legacy_plus_entries_etc_shadow
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-no_legacy_plus_entries_etc_shadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-no_legacy_plus_entries_etc_shadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_netrc_files" severity="medium">
                <xccdf-1.2:title>Verify No netrc Files Exist</xccdf-1.2:title>
                <xccdf-1.2:description>The <html:code>.netrc</html:code> files contain login information
used to auto-login into FTP servers and reside in the user's home
directory. These files may contain unencrypted passwords to
remote FTP servers making them susceptible to access by unauthorized
users and should not be used.  Any <html:code>.netrc</html:code> files should be removed.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000196</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(h)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(7)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unencrypted passwords for remote FTP servers may be stored in <html:code>.netrc</html:code>
files. </xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-no_netrc_files:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-no_netrc_files_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_root_logins">
              <xccdf-1.2:title>Restrict Root Logins</xccdf-1.2:title>
              <xccdf-1.2:description>Direct root logins should be allowed only for emergency use.
In normal situations, the administrator should access the system
via a unique unprivileged account, and then use <html:code>su</html:code> or <html:code>sudo</html:code> to execute
privileged commands. Discouraging administrators from accessing the
root account directly ensures an audit trail in organizations with
multiple administrators. Locking down the channels through which
root can connect directly also reduces opportunities for
password-guessing against the root account. The <html:code>login</html:code> program
uses the file <html:code>/etc/securetty</html:code> to determine which interfaces
should allow root logins.

The virtual devices <html:code>/dev/console</html:code>
and <html:code>/dev/tty*</html:code> represent the system consoles (accessible via
the Ctrl-Alt-F1 through Ctrl-Alt-F6 keyboard sequences on a default
installation). The default securetty file also contains <html:code>/dev/vc/*</html:code>.
These are likely to be deprecated in most environments, but may be retained
for compatibility. Root should also be prohibited from connecting
via network protocols. Other sections of this document
include guidance describing how to prevent root from logging in via SSH.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero" severity="high">
                <xccdf-1.2:title>Verify Only Root Has UID 0</xccdf-1.2:title>
                <xccdf-1.2:description>If any account other than root has a UID of 0, this misconfiguration should
be investigated and the accounts other than root should be removed or have
their UID changed.
<html:br/>
If the account is associated with system commands or applications the UID
should be changed to one greater than "0" but less than "1000."
Otherwise assign a UID greater than "1000" that has not already been
assigned.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(5)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-4(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An account has root authority if it has a UID of 0. Multiple accounts
with a UID of 0 afford more opportunity for potential intruders to
guess a password for a privileged account. Proper configuration of
sudo is recommended to afford multiple system administrators
access to root privileges in an accountable manner.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_no_uid_except_zero">awk -F: '$3 == 0 &amp;&amp; $1 != "root" { print $1 }' /etc/passwd | xargs --no-run-if-empty --max-lines=1 passwd -l
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_no_uid_except_zero:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_no_uid_except_zero_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_root_gid_zero" severity="high">
                <xccdf-1.2:title>Verify Root Has A Primary GID 0</xccdf-1.2:title>
                <xccdf-1.2:description>The <html:code>root</html:code> user should have a primary group of 0.</xccdf-1.2:description>
                <xccdf-1.2:rationale>To help ensure that root-owned files are not inadvertently exposed to other users.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_root_gid_zero:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_root_gid_zero_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_direct_root_logins" severity="medium">
                <xccdf-1.2:title>Direct root Logins Not Allowed</xccdf-1.2:title>
                <xccdf-1.2:description>To further limit access to the <html:code>root</html:code> account, administrators
can disable root logins at the console by editing the <html:code>/etc/securetty</html:code> file.
This file lists all devices the root user is allowed to login to. If the file does
not exist at all, the root user can login through any communication device on the
system, whether via the console or via a raw network interface. This is dangerous
as user can login to the system as root via Telnet, which sends the password in
plain text over the network. By default, Fedora's
<html:code>/etc/securetty</html:code> file only allows the root user to login at the console
physically attached to the system. To prevent root from logging in, remove the
contents of this file. To prevent direct root logins, remove the contents of this
file by typing the following command:
<html:pre>
$ sudo echo &gt; /etc/securetty
</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R19)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Disabling direct root logins ensures proper accountability and multifactor
authentication to privileged accounts. Users will first login, then escalate
to privileged (root) access via su / sudo. This is required for FISMA Low
and FISMA Moderate systems.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="no_direct_root_logins"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

echo &gt; /etc/securetty

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="no_direct_root_logins" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Direct root Logins Not Allowed
  copy:
    dest: /etc/securetty
    content: ''
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2
    - low_complexity
    - low_disruption
    - medium_severity
    - no_direct_root_logins
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="no_direct_root_logins">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,
        mode: 0600
        path: /etc/securetty
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-no_direct_root_logins:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-no_direct_root_logins_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_password_auth_for_systemaccounts" severity="medium">
                <xccdf-1.2:title>Ensure that System Accounts Are Locked</xccdf-1.2:title>
                <xccdf-1.2:description>Some accounts are not associated with a human user of the system, and exist to
perform some administrative function. An attacker should not be able to log into
these accounts.
<html:br/><html:br/>
System accounts are those user accounts with a user ID
less than UID_MIN, where value of the UID_MIN directive is set in
<html:code>/etc/login.defs</html:code> configuration file. In the default configuration UID_MIN is set
to 500, thus system accounts are those user accounts with a user ID less than
500. If any system account <html:i>SYSACCT</html:i> (other than root) has an unlocked password,
disable it with the command:
<html:pre>$ sudo passwd -l <html:i>SYSACCT</html:i></html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Disabling authentication for default system accounts makes it more difficult
for attackers to make use of them to compromise a system.false</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-no_password_auth_for_systemaccounts_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_root_webbrowsing" severity="unknown">
                <xccdf-1.2:title>Restrict Web Browser Use for Administrative Accounts</xccdf-1.2:title>
                <xccdf-1.2:description>Enforce policy requiring administrative accounts use web browsers only for
local service administration.</xccdf-1.2:description>
                <xccdf-1.2:rationale>If a browser vulnerability is exploited while running with administrative privileges,
the entire system could be compromised. Specific exceptions for local service
administration should be documented in site-defined policy.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-no_root_webbrowsing_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts" severity="medium">
                <xccdf-1.2:title>Ensure that System Accounts Do Not Run a Shell Upon Login</xccdf-1.2:title>
                <xccdf-1.2:description>Some accounts are not associated with a human user of the system, and exist to
perform some administrative function. Should an attacker be able to log into
these accounts, they should not be granted access to a shell.
<html:br/><html:br/>
The login shell for each local account is stored in the last field of each line
in <html:code>/etc/passwd</html:code>. System accounts are those user accounts with a user ID
less than UID_MIN, where value of UID_MIN directive is set in
/etc/login.defs configuration file. In the default configuration UID_MIN is set
to 1000, thus system accounts are those user accounts with a user ID less than
1000. The user ID is stored in the third field. If any system account
<html:i>SYSACCT</html:i> (other than root) has a login shell, disable it with the
command: <html:pre>$ sudo usermod -s /sbin/nologin <html:i>SYSACCT</html:i></html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="functionality">Do not perform the steps in this section on the root account. Doing so might
cause the system to become inaccessible.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1491</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6.1(iv)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Ensuring shells are not given to system accounts upon login makes it more
difficult for attackers to make use of system accounts.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-no_shelllogin_for_systemaccounts:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-no_shelllogin_for_systemaccounts_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_restrict_serial_port_logins" severity="medium">
                <xccdf-1.2:title>Restrict Serial Port Root Logins</xccdf-1.2:title>
                <xccdf-1.2:description>To restrict root logins on serial ports,
ensure lines of this form do not appear in <html:code>/etc/securetty</html:code>:
<html:pre>ttyS0
ttyS1</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000770</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Preventing direct root login to serial port interfaces
helps ensure accountability for actions taken on the systems
using the root account.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="restrict_serial_port_logins">sed -i '/ttyS/d' /etc/securetty
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="restrict_serial_port_logins" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Restrict Serial Port Root Logins
  lineinfile:
    dest: /etc/securetty
    regexp: ttyS[0-9]
    state: absent
  tags:
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-AC-6
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_serial_port_logins
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-restrict_serial_port_logins:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-restrict_serial_port_logins_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_root_path_default" severity="unknown">
                <xccdf-1.2:title>Root Path Must Be Vendor Default</xccdf-1.2:title>
                <xccdf-1.2:description>Assuming root shell is bash, edit the following files:
<html:pre>~/.profile</html:pre>
<html:pre>~/.bashrc</html:pre>
Change any <html:code>PATH</html:code> variables to the vendor default for root and remove any
empty <html:code>PATH</html:code> entries or references to relative paths.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The root account's executable search path must be the vendor default, and must
contain only absolute paths.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-root_path_default_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_securetty_root_login_console_only" severity="medium">
                <xccdf-1.2:title>Restrict Virtual Console Root Logins</xccdf-1.2:title>
                <xccdf-1.2:description>To restrict root logins through the (deprecated) virtual console devices,
ensure lines of this form do not appear in <html:code>/etc/securetty</html:code>:
<html:pre>vc/1
vc/2
vc/3
vc/4</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000770</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000324-GPOS-00125</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Preventing direct root login to virtual console devices
helps ensure accountability for actions taken on the system
using the root account.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="securetty_root_login_console_only">sed -i '/^vc\//d' /etc/securetty
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="securetty_root_login_console_only" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Restrict Virtual Console Root Logins
  lineinfile:
    dest: /etc/securetty
    regexp: ^vc
    state: absent
  tags:
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-AC-6
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - securetty_root_login_console_only
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-securetty_root_login_console_only:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-securetty_root_login_console_only_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_use_pam_wheel_for_su" severity="medium">
                <xccdf-1.2:title>Enforce usage of pam_wheel for su authentication</xccdf-1.2:title>
                <xccdf-1.2:description>To ensure that only users who are members of the <html:code>wheel</html:code> group can
run commands with altered privileges through the <html:code>su</html:code> command, make
sure that the following line exists in the file <html:code>/etc/pam.d/su</html:code>:
<html:pre>auth             required        pam_wheel.so use_uid</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00156</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000312-GPOS-00123</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>su</html:code> program allows to run commands with a substitute user and
group ID. It is commonly used to run commands as the root user. Limiting
access to such command is considered a good security practice.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="use_pam_wheel_for_su">
# uncomment the option if commented
  sed '/^[[:space:]]*#[[:space:]]*auth[[:space:]]\+required[[:space:]]\+pam_wheel\.so[[:space:]]\+use_uid$/s/^[[:space:]]*#//' -i /etc/pam.d/su
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="use_pam_wheel_for_su" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: restrict usage of su command only to members of wheel group
  replace:
    path: /etc/pam.d/su
    regexp: ^[\s]*#[\s]*auth[\s]+required[\s]+pam_wheel\.so[\s]+use_uid$
    replace: auth             required        pam_wheel.so use_uid
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - use_pam_wheel_for_su
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-use_pam_wheel_for_su:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-use_pam_wheel_for_su_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_accounts-session">
            <xccdf-1.2:title>Secure Session Configuration Files for Login Accounts</xccdf-1.2:title>
            <xccdf-1.2:description>When a user logs into a Unix account, the system
configures the user's session by reading a number of files. Many of
these files are located in the user's home directory, and may have
weak permissions as a result of user error or misconfiguration. If
an attacker can modify or even read certain types of account
configuration information, they can often gain full access to the
affected user's account. Therefore, it is important to test and
correct configuration file permissions for interactive accounts,
particularly those of privileged users such as root or system
administrators.</xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_fail_delay" type="number">
              <xccdf-1.2:title>Maximum login attempts delay</xccdf-1.2:title>
              <xccdf-1.2:description>Maximum time in seconds between fail login attempts before re-prompting.</xccdf-1.2:description>
              <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
              <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
              <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
              <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
              <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
              <xccdf-1.2:value>4</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_max_concurrent_login_sessions" type="number">
              <xccdf-1.2:title>Maximum concurrent login sessions</xccdf-1.2:title>
              <xccdf-1.2:description>Maximum number of concurrent sessions by a user</xccdf-1.2:description>
              <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
              <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
              <xccdf-1.2:value selector="15">15</xccdf-1.2:value>
              <xccdf-1.2:value selector="20">20</xccdf-1.2:value>
              <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
              <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
              <xccdf-1.2:value>1</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_tmout" type="number">
              <xccdf-1.2:title>Account Inactivity Timeout (seconds)</xccdf-1.2:title>
              <xccdf-1.2:description>In an interactive shell, the value is interpreted as the
number of seconds to wait for input after issuing the primary prompt.
Bash terminates after waiting for that number of seconds if input does
not arrive.</xccdf-1.2:description>
              <xccdf-1.2:value selector="30_min">1800</xccdf-1.2:value>
              <xccdf-1.2:value selector="10_min">600</xccdf-1.2:value>
              <xccdf-1.2:value selector="15_min">900</xccdf-1.2:value>
              <xccdf-1.2:value selector="5_min">300</xccdf-1.2:value>
              <xccdf-1.2:value>600</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_have_homedir_login_defs" severity="medium">
              <xccdf-1.2:title>Ensure Home Directories are Created for New Users</xccdf-1.2:title>
              <xccdf-1.2:description>All local interactive user accounts, upon creation, should be assigned a home directory.
<html:br/><html:br/>
Configure the operating system to assign home directories to all new local interactive users by setting the <html:code>CREATE_HOME</html:code>
parameter in <html:code>/etc/login.defs</html:code> to <html:code>yes</html:code> as follows:
<html:br/><html:br/>
<html:pre>CREATE_HOME yes</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If local interactive users are not assigned a valid home directory, there is no place
for the storage and control of files they should own.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#login_defs"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_have_homedir_login_defs"># Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then

if [ -e "/etc/login.defs" ] ; then
    
    LC_ALL=C sed -i "/^\s*CREATE_HOME\s\+/Id" "/etc/login.defs"
else
    touch "/etc/login.defs"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/login.defs"

cp "/etc/login.defs" "/etc/login.defs.bak"
# Insert before the line matching the regex '^\s*CREATE_HOME'.
line_number="$(LC_ALL=C grep -n "^\s*CREATE_HOME" "/etc/login.defs.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^\s*CREATE_HOME', insert at
    # the end of the file.
    printf '%s\n' "CREATE_HOME yes" &gt;&gt; "/etc/login.defs"
else
    head -n "$(( line_number - 1 ))" "/etc/login.defs.bak" &gt; "/etc/login.defs"
    printf '%s\n' "CREATE_HOME yes" &gt;&gt; "/etc/login.defs"
    tail -n "+$(( line_number ))" "/etc/login.defs.bak" &gt;&gt; "/etc/login.defs"
fi
# Clean up after ourselves.
rm "/etc/login.defs.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_have_homedir_login_defs" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - accounts_have_homedir_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Ensure new users receive home directories
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/login.defs
        create: false
        regexp: ^\s*CREATE_HOME\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/login.defs
      lineinfile:
        path: /etc/login.defs
        create: false
        regexp: ^\s*CREATE_HOME\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/login.defs
      lineinfile:
        path: /etc/login.defs
        create: true
        regexp: ^\s*CREATE_HOME\s+
        line: CREATE_HOME yes
        state: present
  when: '"shadow-utils" in ansible_facts.packages'
  tags:
    - accounts_have_homedir_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_have_homedir_login_defs:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_have_homedir_login_defs_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_logon_fail_delay" severity="medium">
              <xccdf-1.2:title>Ensure the Logon Failure Delay is Set Correctly in login.defs</xccdf-1.2:title>
              <xccdf-1.2:description>To ensure the logon failure delay controlled by <html:code>/etc/login.defs</html:code> is set properly,
add or correct the <html:code>FAIL_DELAY</html:code> setting in <html:code>/etc/login.defs</html:code> to read as follows:
<html:pre>FAIL_DELAY <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_fail_delay" use="legacy"/></html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00226</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Increasing the time between a failed authentication attempt and re-prompting to
enter credentials helps to slow a single-threaded brute force attack.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#login_defs"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_fail_delay:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_fail_delay"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_logon_fail_delay:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_logon_fail_delay_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_max_concurrent_login_sessions" severity="low">
              <xccdf-1.2:title>Limit the Number of Concurrent Login Sessions Allowed Per User</xccdf-1.2:title>
              <xccdf-1.2:description>Limiting the number of allowed users and sessions per user can limit risks related to Denial of
Service attacks. This addresses concurrent sessions for a single account and does not address
concurrent sessions by a single user via multiple accounts. To set the number of concurrent
sessions per user add the following line in <html:code>/etc/security/limits.conf</html:code> or
a file under <html:code>/etc/security/limits.d/</html:code>:
<html:pre>* hard maxlogins <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_max_concurrent_login_sessions" use="legacy"/></html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000054</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000027-GPOS-00008</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000027-VMM-000080</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Limiting simultaneous user logins can insulate the system from denial of service
problems caused by excessive logins. Automated login processes operating improperly or
maliciously may result in an exceptional number of simultaneous login sessions.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#pam"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_max_concurrent_login_sessions" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-10
    - NIST-800-53-CM-6(a)
    - accounts_max_concurrent_login_sessions
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_accounts_max_concurrent_login_sessions # promote to variable
  set_fact:
    var_accounts_max_concurrent_login_sessions: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_max_concurrent_login_sessions" use="legacy"/>
  tags:
    - always

- name: Find /etc/security/limits.d files containing maxlogins configuration
  find:
    paths: /etc/security/limits.d
    contains: ^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins
    patterns: '*.conf'
  register: maxlogins
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-10
    - NIST-800-53-CM-6(a)
    - accounts_max_concurrent_login_sessions
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy

- name: Limit the Number of Concurrent Login Sessions Allowed Per User in files from
    limits.d
  replace:
    dest: '{{ item.path }}'
    regexp: ^#?\*.*maxlogins.*
    replace: '*          hard    maxlogins     {{ var_accounts_max_concurrent_login_sessions
      }}'
  with_items:
    - '{{ maxlogins.files }}'
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-10
    - NIST-800-53-CM-6(a)
    - accounts_max_concurrent_login_sessions
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy

- name: Limit the Number of Concurrent Login Sessions Allowed Per User
  lineinfile:
    state: present
    dest: /etc/security/limits.conf
    insertbefore: ^# End of file
    regexp: ^#?\*.*maxlogins
    line: '*          hard    maxlogins     {{ var_accounts_max_concurrent_login_sessions
      }}'
    create: true
  when:
    - '"pam" in ansible_facts.packages'
    - maxlogins.matched == 0
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-10
    - NIST-800-53-CM-6(a)
    - accounts_max_concurrent_login_sessions
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_max_concurrent_login_sessions:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_max_concurrent_login_sessions"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_max_concurrent_login_sessions:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_max_concurrent_login_sessions_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_polyinstantiated_tmp" severity="low">
              <xccdf-1.2:title>Configure Polyinstantiation of /tmp Directories</xccdf-1.2:title>
              <xccdf-1.2:description>To configure polyinstantiated /tmp directories, first create the parent directories
which will hold the polyinstantiation child directories. Use the following command:
<html:pre>$ sudo mkdir --mode 000 /tmp/tmp-inst</html:pre>
Then, add the following entry to <html:code>/etc/security/namespace.conf</html:code>:
<html:pre>/tmp     /tmp/tmp-inst/            level      root,adm</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R39)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Polyinstantiation of temporary directories is a proactive security measure
which reduces chances of attacks that are made possible by /tmp
directories being world-writable.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_polyinstantiated_tmp">if ! [ -d /tmp/tmp-inst ] ; then
    mkdir --mode 000 /tmp/tmp-inst
fi
chmod 000 /tmp/tmp-inst
chcon --reference=/tmp /tmp/tmp-inst

if ! grep -Eq '^\s*/tmp\s+/tmp/tmp-inst/\s+level\s+root,adm$' /etc/security/namespace.conf ; then
    if grep -Eq '^\s*/tmp\s+' /etc/security/namespace.conf ; then
        sed -i '/^\s*\/tmp/d' /etc/security/namespace.conf
    fi
    echo "/tmp     /tmp/tmp-inst/        level      root,adm" &gt;&gt; /etc/security/namespace.conf
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_polyinstantiated_tmp" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Create /tmp/tmp-inst directory
  file:
    path: /tmp/tmp-inst
    state: directory
    mode: '000'
    seuser: system_u
    serole: object_r
    setype: tmp_t
  tags:
    - accounts_polyinstantiated_tmp
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy

- name: Make changes to /etc/security/namespace.conf
  lineinfile:
    path: /etc/security/namespace.conf
    create: false
    regexp: ^\s*/tmp\s+/tmp/tmp-inst/\s+level\s+root,adm$
    line: /tmp     /tmp/tmp-inst/        level      root,adm
    state: present
  tags:
    - accounts_polyinstantiated_tmp
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_polyinstantiated_tmp:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_polyinstantiated_tmp_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_polyinstantiated_var_tmp" severity="low">
              <xccdf-1.2:title>Configure Polyinstantiation of /var/tmp Directories</xccdf-1.2:title>
              <xccdf-1.2:description>To configure polyinstantiated /tmp directories, first create the parent directories
which will hold the polyinstantiation child directories. Use the following command:
<html:pre>$ sudo mkdir --mode 000 /var/tmp/tmp-inst</html:pre>
Then, add the following entry to <html:code>/etc/security/namespace.conf</html:code>:
<html:pre>/var/tmp /var/tmp/tmp-inst/    level      root,adm</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R39)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Polyinstantiation of temporary directories is a proactive security measure
which reduces chances of attacks that are made possible by /var/tmp
directories being world-writable.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_polyinstantiated_var_tmp">if ! [ -d /tmp-inst ] ; then
    mkdir --mode 000 /var/tmp/tmp-inst
fi
chmod 000 /var/tmp/tmp-inst
chcon --reference=/var/tmp/ /var/tmp/tmp-inst

if ! grep -Eq '^\s*/var/tmp\s+/var/tmp/tmp-inst/\s+level\s+root,adm$' /etc/security/namespace.conf ; then
    if grep -Eq '^\s*/var/tmp\s+' /etc/security/namespace.conf ; then
        sed -i '/^\s*\/var\/tmp/d' /etc/security/namespace.conf
    fi
    echo "/var/tmp /var/tmp/tmp-inst/    level      root,adm" &gt;&gt; /etc/security/namespace.conf
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_polyinstantiated_var_tmp" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Create /var/tmp/tmp-inst directory
  file:
    path: /var/tmp/tmp-inst
    state: directory
    mode: '000'
    seuser: system_u
    serole: object_r
    setype: tmp_t
  tags:
    - accounts_polyinstantiated_var_tmp
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy

- name: Make changes to /etc/security/namespace.conf
  lineinfile:
    path: /etc/security/namespace.conf
    create: false
    regexp: ^\s*/var/tmp\s+/var/tmp/tmp-inst/\s+level\s+root,adm$
    line: /var/tmp /var/tmp/tmp-inst/    level      root,adm
    state: present
  tags:
    - accounts_polyinstantiated_var_tmp
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_polyinstantiated_var_tmp:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_polyinstantiated_var_tmp_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_tmout" severity="medium">
              <xccdf-1.2:title>Set Interactive Session Timeout</xccdf-1.2:title>
              <xccdf-1.2:description>Setting the <html:code>TMOUT</html:code> option in <html:code>/etc/profile</html:code> ensures that
all user sessions will terminate based on inactivity. The <html:code>TMOUT</html:code>

setting in a file loaded by <html:code>/etc/profile</html:code>, e.g.
<html:code>/etc/profile.d/tmout.sh</html:code> should read as follows:
<html:pre>TMOUT=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_tmout" use="legacy"/></html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R29)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002361</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000163-GPOS-00072</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000163-VMM-000700</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000279-VMM-001010</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Terminating an idle session within a short time period reduces
the window of opportunity for unauthorized personnel to take control of a
management session enabled on the console or console port that has been
left unattended.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_tmout"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

var_accounts_tmout='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_tmout" use="legacy"/>'


# if 0, no occurence of tmout found, if 1, occurence found
tmout_found=0

for f in /etc/profile /etc/profile.d/*.sh; do
    if grep --silent '^\s*TMOUT' $f; then
        sed -i -E "s/^(\s*)TMOUT\s*=\s*(\w|\$)*(.*)$/\1TMOUT=$var_accounts_tmout\3/g" $f
        tmout_found=1
    fi
done

if [ $tmout_found -eq 0 ]; then
        echo -e "\n# Set TMOUT to $var_accounts_tmout per security requirements" &gt;&gt; /etc/profile.d/tmout.sh
        echo "TMOUT=$var_accounts_tmout" &gt;&gt; /etc/profile.d/tmout.sh
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_tmout" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: XCCDF Value var_accounts_tmout # promote to variable
  set_fact:
    var_accounts_tmout: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_tmout" use="legacy"/>
  tags:
    - always

- name: Set Interactive Session Timeout
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/profile.d/tmout.sh
        create: false
        regexp: ^\s*TMOUT=
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/profile.d/tmout.sh
      lineinfile:
        path: /etc/profile.d/tmout.sh
        create: false
        regexp: ^\s*TMOUT=
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/profile.d/tmout.sh
      lineinfile:
        path: /etc/profile.d/tmout.sh
        create: true
        regexp: ^\s*TMOUT=
        line: TMOUT={{ var_accounts_tmout }}
        state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - accounts_tmout
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_tmout:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_tmout"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_tmout:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_tmout_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_home_dirs" severity="medium">
              <xccdf-1.2:title>Ensure that User Home Directories are not Group-Writable or World-Readable</xccdf-1.2:title>
              <xccdf-1.2:description>For each human user of the system, view the
permissions of the user's home directory:
<html:pre># ls -ld /home/<html:i>USER</html:i></html:pre>
Ensure that the directory is not group-writable and that it
is not world-readable. If necessary, repair the permissions:
<html:pre># chmod g-w /home/<html:i>USER</html:i>
# chmod o-rwx /home/<html:i>USER</html:i></html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="functionality">This action may involve modifying user home directories.
Notify your user community, and solicit input if appropriate,
before making this type of change.</xccdf-1.2:warning>
              <xccdf-1.2:warning category="general">This rule is deprecated in favor of the <html:code>file_permissions_home_directories</html:code> rule.
Please consider replacing this rule in your files as it is not expected to receive
updates as of version <html:code>0.1.62</html:code>.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:rationale>User home directories contain many configuration files which
affect the behavior of a user's account. No user should ever have
write permission to another user's home directory. Group shared
directories can be configured in sub-directories or elsewhere in the
filesystem if they are needed. Typically, user home directories
should not be world-readable, as it would disclose file names
to other users. If a subset of users need read access
to one another's home directories, this can be provided using
groups or ACLs.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_home_dirs" complexity="low" disruption="low" reboot="false" strategy="restrict">
for home_dir in $(awk -F':' '{ if ($3 &gt;= 1000 &amp;&amp; $3 != 65534) print $6 }' /etc/passwd); do
    # Only update the permissions when necessary. This will avoid changing the inode timestamp when
    # the permission is already defined as expected, therefore not impacting in possible integrity
    # check systems that also check inodes timestamps.
    find "$home_dir" -maxdepth 0 -perm /7027 -exec chmod u-s,g-w-s,o=- {} \;
done
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_home_dirs" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Get all local users from /etc/passwd
  ansible.builtin.getent:
    database: passwd
    split: ':'
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(a)
    - file_permissions_home_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Create local_users variable from the getent output
  ansible.builtin.set_fact:
    local_users: '{{ ansible_facts.getent_passwd|dict2items }}'
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(a)
    - file_permissions_home_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Test for existence home directories to avoid creating them.
  ansible.builtin.stat:
    path: '{{ item.value[4] }}'
  register: path_exists
  loop: '{{ local_users }}'
  when:
    - item.value[1]|int &gt;= 1000
    - item.value[1]|int != 65534
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(a)
    - file_permissions_home_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Ensure interactive local users have proper permissions on their respective
    home directories
  ansible.builtin.file:
    path: '{{ item.0.value[4] }}'
    mode: u-s,g-w-s,o=-
    follow: false
    recurse: false
  loop: '{{ local_users|zip(path_exists.results)|list }}'
  when: item.1.stat is defined and item.1.stat.exists
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(a)
    - file_permissions_home_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_home_dirs:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_home_dirs_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_root_paths">
              <xccdf-1.2:title>Ensure that No Dangerous Directories Exist in Root's Path</xccdf-1.2:title>
              <xccdf-1.2:description>The active path of the root account can be obtained by
starting a new root shell and running:
<html:pre># echo $PATH</html:pre>
This will produce a colon-separated list of
directories in the path.
<html:br/><html:br/>
Certain path elements could be considered dangerous, as they could lead
to root executing unknown or
untrusted programs, which could contain malicious
code.
Since root may sometimes work inside
untrusted directories, the <html:code>.</html:code> character, which represents the
current directory, should never be in the root path, nor should any
directory which can be written to by an unprivileged or
semi-privileged (system) user.
<html:br/><html:br/>
It is a good practice for administrators to always execute
privileged commands by typing the full path to the
command.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_root_path_dirs_no_write" severity="medium">
                <xccdf-1.2:title>Ensure that Root's Path Does Not Include World or Group-Writable Directories</xccdf-1.2:title>
                <xccdf-1.2:description>For each element in root's path, run:
<html:pre># ls -ld <html:i>DIR</html:i></html:pre>
and ensure that write permissions are disabled for group and
other.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Such entries increase the risk that root could
execute code provided by unprivileged users,
and potentially malicious code.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_root_path_dirs_no_write" complexity="low" disruption="medium" reboot="false" strategy="restrict">- name: Print error message if user is not root
  fail:
    msg: Root account required to read root $PATH
  when: ansible_env.USER != "root"
  ignore_errors: true
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(a)
    - accounts_root_path_dirs_no_write
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Get root paths which are not symbolic links
  stat:
    path: '{{ item }}'
  changed_when: false
  failed_when: false
  register: root_paths
  with_items: '{{ ansible_env.PATH.split('':'') }}'
  when: ansible_env.USER == "root"
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(a)
    - accounts_root_path_dirs_no_write
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Disable writability to root directories
  file:
    path: '{{ item.item }}'
    mode: g-w,o-w
  with_items: '{{ root_paths.results }}'
  when:
    - root_paths.results is defined
    - item.stat.exists
    - not item.stat.islnk
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(a)
    - accounts_root_path_dirs_no_write
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_root_path_dirs_no_write:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_root_path_dirs_no_write_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_root_path_no_dot" severity="unknown">
                <xccdf-1.2:title>Ensure that Root's Path Does Not Include Relative Paths or Null Directories</xccdf-1.2:title>
                <xccdf-1.2:description>Ensure that none of the directories in root's path is equal to a single
<html:code>.</html:code> character, or
that it contains any instances that lead to relative path traversal, such as
<html:code>..</html:code> or beginning a path without the slash (<html:code>/</html:code>) character.
Also ensure that there are no "empty" elements in the path, such as in these examples:
<html:pre>PATH=:/bin
PATH=/bin:
PATH=/bin::/sbin</html:pre>
These empty elements have the same effect as a single <html:code>.</html:code> character.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Including these entries increases the risk that root could
execute code from an untrusted location.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-root_path_no_dot:def:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_user_umask">
              <xccdf-1.2:title>Ensure that Users Have Sensible Umask Values</xccdf-1.2:title>
              <xccdf-1.2:description>The umask setting controls the default permissions
for the creation of new files.
With a default <html:code>umask</html:code> setting of 077, files and directories
created by users will not be readable by any other user on the
system. Users who wish to make specific files group- or
world-readable can accomplish this by using the chmod command.
Additionally, users can make all their files readable to their
group by default by setting a <html:code>umask</html:code> of 027 in their shell
configuration files. If default per-user groups exist (that is, if
every user has a default group whose name is the same as that
user's username and whose only member is the user), then it may
even be safe for users to select a <html:code>umask</html:code> of 007, making it very
easy to intentionally share files with groups of which the user is
a member.
<html:br/><html:br/></xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_user_umask" type="string">
                <xccdf-1.2:title>Sensible umask</xccdf-1.2:title>
                <xccdf-1.2:description>Enter default user umask</xccdf-1.2:description>
                <xccdf-1.2:value selector="007">007</xccdf-1.2:value>
                <xccdf-1.2:value selector="022">022</xccdf-1.2:value>
                <xccdf-1.2:value selector="027">027</xccdf-1.2:value>
                <xccdf-1.2:value selector="077">077</xccdf-1.2:value>
                <xccdf-1.2:value>027</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_umask_etc_login_defs" severity="medium">
                <xccdf-1.2:title>Ensure the Default Umask is Set Correctly in login.defs</xccdf-1.2:title>
                <xccdf-1.2:description>To ensure the default umask controlled by <html:code>/etc/login.defs</html:code> is set properly,
add or correct the <html:code>UMASK</html:code> setting in <html:code>/etc/login.defs</html:code> to read as follows:
<html:pre>UMASK <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/></html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R35)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00228</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The umask value influences the permissions assigned to files when they are created.
A misconfigured umask value could result in files with excessive permissions that can be read and
written to by unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#login_defs"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_umask_etc_login_defs" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - accounts_umask_etc_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_accounts_user_umask # promote to variable
  set_fact:
    var_accounts_user_umask: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>
  tags:
    - always

- name: Ensure the Default UMASK is Set Correctly
  replace:
    path: /etc/login.defs
    regexp: ^UMASK
    replace: UMASK {{ var_accounts_user_umask }}
  register: umask_replace
  when: '"shadow-utils" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - accounts_umask_etc_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Ensure the Default UMASK is Appended Correctly
  lineinfile:
    create: true
    path: /etc/login.defs
    line: UMASK {{ var_accounts_user_umask }}
  when:
    - '"shadow-utils" in ansible_facts.packages'
    - umask_replace is not changed
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - accounts_umask_etc_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_user_umask:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_user_umask"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_umask_etc_login_defs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_umask_etc_login_defs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile" severity="medium">
                <xccdf-1.2:title>Ensure the Default Umask is Set Correctly in /etc/profile</xccdf-1.2:title>
                <xccdf-1.2:description>To ensure the default umask controlled by <html:code>/etc/profile</html:code> is set properly,
add or correct the <html:code>umask</html:code> setting in <html:code>/etc/profile</html:code> to read as follows:
<html:pre>umask <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/></html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R35)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00228</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The umask value influences the permissions assigned to files when they are created.
A misconfigured umask value could result in files with excessive permissions that can be read or
written to by unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_umask_etc_profile">
var_accounts_user_umask='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>'


grep -qE '^[^#]*umask' /etc/profile &amp;&amp; \
  sed -i "s/umask.*/umask $var_accounts_user_umask/g" /etc/profile
if ! [ $? -eq 0 ]; then
    echo "umask $var_accounts_user_umask" &gt;&gt; /etc/profile
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_umask_etc_profile" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: XCCDF Value var_accounts_user_umask # promote to variable
  set_fact:
    var_accounts_user_umask: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>
  tags:
    - always

- name: Replace user umask in /etc/profile
  replace:
    path: /etc/profile
    regexp: ^[^#]*umask
    replace: umask {{ var_accounts_user_umask }}
  register: umask_replace
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - accounts_umask_etc_profile
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Append user umask in /etc/profile
  lineinfile:
    create: true
    path: /etc/profile
    line: umask {{ var_accounts_user_umask }}
  when: umask_replace is not changed
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - accounts_umask_etc_profile
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_user_umask:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_user_umask"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-accounts_umask_etc_profile:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-accounts_umask_etc_profile_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_auditing">
          <xccdf-1.2:title>System Accounting with auditd</xccdf-1.2:title>
          <xccdf-1.2:description>The audit service provides substantial capabilities
for recording system activities. By default, the service audits about
SELinux AVC denials and certain types of security-relevant events
such as system logins, account modifications, and authentication
events performed by programs such as sudo.
Under its default configuration, <html:code>auditd</html:code> has modest disk space
requirements, and should not noticeably impact system performance.
<html:br/><html:br/>
NOTE: The Linux Audit daemon <html:code>auditd</html:code> can be configured to use
the <html:code>augenrules</html:code> program to read audit rules files (<html:code>*.rules</html:code>)
located in <html:code>/etc/audit/rules.d</html:code> location and compile them to create
the resulting form of the <html:code>/etc/audit/audit.rules</html:code> configuration file
during the daemon startup (default configuration). Alternatively, the <html:code>auditd</html:code>
daemon can use the <html:code>auditctl</html:code> utility to read audit rules from the
<html:code>/etc/audit/audit.rules</html:code> configuration file during daemon startup,
and load them into the kernel. The expected behavior is configured via the
appropriate <html:code>ExecStartPost</html:code> directive setting in the
<html:code>/usr/lib/systemd/system/auditd.service</html:code> configuration file.
To instruct the <html:code>auditd</html:code> daemon to use the <html:code>augenrules</html:code> program
to read audit rules (default configuration), use the following setting:
<html:br/> <html:pre>ExecStartPost=-/sbin/augenrules --load</html:pre>
in the <html:code>/usr/lib/systemd/system/auditd.service</html:code> configuration file.
In order to instruct the <html:code>auditd</html:code> daemon to use the <html:code>auditctl</html:code>
utility to read audit rules, use the following setting:
<html:br/> <html:pre>ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules</html:pre>
in the <html:code>/usr/lib/systemd/system/auditd.service</html:code> configuration file.
Refer to <html:code>[Service]</html:code> section of the <html:code>/usr/lib/systemd/system/auditd.service</html:code>
configuration file for further details.
<html:br/><html:br/>
Government networks often have substantial auditing
requirements and <html:code>auditd</html:code> can be configured to meet these
requirements.
Examining some example audit records demonstrates how the Linux audit system
satisfies common requirements.
The following example from Red Hat Enterprise Linux 7 Documentation available at
<html:code><html:a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/selinux_users_and_administrators_guide/index#sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages">https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/selinux_users_and_administrators_guide/index#sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages</html:a></html:code>
shows the substantial amount of information captured in a
two typical "raw" audit messages, followed by a breakdown of the most important
fields. In this example the message is SELinux-related and reports an AVC
denial (and the associated system call) that occurred when the Apache HTTP
Server attempted to access the <html:code>/var/www/html/file1</html:code> file (labeled with
the <html:code>samba_share_t</html:code> type):
<html:pre>type=AVC msg=audit(1226874073.147:96): avc:  denied  { getattr } for pid=2465 comm="httpd"
path="/var/www/html/file1" dev=dm-0 ino=284133 scontext=unconfined_u:system_r:httpd_t:s0
tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file

type=SYSCALL msg=audit(1226874073.147:96): arch=40000003 syscall=196 success=no exit=-13
a0=b98df198 a1=bfec85dc a2=54dff4 a3=2008171 items=0 ppid=2463 pid=2465 auid=502 uid=48
gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=6 comm="httpd"
exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
</html:pre>
<html:ul><html:li><html:code>msg=audit(1226874073.147:96)</html:code><html:ul><html:li>The number in parentheses is the unformatted time stamp (Epoch time)
for the event, which can be converted to standard time by using the
<html:code>date</html:code> command.
</html:li></html:ul></html:li><html:li><html:code>{ getattr }</html:code><html:ul><html:li>The item in braces indicates the permission that was denied. <html:code>getattr</html:code>
indicates the source process was trying to read the target file's status information.
This occurs before reading files. This action is denied due to the file being
accessed having the wrong label. Commonly seen permissions include <html:code>getattr</html:code>,
<html:code>read</html:code>, and <html:code>write</html:code>.</html:li></html:ul></html:li><html:li><html:code>comm="httpd"</html:code><html:ul><html:li>The executable that launched the process. The full path of the executable is
found in the <html:code>exe=</html:code> section of the system call (<html:code>SYSCALL</html:code>) message,
which in this case, is <html:code>exe="/usr/sbin/httpd"</html:code>.
</html:li></html:ul></html:li><html:li><html:code>path="/var/www/html/file1"</html:code><html:ul><html:li>The path to the object (target) the process attempted to access.
</html:li></html:ul></html:li><html:li><html:code>scontext="unconfined_u:system_r:httpd_t:s0"</html:code><html:ul><html:li>The SELinux context of the process that attempted the denied action. In
this case, it is the SELinux context of the Apache HTTP Server, which is running
in the <html:code>httpd_t</html:code> domain.
</html:li></html:ul></html:li><html:li><html:code>tcontext="unconfined_u:object_r:samba_share_t:s0"</html:code><html:ul><html:li>The SELinux context of the object (target) the process attempted to access.
In this case, it is the SELinux context of <html:code>file1</html:code>. Note: the <html:code>samba_share_t</html:code>
type is not accessible to processes running in the <html:code>httpd_t</html:code> domain.</html:li></html:ul></html:li><html:li> From the system call (<html:code>SYSCALL</html:code>) message, two items are of interest:
<html:ul><html:li><html:code>success=no</html:code>: indicates whether the denial (AVC) was enforced or not.
<html:code>success=no</html:code> indicates the system call was not successful (SELinux denied
access). <html:code>success=yes</html:code> indicates the system call was successful - this can
be seen for permissive domains or unconfined domains, such as <html:code>initrc_t</html:code>
and <html:code>kernel_t</html:code>.
</html:li><html:li><html:code>exe="/usr/sbin/httpd"</html:code>: the full path to the executable that launched
the process, which in this case, is <html:code>exe="/usr/sbin/httpd"</html:code>.
</html:li></html:ul>
</html:li></html:ul></xccdf-1.2:description>
          <xccdf-1.2:platform idref="#machine"/>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_audispd-plugins_installed" severity="medium">
            <xccdf-1.2:title>Install audispd-plugins Package</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>audispd-plugins</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install audispd-plugins</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</xccdf-1.2:reference>
            <xccdf-1.2:rationale><html:code>audispd-plugins</html:code> provides plugins for the real-time interface to the
audit subsystem, <html:code>audispd</html:code>. These plugins can do things like relay events
to remote machines or analyze events for suspicious behavior.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_audispd-plugins_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "audispd-plugins" ; then
    dnf install -y "audispd-plugins"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_audispd-plugins_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure audispd-plugins is installed
  package:
    name: audispd-plugins
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_audispd-plugins_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_audispd-plugins_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_audispd-plugins

class install_audispd-plugins {
  package { 'audispd-plugins':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_audispd-plugins_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=audispd-plugins
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_audispd-plugins_installed">
[[packages]]
name = "audispd-plugins"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_audispd-plugins_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_audispd-plugins_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_audit-audispd-plugins_installed" severity="medium">
            <xccdf-1.2:title>Ensure the default plugins for the audit dispatcher are Installed</xccdf-1.2:title>
            <xccdf-1.2:description>The audit-audispd-plugins package should be installed.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_audit-audispd-plugins_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "audit-audispd-plugins" ; then
    dnf install -y "audit-audispd-plugins"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_audit-audispd-plugins_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure audit-audispd-plugins is installed
  package:
    name: audit-audispd-plugins
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_audit-audispd-plugins_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_audit-audispd-plugins_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_audit-audispd-plugins

class install_audit-audispd-plugins {
  package { 'audit-audispd-plugins':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_audit-audispd-plugins_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=audit-audispd-plugins
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_audit-audispd-plugins_installed">
[[packages]]
name = "audit-audispd-plugins"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_audit-audispd-plugins_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_audit-audispd-plugins_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_audit_installed" severity="medium">
            <xccdf-1.2:title>Ensure the audit Subsystem is Installed</xccdf-1.2:title>
            <xccdf-1.2:description>The audit package should be installed.</xccdf-1.2:description>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R50)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001814</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001875</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001877</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001878</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001879</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001880</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001881</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001882</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001889</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001914</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-7(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-7(2)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(2)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000038-GPOS-00016</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000039-GPOS-00017</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000040-GPOS-00018</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000041-GPOS-00019</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00021</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000051-GPOS-00024</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000054-GPOS-00025</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000122-GPOS-00063</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000254-GPOS-00095</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000255-GPOS-00096</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000337-GPOS-00129</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000348-GPOS-00136</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000349-GPOS-00137</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000350-GPOS-00138</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000351-GPOS-00139</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000352-GPOS-00140</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000353-GPOS-00141</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000354-GPOS-00142</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000358-GPOS-00145</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000365-GPOS-00152</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000475-GPOS-00220</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_audit_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "audit" ; then
    dnf install -y "audit"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_audit_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure audit is installed
  package:
    name: audit
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-7(a)
    - NIST-800-53-AU-12(2)
    - NIST-800-53-AU-14
    - NIST-800-53-AU-2(a)
    - NIST-800-53-AU-7(1)
    - NIST-800-53-AU-7(2)
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_audit_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_audit_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_audit

class install_audit {
  package { 'audit':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_audit_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=audit
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_audit_installed">
[[packages]]
name = "audit"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_audit_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_audit_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_auditd_enabled" severity="medium">
            <xccdf-1.2:title>Enable auditd Service</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>auditd</html:code> service is an essential userspace component of
the Linux Auditing System, as it is responsible for writing audit records to
disk.

The <html:code>auditd</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable auditd.service</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000131</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000132</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000133</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000134</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000154</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000158</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001464</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001814</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001876</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iv)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(g)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-14(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-4(23)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000038-GPOS-00016</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000039-GPOS-00017</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000040-GPOS-00018</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000041-GPOS-00019</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00021</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000051-GPOS-00024</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000054-GPOS-00025</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000122-GPOS-00063</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000254-GPOS-00095</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000255-GPOS-00096</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000337-GPOS-00129</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000348-GPOS-00136</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000349-GPOS-00137</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000350-GPOS-00138</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000351-GPOS-00139</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000352-GPOS-00140</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000353-GPOS-00141</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000354-GPOS-00142</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000358-GPOS-00145</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000365-GPOS-00152</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000475-GPOS-00220</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">SRG-OS-000037-VMM-000150</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">SRG-OS-000063-VMM-000310</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">SRG-OS-000038-VMM-000160</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">SRG-OS-000039-VMM-000170</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">SRG-OS-000040-VMM-000180</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">SRG-OS-000041-VMM-000190</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Without establishing what type of events occurred, it would be difficult
to establish, correlate, and investigate the events leading up to an outage or attack.
Ensuring the <html:code>auditd</html:code> service is active ensures audit records
generated by the kernel are appropriately recorded.
<html:br/><html:br/>
Additionally, a properly configured audit subsystem ensures that actions of
individual system users can be uniquely traced to those users so they
can be held accountable for their actions.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#audit"/>
            <xccdf-1.2:requires idref="xccdf_org.ssgproject.content_rule_package_audit_installed"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_auditd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ] &amp;&amp; { rpm --quiet -q audit; }; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'auditd.service'
"$SYSTEMCTL_EXEC" start 'auditd.service'
"$SYSTEMCTL_EXEC" enable 'auditd.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_auditd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-171-3.3.2
    - NIST-800-171-3.3.6
    - NIST-800-53-AC-2(g)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-10
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-14(1)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-AU-3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-4(23)
    - PCI-DSS-Req-10.1
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_auditd_enabled

- name: Enable service auditd
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service auditd
      service:
        name: auditd
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"audit" in ansible_facts.packages'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-171-3.3.2
    - NIST-800-171-3.3.6
    - NIST-800-53-AC-2(g)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-10
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-14(1)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-AU-3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-4(23)
    - PCI-DSS-Req-10.1
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_auditd_enabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_auditd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_auditd

class enable_auditd {
  service {'auditd':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="service_auditd_enabled">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: auditd.service
        enabled: true
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_auditd_enabled">
[customizations.services]
enabled = ["auditd"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_auditd_enabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-service_auditd_enabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_audit_argument" severity="medium">
            <xccdf-1.2:title>Enable Auditing for Processes Which Start Prior to the Audit Daemon</xccdf-1.2:title>
            <xccdf-1.2:description>To ensure all processes can be audited, even those which start
prior to the audit daemon, add the argument <html:code>audit=1</html:code> to the default
GRUB 2 command line for the Linux operating system.
Configure the default Grub2 kernel command line to contain audit=1 as follows:
<html:pre># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) audit=1"</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001464</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iv)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-14(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IR-5(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000473-GPOS-00218</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000254-GPOS-00095</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">SRG-OS-000254-VMM-000880</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Each process on the system carries an "auditable" flag which indicates whether
its activities can be audited. Although <html:code>auditd</html:code> takes care of enabling
this for all processes which launch after it does, adding the kernel argument
ensures it is set for every process during boot.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#grub2"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_audit_argument"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ] &amp;&amp; { rpm --quiet -q grub2-common; }; then

grubby --update-kernel=ALL --args=audit=1

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_audit_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-17(1)
    - NIST-800-53-AU-10
    - NIST-800-53-AU-14(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IR-5(1)
    - PCI-DSS-Req-10.3
    - grub2_audit_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="audit=1"
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"grub2-common" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-17(1)
    - NIST-800-53-AU-10
    - NIST-800-53-AU-14(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IR-5(1)
    - PCI-DSS-Req-10.3
    - grub2_audit_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_audit_argument">[customizations.kernel]
append = "audit=1"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-grub2_audit_argument:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-grub2_audit_argument_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_audit_backlog_limit_argument" severity="low">
            <xccdf-1.2:title>Extend Audit Backlog Limit for the Audit Daemon</xccdf-1.2:title>
            <xccdf-1.2:description>To improve the kernel capacity to queue all log events, even those which occurred
prior to the audit daemon, add the argument <html:code>audit_backlog_limit=8192</html:code> to the default
GRUB 2 command line for the Linux operating system.
Configure the default Grub2 kernel command line to contain audit_backlog_limit=8192 as follows:
<html:pre># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) audit_backlog_limit=8192"</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001849</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_STG.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_STG.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000254-GPOS-00095</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000341-GPOS-00132</xccdf-1.2:reference>
            <xccdf-1.2:rationale>audit_backlog_limit sets the queue length for audit events awaiting transfer
to the audit daemon. Until the audit daemon is up and running, all log messages
are stored in this queue.  If the queue is overrun during boot process, the action
defined by audit failure flag is taken.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#grub2"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_audit_backlog_limit_argument"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ] &amp;&amp; { rpm --quiet -q grub2-common; }; then

grubby --update-kernel=ALL --args=audit_backlog_limit=8192

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_audit_backlog_limit_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - grub2_audit_backlog_limit_argument
    - low_disruption
    - low_severity
    - medium_complexity
    - reboot_required
    - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="audit_backlog_limit=8192"
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"grub2-common" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - grub2_audit_backlog_limit_argument
    - low_disruption
    - low_severity
    - medium_complexity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_audit_backlog_limit_argument">[customizations.kernel]
append = "audit_backlog_limit=8192"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-grub2_audit_backlog_limit_argument:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-grub2_audit_backlog_limit_argument_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_auditd_configure_rules">
            <xccdf-1.2:title>Configure auditd Rules for Comprehensive Auditing</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>auditd</html:code> program can perform comprehensive
monitoring of system activity. This section describes recommended
configuration settings for comprehensive auditing, but a full
description of the auditing system's capabilities is beyond the
scope of this guide. The mailing list <html:i>linux-audit@redhat.com</html:i> exists
to facilitate community discussion of the auditing system.
<html:br/><html:br/>
The audit subsystem supports extensive collection of events, including:
<html:br/>
<html:ul><html:li>Tracing of arbitrary system calls (identified by name or number)
on entry or exit.</html:li><html:li>Filtering by PID, UID, call success, system call argument (with
some limitations), etc.</html:li><html:li>Monitoring of specific files for modifications to the file's
contents or metadata.</html:li></html:ul>
<html:br/>
Auditing rules at startup are controlled by the file <html:code>/etc/audit/audit.rules</html:code>.
Add rules to it to meet the auditing requirements for your organization.
Each line in <html:code>/etc/audit/audit.rules</html:code> represents a series of arguments
that can be passed to <html:code>auditctl</html:code> and can be individually tested
during runtime. See documentation in <html:code>/usr/share/doc/audit-<html:i>VERSION</html:i></html:code> and
in the related man pages for more details.
<html:br/><html:br/>
If copying any example audit rulesets from <html:code>/usr/share/doc/audit-VERSION</html:code>,
be sure to comment out the
lines containing <html:code>arch=</html:code> which are not appropriate for your system's
architecture. Then review and understand the following rules,
ensuring rules are activated as needed for the appropriate
architecture.
<html:br/><html:br/>
After reviewing all the rules, reading the following sections, and
editing as needed, the new rules can be activated as follows:
<html:pre>$ sudo service auditd restart</html:pre></xccdf-1.2:description>
            <xccdf-1.2:platform idref="#audit"/>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open" severity="medium">
              <xccdf-1.2:title>Record Events that Modify User/Group Information via open syscall - /etc/group</xccdf-1.2:title>
              <xccdf-1.2:description>The audit system should collect write events to /etc/group file for all users and root.
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre></xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Creation of groups through direct edition of /etc/group could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_etc_group_open"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F a1&amp;03 -F path=/etc/group"
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="open"
	KEY="user-modify"
	SYSCALL_GROUPING=""
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_etc_group_open" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit open tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping: []

    - name: Check existence of open in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modify.rules
      set_fact: audit_file="/etc/audit/rules.d/modify.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a1&amp;03 -F
          path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping: []

    - name: Check existence of open in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a1&amp;03 -F
          path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping: []

    - name: Check existence of open in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modify.rules
      set_fact: audit_file="/etc/audit/rules.d/modify.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a1&amp;03 -F
          path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping: []

    - name: Check existence of open in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a1&amp;03 -F path=/etc/group -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a1&amp;03 -F
          path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_etc_group_open:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_etc_group_open_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at" severity="medium">
              <xccdf-1.2:title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group</xccdf-1.2:title>
              <xccdf-1.2:description>The audit system should collect write events to /etc/group file for all group and root.
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre></xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Creation of groups through direct edition of /etc/group could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_etc_group_open_by_handle_at"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F a2&amp;03 -F path=/etc/group"
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="open_by_handle_at"
	KEY="user-modify"
	SYSCALL_GROUPING=""
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_etc_group_open_by_handle_at" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit open_by_handle_at tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open_by_handle_at for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping: []

    - name: Check existence of open_by_handle_at in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modify.rules
      set_fact: audit_file="/etc/audit/rules.d/modify.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping: []

    - name: Check existence of open_by_handle_at in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open_by_handle_at for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping: []

    - name: Check existence of open_by_handle_at in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modify.rules
      set_fact: audit_file="/etc/audit/rules.d/modify.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping: []

    - name: Check existence of open_by_handle_at in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_etc_group_open_by_handle_at:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_etc_group_open_by_handle_at_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat" severity="medium">
              <xccdf-1.2:title>Record Events that Modify User/Group Information via openat syscall - /etc/group</xccdf-1.2:title>
              <xccdf-1.2:description>The audit system should collect write events to /etc/group file for all users and root.
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S openat -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre></xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Creation of groups through direct edition of /etc/group could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_etc_group_openat"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F a2&amp;03 -F path=/etc/group"
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="openat"
	KEY="user-modify"
	SYSCALL_GROUPING=""
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_etc_group_openat" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit openat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for openat for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping: []

    - name: Check existence of openat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modify.rules
      set_fact: audit_file="/etc/audit/rules.d/modify.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping: []

    - name: Check existence of openat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for openat for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping: []

    - name: Check existence of openat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modify.rules
      set_fact: audit_file="/etc/audit/rules.d/modify.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping: []

    - name: Check existence of openat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/group -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/group -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_group_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_etc_group_openat:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_etc_group_openat_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open" severity="medium">
              <xccdf-1.2:title>Record Events that Modify User/Group Information via open syscall - /etc/gshadow</xccdf-1.2:title>
              <xccdf-1.2:description>The audit system should collect write events to /etc/gshadow file for all users and root.
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre></xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Creation of users through direct edition of /etc/gshadow could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_etc_gshadow_open"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F a1&amp;03 -F path=/etc/gshadow"
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="open"
	KEY="user-modify"
	SYSCALL_GROUPING=""
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_etc_gshadow_open" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit open tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping: []

    - name: Check existence of open in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a1&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modify.rules
      set_fact: audit_file="/etc/audit/rules.d/modify.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a1&amp;03 -F path=/etc/gshadow -F
          auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a1&amp;03 -F
          path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping: []

    - name: Check existence of open in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a1&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a1&amp;03 -F path=/etc/gshadow -F
          auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a1&amp;03 -F
          path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping: []

    - name: Check existence of open in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a1&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modify.rules
      set_fact: audit_file="/etc/audit/rules.d/modify.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a1&amp;03 -F path=/etc/gshadow -F
          auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a1&amp;03 -F
          path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping: []

    - name: Check existence of open in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a1&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a1&amp;03 -F path=/etc/gshadow -F
          auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a1&amp;03 -F
          path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_etc_gshadow_open:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_etc_gshadow_open_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open_by_handle_at" severity="medium">
              <xccdf-1.2:title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow</xccdf-1.2:title>
              <xccdf-1.2:description>The audit system should collect write events to /etc/gshadow file for all users and root.
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre></xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Creation of users through direct edition of /etc/gshadow could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_etc_gshadow_open_by_handle_at"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F a2&amp;03 -F path=/etc/gshadow"
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="open_by_handle_at"
	KEY="user-modify"
	SYSCALL_GROUPING=""
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_etc_gshadow_open_by_handle_at" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit open_by_handle_at tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open_by_handle_at for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping: []

    - name: Check existence of open_by_handle_at in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modify.rules
      set_fact: audit_file="/etc/audit/rules.d/modify.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/gshadow -F
          auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping: []

    - name: Check existence of open_by_handle_at in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/gshadow -F
          auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open_by_handle_at for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping: []

    - name: Check existence of open_by_handle_at in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modify.rules
      set_fact: audit_file="/etc/audit/rules.d/modify.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/gshadow -F
          auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping: []

    - name: Check existence of open_by_handle_at in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/gshadow -F
          auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_etc_gshadow_open_by_handle_at:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_etc_gshadow_open_by_handle_at_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_openat" severity="medium">
              <xccdf-1.2:title>Record Events that Modify User/Group Information via openat syscall - /etc/gshadow</xccdf-1.2:title>
              <xccdf-1.2:description>The audit system should collect write events to /etc/gshadow file for all users and root.
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S openat -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre></xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Creation of users through direct edition of /etc/gshadow could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_etc_gshadow_openat"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F a2&amp;03 -F path=/etc/gshadow"
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="openat"
	KEY="user-modify"
	SYSCALL_GROUPING=""
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_etc_gshadow_openat" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit openat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for openat for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping: []

    - name: Check existence of openat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modify.rules
      set_fact: audit_file="/etc/audit/rules.d/modify.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/gshadow -F
          auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping: []

    - name: Check existence of openat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/gshadow -F
          auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for openat for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping: []

    - name: Check existence of openat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modify.rules
      set_fact: audit_file="/etc/audit/rules.d/modify.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/gshadow -F
          auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping: []

    - name: Check existence of openat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/gshadow -F
          auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/gshadow -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_gshadow_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_etc_gshadow_openat:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_etc_gshadow_openat_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open" severity="medium">
              <xccdf-1.2:title>Record Events that Modify User/Group Information via open syscall - /etc/passwd</xccdf-1.2:title>
              <xccdf-1.2:description>The audit system should collect write events to /etc/passwd file for all users and root.
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre></xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Creation of users through direct edition of /etc/passwd could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_etc_passwd_open"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F a1&amp;03 -F path=/etc/passwd"
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="open"
	KEY="user-modify"
	SYSCALL_GROUPING=""
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_etc_passwd_open" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit open tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping: []

    - name: Check existence of open in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modify.rules
      set_fact: audit_file="/etc/audit/rules.d/modify.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a1&amp;03 -F
          path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping: []

    - name: Check existence of open in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a1&amp;03 -F
          path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping: []

    - name: Check existence of open in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modify.rules
      set_fact: audit_file="/etc/audit/rules.d/modify.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a1&amp;03 -F
          path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping: []

    - name: Check existence of open in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a1&amp;03 -F
          path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_etc_passwd_open:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_etc_passwd_open_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open_by_handle_at" severity="medium">
              <xccdf-1.2:title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd</xccdf-1.2:title>
              <xccdf-1.2:description>The audit system should collect write events to /etc/passwd file for all users and root.
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre></xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Creation of users through direct edition of /etc/passwd could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_etc_passwd_open_by_handle_at"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F a2&amp;03 -F path=/etc/passwd"
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="open_by_handle_at"
	KEY="user-modify"
	SYSCALL_GROUPING=""
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_etc_passwd_open_by_handle_at" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit open_by_handle_at tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open_by_handle_at for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping: []

    - name: Check existence of open_by_handle_at in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modify.rules
      set_fact: audit_file="/etc/audit/rules.d/modify.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping: []

    - name: Check existence of open_by_handle_at in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open_by_handle_at for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping: []

    - name: Check existence of open_by_handle_at in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modify.rules
      set_fact: audit_file="/etc/audit/rules.d/modify.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping: []

    - name: Check existence of open_by_handle_at in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_etc_passwd_open_by_handle_at:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_etc_passwd_open_by_handle_at_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_openat" severity="medium">
              <xccdf-1.2:title>Record Events that Modify User/Group Information via openat syscall - /etc/passwd</xccdf-1.2:title>
              <xccdf-1.2:description>The audit system should collect write events to /etc/passwd file for all users and root.
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S openat -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify</html:pre></xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Creation of users through direct edition of /etc/passwd could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_etc_passwd_openat"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F a2&amp;03 -F path=/etc/passwd"
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="openat"
	KEY="user-modify"
	SYSCALL_GROUPING=""
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_etc_passwd_openat" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit openat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for openat for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping: []

    - name: Check existence of openat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modify.rules
      set_fact: audit_file="/etc/audit/rules.d/modify.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping: []

    - name: Check existence of openat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for openat for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping: []

    - name: Check existence of openat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modify.rules
      set_fact: audit_file="/etc/audit/rules.d/modify.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping: []

    - name: Check existence of openat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_passwd_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_etc_passwd_openat:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_etc_passwd_openat_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open" severity="medium">
              <xccdf-1.2:title>Record Events that Modify User/Group Information via open syscall - /etc/shadow</xccdf-1.2:title>
              <xccdf-1.2:description>The audit system should collect write events to /etc/shadow file for all users and root.
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre></xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Creation of users through direct edition of /etc/shadow could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_etc_shadow_open"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F a1&amp;03 -F path=/etc/shadow"
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="open"
	KEY="user-modify"
	SYSCALL_GROUPING=""
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_etc_shadow_open" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit open tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping: []

    - name: Check existence of open in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modify.rules
      set_fact: audit_file="/etc/audit/rules.d/modify.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a1&amp;03 -F
          path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping: []

    - name: Check existence of open in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a1&amp;03 -F
          path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping: []

    - name: Check existence of open in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modify.rules
      set_fact: audit_file="/etc/audit/rules.d/modify.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a1&amp;03 -F
          path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping: []

    - name: Check existence of open in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a1&amp;03 -F
          path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_etc_shadow_open:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_etc_shadow_open_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open_by_handle_at" severity="medium">
              <xccdf-1.2:title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow</xccdf-1.2:title>
              <xccdf-1.2:description>The audit system should collect write events to /etc/shadow file for all users and root.
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre></xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Creation of users through direct edition of /etc/shadow could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_etc_shadow_open_by_handle_at"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F a2&amp;03 -F path=/etc/shadow"
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="open_by_handle_at"
	KEY="user-modify"
	SYSCALL_GROUPING=""
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_etc_shadow_open_by_handle_at" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit open_by_handle_at tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open_by_handle_at for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping: []

    - name: Check existence of open_by_handle_at in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modify.rules
      set_fact: audit_file="/etc/audit/rules.d/modify.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping: []

    - name: Check existence of open_by_handle_at in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open_by_handle_at for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping: []

    - name: Check existence of open_by_handle_at in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modify.rules
      set_fact: audit_file="/etc/audit/rules.d/modify.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping: []

    - name: Check existence of open_by_handle_at in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_etc_shadow_open_by_handle_at:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_etc_shadow_open_by_handle_at_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_openat" severity="medium">
              <xccdf-1.2:title>Record Events that Modify User/Group Information via openat syscall - /etc/shadow</xccdf-1.2:title>
              <xccdf-1.2:description>The audit system should collect write events to /etc/shadow file for all users and root.
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S openat -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S openat -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify</html:pre></xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Creation of users through direct edition of /etc/shadow could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_etc_shadow_openat"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F a2&amp;03 -F path=/etc/shadow"
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="openat"
	KEY="user-modify"
	SYSCALL_GROUPING=""
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_etc_shadow_openat" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit openat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for openat for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping: []

    - name: Check existence of openat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modify.rules
      set_fact: audit_file="/etc/audit/rules.d/modify.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping: []

    - name: Check existence of openat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for openat for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping: []

    - name: Check existence of openat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modify.rules
      set_fact: audit_file="/etc/audit/rules.d/modify.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping: []

    - name: Check existence of openat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a2&amp;03 -F
          path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=modify
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_etc_shadow_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_etc_shadow_openat:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_etc_shadow_openat_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_immutable" severity="medium">
              <xccdf-1.2:title>Make the auditd Configuration Immutable</xccdf-1.2:title>
              <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code> in order to make the auditd configuration
immutable:
<html:pre>-e 2</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file in order to make the auditd configuration
immutable:
<html:pre>-e 2</html:pre>
With this setting, a reboot will be required to change any audit rules.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000162</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iv)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000057-GPOS-00027</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000058-GPOS-00028</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000059-GPOS-00029</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Making the audit configuration immutable prevents accidental as
well as malicious modification of the audit rules, although it may be
problematic if legitimate changes are needed during system
operation.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_immutable"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Traverse all of:
#
# /etc/audit/audit.rules,			(for auditctl case)
# /etc/audit/rules.d/*.rules			(for augenrules case)
#
# files to check if '-e .*' setting is present in that '*.rules' file already.
# If found, delete such occurrence since auditctl(8) manual page instructs the
# '-e 2' rule should be placed as the last rule in the configuration
find /etc/audit /etc/audit/rules.d -maxdepth 1 -type f -name '*.rules' -exec sed -i '/-e[[:space:]]\+.*/d' {} ';'

# Append '-e 2' requirement at the end of both:
# * /etc/audit/audit.rules file 		(for auditctl case)
# * /etc/audit/rules.d/immutable.rules		(for augenrules case)

for AUDIT_FILE in "/etc/audit/audit.rules" "/etc/audit/rules.d/immutable.rules"
do
	echo '' &gt;&gt; $AUDIT_FILE
	echo '# Set the audit.rules configuration immutable per security requirements' &gt;&gt; $AUDIT_FILE
	echo '# Reboot is required to change audit rules once this setting is applied' &gt;&gt; $AUDIT_FILE
	echo '-e 2' &gt;&gt; $AUDIT_FILE
	chmod o-rwx $AUDIT_FILE
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_immutable" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-171-3.4.3
    - NIST-800-53-AC-6(9)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.2
    - audit_rules_immutable
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Collect all files from /etc/audit/rules.d with .rules extension
  find:
    paths: /etc/audit/rules.d/
    patterns: '*.rules'
  register: find_rules_d
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-171-3.4.3
    - NIST-800-53-AC-6(9)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.2
    - audit_rules_immutable
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Remove the -e option from all Audit config files
  lineinfile:
    path: '{{ item }}'
    regexp: ^\s*(?:-e)\s+.*$
    state: absent
  loop: '{{ find_rules_d.files | map(attribute=''path'') | list + [''/etc/audit/audit.rules'']
    }}'
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-171-3.4.3
    - NIST-800-53-AC-6(9)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.2
    - audit_rules_immutable
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add Audit -e option into /etc/audit/rules.d/immutable.rules and /etc/audit/audit.rules
  lineinfile:
    path: '{{ item }}'
    create: true
    line: -e 2
    mode: o-rwx
  loop:
    - /etc/audit/audit.rules
    - /etc/audit/rules.d/immutable.rules
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-171-3.4.3
    - NIST-800-53-AC-6(9)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.2
    - audit_rules_immutable
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="audit_rules_immutable">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-e%202%0A
        mode: 0600
        path: /etc/audit/rules.d/90-immutable.rules
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_immutable:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_immutable_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification" severity="medium">
              <xccdf-1.2:title>Record Events that Modify the System's Mandatory Access Controls</xccdf-1.2:title>
              <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-w /etc/selinux/ -p wa -k MAC-policy</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-w /etc/selinux/ -p wa -k MAC-policy</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The system's mandatory access policy (SELinux) should not be
arbitrarily changed by anything other than administrator action. All changes to
MAC policy should be audited.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_mac_modification"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/selinux/" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/selinux/ $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/selinux/$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/selinux/ -p wa -k MAC-policy" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/MAC-policy.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/selinux/" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/MAC-policy.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/MAC-policy.rules"
    # If the MAC-policy.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/selinux/" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/selinux/ $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/selinux/$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/selinux/ -p wa -k MAC-policy" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_mac_modification" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /etc/selinux/ already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key MAC-policy
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)MAC-policy$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use /etc/audit/rules.d/MAC-policy.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/MAC-policy.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /etc/selinux/ in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/selinux/ -p wa -k MAC-policy
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /etc/selinux/ already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /etc/selinux/ in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/selinux/ -p wa -k MAC-policy
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="audit_rules_mac_modification" complexity="low" disruption="low" reboot="true" strategy="restrict">---

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ -w%20/etc/selinux/%20-p%20wa%20-k%20MAC-policy%0A }}
        mode: 0600
        path: /etc/audit/rules.d/75-etcselinux-wa-MAC-policy.rules
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_mac_modification:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_mac_modification_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_media_export" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on Exporting to Media (successful)</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect media exportation
events for all users and root. If the <html:code>auditd</html:code> daemon is configured to
use the <html:code>augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code>.rules</html:code> in
the directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S mount -F auid&gt;=1000 -F auid!=unset -F key=export</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S mount -F auid&gt;=1000 -F auid!=unset -F key=export</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The unauthorized exportation of data to external media could result in an information leak
where classified information, Privacy Act information, and intellectual property could be lost. An audit
trail should be created each time a filesystem is mounted to help identify and guard against information
loss.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_media_export"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="mount"
	KEY="perm_mod"
	SYSCALL_GROUPING=""

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_media_export" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_media_export
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit mount tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_media_export
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for mount for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - mount
        syscall_grouping: []

    - name: Check existence of mount in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - mount
        syscall_grouping: []

    - name: Check existence of mount in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_media_export
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for mount for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - mount
        syscall_grouping: []

    - name: Check existence of mount in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - mount
        syscall_grouping: []

    - name: Check existence of mount in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_media_export
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_media_export:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_media_export_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification" severity="medium">
              <xccdf-1.2:title>Record Events that Modify the System's Network Environment</xccdf-1.2:title>
              <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification
-w /etc/issue -p wa -k audit_rules_networkconfig_modification
-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
-w /etc/hosts -p wa -k audit_rules_networkconfig_modification
-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification
-w /etc/issue -p wa -k audit_rules_networkconfig_modification
-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
-w /etc/hosts -p wa -k audit_rules_networkconfig_modification
-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The network environment should not be modified by anything other
than administrator action. Any change to network parameters should be
audited.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_networkconfig_modification"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS=""
	SYSCALL="sethostname setdomainname"
	KEY="audit_rules_networkconfig_modification"
	SYSCALL_GROUPING="sethostname setdomainname"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

# Then perform the remediations for the watch rules
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/issue" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/issue $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/issue$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/issue -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/issue" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
    # If the audit_rules_networkconfig_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/issue" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/issue $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/issue$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/issue -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/issue.net" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/issue.net $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/issue.net$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/issue.net" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
    # If the audit_rules_networkconfig_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/issue.net" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/issue.net $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/issue.net$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/hosts" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/hosts $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/hosts$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/hosts -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/hosts" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
    # If the audit_rules_networkconfig_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/hosts" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/hosts $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/hosts$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/hosts -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/sysconfig/network" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sysconfig/network $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/sysconfig/network$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/sysconfig/network" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
    # If the audit_rules_networkconfig_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/sysconfig/network" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sysconfig/network $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/sysconfig/network$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_networkconfig_modification" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set architecture for audit tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Remediate audit rules for network configuration for x86
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - sethostname
          - setdomainname
        syscall_grouping:
          - sethostname
          - setdomainname

    - name: Check existence of sethostname, setdomainname in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
      set_fact: audit_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_rules_networkconfig_modification
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - sethostname
          - setdomainname
        syscall_grouping:
          - sethostname
          - setdomainname

    - name: Check existence of sethostname, setdomainname in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_rules_networkconfig_modification
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Remediate audit rules for network configuration for x86_64
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - sethostname
          - setdomainname
        syscall_grouping:
          - sethostname
          - setdomainname

    - name: Check existence of sethostname, setdomainname in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
      set_fact: audit_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_rules_networkconfig_modification
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - sethostname
          - setdomainname
        syscall_grouping:
          - sethostname
          - setdomainname

    - name: Check existence of sethostname, setdomainname in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_rules_networkconfig_modification
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/issue already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_networkconfig_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules as the
    recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/issue in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/issue -p wa -k audit_rules_networkconfig_modification
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/issue already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/issue in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/issue -p wa -k audit_rules_networkconfig_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/issue.net already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/issue.net\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_networkconfig_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules as the
    recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/issue.net in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/issue.net already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/issue.net\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/issue.net in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/hosts already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/hosts\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_networkconfig_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules as the
    recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/hosts in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/hosts -p wa -k audit_rules_networkconfig_modification
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/hosts already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/hosts\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/hosts in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/hosts -p wa -k audit_rules_networkconfig_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/sysconfig/network already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/sysconfig/network\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_networkconfig_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules as the
    recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/sysconfig/network in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/sysconfig/network already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/sysconfig/network\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/sysconfig/network in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_networkconfig_modification:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_networkconfig_modification_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_session_events" severity="medium">
              <xccdf-1.2:title>Record Attempts to Alter Process and Session Initiation Information</xccdf-1.2:title>
              <xccdf-1.2:description>The audit system already collects process information for all
users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code> in order to watch for attempted manual
edits of files involved in storing such process information:
<html:pre>-w /var/run/utmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/log/wtmp -p wa -k session</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file in order to watch for attempted manual
edits of files involved in storing such process information:
<html:pre>-w /var/run/utmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/log/wtmp -p wa -k session</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0582</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0584</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">05885</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0586</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0846</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0957</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.3</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Manual editing of these files may indicate nefarious activity, such
as an attacker attempting to remove evidence of an intrusion.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_session_events"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/run/utmp" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/run/utmp $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/run/utmp$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/run/utmp -p wa -k session" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/session.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/run/utmp" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/session.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/session.rules"
    # If the session.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/run/utmp" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/run/utmp $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/run/utmp$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/run/utmp -p wa -k session" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/btmp" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/btmp $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/btmp$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/btmp -p wa -k session" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/session.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/log/btmp" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/session.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/session.rules"
    # If the session.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/btmp" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/btmp $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/btmp$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/btmp -p wa -k session" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/wtmp" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/wtmp $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/wtmp$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/wtmp -p wa -k session" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/session.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/log/wtmp" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/session.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/session.rules"
    # If the session.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/wtmp" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/wtmp $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/wtmp$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/wtmp -p wa -k session" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_session_events" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /var/run/utmp already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/var/run/utmp\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key session
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)session$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use /etc/audit/rules.d/session.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/session.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /var/run/utmp in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/run/utmp -p wa -k session
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /var/run/utmp already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/var/run/utmp\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /var/run/utmp in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/run/utmp -p wa -k session
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /var/log/btmp already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/var/log/btmp\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key session
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)session$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use /etc/audit/rules.d/session.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/session.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /var/log/btmp in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/log/btmp -p wa -k session
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /var/log/btmp already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/var/log/btmp\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /var/log/btmp in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/log/btmp -p wa -k session
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /var/log/wtmp already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/var/log/wtmp\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key session
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)session$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use /etc/audit/rules.d/session.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/session.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /var/log/wtmp in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/log/wtmp -p wa -k session
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /var/log/wtmp already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/var/log/wtmp\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /var/log/wtmp in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/log/wtmp -p wa -k session
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="audit_rules_session_events" complexity="low" disruption="low" reboot="true" strategy="restrict">---


apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ %0A-w%20/var/run/utmp%20-p%20wa%20-k%20session%0A-w%20/var/log/btmp%20-p%20wa%20-k%20session%0A-w%20/var/log/wtmp%20-p%20wa%20-k%20session%0A }}
        mode: 0600
        path: /etc/audit/rules.d/75-audit-session-events.rules
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_session_events:def:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_sysadmin_actions" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects System Administrator Actions</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect administrator actions
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the default),
add the following line to a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>:
<html:pre>-w /etc/sudoers -p wa -k actions
-w /etc/sudoers.d/ -p wa -k actions</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-w /etc/sudoers -p wa -k actions
-w /etc/sudoers.d/ -p wa -k actions</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(7)(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5.b</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000462-VMM-001840</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000471-VMM-001910</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The actions taken by system administrators should be audited to keep a record
of what was executed on the system, as well as, for accountability purposes.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_sysadmin_actions"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/sudoers" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sudoers $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/sudoers$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/sudoers -p wa -k actions" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/actions.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/sudoers" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/actions.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/actions.rules"
    # If the actions.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/sudoers" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sudoers $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/sudoers$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/sudoers -p wa -k actions" &gt;&gt; "$audit_rules_file"
    fi
done

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/sudoers.d/" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sudoers.d/ $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/sudoers.d/$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/sudoers.d/ -p wa -k actions" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/actions.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/sudoers.d/" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/actions.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/actions.rules"
    # If the actions.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/sudoers.d/" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sudoers.d/ $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/sudoers.d/$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/sudoers.d/ -p wa -k actions" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_sysadmin_actions" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for audit rule entries for sysadmin actions
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*/etc/sudoers.*$
    patterns: '*.rules'
  register: find_audit_sysadmin_actions
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/actions.rules as the recipient for the rule
  set_fact:
    all_sysadmin_actions_files:
      - /etc/audit/rules.d/actions.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_audit_sysadmin_actions.matched is defined and find_audit_sysadmin_actions.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_sysadmin_actions_files:
      - '{{ find_audit_sysadmin_actions.files | map(attribute=''path'') | list | first
        }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_audit_sysadmin_actions.matched is defined and find_audit_sysadmin_actions.matched
      &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces audit rule for /etc/sudoers rule in rules.d
  lineinfile:
    path: '{{ all_sysadmin_actions_files[0] }}'
    line: -w /etc/sudoers -p wa -k actions
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces audit rule for /etc/sudoers.d rule in rules.d
  lineinfile:
    path: '{{ all_sysadmin_actions_files[0] }}'
    line: -w /etc/sudoers.d/ -p wa -k actions
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces audit rule for /etc/sudoers in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -w /etc/sudoers -p wa -k actions
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces audit rule for /etc/sudoers.d in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -w /etc/sudoers.d/ -p wa -k actions
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="audit_rules_sysadmin_actions" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ -w%20/etc/sudoers.d/%20-p%20wa%20-k%20actions%0A-w%20/etc/sudoers%20-p%20wa%20-k%20actions%0A }}
        mode: 0600
        path: /etc/audit/rules.d/75-audit-sysadmin-actions.rules
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_sysadmin_actions:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_sysadmin_actions_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification" severity="medium">
              <xccdf-1.2:title>Record Events that Modify User/Group Information</xccdf-1.2:title>
              <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, in order to capture events that modify
account changes:
<html:pre>-w /etc/group -p wa -k audit_rules_usergroup_modification
-w /etc/passwd -p wa -k audit_rules_usergroup_modification
-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
-w /etc/shadow -p wa -k audit_rules_usergroup_modification
-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification</html:pre>
<html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file, in order to capture events that modify
account changes:
<html:pre>-w /etc/group -p wa -k audit_rules_usergroup_modification
-w /etc/passwd -p wa -k audit_rules_usergroup_modification
-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
-w /etc/shadow -p wa -k audit_rules_usergroup_modification
-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This rule checks for multiple syscalls related to account changes;
it was written with DISA STIG in mind. Other policies should use a
separate rule for each syscall that needs to be checked. For example:
<html:ul><html:li><html:code>audit_rules_usergroup_modification_group</html:code></html:li><html:li><html:code>audit_rules_usergroup_modification_gshadow</html:code></html:li><html:li><html:code>audit_rules_usergroup_modification_passwd</html:code></html:li></html:ul></xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</xccdf-1.2:reference>
              <xccdf-1.2:rationale>In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_usergroup_modification:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_usergroup_modification_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group" severity="medium">
              <xccdf-1.2:title>Record Events that Modify User/Group Information - /etc/group</xccdf-1.2:title>
              <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, in order to capture events that modify
account changes:
<html:br/><html:br/>
<html:pre>-w /etc/group -p wa -k audit_rules_usergroup_modification</html:pre>
<html:br/><html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file, in order to capture events that modify
account changes:
<html:br/><html:br/>
<html:pre>-w /etc/group -p wa -k audit_rules_usergroup_modification</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001404</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001683</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001684</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001685</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001686</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002132</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000004-VMM-000040</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000239-VMM-000810</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000240-VMM-000820</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000241-VMM-000830</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000274-VMM-000960</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000275-VMM-000970</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000276-VMM-000980</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000277-VMM-000990</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000303-VMM-001090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000304-VMM-001100</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000476-VMM-001960</xccdf-1.2:reference>
              <xccdf-1.2:rationale>In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_usergroup_modification_group"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/group" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/group $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/group$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/group -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/group" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/group" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/group $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/group$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/group -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_usergroup_modification_group" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit group tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_group
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_group.matched is defined and find_group.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_group.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_group.matched is defined and find_group.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the group rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/group -p wa -k audit_rules_usergroup_modification
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the group rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/group -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_usergroup_modification_group:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_usergroup_modification_group_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow" severity="medium">
              <xccdf-1.2:title>Record Events that Modify User/Group Information - /etc/gshadow</xccdf-1.2:title>
              <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, in order to capture events that modify
account changes:
<html:br/><html:br/>
<html:pre>-w /etc/gshadow -p wa -k audit_rules_usergroup_modification</html:pre>
<html:br/><html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file, in order to capture events that modify
account changes:
<html:br/><html:br/>
<html:pre>-w /etc/gshadow -p wa -k audit_rules_usergroup_modification</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001404</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001683</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001684</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001685</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001686</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002132</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000004-VMM-000040</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000239-VMM-000810</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000240-VMM-000820</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000241-VMM-000830</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000274-VMM-000960</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000275-VMM-000970</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000276-VMM-000980</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000277-VMM-000990</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000303-VMM-001090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000304-VMM-001100</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000476-VMM-001960</xccdf-1.2:reference>
              <xccdf-1.2:rationale>In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_usergroup_modification_gshadow"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/gshadow" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/gshadow $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/gshadow$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/gshadow -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/gshadow" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/gshadow" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/gshadow $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/gshadow$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/gshadow -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_usergroup_modification_gshadow" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit gshadow tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_gshadow
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_gshadow.matched is defined and find_gshadow.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_gshadow.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_gshadow.matched is defined and find_gshadow.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the gshadow rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the gshadow rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_usergroup_modification_gshadow:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_usergroup_modification_gshadow_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd" severity="medium">
              <xccdf-1.2:title>Record Events that Modify User/Group Information - /etc/security/opasswd</xccdf-1.2:title>
              <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, in order to capture events that modify
account changes:
<html:br/><html:br/>
<html:pre>-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification</html:pre>
<html:br/><html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file, in order to capture events that modify
account changes:
<html:br/><html:br/>
<html:pre>-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001404</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001683</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001684</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001685</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001686</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002132</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000004-VMM-000040</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000239-VMM-000810</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000240-VMM-000820</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000241-VMM-000830</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000274-VMM-000960</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000275-VMM-000970</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000276-VMM-000980</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000277-VMM-000990</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000303-VMM-001090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000304-VMM-001100</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000476-VMM-001960</xccdf-1.2:reference>
              <xccdf-1.2:rationale>In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_usergroup_modification_opasswd"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/security/opasswd" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/security/opasswd $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/security/opasswd$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/security/opasswd" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/security/opasswd" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/security/opasswd $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/security/opasswd$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_usergroup_modification_opasswd" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit opasswd tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_opasswd
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_opasswd.matched is defined and find_opasswd.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_opasswd.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_opasswd.matched is defined and find_opasswd.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the opasswd rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the opasswd rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_usergroup_modification_opasswd:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_usergroup_modification_opasswd_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd" severity="medium">
              <xccdf-1.2:title>Record Events that Modify User/Group Information - /etc/passwd</xccdf-1.2:title>
              <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, in order to capture events that modify
account changes:
<html:br/><html:br/>
<html:pre>-w /etc/passwd -p wa -k audit_rules_usergroup_modification</html:pre>
<html:br/><html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file, in order to capture events that modify
account changes:
<html:br/><html:br/>
<html:pre>-w /etc/passwd -p wa -k audit_rules_usergroup_modification</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001404</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001683</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001684</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001685</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001686</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002132</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000274-GPOS-00104</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000275-GPOS-00105</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000276-GPOS-00106</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000277-GPOS-00107</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000004-VMM-000040</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000239-VMM-000810</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000240-VMM-000820</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000241-VMM-000830</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000274-VMM-000960</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000275-VMM-000970</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000276-VMM-000980</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000277-VMM-000990</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000303-VMM-001090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000304-VMM-001100</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000476-VMM-001960</xccdf-1.2:reference>
              <xccdf-1.2:rationale>In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_usergroup_modification_passwd"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/passwd" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/passwd $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/passwd$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/passwd -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/passwd" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/passwd" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/passwd $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/passwd$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/passwd -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_usergroup_modification_passwd" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit passwd tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_passwd
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_passwd.matched is defined and find_passwd.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_passwd.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_passwd.matched is defined and find_passwd.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the passwd rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/passwd -p wa -k audit_rules_usergroup_modification
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the passwd rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/passwd -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_usergroup_modification_passwd:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_usergroup_modification_passwd_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow" severity="medium">
              <xccdf-1.2:title>Record Events that Modify User/Group Information - /etc/shadow</xccdf-1.2:title>
              <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, in order to capture events that modify
account changes:
<html:br/><html:br/>
<html:pre>-w /etc/shadow -p wa -k audit_rules_usergroup_modification</html:pre>
<html:br/><html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file, in order to capture events that modify
account changes:
<html:br/><html:br/>
<html:pre>-w /etc/shadow -p wa -k audit_rules_usergroup_modification</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001404</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001683</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001684</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001685</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001686</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002132</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000004-VMM-000040</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000239-VMM-000810</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000240-VMM-000820</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000241-VMM-000830</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000274-VMM-000960</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000275-VMM-000970</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000276-VMM-000980</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000277-VMM-000990</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000303-VMM-001090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000304-VMM-001100</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000476-VMM-001960</xccdf-1.2:reference>
              <xccdf-1.2:rationale>In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_usergroup_modification_shadow"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/shadow" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/shadow $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/shadow$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/shadow -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/shadow" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/shadow" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/shadow $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/shadow$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/shadow -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_usergroup_modification_shadow" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit shadow tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_shadow
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_shadow.matched is defined and find_shadow.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_shadow.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_shadow.matched is defined and find_shadow.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the shadow rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/shadow -p wa -k audit_rules_usergroup_modification
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the shadow rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/shadow -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_usergroup_modification_shadow:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_usergroup_modification_shadow_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_directory_access_var_log_audit" severity="medium">
              <xccdf-1.2:title>Record Access Events to Audit Log Directory</xccdf-1.2:title>
              <xccdf-1.2:description>The audit system should collect access events to read audit log directory.
The following audit rule will assure that access to audit log directory are
collected.
<html:pre>-a always,exit -F dir=/var/log/audit/ -F perm=r -F auid&gt;=1000 -F auid!=unset -F key=access-audit-trail</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rule to a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>.
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the rule to
<html:code>/etc/audit/audit.rules</html:code> file.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Attempts to read the logs should be recorded, suspicious access to audit log files could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.'</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="directory_access_var_log_audit"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F dir=/var/log/audit/ -F perm=r"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="access-audit-trail"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="directory_access_var_log_audit" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - directory_access_var_log_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /var/log/audit
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F dir=/var/log/audit/ -F perm=r -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access-audit-trail.rules
      set_fact: audit_file="/etc/audit/rules.d/access-audit-trail.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F dir=/var/log/audit/ -F perm=r
          -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F dir=/var/log/audit/ -F perm=r
          -F auid&gt;=1000 -F auid!=unset -F key=access-audit-trail
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F dir=/var/log/audit/ -F perm=r -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F dir=/var/log/audit/ -F perm=r -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F dir=/var/log/audit/ -F perm=r
          -F auid&gt;=1000 -F auid!=unset -F key=access-audit-trail
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - directory_access_var_log_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-directory_access_var_log_audit:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-directory_access_var_log_audit_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_directory_permissions_var_log_audit" severity="medium">
              <xccdf-1.2:title>System Audit Logs Must Have Mode 0750 or Less Permissive</xccdf-1.2:title>
              <xccdf-1.2:description>If <html:code>log_group</html:code> in <html:code>/etc/audit/auditd.conf</html:code> is set to a group other than the <html:code>root</html:code>
group account, change the mode of the audit log files with the following command:
<html:pre>$ sudo chmod 0750 /var/log/audit</html:pre>
<html:br/>
Otherwise, change the mode of the audit log files with the following command:
<html:pre>$ sudo chmod 0700 /var/log/audit</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000162</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000164</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000057-GPOS-00027</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000058-GPOS-00028</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000059-GPOS-00029</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If users can write to audit logs, audit trails can be modified or destroyed.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-directory_permissions_var_log_audit:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-directory_permissions_var_log_audit_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupownership_audit_configuration" severity="medium">
              <xccdf-1.2:title>Audit Configuration Files Must Be Owned By Group root</xccdf-1.2:title>
              <xccdf-1.2:description>All audit configuration files must be owned by group root.
<html:pre>chown :root /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000171</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000063-GPOS-00032</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Without the capability to restrict which roles and individuals can
select which events are audited, unauthorized personnel may be able
to prevent the auditing of critical events.
Misconfigured audits may degrade the system's performance by
overwhelming the audit log. Misconfigured audits may also make it more
difficult to establish, correlate, and investigate the events relating
to an incident or identify those responsible for one.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupownership_audit_configuration" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

find /etc/audit/ -maxdepth 1 -type f ! -gid 0 -regex '^audit(\.rules|d\.conf)$' -exec chgrp 0 {} \;


find /etc/audit/rules.d/ -maxdepth 1 -type f ! -gid 0 -regex '^.*\.rules$' -exec chgrp 0 {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupownership_audit_configuration" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - configure_strategy
    - file_groupownership_audit_configuration
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Find /etc/audit/ file(s) matching ^audit(\.rules|d\.conf)$
  command: find -H /etc/audit/ -maxdepth 1 -type f ! -gid 0 -regex "^audit(\.rules|d\.conf)$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: '"audit" in ansible_facts.packages'
  tags:
    - configure_strategy
    - file_groupownership_audit_configuration
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner on /etc/audit/ file(s) matching ^audit(\.rules|d\.conf)$
  file:
    path: '{{ item }}'
    group: '0'
    state: file
  with_items:
    - '{{ files_found.stdout_lines }}'
  when: '"audit" in ansible_facts.packages'
  tags:
    - configure_strategy
    - file_groupownership_audit_configuration
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Find /etc/audit/rules.d/ file(s) matching ^.*\.rules$
  command: find -H /etc/audit/rules.d/ -maxdepth 1 -type f ! -gid 0 -regex "^.*\.rules$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: '"audit" in ansible_facts.packages'
  tags:
    - configure_strategy
    - file_groupownership_audit_configuration
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner on /etc/audit/rules.d/ file(s) matching ^.*\.rules$
  file:
    path: '{{ item }}'
    group: '0'
    state: file
  with_items:
    - '{{ files_found.stdout_lines }}'
  when: '"audit" in ansible_facts.packages'
  tags:
    - configure_strategy
    - file_groupownership_audit_configuration
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_groupownership_audit_configuration:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_groupownership_audit_configuration_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_ownership_audit_configuration" severity="medium">
              <xccdf-1.2:title>Audit Configuration Files Must Be Owned By Root</xccdf-1.2:title>
              <xccdf-1.2:description>All audit configuration files must be owned by root user.

To properly set the owner of <html:code>/etc/audit/</html:code>, run the command:
<html:pre>$ sudo chown root /etc/audit/ </html:pre>

To properly set the owner of <html:code>/etc/audit/rules.d/</html:code>, run the command:
<html:pre>$ sudo chown root /etc/audit/rules.d/ </html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000171</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000063-GPOS-00032</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Without the capability to restrict which roles and individuals can
select which events are audited, unauthorized personnel may be able
to prevent the auditing of critical events.
Misconfigured audits may degrade the system's performance by
overwhelming the audit log. Misconfigured audits may also make it more
difficult to establish, correlate, and investigate the events relating
to an incident or identify those responsible for one.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_ownership_audit_configuration" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

find /etc/audit/ -maxdepth 1 -type f ! -uid 0 -regex '^audit(\.rules|d\.conf)$' -exec chown 0 {} \;

find /etc/audit/rules.d/ -maxdepth 1 -type f ! -uid 0 -regex '^.*\.rules$' -exec chown 0 {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_ownership_audit_configuration" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - configure_strategy
    - file_ownership_audit_configuration
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Find /etc/audit/ file(s) matching ^audit(\.rules|d\.conf)$
  command: find -H /etc/audit/ -maxdepth 1 -type f ! -uid 0 -regex "^audit(\.rules|d\.conf)$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: '"audit" in ansible_facts.packages'
  tags:
    - configure_strategy
    - file_ownership_audit_configuration
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner on /etc/audit/ file(s) matching ^audit(\.rules|d\.conf)$
  file:
    path: '{{ item }}'
    owner: '0'
    state: file
  with_items:
    - '{{ files_found.stdout_lines }}'
  when: '"audit" in ansible_facts.packages'
  tags:
    - configure_strategy
    - file_ownership_audit_configuration
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Find /etc/audit/rules.d/ file(s) matching ^.*\.rules$
  command: find -H /etc/audit/rules.d/ -maxdepth 1 -type f ! -uid 0 -regex "^.*\.rules$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: '"audit" in ansible_facts.packages'
  tags:
    - configure_strategy
    - file_ownership_audit_configuration
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner on /etc/audit/rules.d/ file(s) matching ^.*\.rules$
  file:
    path: '{{ item }}'
    owner: '0'
    state: file
  with_items:
    - '{{ files_found.stdout_lines }}'
  when: '"audit" in ansible_facts.packages'
  tags:
    - configure_strategy
    - file_ownership_audit_configuration
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_ownership_audit_configuration:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_ownership_audit_configuration_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit" severity="medium">
              <xccdf-1.2:title>System Audit Logs Must Be Owned By Root</xccdf-1.2:title>
              <xccdf-1.2:description>All audit logs must be owned by root user and group. By default, the path for audit log is <html:pre>/var/log/audit/</html:pre>.

To properly set the owner of <html:code>/var/log/audit</html:code>, run the command:
<html:pre>$ sudo chown root /var/log/audit </html:pre>

To properly set the owner of <html:code>/var/log/audit/*</html:code>, run the command:
<html:pre>$ sudo chown root /var/log/audit/* </html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000162</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000163</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000164</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000057-GPOS-00027</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000058-GPOS-00028</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000059-GPOS-00029</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Unauthorized disclosure of audit records can reveal system and configuration data to
attackers, thus compromising its confidentiality.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_ownership_var_log_audit"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

if LC_ALL=C grep -m 1 -q ^log_group /etc/audit/auditd.conf; then
  GROUP=$(awk -F "=" '/log_group/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
  if ! [ "${GROUP}" == 'root' ] ; then
    chown root.${GROUP} /var/log/audit
    chown root.${GROUP} /var/log/audit/audit.log*
  else
    chown root.root /var/log/audit
    chown root.root /var/log/audit/audit.log*
  fi
else
  chown root.root /var/log/audit
  chown root.root /var/log/audit/audit.log*
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_ownership_var_log_audit:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_ownership_var_log_audit_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_var_log_audit" severity="medium">
              <xccdf-1.2:title>System Audit Logs Must Have Mode 0640 or Less Permissive</xccdf-1.2:title>
              <xccdf-1.2:description>If <html:code>log_group</html:code> in <html:code>/etc/audit/auditd.conf</html:code> is set to a group other than the <html:code>root</html:code>
group account, change the mode of the audit log files with the following command:
<html:pre>$ sudo chmod 0640 <html:i>audit_file</html:i></html:pre>
<html:br/>
Otherwise, change the mode of the audit log files with the following command:
<html:pre>$ sudo chmod 0600 <html:i>audit_file</html:i></html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000162</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000163</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000164</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000057-GPOS-00027</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000058-GPOS-00028</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000059-GPOS-00029</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If users can write to audit logs, audit trails can be modified or destroyed.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_var_log_audit"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

if LC_ALL=C grep -iw log_file /etc/audit/auditd.conf; then
    FILE=$(awk -F "=" '/^log_file/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
else
    FILE="/var/log/audit/audit.log"
fi

if LC_ALL=C grep -m 1 -q ^log_group /etc/audit/auditd.conf; then
  GROUP=$(awk -F "=" '/log_group/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
  if ! [ "${GROUP}" == 'root' ] ; then
    chmod 0640 $FILE
    chmod 0440 $FILE.*
  else
    chmod 0600 $FILE
    chmod 0400 $FILE.*
  fi
else
  chmod 0600 $FILE
  chmod 0400 $FILE.*
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_var_log_audit:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_var_log_audit_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_dac_actions">
              <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root. Note that the "-F arch=b32" lines should be
present even on a 64 bit system. These commands identify system calls for
auditing. Even if the system is 64 bit it can still execute 32 bit system
calls. Additionally, these rules can be configured in a number of ways while
still achieving the desired effect. An example of this is that the "-S" calls
could be split up and placed on separate lines, however, this is less efficient.
Add the following to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If your system is 64 bit then these lines should be duplicated and the
arch=b32 replaced with arch=b64 as follows:
<html:pre>-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod" severity="medium">
                <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - chmod</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured to
use the <html:code>augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code>.rules</html:code> in
the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.  Here the system calls
have been placed independent of other system calls.  Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_chmod"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="chmod"
	KEY="perm_mod"
	SYSCALL_GROUPING="chmod fchmod fchmodat"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_chmod" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit chmod tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for chmod for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of chmod in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of chmod in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for chmod for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of chmod in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of chmod in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_dac_modification_chmod:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_chmod_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown" severity="medium">
                <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - chown</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured to
use the <html:code>augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code>.rules</html:code> in
the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.  Here the system calls
have been placed independent of other system calls.  Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_chown"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="chown"
	KEY="perm_mod"
	SYSCALL_GROUPING="chown fchown fchownat lchown"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_chown" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit chown tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for chown for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of chown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of chown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for chown for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of chown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of chown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_dac_modification_chown:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_chown_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod" severity="medium">
                <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - fchmod</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured to
use the <html:code>augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code>.rules</html:code> in
the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_fchmod"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="fchmod"
	KEY="perm_mod"
	SYSCALL_GROUPING="chmod fchmod fchmodat"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_fchmod" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit fchmod tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchmod for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of fchmod in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of fchmod in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchmod for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of fchmod in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of fchmod in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_dac_modification_fchmod:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_fchmod_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat" severity="medium">
                <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - fchmodat</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured to
use the <html:code>augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code>.rules</html:code> in
the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_fchmodat"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="fchmodat"
	KEY="perm_mod"
	SYSCALL_GROUPING="chmod fchmod fchmodat"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_fchmodat" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit fchmodat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchmodat for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmodat
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of fchmodat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmodat
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of fchmodat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchmodat for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmodat
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of fchmodat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmodat
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of fchmodat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_dac_modification_fchmodat:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_fchmodat_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown" severity="medium">
                <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - fchown</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>

If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>

If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_fchown"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="fchown"
	KEY="perm_mod"
	SYSCALL_GROUPING="chown fchown fchownat lchown"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_fchown" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit fchown tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchown for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchown for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_dac_modification_fchown:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_fchown_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat" severity="medium">
                <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - fchownat</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_fchownat"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="fchownat"
	KEY="perm_mod"
	SYSCALL_GROUPING="chown fchown fchownat lchown"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_fchownat" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit fchownat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchownat for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchownat
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchownat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchownat
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchownat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchownat for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchownat
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchownat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchownat
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchownat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_dac_modification_fchownat:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_fchownat_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr" severity="medium">
                <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - fremovexattr</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root.
<html:br/><html:br/>
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br/><html:br/>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br/><html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br/><html:br/>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_fremovexattr"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="fremovexattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_fremovexattr" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit fremovexattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fremovexattr for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fremovexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fremovexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fremovexattr for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fremovexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fremovexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_dac_modification_fremovexattr:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_fremovexattr_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr" severity="medium">
                <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - fsetxattr</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_fsetxattr"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="fsetxattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_fsetxattr" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit fsetxattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fsetxattr for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fsetxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fsetxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fsetxattr for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fsetxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fsetxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_dac_modification_fsetxattr:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_fsetxattr_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown" severity="medium">
                <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - lchown</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_lchown"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="lchown"
	KEY="perm_mod"
	SYSCALL_GROUPING="chown fchown fchownat lchown"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_lchown" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit lchown tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lchown for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of lchown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of lchown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lchown for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of lchown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of lchown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_dac_modification_lchown:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_lchown_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr" severity="medium">
                <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - lremovexattr</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root.
<html:br/><html:br/>
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S lremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br/><html:br/>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S lremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br/><html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S lremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br/><html:br/>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S lremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_lremovexattr"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="lremovexattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_lremovexattr" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit lremovexattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lremovexattr for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lremovexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lremovexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lremovexattr for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lremovexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lremovexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_dac_modification_lremovexattr:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_lremovexattr_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr" severity="medium">
                <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - lsetxattr</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_lsetxattr"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="lsetxattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_lsetxattr" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit lsetxattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lsetxattr for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lsetxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lsetxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lsetxattr for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lsetxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lsetxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_dac_modification_lsetxattr:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_lsetxattr_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr" severity="medium">
                <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - removexattr</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root.
<html:br/><html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
following line to a file with suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S removexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br/><html:br/>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S removexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br/><html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S removexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br/><html:br/>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S removexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_removexattr"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="removexattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_removexattr" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit removexattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for removexattr for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - removexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of removexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - removexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of removexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for removexattr for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - removexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of removexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - removexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of removexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_dac_modification_removexattr:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_removexattr_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr" severity="medium">
                <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - setxattr</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_setxattr"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="setxattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_setxattr" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit setxattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for setxattr for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - setxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of setxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - setxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of setxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for setxattr for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - setxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of setxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - setxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of setxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_dac_modification_setxattr:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_setxattr_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_umount" severity="medium">
                <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - umount</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file system umount
changes. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S umount -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S umount -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_umount"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit -F arch=b32"
OTHER_FILTERS=""
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="umount"
KEY="perm_mod"
SYSCALL_GROUPING=""

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_umount" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - audit_rules_dac_modification_umount
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for umount for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - umount
        syscall_grouping: []

    - name: Check existence of umount in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - umount
        syscall_grouping: []

    - name: Check existence of umount in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - audit_rules_dac_modification_umount
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_dac_modification_umount:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_umount_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_umount2" severity="medium">
                <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - umount2</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file system umount2
changes. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S umount2 -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S umount2 -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S umount2 -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S umount2 -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_umount2"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="umount2"
	KEY="perm_mod"
	SYSCALL_GROUPING=""

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_umount2" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - audit_rules_dac_modification_umount2
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit umount2 tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - audit_rules_dac_modification_umount2
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for umount2 for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - umount2
        syscall_grouping: []

    - name: Check existence of umount2 in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - umount2
        syscall_grouping: []

    - name: Check existence of umount2 in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - audit_rules_dac_modification_umount2
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for umount2 for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - umount2
        syscall_grouping: []

    - name: Check existence of umount2 in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - umount2
        syscall_grouping: []

    - name: Check existence of umount2 in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - audit_rules_dac_modification_umount2
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_dac_modification_umount2:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_umount2_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_execution_acl_commands">
              <xccdf-1.2:title>Record Execution Attempts to Run ACL Privileged Commands</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
ACL privileged commands for all users and root.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#audit"/>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_execution_selinux_commands">
              <xccdf-1.2:title>Record Execution Attempts to Run SELinux Privileged Commands</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
SELinux privileged commands for all users and root.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_execution_chcon" severity="medium">
                <xccdf-1.2:title>Record Any Attempts to Run chcon</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect any execution attempt
of the <html:code>chcon</html:code> command for all users and root. If the <html:code>auditd</html:code>
daemon is configured to use the <html:code>augenrules</html:code> program to read audit rules
during daemon startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000463-VMM-001850</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_execution_chcon"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/chcon -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_execution_chcon" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_chcon
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/chcon
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/chcon -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chcon -F perm=x
          -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chcon -F perm=x
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/chcon -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chcon -F perm=x -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chcon -F perm=x
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_chcon
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_execution_chcon:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_execution_chcon_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_execution_restorecon" severity="medium">
                <xccdf-1.2:title>Record Any Attempts to Run restorecon</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect any execution attempt
of the <html:code>restorecon</html:code> command for all users and root. If the <html:code>auditd</html:code>
daemon is configured to use the <html:code>augenrules</html:code> program to read audit rules
during daemon startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/restorecon -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F path=/usr/sbin/restorecon -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000463-VMM-001850</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_execution_restorecon"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/restorecon -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_execution_restorecon" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_restorecon
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /usr/sbin/restorecon
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/restorecon -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/restorecon -F perm=x
          -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/restorecon
          -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/restorecon -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/restorecon -F perm=x -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/restorecon
          -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_restorecon
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_execution_restorecon:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_execution_restorecon_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_execution_semanage" severity="medium">
                <xccdf-1.2:title>Record Any Attempts to Run semanage</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect any execution attempt
of the <html:code>semanage</html:code> command for all users and root. If the <html:code>auditd</html:code>
daemon is configured to use the <html:code>augenrules</html:code> program to read audit rules
during daemon startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000463-VMM-001850</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_execution_semanage"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/semanage -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_execution_semanage" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_semanage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /usr/sbin/semanage
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/semanage -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/semanage -F perm=x
          -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/semanage
          -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/semanage -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/semanage -F perm=x -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/semanage
          -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_semanage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_execution_semanage:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_execution_semanage_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_execution_setsebool" severity="medium">
                <xccdf-1.2:title>Record Any Attempts to Run setsebool</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect any execution attempt
of the <html:code>setsebool</html:code> command for all users and root. If the <html:code>auditd</html:code>
daemon is configured to use the <html:code>augenrules</html:code> program to read audit rules
during daemon startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000463-VMM-001850</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_execution_setsebool"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/setsebool -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_execution_setsebool" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_setsebool
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /usr/sbin/setsebool
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/setsebool -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/setsebool -F perm=x
          -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/setsebool
          -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/setsebool -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/setsebool -F perm=x -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/setsebool
          -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_setsebool
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_execution_setsebool:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_execution_setsebool_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_execution_seunshare" severity="medium">
                <xccdf-1.2:title>Record Any Attempts to Run seunshare</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect any execution attempt
of the <html:code>seunshare</html:code> command for all users and root. If the <html:code>auditd</html:code>
daemon is configured to use the <html:code>augenrules</html:code> program to read audit rules
during daemon startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000463-VMM-001850</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_execution_seunshare"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/seunshare -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_execution_seunshare" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_seunshare
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /usr/sbin/seunshare
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/seunshare -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/seunshare -F perm=x
          -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/seunshare
          -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/seunshare -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/seunshare -F perm=x -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/seunshare
          -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_seunshare
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_execution_seunshare:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_execution_seunshare_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_file_deletion_events">
              <xccdf-1.2:title>Record File Deletion Events by User</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename,renameat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename,renameat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre></xccdf-1.2:description>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects File Deletion Events by User</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum the audit system should collect file deletion events
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename,renameat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename -S renameat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">This rule checks for multiple syscalls related to file deletion;
it was written with DISA STIG in mind. Other policies should use a
separate rule for each syscall that needs to be checked. For example:
<html:ul><html:li><html:code>audit_rules_file_deletion_events_rmdir</html:code></html:li><html:li><html:code>audit_rules_file_deletion_events_unlink</html:code></html:li><html:li><html:code>audit_rules_file_deletion_events_unlinkat</html:code></html:li></html:ul></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_file_deletion_events:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_file_deletion_events_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects File Deletion Events by User - rename</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S rename -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S rename -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000467-GPOS-00211</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000466-VMM-001870</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000468-VMM-001890</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_file_deletion_events_rename"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="rename"
	KEY="delete"
	SYSCALL_GROUPING="unlink unlinkat rename renameat rmdir"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_file_deletion_events_rename" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit rename tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for rename for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rename
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of rename in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rename
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of rename in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for rename for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rename
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of rename in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rename
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of rename in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_file_deletion_events_rename:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_file_deletion_events_rename_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_renameat" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects File Deletion Events by User - renameat</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S renameat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S renameat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000467-GPOS-00211</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000466-VMM-001870</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000468-VMM-001890</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_file_deletion_events_renameat"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="renameat"
	KEY="delete"
	SYSCALL_GROUPING="unlink unlinkat rename renameat rmdir"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_file_deletion_events_renameat" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit renameat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for renameat for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - renameat
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of renameat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - renameat
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of renameat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for renameat for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - renameat
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of renameat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - renameat
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of renameat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_file_deletion_events_renameat:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_file_deletion_events_renameat_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rmdir" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects File Deletion Events by User - rmdir</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S rmdir -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S rmdir -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000467-GPOS-00211</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000466-VMM-001870</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000468-VMM-001890</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_file_deletion_events_rmdir"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="rmdir"
	KEY="delete"
	SYSCALL_GROUPING="unlink unlinkat rename renameat rmdir"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_file_deletion_events_rmdir" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rmdir
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit rmdir tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rmdir
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for rmdir for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rmdir
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of rmdir in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rmdir
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of rmdir in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rmdir
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for rmdir for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rmdir
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of rmdir in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rmdir
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of rmdir in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rmdir
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_file_deletion_events_rmdir:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_file_deletion_events_rmdir_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlink" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects File Deletion Events by User - unlink</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S unlink -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S unlink -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000467-GPOS-00211</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000466-VMM-001870</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000468-VMM-001890</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_file_deletion_events_unlink"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="unlink"
	KEY="delete"
	SYSCALL_GROUPING="unlink unlinkat rename renameat rmdir"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_file_deletion_events_unlink" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit unlink tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for unlink for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlink
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of unlink in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlink
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of unlink in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for unlink for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlink
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of unlink in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlink
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of unlink in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_file_deletion_events_unlink:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_file_deletion_events_unlink_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlinkat" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects File Deletion Events by User - unlinkat</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S unlinkat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S unlinkat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000467-GPOS-00211</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000466-VMM-001870</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000468-VMM-001890</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_file_deletion_events_unlinkat"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="unlinkat"
	KEY="delete"
	SYSCALL_GROUPING="unlink unlinkat rename renameat rmdir"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_file_deletion_events_unlinkat" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit unlinkat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for unlinkat for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlinkat
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of unlinkat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlinkat
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of unlinkat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for unlinkat for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlinkat
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of unlinkat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlinkat
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of unlinkat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_file_deletion_events_unlinkat:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_file_deletion_events_unlinkat_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_file_modification">
              <xccdf-1.2:title>Record Unauthorized Access Attempts Events to Files (unsuccessful)</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect unauthorized file
accesses for all users and root. Note that the "-F arch=b32" lines should be
present even on a 64 bit system. These commands identify system calls for
auditing. Even if the system is 64 bit it can still execute 32 bit system
calls. Additionally, these rules can be configured in a number of ways while
still achieving the desired effect. An example of this is that the "-S" calls
could be split up and placed on separate lines, however, this is less efficient.
Add the following to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If your system is 64 bit then these lines should be duplicated and the
arch=b32 replaced with arch=b64 as follows:
<html:pre>-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre></xccdf-1.2:description>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_chmod" severity="medium">
                <xccdf-1.2:title>Record Successful Permission Changes to Files - chmod</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file permission changes
for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:

<html:pre>-a always,exit -F arch=b32 -S chmod -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S chmod -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S chmod -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S chmod -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>File permission changes could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_chmod_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_chown" severity="medium">
                <xccdf-1.2:title>Record Successful Ownership Changes to Files - chown</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file ownership changes
for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:

<html:pre>-a always,exit -F arch=b32 -S chown -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S chown -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S chown -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S chown -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>File ownership attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_chown_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_creat" severity="medium">
                <xccdf-1.2:title>Record Successful Access Attempts to Files - creat</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:

<html:pre>-a always,exit -F arch=b32 -S creat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S creat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S creat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S creat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>File access attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_creat_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_fchmod" severity="medium">
                <xccdf-1.2:title>Record Successful Permission Changes to Files - fchmod</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file permission changes
for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:

<html:pre>-a always,exit -F arch=b32 -S fchmod -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S fchmod -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S fchmod -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S fchmod -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>File permission changes could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_fchmod_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_fchmodat" severity="medium">
                <xccdf-1.2:title>Record Successful Permission Changes to Files - fchmodat</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file permission changes
for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:

<html:pre>-a always,exit -F arch=b32 -S fchmodat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S fchmodat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S fchmodat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S fchmodat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>File permission changes could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_fchmodat_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_fchown" severity="medium">
                <xccdf-1.2:title>Record Successful Ownership Changes to Files - fchown</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file ownership changes
for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:

<html:pre>-a always,exit -F arch=b32 -S fchown -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S fchown -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S fchown -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S fchown -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>File ownership attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_fchown_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_fchownat" severity="medium">
                <xccdf-1.2:title>Record Successful Ownership Changes to Files - fchownat</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file ownership changes
for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:

<html:pre>-a always,exit -F arch=b32 -S fchownat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S fchownat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S fchownat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S fchownat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>File ownership attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_fchownat_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_fremovexattr" severity="medium">
                <xccdf-1.2:title>Record Successful Permission Changes to Files - fremovexattr</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file permission changes
for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:

<html:pre>-a always,exit -F arch=b32 -S fremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S fremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S fremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S fremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>File permission changes could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_fremovexattr_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_fsetxattr" severity="medium">
                <xccdf-1.2:title>Record Successful Permission Changes to Files - fsetxattr</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file permission changes
for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:

<html:pre>-a always,exit -F arch=b32 -S fsetxattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S fsetxattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S fsetxattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S fsetxattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>File permission changes could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_fsetxattr_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_ftruncate" severity="medium">
                <xccdf-1.2:title>Record Successful Access Attempts to Files - ftruncate</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:

<html:pre>-a always,exit -F arch=b32 -S ftruncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S ftruncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S ftruncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S ftruncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>File access attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_ftruncate_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_lchown" severity="medium">
                <xccdf-1.2:title>Record Successful Ownership Changes to Files - lchown</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file ownership changes
for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:

<html:pre>-a always,exit -F arch=b32 -S lchown -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S lchown -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S lchown -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S lchown -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>File ownership attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_lchown_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_lremovexattr" severity="medium">
                <xccdf-1.2:title>Record Successful Permission Changes to Files - lremovexattr</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file permission changes
for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:

<html:pre>-a always,exit -F arch=b32 -S lremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S lremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S lremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S lremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>File permission changes could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_lremovexattr_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_lsetxattr" severity="medium">
                <xccdf-1.2:title>Record Successful Permission Changes to Files - lsetxattr</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file permission changes
for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:

<html:pre>-a always,exit -F arch=b32 -S lsetxattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S lsetxattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S lsetxattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S lsetxattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>File permission changes could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_lsetxattr_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_open" severity="medium">
                <xccdf-1.2:title>Record Successful Access Attempts to Files - open</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:

<html:pre>-a always,exit -F arch=b32 -S open -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S open -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S open -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S open -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>File access attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_open_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_open_by_handle_at" severity="medium">
                <xccdf-1.2:title>Record Successful Access Attempts to Files - open_by_handle_at</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:

<html:pre>-a always,exit -F arch=b32 -S open_by_handle_at -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S open_by_handle_at -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S open_by_handle_at -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S open_by_handle_at -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>File access attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_open_by_handle_at_o_creat" severity="medium">
                <xccdf-1.2:title>Record Successful Creation Attempts to Files - open_by_handle_at O_CREAT</xccdf-1.2:title>
                <xccdf-1.2:description>The <html:code>open_by_handle_at</html:code> syscall can be used to create new files
when O_CREAT flag is specified.

The following audit rules will assure that successful attempts to create a
file via <html:code>open_by_handle_at</html:code> syscall are collected.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rules below to a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the rules below to
<html:code>/etc/audit/audit.rules</html:code> file.

<html:pre>
-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S open_by_handle_at,open_by_handle_at -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:rationale>Successful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_creat_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write" severity="medium">
                <xccdf-1.2:title>Record Successful Creation Attempts to Files - open_by_handle_at O_TRUNC_WRITE</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect detailed file access records for
all users and root. The <html:code>open_by_handle_at</html:code> syscall can be used to modify
files if called for write operation with the O_TRUNC_WRITE flag.

The following audit rules will assure that successful attempts to create a
file via <html:code>open_by_handle_at</html:code> syscall are collected.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rules below to a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the rules below to
<html:code>/etc/audit/audit.rules</html:code> file.

<html:pre>
-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S open,open_by_handle_at -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:rationale>Successful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_open_o_creat" severity="medium">
                <xccdf-1.2:title>Record Successful Creation Attempts to Files - open O_CREAT</xccdf-1.2:title>
                <xccdf-1.2:description>The <html:code>open</html:code> syscall can be used to create new files
when O_CREAT flag is specified.

The following audit rules will assure that successful attempts to create a
file via <html:code>open</html:code> syscall are collected.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rules below to a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the rules below to
<html:code>/etc/audit/audit.rules</html:code> file.

<html:pre>
-a always,exit -F arch=b32 -S open -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S open -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S open,open -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:rationale>Successful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_open_o_creat_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_open_o_trunc_write" severity="medium">
                <xccdf-1.2:title>Record Successful Creation Attempts to Files - open O_TRUNC_WRITE</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect detailed file access records for
all users and root. The <html:code>open</html:code> syscall can be used to modify
files if called for write operation with the O_TRUNC_WRITE flag.

The following audit rules will assure that successful attempts to create a
file via <html:code>open</html:code> syscall are collected.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rules below to a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the rules below to
<html:code>/etc/audit/audit.rules</html:code> file.

<html:pre>
-a always,exit -F arch=b32 -S open -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S open -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S open,openat -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:rationale>Successful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_open_o_trunc_write_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_openat" severity="medium">
                <xccdf-1.2:title>Record Successful Access Attempts to Files - openat</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:

<html:pre>-a always,exit -F arch=b32 -S openat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S openat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S openat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S openat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>File access attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_openat_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_openat_o_creat" severity="medium">
                <xccdf-1.2:title>Record Successful Creation Attempts to Files - openat O_CREAT</xccdf-1.2:title>
                <xccdf-1.2:description>The <html:code>openat</html:code> syscall can be used to create new files
when O_CREAT flag is specified.

The following audit rules will assure that successful attempts to create a
file via <html:code>openat</html:code> syscall are collected.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rules below to a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the rules below to
<html:code>/etc/audit/audit.rules</html:code> file.

<html:pre>
-a always,exit -F arch=b32 -S openat -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S openat -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:rationale>Successful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_openat_o_creat_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_openat_o_trunc_write" severity="medium">
                <xccdf-1.2:title>Record Successful Creation Attempts to Files - openat O_TRUNC_WRITE</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect detailed file access records for
all users and root. The <html:code>openat</html:code> syscall can be used to modify
files if called for write operation with the O_TRUNC_WRITE flag.

The following audit rules will assure that successful attempts to create a
file via <html:code>openat</html:code> syscall are collected.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rules below to a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the rules below to
<html:code>/etc/audit/audit.rules</html:code> file.

<html:pre>
-a always,exit -F arch=b32 -S openat -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S openat -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S open,openat -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:rationale>Successful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_openat_o_trunc_write_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_removexattr" severity="medium">
                <xccdf-1.2:title>Record Successful Permission Changes to Files - removexattr</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file permission changes
for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:

<html:pre>-a always,exit -F arch=b32 -S removexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S removexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S removexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S removexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>File permission changes could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_removexattr_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_rename" severity="medium">
                <xccdf-1.2:title>Record Successful Delete Attempts to Files - rename</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file
deletion for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:

<html:pre>-a always,exit -F arch=b32 -S rename -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S rename -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S rename -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S rename -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>File deletion attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_rename_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_renameat" severity="medium">
                <xccdf-1.2:title>Record Successful Delete Attempts to Files - renameat</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file
deletion for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:

<html:pre>-a always,exit -F arch=b32 -S renameat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S renameat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S renameat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S renameat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>File deletion attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_renameat_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_setxattr" severity="medium">
                <xccdf-1.2:title>Record Successful Permission Changes to Files - setxattr</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file permission changes
for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:

<html:pre>-a always,exit -F arch=b32 -S setxattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S setxattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S setxattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S setxattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>File deletion attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_setxattr_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_truncate" severity="medium">
                <xccdf-1.2:title>Record Successful Access Attempts to Files - truncate</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:

<html:pre>-a always,exit -F arch=b32 -S truncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S truncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S truncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S truncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>File access attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_truncate_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_unlink" severity="medium">
                <xccdf-1.2:title>Record Successful Delete Attempts to Files - unlink</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file
deletion for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:

<html:pre>-a always,exit -F arch=b32 -S unlink -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S unlink -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S unlink -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S unlink -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>File deletion attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_unlink_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_unlinkat" severity="medium">
                <xccdf-1.2:title>Record Successful Delete Attempts to Files - unlinkat</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect file
deletion for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:

<html:pre>-a always,exit -F arch=b32 -S unlinkat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S unlinkat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S unlinkat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S unlinkat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>File deletion attempts could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_successful_file_modification_unlinkat_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">This rule checks for multiple syscalls related to unsuccessful file modification;
it was written with DISA STIG in mind. Other policies should use a
separate rule for each syscall that needs to be checked. For example:
<html:ul><html:li><html:code>audit_rules_unsuccessful_file_modification_open</html:code></html:li><html:li><html:code>audit_rules_unsuccessful_file_modification_ftruncate</html:code></html:li><html:li><html:code>audit_rules_unsuccessful_file_modification_creat</html:code></html:li></html:ul></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0582</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0584</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">05885</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0586</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0846</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0957</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_chmod" severity="medium">
                <xccdf-1.2:title>Record Unsuccessul Permission Changes to Files - chmod</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect unsuccessful file permission change
attempts for all users and root.
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>-a always,exit -F arch=b32 -S chmod -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S chmod -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S chmod -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S chmod -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_chmod"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="chmod"
KEY="access"
SYSCALL_GROUPING="chmod fchmod fchmodat fsetxattr lsetxattr setxattr"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_chmod" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit chmod tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for chmod EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of chmod in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of chmod in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for chmod EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of chmod in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of chmod in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for chmod EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of chmod in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of chmod in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for chmod EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of chmod in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of chmod in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_chmod:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_chmod_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_chown" severity="medium">
                <xccdf-1.2:title>Record Unsuccessul Ownership Changes to Files - chown</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect unsuccessful file ownership change
attempts for all users and root.
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>-a always,exit -F arch=b32 -S chown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S chown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S chown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S chown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to change ownership of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_chown"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="chown"
KEY="access"
SYSCALL_GROUPING="chown fchown fchownat lchown"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_chown" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit chown tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for chown EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of chown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of chown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for chown EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of chown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of chown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for chown EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of chown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of chown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for chown EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of chown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of chown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_chown:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_chown_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_creat" severity="medium">
                <xccdf-1.2:title>Record Unsuccessful Access Attempts to Files - creat</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_creat"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="creat"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_creat" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit creat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for creat EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - creat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of creat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - creat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of creat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for creat EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - creat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of creat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - creat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of creat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for creat EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - creat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of creat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - creat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of creat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for creat EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - creat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of creat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - creat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of creat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_creat:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_creat_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchmod" severity="medium">
                <xccdf-1.2:title>Record Unsuccessul Permission Changes to Files - fchmod</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect unsuccessful file permission change
attempts for all users and root.
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>-a always,exit -F arch=b32 -S fchmod -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S fchmod -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S fchmod -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S fchmod -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_fchmod"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="fchmod"
KEY="access"
SYSCALL_GROUPING="chmod fchmod fchmodat fsetxattr lsetxattr setxattr"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_fchmod" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit fchmod tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchmod EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fchmod in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fchmod in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchmod EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fchmod in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fchmod in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchmod EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fchmod in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fchmod in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchmod EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fchmod in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fchmod in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_fchmod:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmod_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchmodat" severity="medium">
                <xccdf-1.2:title>Record Unsuccessul Permission Changes to Files - fchmodat</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect unsuccessful file permission change
attempts for all users and root.
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>-a always,exit -F arch=b32 -S fchmodat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S fchmodat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S fchmodat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S fchmodat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_fchmodat"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="fchmodat"
KEY="access"
SYSCALL_GROUPING="chmod fchmod fchmodat fsetxattr lsetxattr setxattr"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_fchmodat" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit fchmodat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchmodat EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmodat
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fchmodat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmodat
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fchmodat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchmodat EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmodat
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fchmodat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmodat
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fchmodat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchmodat EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmodat
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fchmodat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmodat
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fchmodat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchmodat EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmodat
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fchmodat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmodat
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fchmodat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_fchmodat:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmodat_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchown" severity="medium">
                <xccdf-1.2:title>Record Unsuccessul Ownership Changes to Files - fchown</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect unsuccessful file ownership change
attempts for all users and root.
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>-a always,exit -F arch=b32 -S fchown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S fchown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S fchown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S fchown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to change ownership of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_fchown"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="fchown"
KEY="access"
SYSCALL_GROUPING="chown fchown fchownat lchown"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_fchown" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit fchown tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchown EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchown EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchown EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchown EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_fchown:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_fchown_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchownat" severity="medium">
                <xccdf-1.2:title>Record Unsuccessul Ownership Changes to Files - fchownat</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect unsuccessful file ownership change
attempts for all users and root.
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>-a always,exit -F arch=b32 -S fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S fchownat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S fchownat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to change ownership of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_fchownat"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="fchownat"
KEY="access"
SYSCALL_GROUPING="chown fchown fchownat lchown"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_fchownat" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit fchownat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchownat EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchownat
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchownat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchownat
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchownat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchownat EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchownat
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchownat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchownat
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchownat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchownat EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchownat
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchownat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchownat
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchownat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchownat EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchownat
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchownat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchownat
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchownat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_fchownat:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_fchownat_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fremovexattr" severity="medium">
                <xccdf-1.2:title>Record Unsuccessul Permission Changes to Files - fremovexattr</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect unsuccessful file permission change
attempts for all users and root.
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>-a always,exit -F arch=b32 -S fremovexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S fremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S fremovexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S fremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_fremovexattr"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="fremovexattr"
KEY="access"
SYSCALL_GROUPING=""

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_fremovexattr" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit fremovexattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fremovexattr EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fremovexattr
        syscall_grouping: []

    - name: Check existence of fremovexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fremovexattr
        syscall_grouping: []

    - name: Check existence of fremovexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fremovexattr EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fremovexattr
        syscall_grouping: []

    - name: Check existence of fremovexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fremovexattr
        syscall_grouping: []

    - name: Check existence of fremovexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fremovexattr EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fremovexattr
        syscall_grouping: []

    - name: Check existence of fremovexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fremovexattr
        syscall_grouping: []

    - name: Check existence of fremovexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fremovexattr EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fremovexattr
        syscall_grouping: []

    - name: Check existence of fremovexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fremovexattr
        syscall_grouping: []

    - name: Check existence of fremovexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_fremovexattr:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_fremovexattr_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fsetxattr" severity="medium">
                <xccdf-1.2:title>Record Unsuccessul Permission Changes to Files - fsetxattr</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect unsuccessful file permission change
attempts for all users and root.
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>-a always,exit -F arch=b32 -S fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S fsetxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S fsetxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_fsetxattr"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="fsetxattr"
KEY="access"
SYSCALL_GROUPING="chmod fchmod fchmodat fsetxattr lsetxattr setxattr"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_fsetxattr" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit fsetxattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fsetxattr EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fsetxattr
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fsetxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fsetxattr
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fsetxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fsetxattr EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fsetxattr
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fsetxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fsetxattr
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fsetxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fsetxattr EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fsetxattr
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fsetxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fsetxattr
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fsetxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fsetxattr EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fsetxattr
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fsetxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fsetxattr
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fsetxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_fsetxattr:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_fsetxattr_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_ftruncate" severity="medium">
                <xccdf-1.2:title>Record Unsuccessful Access Attempts to Files - ftruncate</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S ftruncate -F exiu=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_ftruncate"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="ftruncate"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_ftruncate" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit ftruncate tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for ftruncate EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - ftruncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - ftruncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for ftruncate EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - ftruncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - ftruncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for ftruncate EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - ftruncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - ftruncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for ftruncate EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - ftruncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - ftruncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_ftruncate:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_lchown" severity="medium">
                <xccdf-1.2:title>Record Unsuccessul Ownership Changes to Files - lchown</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect unsuccessful file ownership change
attempts for all users and root.

If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file.

<html:pre>-a always,exit -F arch=b32 -S lchown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S lchown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S lchown -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S lchown -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to change ownership of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_lchown"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="lchown"
KEY="access"
SYSCALL_GROUPING="chown fchown fchownat lchown"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_lchown" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit lchown tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lchown EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of lchown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of lchown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lchown EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of lchown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of lchown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lchown EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of lchown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of lchown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lchown EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of lchown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of lchown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_lchown:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_lchown_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_lremovexattr" severity="medium">
                <xccdf-1.2:title>Record Unsuccessul Permission Changes to Files - lremovexattr</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect unsuccessful file permission change
attempts for all users and root.
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>-a always,exit -F arch=b32 -S lremovexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S lremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S lremovexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S lremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_lremovexattr"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="lremovexattr"
KEY="access"
SYSCALL_GROUPING=""

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_lremovexattr" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit lremovexattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lremovexattr EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lremovexattr
        syscall_grouping: []

    - name: Check existence of lremovexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lremovexattr
        syscall_grouping: []

    - name: Check existence of lremovexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lremovexattr EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lremovexattr
        syscall_grouping: []

    - name: Check existence of lremovexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lremovexattr
        syscall_grouping: []

    - name: Check existence of lremovexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lremovexattr EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lremovexattr
        syscall_grouping: []

    - name: Check existence of lremovexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lremovexattr
        syscall_grouping: []

    - name: Check existence of lremovexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lremovexattr EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lremovexattr
        syscall_grouping: []

    - name: Check existence of lremovexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lremovexattr
        syscall_grouping: []

    - name: Check existence of lremovexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_lremovexattr:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_lremovexattr_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_lsetxattr" severity="medium">
                <xccdf-1.2:title>Record Unsuccessul Permission Changes to Files - lsetxattr</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect unsuccessful file permission change
attempts for all users and root.
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>-a always,exit -F arch=b32 -S lsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S lsetxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S lsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S lsetxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_lsetxattr"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="lsetxattr"
KEY="access"
SYSCALL_GROUPING="chmod fchmod fchmodat fsetxattr lsetxattr setxattr"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_lsetxattr" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit lsetxattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lsetxattr EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lsetxattr
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lsetxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lsetxattr
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lsetxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lsetxattr EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lsetxattr
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lsetxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lsetxattr
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lsetxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lsetxattr EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lsetxattr
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lsetxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lsetxattr
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lsetxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lsetxattr EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lsetxattr
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lsetxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lsetxattr
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lsetxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_lsetxattr:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_lsetxattr_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open" severity="medium">
                <xccdf-1.2:title>Record Unsuccessful Access Attempts to Files - open</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_open"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="open"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_open" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit open tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_open:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_open_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at" severity="medium">
                <xccdf-1.2:title>Record Unsuccessful Access Attempts to Files - open_by_handle_at</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_open_by_handle_at"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="open_by_handle_at"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_open_by_handle_at" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit open_by_handle_at tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open_by_handle_at EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open_by_handle_at in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open_by_handle_at in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open_by_handle_at EACCES for x86_64
    platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open_by_handle_at in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open_by_handle_at in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open_by_handle_at EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open_by_handle_at in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open_by_handle_at in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open_by_handle_at EPERM for x86_64
    platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open_by_handle_at in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open_by_handle_at in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat" severity="medium">
                <xccdf-1.2:title>Record Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect unauthorized file accesses for
all users and root. The <html:code>open_by_handle_at</html:code> syscall can be used to create new files
when O_CREAT flag is specified.

The following auidt rules will asure that unsuccessful attempts to create a
file via <html:code>open_by_handle_at</html:code> syscall are collected.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rules below to a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the rules below to
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>
-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add unsuccessful file operations audit rules
  blockinfile:
    path: /etc/audit/rules.d/30-ospp-v42-remediation.rules
    create: true
    block: |-
      ## This content is a section of an Audit config snapshot recommended for Fedora systems that target OSPP compliance.
      ## The following content has been retreived on 2019-03-11 from: https://github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules

      ## The purpose of these rules is to meet the requirements for Operating
      ## System Protection Profile (OSPP)v4.2. These rules depends on having
      ## 10-base-config.rules, 11-loginuid.rules, and 43-module-load.rules installed.

      ## Unsuccessful file creation (open with O_CREAT)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create

      ## Unsuccessful file modifications (open for write or truncate)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification

      ## Unsuccessful file access (any other opens) This has to go last.
      -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write" severity="medium">
                <xccdf-1.2:title>Record Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect detailed unauthorized file accesses for
all users and root. The <html:code>open_by_handle_at</html:code> syscall can be used to modify files
if called for write operation of with O_TRUNC_WRITE flag.

The following auidt rules will asure that unsuccessful attempts to modify a
file via <html:code>open_by_handle_at</html:code> syscall are collected.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rules below to a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the rules below to
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>
-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add unsuccessful file operations audit rules
  blockinfile:
    path: /etc/audit/rules.d/30-ospp-v42-remediation.rules
    create: true
    block: |-
      ## This content is a section of an Audit config snapshot recommended for Fedora systems that target OSPP compliance.
      ## The following content has been retreived on 2019-03-11 from: https://github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules

      ## The purpose of these rules is to meet the requirements for Operating
      ## System Protection Profile (OSPP)v4.2. These rules depends on having
      ## 10-base-config.rules, 11-loginuid.rules, and 43-module-load.rules installed.

      ## Unsuccessful file creation (open with O_CREAT)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create

      ## Unsuccessful file modifications (open for write or truncate)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification

      ## Unsuccessful file access (any other opens) This has to go last.
      -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order" severity="medium">
                <xccdf-1.2:title>Ensure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect detailed unauthorized file
accesses for all users and root.
To correctly identify unsuccessful creation, unsuccessful modification and unsuccessful access
of files via <html:code>open_by_handle_at</html:code> syscall the audit rules collecting these events need to be in certain order.
The more specific rules need to come before the less specific rules. The reason for that is that more
specific rules cover a subset of events covered in the less specific rules, thus, they need to come
before to not be overshadowed by less specific rules, which match a bigger set of events.
Make sure that rules for unsuccessful calls of <html:code>open_by_handle_at</html:code> syscall are in the order shown below.
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code>
program to read audit rules during daemon startup (the default), check the order of
rules below in a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>.
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, check the order of rules below in
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>
-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b32 -S open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b64 -S open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The more specific rules cover a subset of events covered by the less specific rules.
By ordering them from more specific to less specific, it is assured that the less specific
rule will not catch events better recorded by the more specific rule.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_o_creat" severity="medium">
                <xccdf-1.2:title>Record Unsuccessful Creation Attempts to Files - open O_CREAT</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect unauthorized file accesses for
all users and root. The <html:code>open</html:code> syscall can be used to create new files
when O_CREAT flag is specified.

The following auidt rules will asure that unsuccessful attempts to create a
file via <html:code>open</html:code> syscall are collected.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rules below to a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the rules below to
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>
-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_open_o_creat" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_o_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add unsuccessful file operations audit rules
  blockinfile:
    path: /etc/audit/rules.d/30-ospp-v42-remediation.rules
    create: true
    block: |-
      ## This content is a section of an Audit config snapshot recommended for Fedora systems that target OSPP compliance.
      ## The following content has been retreived on 2019-03-11 from: https://github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules

      ## The purpose of these rules is to meet the requirements for Operating
      ## System Protection Profile (OSPP)v4.2. These rules depends on having
      ## 10-base-config.rules, 11-loginuid.rules, and 43-module-load.rules installed.

      ## Unsuccessful file creation (open with O_CREAT)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create

      ## Unsuccessful file modifications (open for write or truncate)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification

      ## Unsuccessful file access (any other opens) This has to go last.
      -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_o_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_open_o_creat:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_creat_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_o_trunc_write" severity="medium">
                <xccdf-1.2:title>Record Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect detailed unauthorized file accesses for
all users and root. The <html:code>open</html:code> syscall can be used to modify files
if called for write operation of with O_TRUNC_WRITE flag.
The following auidt rules will asure that unsuccessful attempts to modify a
file via <html:code>open</html:code> syscall are collected.
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rules below to a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>.
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the rules below to
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>
-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_open_o_trunc_write" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_o_trunc_write
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add unsuccessful file operations audit rules
  blockinfile:
    path: /etc/audit/rules.d/30-ospp-v42-remediation.rules
    create: true
    block: |-
      ## This content is a section of an Audit config snapshot recommended for Fedora systems that target OSPP compliance.
      ## The following content has been retreived on 2019-03-11 from: https://github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules

      ## The purpose of these rules is to meet the requirements for Operating
      ## System Protection Profile (OSPP)v4.2. These rules depends on having
      ## 10-base-config.rules, 11-loginuid.rules, and 43-module-load.rules installed.

      ## Unsuccessful file creation (open with O_CREAT)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create

      ## Unsuccessful file modifications (open for write or truncate)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification

      ## Unsuccessful file access (any other opens) This has to go last.
      -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_o_trunc_write
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_rule_order" severity="medium">
                <xccdf-1.2:title>Ensure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect detailed unauthorized file
accesses for all users and root.
To correctly identify unsuccessful creation, unsuccessful modification and unsuccessful access
of files via <html:code>open</html:code> syscall the audit rules collecting these events need to be in certain order.
The more specific rules need to come before the less specific rules. The reason for that is that more
specific rules cover a subset of events covered in the less specific rules, thus, they need to come
before to not be overshadowed by less specific rules, which match a bigger set of events.
Make sure that rules for unsuccessful calls of <html:code>open</html:code> syscall are in the order shown below.
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code>
program to read audit rules during daemon startup (the default), check the order of
rules below in a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>.
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, check the order of rules below in
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>
-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The more specific rules cover a subset of events covered by the less specific rules.
By ordering them from more specific to less specific, it is assured that the less specific
rule will not catch events better recorded by the more specific rule.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_open_rule_order:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_open_rule_order_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat" severity="medium">
                <xccdf-1.2:title>Record Unsuccessful Access Attempts to Files - openat</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_openat"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="openat"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_openat" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit openat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for openat EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of openat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of openat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for openat EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of openat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of openat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for openat EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of openat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of openat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for openat EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of openat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of openat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_openat:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat_o_creat" severity="medium">
                <xccdf-1.2:title>Record Unsuccessful Creation Attempts to Files - openat O_CREAT</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect unauthorized file accesses for
all users and root. The <html:code>openat</html:code> syscall can be used to create new files
when O_CREAT flag is specified.

The following auidt rules will asure that unsuccessful attempts to create a
file via <html:code>openat</html:code> syscall are collected.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rules below to a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the rules below to
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>
-a always,exit -F arch=b32 -S openat -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b32 -S openat -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S openat -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b64 -S openat -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_openat_o_creat" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat_o_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add unsuccessful file operations audit rules
  blockinfile:
    path: /etc/audit/rules.d/30-ospp-v42-remediation.rules
    create: true
    block: |-
      ## This content is a section of an Audit config snapshot recommended for Fedora systems that target OSPP compliance.
      ## The following content has been retreived on 2019-03-11 from: https://github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules

      ## The purpose of these rules is to meet the requirements for Operating
      ## System Protection Profile (OSPP)v4.2. These rules depends on having
      ## 10-base-config.rules, 11-loginuid.rules, and 43-module-load.rules installed.

      ## Unsuccessful file creation (open with O_CREAT)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create

      ## Unsuccessful file modifications (open for write or truncate)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification

      ## Unsuccessful file access (any other opens) This has to go last.
      -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat_o_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat_o_trunc_write" severity="medium">
                <xccdf-1.2:title>Record Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect detailed unauthorized file accesses for
all users and root. The <html:code>openat</html:code> syscall can be used to modify files
if called for write operation of with O_TRUNC_WRITE flag.

The following auidt rules will asure that unsuccessful attempts to modify a
file via <html:code>openat</html:code> syscall are collected.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rules below to a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the rules below to
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>
-a always,exit -F arch=b32 -S openat -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b32 -S openat -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S openat -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b64 -S openat -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_openat_o_trunc_write" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat_o_trunc_write
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add unsuccessful file operations audit rules
  blockinfile:
    path: /etc/audit/rules.d/30-ospp-v42-remediation.rules
    create: true
    block: |-
      ## This content is a section of an Audit config snapshot recommended for Fedora systems that target OSPP compliance.
      ## The following content has been retreived on 2019-03-11 from: https://github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules

      ## The purpose of these rules is to meet the requirements for Operating
      ## System Protection Profile (OSPP)v4.2. These rules depends on having
      ## 10-base-config.rules, 11-loginuid.rules, and 43-module-load.rules installed.

      ## Unsuccessful file creation (open with O_CREAT)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create

      ## Unsuccessful file modifications (open for write or truncate)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification

      ## Unsuccessful file access (any other opens) This has to go last.
      -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
      -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat_o_trunc_write
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat_rule_order" severity="medium">
                <xccdf-1.2:title>Ensure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect detailed unauthorized file
accesses for all users and root.
To correctly identify unsuccessful creation, unsuccessful modification and unsuccessful access
of files via <html:code>openat</html:code> syscall the audit rules collecting these events need to be in certain order.
The more specific rules need to come before the less specific rules. The reason for that is that more
specific rules cover a subset of events covered in the less specific rules, thus, they need to come
before to not be overshadowed by less specific rules, which match a bigger set of events.
Make sure that rules for unsuccessful calls of <html:code>openat</html:code> syscall are in the order shown below.
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code>
program to read audit rules during daemon startup (the default), check the order of
rules below in a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>.
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, check the order of rules below in
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>
-a always,exit -F arch=b32 -S openat -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b32 -S openat -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b32 -S openat -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b32 -S openat -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S openat -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b64 -S openat -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-create
-a always,exit -F arch=b64 -S openat -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b64 -S openat -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-modification
-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-access
</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The more specific rules cover a subset of events covered by the less specific rules.
By ordering them from more specific to less specific, it is assured that the less specific
rule will not catch events better recorded by the more specific rule.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_openat_rule_order:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_rule_order_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_removexattr" severity="medium">
                <xccdf-1.2:title>Record Unsuccessul Permission Changes to Files - removexattr</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect unsuccessful file permission change
attempts for all users and root.
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>-a always,exit -F arch=b32 -S removexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S removexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S removexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S removexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_removexattr"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="removexattr"
KEY="access"
SYSCALL_GROUPING=""

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_removexattr" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit removexattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for removexattr EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - removexattr
        syscall_grouping: []

    - name: Check existence of removexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - removexattr
        syscall_grouping: []

    - name: Check existence of removexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for removexattr EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - removexattr
        syscall_grouping: []

    - name: Check existence of removexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - removexattr
        syscall_grouping: []

    - name: Check existence of removexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for removexattr EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - removexattr
        syscall_grouping: []

    - name: Check existence of removexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - removexattr
        syscall_grouping: []

    - name: Check existence of removexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for removexattr EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - removexattr
        syscall_grouping: []

    - name: Check existence of removexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - removexattr
        syscall_grouping: []

    - name: Check existence of removexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_removexattr:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_removexattr_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_rename" severity="medium">
                <xccdf-1.2:title>Record Unsuccessul Delete Attempts to Files - rename</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect unsuccessful file deletion
attempts for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>-a always,exit -F arch=b32 -S rename -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b32 -S rename -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S rename -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b64 -S rename -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-delete</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_rename"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="rename"
KEY="access"
SYSCALL_GROUPING="rename renameat unlink unlinkat"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_rename" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit rename tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for rename EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rename
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of rename in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rename
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of rename in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for rename EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rename
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of rename in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rename
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of rename in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for rename EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rename
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of rename in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rename
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of rename in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for rename EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rename
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of rename in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rename
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of rename in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_rename:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_rename_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_renameat" severity="medium">
                <xccdf-1.2:title>Record Unsuccessul Delete Attempts to Files - renameat</xccdf-1.2:title>
                <xccdf-1.2:description>
The audit system should collect unsuccessful file deletion
attempts for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>-a always,exit -F arch=b32 -S renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b32 -S renameat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b64 -S renameat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:

<html:pre>-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-delete</html:pre>
 </xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_renameat"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="renameat"
KEY="access"
SYSCALL_GROUPING="rename renameat unlink unlinkat"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_renameat" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit renameat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for renameat EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - renameat
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of renameat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - renameat
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of renameat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for renameat EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - renameat
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of renameat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - renameat
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of renameat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for renameat EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - renameat
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of renameat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - renameat
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of renameat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for renameat EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - renameat
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of renameat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - renameat
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of renameat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_renameat:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_renameat_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_setxattr" severity="medium">
                <xccdf-1.2:title>Record Unsuccessul Permission Changes to Files - setxattr</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect unsuccessful file permission change
attempts for all users and root.
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>-a always,exit -F arch=b32 -S setxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b32 -S setxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>-a always,exit -F arch=b64 -S setxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change
-a always,exit -F arch=b64 -S setxattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the audit rule checks a
system call independently of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:
<html:pre>-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-perm-change</html:pre></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_setxattr"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="setxattr"
KEY="access"
SYSCALL_GROUPING="chmod fchmod fchmodat fsetxattr lsetxattr setxattr"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_setxattr" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit setxattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for setxattr EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - setxattr
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of setxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - setxattr
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of setxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for setxattr EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - setxattr
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of setxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - setxattr
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of setxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for setxattr EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - setxattr
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of setxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - setxattr
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of setxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for setxattr EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - setxattr
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of setxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - setxattr
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of setxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_unsuccessful_file_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_setxattr:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_setxattr_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_truncate" severity="medium">
                <xccdf-1.2:title>Record Unsuccessful Access Attempts to Files - truncate</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_truncate"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="truncate"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_truncate" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit truncate tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for truncate EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - truncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - truncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for truncate EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - truncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - truncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for truncate EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - truncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - truncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for truncate EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - truncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - truncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_truncate:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_unlink" severity="medium">
                <xccdf-1.2:title>Record Unsuccessul Delete Attempts to Files - unlink</xccdf-1.2:title>
                <xccdf-1.2:description>
The audit system should collect unsuccessful file deletion
attempts for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>-a always,exit -F arch=b32 -S unlink -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b32 -S unlink -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S unlink -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b64 -S unlink -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:

<html:pre>-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-delete</html:pre>
 </xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_unlink"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="unlink"
KEY="access"
SYSCALL_GROUPING="rename renameat unlink unlinkat"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_unlink" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit unlink tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for unlink EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlink
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of unlink in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlink
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of unlink in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for unlink EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlink
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of unlink in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlink
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of unlink in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for unlink EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlink
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of unlink in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlink
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of unlink in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for unlink EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlink
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of unlink in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlink
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of unlink in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_unlink:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_unlink_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_unlinkat" severity="medium">
                <xccdf-1.2:title>Record Unsuccessul Delete Attempts to Files - unlinkat</xccdf-1.2:title>
                <xccdf-1.2:description>
The audit system should collect unsuccessful file deletion
attempts for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file.
<html:pre>-a always,exit -F arch=b32 -S unlinkat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b32 -S unlinkat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S unlinkat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b64 -S unlinkat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping system calls related
to the same event is more efficient. See the following example:

<html:pre>-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccesful-delete</html:pre>
 </xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unsuccessful attempts to delete files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_unlinkat"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="unlinkat"
KEY="access"
SYSCALL_GROUPING="rename renameat unlink unlinkat"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_unlinkat" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit unlinkat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for unlinkat EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlinkat
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of unlinkat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlinkat
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of unlinkat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for unlinkat EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlinkat
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of unlinkat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlinkat
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of unlinkat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for unlinkat EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlinkat
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of unlinkat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlinkat
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of unlinkat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for unlinkat EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlinkat
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of unlinkat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlinkat
        syscall_grouping:
          - rename
          - renameat
          - unlink
          - unlinkat

    - name: Check existence of unlinkat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_unlinkat:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_unlinkat_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_kernel_module_loading">
              <xccdf-1.2:title>Record Information on Kernel Modules Loading and Unloading</xccdf-1.2:title>
              <xccdf-1.2:description>To capture kernel module loading and unloading events, use following lines, setting ARCH to
either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:
<html:pre>
-a always,exit -F arch=<html:i>ARCH</html:i> -S init_module,delete_module -F key=modules
</html:pre>

Place to add the lines depends on a way <html:code>auditd</html:code> daemon is configured. If it is configured
to use the <html:code>augenrules</html:code> program (the default), add the lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code> utility,
add the lines to file <html:code>/etc/audit/audit.rules</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Information on Kernel Module Loading and Unloading</xccdf-1.2:title>
                <xccdf-1.2:description>To capture kernel module loading and unloading events, use following lines, setting ARCH to
either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:
<html:pre>
-a always,exit -F arch=<html:i>ARCH</html:i> -S init_module,finit_module,delete_module -F key=modules
</html:pre>

The place to add the lines depends on a way <html:code>auditd</html:code> daemon is configured. If it is configured
to use the <html:code>augenrules</html:code> program (the default), add the lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code> utility,
add the lines to file <html:code>/etc/audit/audit.rules</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The addition/removal of kernel modules can be used to alter the behavior of
the kernel and potentially introduce malicious code into kernel space. It is important
to have an audit trail of modules that have been introduced into the kernel.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_kernel_module_loading"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
# Note: 32-bit and 64-bit kernel syscall numbers not always line up =&gt;
#       it's required on a 64-bit system to check also for the presence
#       of 32-bit's equivalent of the corresponding rule.
#       (See `man 7 audit.rules` for details )
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        OTHER_FILTERS=""
        
        AUID_FILTERS=""
        
        SYSCALL="init_module finit_module delete_module"
        KEY="modules"
        SYSCALL_GROUPING="init_module finit_module delete_module"
        # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
        unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
        unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_kernel_module_loading" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_kernel_module_loading
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_kernel_module_loading
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for kernel module loading for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - init_module
          - delete_module
          - finit_module
        syscall_grouping:
          - init_module
          - delete_module
          - finit_module

    - name: Check existence of init_module, delete_module, finit_module in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modules.rules
      set_fact: audit_file="/etc/audit/rules.d/modules.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=modules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - init_module
          - delete_module
          - finit_module
        syscall_grouping:
          - init_module
          - delete_module
          - finit_module

    - name: Check existence of init_module, delete_module, finit_module in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=modules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_kernel_module_loading
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for kernel module loading for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - init_module
          - delete_module
          - finit_module
        syscall_grouping:
          - init_module
          - delete_module
          - finit_module

    - name: Check existence of init_module, delete_module, finit_module in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modules.rules
      set_fact: audit_file="/etc/audit/rules.d/modules.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=modules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - init_module
          - delete_module
          - finit_module
        syscall_grouping:
          - init_module
          - delete_module
          - finit_module

    - name: Check existence of init_module, delete_module, finit_module in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=modules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_kernel_module_loading
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_kernel_module_loading:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_kernel_module_loading_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Information on Kernel Module Unloading - delete_module</xccdf-1.2:title>
                <xccdf-1.2:description>To capture kernel module unloading events, use following line, setting ARCH to
either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:

<html:pre>-a always,exit -F arch=<html:i>ARCH</html:i> -S delete_module -F key=modules</html:pre>


Place to add the line depends on a way <html:code>auditd</html:code> daemon is configured. If it is configured
to use the <html:code>augenrules</html:code> program (the default), add the line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code> utility,
add the line to file <html:code>/etc/audit/audit.rules</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00216</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000477-GPOS-00222</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000477-VMM-001970</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The removal of kernel modules can be used to alter the behavior of
the kernel and potentially introduce malicious code into kernel space. It is important
to have an audit trail of modules that have been introduced into the kernel.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_kernel_module_loading_delete"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
# Note: 32-bit and 64-bit kernel syscall numbers not always line up =&gt;
#       it's required on a 64-bit system to check also for the presence
#       of 32-bit's equivalent of the corresponding rule.
#       (See `man 7 audit.rules` for details )
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	
	AUID_FILTERS=""
	
	SYSCALL="delete_module"
	KEY="modules"
	SYSCALL_GROUPING="delete_module"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="audit_rules_kernel_module_loading_delete">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module-change%0A
        mode: 0600
        path: /etc/audit/rules.d/75-kernel-module-loading-delete.rules
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_kernel_module_loading_delete:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_kernel_module_loading_delete_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_finit" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</xccdf-1.2:title>
                <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code> program
to read audit rules during daemon startup (the default), add the following lines to a file
with suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code> to capture kernel module
loading and unloading events, setting ARCH to either b32 or b64 as appropriate for your system:

<html:pre>-a always,exit -F arch=<html:i>ARCH</html:i> -S finit_module -F key=modules</html:pre>
    If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code> utility to read audit
rules during daemon startup, add the following lines to <html:code>/etc/audit/audit.rules</html:code> file
in order to capture kernel module loading and unloading events, setting ARCH to either b32 or
b64 as appropriate for your system:

<html:pre>-a always,exit -F arch=<html:i>ARCH</html:i> -S finit_module -F key=modules</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00216</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000477-GPOS-00222</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000477-VMM-001970</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The addition/removal of kernel modules can be used to alter the behavior of
the kernel and potentially introduce malicious code into kernel space. It is important
to have an audit trail of modules that have been introduced into the kernel.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_kernel_module_loading_finit"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
# Note: 32-bit and 64-bit kernel syscall numbers not always line up =&gt;
#       it's required on a 64-bit system to check also for the presence
#       of 32-bit's equivalent of the corresponding rule.
#       (See `man 7 audit.rules` for details )
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	
	AUID_FILTERS=""
	
	SYSCALL="finit_module"
	KEY="modules"
	SYSCALL_GROUPING="init_module finit_module"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="audit_rules_kernel_module_loading_finit">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20finit_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20finit_module%20-k%20module-change%0A
        mode: 0600
        path: /etc/audit/rules.d/75-kernel-module-loading-finit.rules
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_kernel_module_loading_finit:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_kernel_module_loading_finit_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Information on Kernel Module Loading - init_module</xccdf-1.2:title>
                <xccdf-1.2:description>To capture kernel module loading events, use following line, setting ARCH to
either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:

<html:pre>-a always,exit -F arch=<html:i>ARCH</html:i> -S init_module -F key=modules</html:pre>


Place to add the line depends on a way <html:code>auditd</html:code> daemon is configured. If it is configured
to use the <html:code>augenrules</html:code> program (the default), add the line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code> utility,
add the line to file <html:code>/etc/audit/audit.rules</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00216</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000477-GPOS-00222</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000477-VMM-001970</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The addition of kernel modules can be used to alter the behavior of
the kernel and potentially introduce malicious code into kernel space. It is important
to have an audit trail of modules that have been introduced into the kernel.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_kernel_module_loading_init"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
# Note: 32-bit and 64-bit kernel syscall numbers not always line up =&gt;
#       it's required on a 64-bit system to check also for the presence
#       of 32-bit's equivalent of the corresponding rule.
#       (See `man 7 audit.rules` for details )
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	
	AUID_FILTERS=""
	
	SYSCALL="init_module"
	KEY="modules"
	SYSCALL_GROUPING="init_module finit_module"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="audit_rules_kernel_module_loading_init">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20init_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20init_module%20-k%20module-change%0A
        mode: 0600
        path: /etc/audit/rules.d/75-kernel-module-loading-init.rules
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_kernel_module_loading_init:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_kernel_module_loading_init_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_login_events">
              <xccdf-1.2:title>Record Attempts to Alter Logon and Logout Events</xccdf-1.2:title>
              <xccdf-1.2:description>The audit system already collects login information for all users
and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code> in order to watch for attempted manual
edits of files involved in storing logon events:
<html:pre>-w /var/log/tallylog -p wa -k logins
-w /var/run/faillock/ -p wa -k logins
-w /var/log/lastlog -p wa -k logins</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file in order to watch for unattempted manual
edits of files involved in storing logon events:
<html:pre>-w /var/log/tallylog -p wa -k logins
-w /var/run/faillock/ -p wa -k logins
-w /var/log/lastlog -p wa -k logins</html:pre></xccdf-1.2:description>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_login_events" severity="medium">
                <xccdf-1.2:title>Record Attempts to Alter Logon and Logout Events</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system already collects login information for all users
and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code> in order to watch for attempted manual
edits of files involved in storing logon events:
<html:pre>-w /var/log/tallylog -p wa -k logins
-w /var/run/faillock -p wa -k logins
-w /var/log/lastlog -p wa -k logins</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file in order to watch for unattempted manual
edits of files involved in storing logon events:
<html:pre>-w /var/log/tallylog -p wa -k logins
-w /var/run/faillock -p wa -k logins
-w /var/log/lastlog -p wa -k logins</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">This rule checks for multiple syscalls related to login events;
it was written with DISA STIG in mind. Other policies should use a
separate rule for each syscall that needs to be checked. For example:
<html:ul><html:li><html:code>audit_rules_login_events_tallylog</html:code></html:li><html:li><html:code>audit_rules_login_events_faillock</html:code></html:li><html:li><html:code>audit_rules_login_events_lastlog</html:code></html:li></html:ul></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Manual editing of these files may indicate nefarious activity, such
as an attacker attempting to remove evidence of an intrusion.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_login_events"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/tallylog" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/tallylog $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/tallylog$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/tallylog -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/logins.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/log/tallylog" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/logins.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/logins.rules"
    # If the logins.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/tallylog" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/tallylog $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/tallylog$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/tallylog -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/run/faillock" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/run/faillock $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/run/faillock$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/run/faillock -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/logins.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/run/faillock" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/logins.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/logins.rules"
    # If the logins.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/run/faillock" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/run/faillock $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/run/faillock$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/run/faillock -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/lastlog" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/lastlog $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/lastlog$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/lastlog -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/logins.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/log/lastlog" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/logins.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/logins.rules"
    # If the logins.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/lastlog" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/lastlog $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/lastlog$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/lastlog -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_login_events:def:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_login_events_faillock" severity="medium">
                <xccdf-1.2:title>Record Attempts to Alter Logon and Logout Events - faillock</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system already collects login information for all users
and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code> in order to watch for attempted manual
edits of files involved in storing logon events:
<html:pre>-w /var/run/faillock -p wa -k logins</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file in order to watch for unattempted manual
edits of files involved in storing logon events:
<html:pre>-w /var/run/faillock -p wa -k logins</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000473-GPOS-00218</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000473-VMM-001930</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000470-VMM-001900</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Manual editing of these files may indicate nefarious activity, such
as an attacker attempting to remove evidence of an intrusion.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_login_events_faillock"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/run/faillock" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/run/faillock $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/run/faillock$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/run/faillock -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/logins.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/run/faillock" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/logins.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/logins.rules"
    # If the logins.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/run/faillock" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/run/faillock $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/run/faillock$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/run/faillock -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_login_events_faillock" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_faillock
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k logins$
    patterns: '*.rules'
  register: find_faillock
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_faillock
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/logins.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/logins.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_faillock.matched is defined and find_faillock.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_faillock
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_faillock.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_faillock.matched is defined and find_faillock.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_faillock
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the faillock rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/run/faillock -p wa -k logins
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_faillock
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the faillock rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/run/faillock -p wa -k logins
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_faillock
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_login_events_faillock:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_login_events_faillock_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_login_events_lastlog" severity="medium">
                <xccdf-1.2:title>Record Attempts to Alter Logon and Logout Events - lastlog</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system already collects login information for all users
and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code> in order to watch for attempted manual
edits of files involved in storing logon events:
<html:pre>-w /var/log/lastlog -p wa -k logins</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file in order to watch for unattempted manual
edits of files involved in storing logon events:
<html:pre>-w /var/log/lastlog -p wa -k logins</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000473-GPOS-00218</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000473-VMM-001930</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000470-VMM-001900</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Manual editing of these files may indicate nefarious activity, such
as an attacker attempting to remove evidence of an intrusion.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_login_events_lastlog"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/lastlog" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/lastlog $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/lastlog$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/lastlog -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/logins.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/log/lastlog" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/logins.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/logins.rules"
    # If the logins.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/lastlog" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/lastlog $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/lastlog$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/lastlog -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_login_events_lastlog" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_lastlog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k logins$
    patterns: '*.rules'
  register: find_lastlog
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_lastlog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/logins.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/logins.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_lastlog.matched is defined and find_lastlog.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_lastlog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_lastlog.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_lastlog.matched is defined and find_lastlog.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_lastlog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lastlog rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/log/lastlog -p wa -k logins
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_lastlog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lastlog rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/log/lastlog -p wa -k logins
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_lastlog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_login_events_lastlog:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_login_events_lastlog_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_login_events_tallylog" severity="medium">
                <xccdf-1.2:title>Record Attempts to Alter Logon and Logout Events - tallylog</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system already collects login information for all users
and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code> in order to watch for attempted manual
edits of files involved in storing logon events:
<html:pre>-w /var/log/tallylog -p wa -k logins</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file in order to watch for unattempted manual
edits of files involved in storing logon events:
<html:pre>-w /var/log/tallylog -p wa -k logins</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000473-GPOS-00218</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000473-VMM-001930</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000470-VMM-001900</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Manual editing of these files may indicate nefarious activity, such
as an attacker attempting to remove evidence of an intrusion.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_login_events_tallylog"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/tallylog" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/tallylog $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/tallylog$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/tallylog -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/logins.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/log/tallylog" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/logins.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/logins.rules"
    # If the logins.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/tallylog" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/tallylog $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/tallylog$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/tallylog -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_login_events_tallylog" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_tallylog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k logins$
    patterns: '*.rules'
  register: find_tallylog
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_tallylog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/logins.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/logins.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_tallylog.matched is defined and find_tallylog.matched == 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_tallylog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_tallylog.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_tallylog.matched is defined and find_tallylog.matched &gt; 0
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_tallylog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the tallylog rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/log/tallylog -p wa -k logins
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_tallylog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the tallylog rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/log/tallylog -p wa -k logins
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_tallylog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_login_events_tallylog:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_login_events_tallylog_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_privileged_commands">
              <xccdf-1.2:title>Record Information on the Use of Privileged Commands</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands</xccdf-1.2:title>
                <xccdf-1.2:description>The audit system should collect information about usage of privileged
commands for all users and root. To find the relevant setuid /
setgid programs, run the following command for each local partition
<html:i>PART</html:i>:
<html:pre>$ sudo find <html:i>PART</html:i> -xdev -type f -perm -4000 -o -type f -perm -2000 2&gt;/dev/null</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code>
program to read audit rules during daemon startup (the default), add a line of
the following form to a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code> for each setuid / setgid program on the system,
replacing the <html:i>SETUID_PROG_PATH</html:i> part with the full path of that setuid /
setgid program in the list:
<html:pre>-a always,exit -F path=<html:i>SETUID_PROG_PATH</html:i> -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code> for each setuid / setgid program on the
system, replacing the <html:i>SETUID_PROG_PATH</html:i> part with the full path of that
setuid / setgid program in the list:
<html:pre>-a always,exit -F path=<html:i>SETUID_PROG_PATH</html:i> -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">This rule checks for multiple syscalls related to privileged commands;
it was written with DISA STIG in mind. Other policies should use a
separate rule for each syscall that needs to be checked. For example:
<html:ul><html:li><html:code>audit_rules_privileged_commands_su</html:code></html:li><html:li><html:code>audit_rules_privileged_commands_umount</html:code></html:li><html:li><html:code>audit_rules_privileged_commands_passwd</html:code></html:li></html:ul></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO08.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002234</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0582</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0584</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">05885</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0586</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0846</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0957</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.DP-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.CO-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000327-GPOS-00127</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000471-VMM-001910</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
files_to_inspect=()

# If the audit tool is 'auditctl', then:
# * add '/etc/audit/audit.rules'to the list of files to be inspected,
# * specify '/etc/audit/audit.rules' as the output audit file, where
#   missing rules should be inserted
files_to_inspect=("/etc/audit/audit.rules")
output_audit_file="/etc/audit/audit.rules"

# Obtain the list of SUID/SGID binaries on the particular system (split by newline)
# into privileged_binaries array
privileged_binaries=()
readarray -t privileged_binaries &lt; &lt;(find / -not \( -fstype afs -o -fstype ceph -o -fstype cifs -o -fstype smb3 -o -fstype smbfs -o -fstype sshfs -o -fstype ncpfs -o -fstype ncp -o -fstype nfs -o -fstype nfs4 -o -fstype gfs -o -fstype gfs2 -o -fstype glusterfs -o -fstype gpfs -o -fstype pvfs2 -o -fstype ocfs2 -o -fstype lustre -o -fstype davfs -o -fstype fuse.sshfs \) -type f \( -perm -4000 -o -perm -2000 \) 2&gt; /dev/null)

# Keep list of SUID/SGID binaries that have been already handled within some previous iteration
sbinaries_to_skip=()

# For each found sbinary in privileged_binaries list
for sbinary in "${privileged_binaries[@]}"
do

    # Check if this sbinary wasn't already handled in some of the previous sbinary iterations
    # Return match only if whole sbinary definition matched (not in the case just prefix matched!!!)
    if [[ $(sed -ne "\|${sbinary}|p" &lt;&lt;&lt; "${sbinaries_to_skip[*]}") ]]
    then
        # If so, don't process it second time &amp; go to process next sbinary
        continue
    fi

    # Reset the counter of inspected files when starting to check
    # presence of existing audit rule for new sbinary
    count_of_inspected_files=0

    # Define expected rule form for this binary
    expected_rule="-a always,exit -F path=${sbinary} -F auid&gt;=1000 -F auid!=unset -F key=privileged"

    # If list of audit rules files to be inspected is empty, just add new rule and move on to next binary
    if [[ ${#files_to_inspect[@]} -eq 0 ]]; then
        echo "$expected_rule" &gt;&gt; "$output_audit_file"
        continue
    fi

    # Replace possible slash '/' character in sbinary definition so we could use it in sed expressions below
    sbinary_esc=${sbinary//$'/'/$'\/'}

    # For each audit rules file from the list of files to be inspected
    for afile in "${files_to_inspect[@]}"
    do
        # Search current audit rules file's content for match. Match criteria:
        # * existing rule is for the same SUID/SGID binary we are currently processing (but
        #   can contain multiple -F path= elements covering multiple SUID/SGID binaries)
        # * existing rule contains all arguments from expected rule form (though can contain
        #   them in arbitrary order)

        base_search=$(sed -e '/-a always,exit/!d' -e '/-F path='"${sbinary_esc}"'[^[:graph:]]/!d'		\
                -e '/-F path=[^[:space:]]\+/!d'						\
                -e '/-F auid&gt;='"1000"'/!d' -e '/-F auid!=\(4294967295\|unset\)/!d'	\
                -e '/-k \|-F key=/!d' "$afile")

        # Increase the count of inspected files for this sbinary
        count_of_inspected_files=$((count_of_inspected_files + 1))

        # Search current audit rules file's content for presence of rule pattern for this sbinary
        if [[ $base_search ]]
        then

            # Current audit rules file already contains rule for this binary =&gt;
            # Store the exact form of found rule for this binary for further processing
            concrete_rule=$base_search

            # Select all other SUID/SGID binaries possibly also present in the found rule

            readarray -t handled_sbinaries &lt; &lt;(grep -o -e "-F path=[^[:space:]]\+" &lt;&lt;&lt; "$concrete_rule")
            handled_sbinaries=("${handled_sbinaries[@]//-F path=/}")

            # Merge the list of such SUID/SGID binaries found in this iteration with global list ignoring duplicates
            readarray -t sbinaries_to_skip &lt; &lt;(for i in "${sbinaries_to_skip[@]}" "${handled_sbinaries[@]}"; do echo "$i"; done | sort -du)

            # if there is a -F perm flag, remove it
            if grep -q '.*-F\s\+perm=[rwxa]\+.*' &lt;&lt;&lt; "$concrete_rule"; then

                # Separate concrete_rule into three sections using hash '#'
                # sign as a delimiter around rule's permission section borders
                # note that the trailing space after perm flag is captured because there would be
                # two consecutive spaces after joining remaining parts of the rule together
                concrete_rule="$(echo "$concrete_rule" | sed -n "s/\(.*\)\+\(-F perm=[rwax]\+\ \?\)\+/\1#\2#/p")"

                # Split concrete_rule into head and tail sections using hash '#' delimiter
                # The second column contains the permission section, which we don't need to extract
                rule_head=$(cut -d '#' -f 1 &lt;&lt;&lt; "$concrete_rule")
                rule_tail=$(cut -d '#' -f 3 &lt;&lt;&lt; "$concrete_rule")

                # Remove permissions section from existing rule in the file
                sed -i "s#${rule_head}\(.*\)${rule_tail}#${rule_head}${rule_tail}#" "$afile"
            fi
        # If the required audit rule for particular sbinary wasn't found yet, insert it under following conditions:
        #
        # * in the "auditctl" mode of operation insert particular rule each time
        #   (because in this mode there's only one file -- /etc/audit/audit.rules to be inspected for presence of this rule),
        #
        # * in the "augenrules" mode of operation insert particular rule only once and only in case we have already
        #   searched all of the files from /etc/audit/rules.d/*.rules location (since that audit rule can be defined
        #   in any of those files and if not, we want it to be inserted only once into /etc/audit/rules.d/privileged.rules file)
        #
	
	else
            # Check if this sbinary wasn't already handled in some of the previous afile iterations
            # Return match only if whole sbinary definition matched (not in the case just prefix matched!!!)
            if [[ ! $(sed -ne "\|${sbinary}|p" &lt;&lt;&lt; "${sbinaries_to_skip[*]}") ]]
            then
                # Current audit rules file's content doesn't contain expected rule for this
                # SUID/SGID binary yet =&gt; append it
                echo "$expected_rule" &gt;&gt; "$output_audit_file"
            fi
            continue
        fi
    done
done
files_to_inspect=()
# If the audit tool is 'augenrules', then:
# * add '/etc/audit/rules.d/*.rules' to the list of files to be inspected
#   (split by newline),
# * specify /etc/audit/rules.d/privileged.rules' as the output file, where
#   missing rules should be inserted
readarray -t files_to_inspect &lt; &lt;(find /etc/audit/rules.d -maxdepth 1 -type f -name '*.rules' -print)
output_audit_file="/etc/audit/rules.d/privileged.rules"

# Obtain the list of SUID/SGID binaries on the particular system (split by newline)
# into privileged_binaries array
privileged_binaries=()
readarray -t privileged_binaries &lt; &lt;(find / -not \( -fstype afs -o -fstype ceph -o -fstype cifs -o -fstype smb3 -o -fstype smbfs -o -fstype sshfs -o -fstype ncpfs -o -fstype ncp -o -fstype nfs -o -fstype nfs4 -o -fstype gfs -o -fstype gfs2 -o -fstype glusterfs -o -fstype gpfs -o -fstype pvfs2 -o -fstype ocfs2 -o -fstype lustre -o -fstype davfs -o -fstype fuse.sshfs \) -type f \( -perm -4000 -o -perm -2000 \) 2&gt; /dev/null)

# Keep list of SUID/SGID binaries that have been already handled within some previous iteration
sbinaries_to_skip=()

# For each found sbinary in privileged_binaries list
for sbinary in "${privileged_binaries[@]}"
do

    # Check if this sbinary wasn't already handled in some of the previous sbinary iterations
    # Return match only if whole sbinary definition matched (not in the case just prefix matched!!!)
    if [[ $(sed -ne "\|${sbinary}|p" &lt;&lt;&lt; "${sbinaries_to_skip[*]}") ]]
    then
        # If so, don't process it second time &amp; go to process next sbinary
        continue
    fi

    # Reset the counter of inspected files when starting to check
    # presence of existing audit rule for new sbinary
    count_of_inspected_files=0

    # Define expected rule form for this binary
    expected_rule="-a always,exit -F path=${sbinary} -F auid&gt;=1000 -F auid!=unset -F key=privileged"

    # If list of audit rules files to be inspected is empty, just add new rule and move on to next binary
    if [[ ${#files_to_inspect[@]} -eq 0 ]]; then
        echo "$expected_rule" &gt;&gt; "$output_audit_file"
        continue
    fi

    # Replace possible slash '/' character in sbinary definition so we could use it in sed expressions below
    sbinary_esc=${sbinary//$'/'/$'\/'}

    # For each audit rules file from the list of files to be inspected
    for afile in "${files_to_inspect[@]}"
    do
        # Search current audit rules file's content for match. Match criteria:
        # * existing rule is for the same SUID/SGID binary we are currently processing (but
        #   can contain multiple -F path= elements covering multiple SUID/SGID binaries)
        # * existing rule contains all arguments from expected rule form (though can contain
        #   them in arbitrary order)

        base_search=$(sed -e '/-a always,exit/!d' -e '/-F path='"${sbinary_esc}"'[^[:graph:]]/!d'		\
                -e '/-F path=[^[:space:]]\+/!d'						\
                -e '/-F auid&gt;='"1000"'/!d' -e '/-F auid!=\(4294967295\|unset\)/!d'	\
                -e '/-k \|-F key=/!d' "$afile")

        # Increase the count of inspected files for this sbinary
        count_of_inspected_files=$((count_of_inspected_files + 1))

        # Search current audit rules file's content for presence of rule pattern for this sbinary
        if [[ $base_search ]]
        then

            # Current audit rules file already contains rule for this binary =&gt;
            # Store the exact form of found rule for this binary for further processing
            concrete_rule=$base_search

            # Select all other SUID/SGID binaries possibly also present in the found rule

            readarray -t handled_sbinaries &lt; &lt;(grep -o -e "-F path=[^[:space:]]\+" &lt;&lt;&lt; "$concrete_rule")
            handled_sbinaries=("${handled_sbinaries[@]//-F path=/}")

            # Merge the list of such SUID/SGID binaries found in this iteration with global list ignoring duplicates
            readarray -t sbinaries_to_skip &lt; &lt;(for i in "${sbinaries_to_skip[@]}" "${handled_sbinaries[@]}"; do echo "$i"; done | sort -du)

            # if there is a -F perm flag, remove it
            if grep -q '.*-F\s\+perm=[rwxa]\+.*' &lt;&lt;&lt; "$concrete_rule"; then

                # Separate concrete_rule into three sections using hash '#'
                # sign as a delimiter around rule's permission section borders
                # note that the trailing space after perm flag is captured because there would be
                # two consecutive spaces after joining remaining parts of the rule together
                concrete_rule="$(echo "$concrete_rule" | sed -n "s/\(.*\)\+\(-F perm=[rwax]\+\ \?\)\+/\1#\2#/p")"

                # Split concrete_rule into head and tail sections using hash '#' delimiter
                # The second column contains the permission section, which we don't need to extract
                rule_head=$(cut -d '#' -f 1 &lt;&lt;&lt; "$concrete_rule")
                rule_tail=$(cut -d '#' -f 3 &lt;&lt;&lt; "$concrete_rule")

                # Remove permissions section from existing rule in the file
                sed -i "s#${rule_head}\(.*\)${rule_tail}#${rule_head}${rule_tail}#" "$afile"
            fi
        # If the required audit rule for particular sbinary wasn't found yet, insert it under following conditions:
        #
        # * in the "auditctl" mode of operation insert particular rule each time
        #   (because in this mode there's only one file -- /etc/audit/audit.rules to be inspected for presence of this rule),
        #
        # * in the "augenrules" mode of operation insert particular rule only once and only in case we have already
        #   searched all of the files from /etc/audit/rules.d/*.rules location (since that audit rule can be defined
        #   in any of those files and if not, we want it to be inserted only once into /etc/audit/rules.d/privileged.rules file)
        #
	elif [[ $count_of_inspected_files -eq "${#files_to_inspect[@]}" ]]
        then
	
            # Check if this sbinary wasn't already handled in some of the previous afile iterations
            # Return match only if whole sbinary definition matched (not in the case just prefix matched!!!)
            if [[ ! $(sed -ne "\|${sbinary}|p" &lt;&lt;&lt; "${sbinaries_to_skip[*]}") ]]
            then
                # Current audit rules file's content doesn't contain expected rule for this
                # SUID/SGID binary yet =&gt; append it
                echo "$expected_rule" &gt;&gt; "$output_audit_file"
            fi
            continue
        fi
    done
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - audit_rules_privileged_commands
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search for privileged commands
  shell: |
    set -o pipefail
    find / -not \( -fstype afs -o -fstype ceph -o -fstype cifs -o -fstype smb3 -o -fstype smbfs -o -fstype sshfs -o -fstype ncpfs -o -fstype ncp -o -fstype nfs -o -fstype nfs4 -o -fstype gfs -o -fstype gfs2 -o -fstype glusterfs -o -fstype gpfs -o -fstype pvfs2 -o -fstype ocfs2 -o -fstype lustre -o -fstype davfs -o -fstype fuse.sshfs \) -type f \( -perm -4000 -o -perm -2000 \) 2&gt; /dev/null
  args:
    warn: false
    executable: /bin/bash
  check_mode: false
  register: find_result
  changed_when: false
  failed_when: false
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - audit_rules_privileged_commands
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path={{ item }} .*$
    patterns: '*.rules'
  with_items:
    - '{{ find_result.stdout_lines }}'
  register: files_result
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - audit_rules_privileged_commands
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Overwrites the rule in rules.d
  lineinfile:
    path: '{{ item.1.path }}'
    line: -a always,exit -F path={{ item.0.item }} -F auid&gt;=1000 -F auid!=unset -F
      key=privileged
    create: false
    regexp: ^.*path={{ item.0.item }} .*$
  with_subelements:
    - '{{ files_result.results }}'
    - files
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - audit_rules_privileged_commands
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Adds the rule in rules.d
  lineinfile:
    path: /etc/audit/rules.d/privileged.rules
    line: -a always,exit -F path={{ item.item }} -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
  with_items:
    - '{{ files_result.results }}'
  when:
    - '"audit" in ansible_facts.packages'
    - files_result.results is defined and item.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - audit_rules_privileged_commands
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path={{ item.item }} -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
    regexp: ^.*path={{ item.item }} .*$
  with_items:
    - '{{ files_result.results }}'
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - audit_rules_privileged_commands
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_privileged_commands:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_at" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - at</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/at -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/at -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000471-VMM-001910</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_at"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/at -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_at" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_at
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/at
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/at -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/at -F perm=x -F
          auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/at -F perm=x
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/at -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/at -F perm=x -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/at -F perm=x
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_at
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_privileged_commands_at:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_at_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chage" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - chage</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/chage -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/chage -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000471-VMM-001910</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_chage"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/chage -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_chage" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_chage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/chage
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/chage -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chage -F perm=x
          -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chage -F perm=x
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/chage -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chage -F perm=x -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chage -F perm=x
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_chage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_privileged_commands_chage:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_chage_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chsh" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - chsh</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000471-VMM-001910</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_chsh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/chsh -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_chsh" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_chsh
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/chsh
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/chsh -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chsh -F perm=x -F
          auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chsh -F perm=x
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/chsh -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chsh -F perm=x -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chsh -F perm=x
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_chsh
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_privileged_commands_chsh:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_chsh_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_crontab" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - crontab</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000471-VMM-001910</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_crontab"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/crontab -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_crontab" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_crontab
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/crontab
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/crontab -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/crontab -F perm=x
          -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/crontab -F
          perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/crontab -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/crontab -F perm=x -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/crontab -F
          perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_crontab
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_privileged_commands_crontab:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_crontab_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_gpasswd" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000471-VMM-001910</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_gpasswd"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/gpasswd -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_gpasswd" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_gpasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/gpasswd
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/gpasswd -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/gpasswd -F perm=x
          -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/gpasswd -F
          perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/gpasswd -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/gpasswd -F perm=x -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/gpasswd -F
          perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_gpasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_privileged_commands_gpasswd:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_gpasswd_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_mount" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - mount</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/mount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/mount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000471-VMM-001910</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_mount"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/mount -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_mount" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_mount
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/mount
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/mount -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/mount -F perm=x
          -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/mount -F perm=x
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/mount -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/mount -F perm=x -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/mount -F perm=x
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_mount
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_privileged_commands_mount:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_mount_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgidmap" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - newgidmap</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/newgidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/newgidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000471-VMM-001910</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_newgidmap"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/newgidmap -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_newgidmap" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newgidmap
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/newgidmap
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/newgidmap -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/newgidmap -F perm=x
          -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/newgidmap
          -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/newgidmap -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/newgidmap -F perm=x -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/newgidmap
          -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newgidmap
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_privileged_commands_newgidmap:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_newgidmap_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgrp" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000471-VMM-001910</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_newgrp"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/newgrp -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_newgrp" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newgrp
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/newgrp
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/newgrp -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/newgrp -F perm=x
          -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/newgrp -F
          perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/newgrp -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/newgrp -F perm=x -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/newgrp -F
          perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newgrp
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_privileged_commands_newgrp:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_newgrp_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newuidmap" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - newuidmap</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/newuidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/newuidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000471-VMM-001910</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_newuidmap"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/newuidmap -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_newuidmap" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newuidmap
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/newuidmap
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/newuidmap -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/newuidmap -F perm=x
          -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/newuidmap
          -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/newuidmap -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/newuidmap -F perm=x -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/newuidmap
          -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newuidmap
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_privileged_commands_newuidmap:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_newuidmap_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_passwd" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - passwd</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000471-VMM-001910</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_passwd"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/passwd -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_passwd" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/passwd
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/passwd -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/passwd -F perm=x
          -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/passwd -F
          perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/passwd -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/passwd -F perm=x -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/passwd -F
          perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_privileged_commands_passwd:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_passwd_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_pt_chown" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - pt_chown</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/libexec/pt_chown -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/libexec/pt_chown -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000471-VMM-001910</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_pt_chown"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/libexec/pt_chown -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_pt_chown" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_pt_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /usr/libexec/pt_chown
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/libexec/pt_chown -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/libexec/pt_chown -F
          perm=x -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/libexec/pt_chown
          -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/libexec/pt_chown -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/libexec/pt_chown -F perm=x -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/libexec/pt_chown
          -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_pt_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_privileged_commands_pt_chown:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_pt_chown_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_ssh_keysign" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000471-VMM-001910</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_ssh_keysign"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/libexec/openssh/ssh-keysign -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_ssh_keysign" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_ssh_keysign
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /usr/libexec/openssh/ssh-keysign
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid&gt;=1000 -F auid!=unset
          (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/libexec/openssh/ssh-keysign
          -F perm=x -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/libexec/openssh/ssh-keysign
          -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid&gt;=1000 -F auid!=unset
          (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/libexec/openssh/ssh-keysign -F perm=x
          -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/libexec/openssh/ssh-keysign
          -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_ssh_keysign
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_privileged_commands_ssh_keysign:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_ssh_keysign_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_su" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - su</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/su -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/su -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-0003</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000471-VMM-001910</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_su"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/su -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_su" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_su
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/su
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/su -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/su -F perm=x -F
          auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/su -F perm=x
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/su -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/su -F perm=x -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/su -F perm=x
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_su
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_privileged_commands_su:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_su_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudo" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - sudo</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R19)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000471-VMM-001910</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_sudo"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/sudo -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_sudo" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_sudo
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/sudo
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/sudo -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/sudo -F perm=x -F
          auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/sudo -F perm=x
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/sudo -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/sudo -F perm=x -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/sudo -F perm=x
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_sudo
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_privileged_commands_sudo:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_sudo_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudoedit" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000471-VMM-001910</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_sudoedit"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/sudoedit -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_sudoedit" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_sudoedit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/sudoedit
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/sudoedit -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/sudoedit -F perm=x
          -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/sudoedit -F
          perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/sudoedit -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/sudoedit -F perm=x -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/sudoedit -F
          perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_sudoedit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_privileged_commands_sudoedit:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_sudoedit_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_umount" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - umount</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/umount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/umount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000471-VMM-001910</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_umount"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/umount -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_umount" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_umount
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/umount
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/umount -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/umount -F perm=x
          -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/umount -F
          perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/umount -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/umount -F perm=x -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/umount -F
          perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_umount
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_privileged_commands_umount:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_umount_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_chkpwd" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12.1(ii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12.1(iv)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(1)(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000471-VMM-001910</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_unix_chkpwd"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/unix_chkpwd -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_unix_chkpwd" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-12.1(ii)
    - NIST-800-53-AU-12.1(iv)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-AU-3
    - NIST-800-53-AU-3.1
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(1)(a)
    - audit_rules_privileged_commands_unix_chkpwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /usr/sbin/unix_chkpwd
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/unix_chkpwd -F
          perm=x -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/unix_chkpwd
          -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/unix_chkpwd
          -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-12.1(ii)
    - NIST-800-53-AU-12.1(iv)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-AU-3
    - NIST-800-53-AU-3.1
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(1)(a)
    - audit_rules_privileged_commands_unix_chkpwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_privileged_commands_unix_chkpwd:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_unix_chkpwd_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_userhelper" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - userhelper</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000471-VMM-001910</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_userhelper"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/userhelper -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_userhelper" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_userhelper
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /usr/sbin/userhelper
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/userhelper -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/userhelper -F perm=x
          -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/userhelper
          -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/userhelper -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/userhelper -F perm=x -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/userhelper
          -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_userhelper
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_privileged_commands_userhelper:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_userhelper_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_usernetctl" severity="medium">
                <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - usernetctl</xccdf-1.2:title>
                <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000471-VMM-001910</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_usernetctl"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/usernetctl -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_usernetctl" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_usernetctl
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for /usr/sbin/usernetctl
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/usernetctl -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/usernetctl -F perm=x
          -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/usernetctl
          -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/usernetctl -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/usernetctl -F perm=x -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/usernetctl
          -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_usernetctl
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_privileged_commands_usernetctl:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_usernetctl_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_time_rules">
              <xccdf-1.2:title>Records Events that Modify Date and Time Information</xccdf-1.2:title>
              <xccdf-1.2:description>Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time. All changes to the system
time should be audited.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex" severity="medium">
                <xccdf-1.2:title>Record attempts to alter time through adjtimex</xccdf-1.2:title>
                <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S adjtimex -F key=audit_time_rules</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S adjtimex -F key=audit_time_rules</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S adjtimex -F key=audit_time_rules</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S adjtimex -F key=audit_time_rules</html:pre>
The -k option allows for the specification of a key in string form that can be
used for better reporting capability through ausearch and aureport. Multiple
system calls can be defined on the same line to save space if desired, but is
not required. See an example of multiple combined syscalls:
<html:pre>-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.2.b</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_time_adjtimex"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
    # Create expected audit group and audit rule form for particular system call &amp; architecture
    if [ ${ARCH} = "b32" ]
    then
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        # stime system call is known at 32-bit arch (see e.g "$ ausyscall i386 stime" 's output)
        # so append it to the list of time group system calls to be audited
        SYSCALL="adjtimex settimeofday stime"
        SYSCALL_GROUPING="adjtimex settimeofday stime"
    elif [ ${ARCH} = "b64" ]
    then
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        # stime system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
        # therefore don't add it to the list of time group system calls to be audited
        SYSCALL="adjtimex settimeofday"
        SYSCALL_GROUPING="adjtimex settimeofday"
    fi
    OTHER_FILTERS=""
    AUID_FILTERS=""
    KEY="audit_time_rules"
    # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
    unset syscall_a
    unset syscall_grouping
    unset syscall_string
    unset syscall
    unset file_to_edit
    unset rule_to_edit
    unset rule_syscalls_to_edit
    unset other_string
    unset auid_string
    unset full_rule

    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    #
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()


    # If audit tool is 'augenrules', then check if the audit rule is defined
    # If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
    # If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
    default_file="/etc/audit/rules.d/$KEY.rules"
    # As other_filters may include paths, lets use a different delimiter for it
    # The "F" script expression tells sed to print the filenames where the expressions matched
    readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
    # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
    if [ ${#files_to_inspect[@]} -eq "0" ]
    then
        file_to_inspect="/etc/audit/rules.d/$KEY.rules"
        files_to_inspect=("$file_to_inspect")
        if [ ! -e "$file_to_inspect" ]
        then
            touch "$file_to_inspect"
            chmod 0640 "$file_to_inspect"
        fi
    fi

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                       # A syscall was not found in the candidate rule
                       all_syscalls_found=1
                       }
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [ "${#candidate_rules[@]}" -gt 0 ]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [ "${#syscall_a[@]}" -gt 0 ]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod o-rwx ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
                   # A syscall was not found in the candidate rule
                   new_grouped_syscalls+="${delimiter}${syscall}"
                   }
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
    unset syscall_a
    unset syscall_grouping
    unset syscall_string
    unset syscall
    unset file_to_edit
    unset rule_to_edit
    unset rule_syscalls_to_edit
    unset other_string
    unset auid_string
    unset full_rule

    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    #
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()



    # If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
    # file to the list of files to be inspected
    default_file="/etc/audit/audit.rules"
    files_to_inspect+=('/etc/audit/audit.rules' )

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                       # A syscall was not found in the candidate rule
                       all_syscalls_found=1
                       }
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [ "${#candidate_rules[@]}" -gt 0 ]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [ "${#syscall_a[@]}" -gt 0 ]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod o-rwx ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
                   # A syscall was not found in the candidate rule
                   new_grouped_syscalls+="${delimiter}${syscall}"
                   }
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_time_adjtimex" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_adjtimex
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set architecture for audit tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_adjtimex
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for adjtimex for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - adjtimex
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of adjtimex in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
      set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - adjtimex
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of adjtimex in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_adjtimex
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for adjtimex for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - adjtimex
        syscall_grouping:
          - adjtimex
          - settimeofday

    - name: Check existence of adjtimex in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
      set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - adjtimex
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of adjtimex in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_adjtimex
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="audit_rules_time_adjtimex" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
        mode: 0600
        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_time_adjtimex:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_time_adjtimex_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime" severity="medium">
                <xccdf-1.2:title>Record Attempts to Alter Time Through clock_settime</xccdf-1.2:title>
                <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change</html:pre>
The -k option allows for the specification of a key in string form that can
be used for better reporting capability through ausearch and aureport.
Multiple system calls can be defined on the same line to save space if
desired, but is not required. See an example of multiple combined syscalls:
<html:pre>-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.2.b</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_time_clock_settime"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F a0=0x0"
	AUID_FILTERS=""
	SYSCALL="clock_settime"
	KEY="time-change"
	SYSCALL_GROUPING=""
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()



# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_time_clock_settime" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_clock_settime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set architecture for audit tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_clock_settime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for clock_settime for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - clock_settime
        syscall_grouping: []

    - name: Check existence of clock_settime in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a0=0x0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/time-change.rules
      set_fact: audit_file="/etc/audit/rules.d/time-change.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a0=0x0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a0=0x0 -F
          key=time-change
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - clock_settime
        syscall_grouping: []

    - name: Check existence of clock_settime in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a0=0x0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a0=0x0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a0=0x0 -F
          key=time-change
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_clock_settime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for clock_settime for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - clock_settime
        syscall_grouping: []

    - name: Check existence of clock_settime in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a0=0x0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/time-change.rules
      set_fact: audit_file="/etc/audit/rules.d/time-change.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a0=0x0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a0=0x0 -F
          key=time-change
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - clock_settime
        syscall_grouping: []

    - name: Check existence of clock_settime in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a0=0x0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a0=0x0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a0=0x0 -F
          key=time-change
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_clock_settime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="audit_rules_time_clock_settime" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A }}
        mode: 0600
        path: /etc/audit/rules.d/75-syscall-clock-settime.rules
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_time_clock_settime:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_time_clock_settime_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_time_settimeofday" severity="medium">
                <xccdf-1.2:title>Record attempts to alter time through settimeofday</xccdf-1.2:title>
                <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S settimeofday -F key=audit_time_rules</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S settimeofday -F key=audit_time_rules</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S settimeofday -F key=audit_time_rules</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S settimeofday -F key=audit_time_rules</html:pre>
The -k option allows for the specification of a key in string form that can be
used for better reporting capability through ausearch and aureport. Multiple
system calls can be defined on the same line to save space if desired, but is
not required. See an example of multiple combined syscalls:
<html:pre>-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.2.b</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_time_settimeofday"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
    # Create expected audit group and audit rule form for particular system call &amp; architecture
    if [ ${ARCH} = "b32" ]
    then
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        # stime system call is known at 32-bit arch (see e.g "$ ausyscall i386 stime" 's output)
        # so append it to the list of time group system calls to be audited
        SYSCALL="adjtimex settimeofday stime"
        SYSCALL_GROUPING="adjtimex settimeofday stime"
    elif [ ${ARCH} = "b64" ]
    then
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        # stime system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
        # therefore don't add it to the list of time group system calls to be audited
        SYSCALL="adjtimex settimeofday"
        SYSCALL_GROUPING="adjtimex settimeofday"
    fi
    OTHER_FILTERS=""
    AUID_FILTERS=""
    KEY="audit_time_rules"
    # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
    unset syscall_a
    unset syscall_grouping
    unset syscall_string
    unset syscall
    unset file_to_edit
    unset rule_to_edit
    unset rule_syscalls_to_edit
    unset other_string
    unset auid_string
    unset full_rule

    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    #
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()


    # If audit tool is 'augenrules', then check if the audit rule is defined
    # If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
    # If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
    default_file="/etc/audit/rules.d/$KEY.rules"
    # As other_filters may include paths, lets use a different delimiter for it
    # The "F" script expression tells sed to print the filenames where the expressions matched
    readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
    # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
    if [ ${#files_to_inspect[@]} -eq "0" ]
    then
        file_to_inspect="/etc/audit/rules.d/$KEY.rules"
        files_to_inspect=("$file_to_inspect")
        if [ ! -e "$file_to_inspect" ]
        then
            touch "$file_to_inspect"
            chmod 0640 "$file_to_inspect"
        fi
    fi

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                       # A syscall was not found in the candidate rule
                       all_syscalls_found=1
                       }
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [ "${#candidate_rules[@]}" -gt 0 ]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [ "${#syscall_a[@]}" -gt 0 ]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod o-rwx ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
                   # A syscall was not found in the candidate rule
                   new_grouped_syscalls+="${delimiter}${syscall}"
                   }
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
    unset syscall_a
    unset syscall_grouping
    unset syscall_string
    unset syscall
    unset file_to_edit
    unset rule_to_edit
    unset rule_syscalls_to_edit
    unset other_string
    unset auid_string
    unset full_rule

    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    #
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()



    # If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
    # file to the list of files to be inspected
    default_file="/etc/audit/audit.rules"
    files_to_inspect+=('/etc/audit/audit.rules' )

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                       # A syscall was not found in the candidate rule
                       all_syscalls_found=1
                       }
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [ "${#candidate_rules[@]}" -gt 0 ]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [ "${#syscall_a[@]}" -gt 0 ]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod o-rwx ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
                   # A syscall was not found in the candidate rule
                   new_grouped_syscalls+="${delimiter}${syscall}"
                   }
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_time_settimeofday" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_settimeofday
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set architecture for audit tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_settimeofday
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for settimeofday for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - settimeofday
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of settimeofday in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
      set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - settimeofday
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of settimeofday in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_settimeofday
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for settimeofday for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - settimeofday
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of settimeofday in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
      set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - settimeofday
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of settimeofday in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_settimeofday
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="audit_rules_time_settimeofday" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20settimeofday%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20settimeofday%20-k%20audit_time_rules%0A }}
        mode: 0600
        path: /etc/audit/rules.d/75-syscall-settimeofday.rules
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_time_settimeofday:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_time_settimeofday_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_time_stime" severity="medium">
                <xccdf-1.2:title>Record Attempts to Alter Time Through stime</xccdf-1.2:title>
                <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code> for both 32 bit and 64 bit systems:
<html:pre>-a always,exit -F arch=b32 -S stime -F key=audit_time_rules</html:pre>
Since the 64 bit version of the "stime" system call is not defined in the audit
lookup table, the corresponding "-F arch=b64" form of this rule is not expected
to be defined on 64 bit systems (the aforementioned "-F arch=b32" stime rule
form itself is sufficient for both 32 bit and 64 bit systems). If the
<html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code> utility to
read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file for both 32 bit and 64 bit systems:
<html:pre>-a always,exit -F arch=b32 -S stime -F key=audit_time_rules</html:pre>
Since the 64 bit version of the "stime" system call is not defined in the audit
lookup table, the corresponding "-F arch=b64" form of this rule is not expected
to be defined on 64 bit systems (the aforementioned "-F arch=b32" stime rule
form itself is sufficient for both 32 bit and 64 bit systems). The -k option
allows for the specification of a key in string form that can be used for
better reporting capability through ausearch and aureport. Multiple system
calls can be defined on the same line to save space if desired, but is not
required. See an example of multiple combined system calls:
<html:pre>-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.2.b</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_time_stime"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
    # Create expected audit group and audit rule form for particular system call &amp; architecture
    if [ ${ARCH} = "b32" ]
    then
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        # stime system call is known at 32-bit arch (see e.g "$ ausyscall i386 stime" 's output)
        # so append it to the list of time group system calls to be audited
        SYSCALL="adjtimex settimeofday stime"
        SYSCALL_GROUPING="adjtimex settimeofday stime"
    elif [ ${ARCH} = "b64" ]
    then
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        # stime system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
        # therefore don't add it to the list of time group system calls to be audited
        SYSCALL="adjtimex settimeofday"
        SYSCALL_GROUPING="adjtimex settimeofday"
    fi
    OTHER_FILTERS=""
    AUID_FILTERS=""
    KEY="audit_time_rules"
    # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
    unset syscall_a
    unset syscall_grouping
    unset syscall_string
    unset syscall
    unset file_to_edit
    unset rule_to_edit
    unset rule_syscalls_to_edit
    unset other_string
    unset auid_string
    unset full_rule

    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    #
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()


    # If audit tool is 'augenrules', then check if the audit rule is defined
    # If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
    # If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
    default_file="/etc/audit/rules.d/$KEY.rules"
    # As other_filters may include paths, lets use a different delimiter for it
    # The "F" script expression tells sed to print the filenames where the expressions matched
    readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
    # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
    if [ ${#files_to_inspect[@]} -eq "0" ]
    then
        file_to_inspect="/etc/audit/rules.d/$KEY.rules"
        files_to_inspect=("$file_to_inspect")
        if [ ! -e "$file_to_inspect" ]
        then
            touch "$file_to_inspect"
            chmod 0640 "$file_to_inspect"
        fi
    fi

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                       # A syscall was not found in the candidate rule
                       all_syscalls_found=1
                       }
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [ "${#candidate_rules[@]}" -gt 0 ]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [ "${#syscall_a[@]}" -gt 0 ]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod o-rwx ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
                   # A syscall was not found in the candidate rule
                   new_grouped_syscalls+="${delimiter}${syscall}"
                   }
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
    unset syscall_a
    unset syscall_grouping
    unset syscall_string
    unset syscall
    unset file_to_edit
    unset rule_to_edit
    unset rule_syscalls_to_edit
    unset other_string
    unset auid_string
    unset full_rule

    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    #
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()



    # If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
    # file to the list of files to be inspected
    default_file="/etc/audit/audit.rules"
    files_to_inspect+=('/etc/audit/audit.rules' )

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                       # A syscall was not found in the candidate rule
                       all_syscalls_found=1
                       }
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [ "${#candidate_rules[@]}" -gt 0 ]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [ "${#syscall_a[@]}" -gt 0 ]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod o-rwx ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
                   # A syscall was not found in the candidate rule
                   new_grouped_syscalls+="${delimiter}${syscall}"
                   }
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_time_stime" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_stime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for stime syscall for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - stime
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of stime in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
      set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - stime
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of stime in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_stime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="audit_rules_time_stime" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20stime%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20stime%20-k%20audit_time_rules%0A }}
        mode: 0600
        path: /etc/audit/rules.d/75-syscall-stime.rules
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_time_stime:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_time_stime_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_time_watch_localtime" severity="medium">
                <xccdf-1.2:title>Record Attempts to Alter the localtime File</xccdf-1.2:title>
                <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the default),
add the following line to a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>:
<html:pre>-w /etc/localtime -p wa -k audit_time_rules</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-w /etc/localtime -p wa -k audit_time_rules</html:pre>
The -k option allows for the specification of a key in string form that can
be used for better reporting capability through ausearch and aureport and
should always be used.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.2.b</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#audit"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_time_watch_localtime"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/localtime" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/localtime $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/localtime$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/localtime -p wa -k audit_time_rules" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_time_rules.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/localtime" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_time_rules.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_time_rules.rules"
    # If the audit_time_rules.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/localtime" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/localtime $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/localtime$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/localtime -p wa -k audit_time_rules" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_time_watch_localtime" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/localtime already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/localtime\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_time_rules
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_time_rules$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/audit_time_rules.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/audit_time_rules.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/localtime in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/localtime -p wa -k audit_time_rules
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/localtime already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/localtime\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/localtime in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/localtime -p wa -k audit_time_rules
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="audit_rules_time_watch_localtime" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ -w%20/etc/localtime%20-p%20wa%20-k%20audit_time_rules%0A }}
        mode: 0600
        path: /etc/audit/rules.d/75-etclocaltime-wa-audit_time_rules.rules
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-audit_rules_time_watch_localtime:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-audit_rules_time_watch_localtime_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_configure_auditd_data_retention">
            <xccdf-1.2:title>Configure auditd Data Retention</xccdf-1.2:title>
            <xccdf-1.2:description>The audit system writes data to <html:code>/var/log/audit/audit.log</html:code>. By default,
<html:code>auditd</html:code> rotates 5 logs by size (6MB), retaining a maximum of 30MB of
data in total, and refuses to write entries when the disk is too
full. This minimizes the risk of audit data filling its partition
and impacting other services. This also minimizes the risk of the audit
daemon temporarily disabling the system if it cannot write audit log (which
it can be configured to do).

For a busy
system or a system which is thoroughly auditing system activity, the default settings
for data retention may be
 insufficient. The log file size needed will depend heavily on what types
of events are being audited. First configure auditing to log all the events of
interest. Then monitor the log size manually for awhile to determine what file
size will allow you to keep the required data for the correct time period.
<html:br/><html:br/>
Using a dedicated partition for <html:code>/var/log/audit</html:code> prevents the
<html:code>auditd</html:code> logs from disrupting system functionality if they fill, and,
more importantly, prevents other activity in <html:code>/var</html:code> from filling the
partition and stopping the audit trail. (The audit logs are size-limited and
therefore unlikely to grow without bound unless configured to do so.) Some
machines may have requirements that no actions occur which cannot be audited.
If this is the case, then <html:code>auditd</html:code> can be configured to halt the machine
if it runs out of space. <html:b>Note:</html:b> Since older logs are rotated,
configuring <html:code>auditd</html:code> this way does not prevent older logs from being
rotated away before they can be viewed.

<html:i>If your system is configured to halt when logging cannot be performed, make
sure this can never happen under normal circumstances! Ensure that
<html:code>/var/log/audit</html:code> is on its own partition, and that this partition is
larger than the maximum amount of data <html:code>auditd</html:code> will retain
normally.</html:i></xccdf-1.2:description>
            <xccdf-1.2:platform idref="#audit"/>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_audispd_disk_full_action" type="string">
              <xccdf-1.2:title>Action for audispd to take when disk is full</xccdf-1.2:title>
              <xccdf-1.2:description>The setting for disk_full_action in /etc/audisp/audisp-remote.conf</xccdf-1.2:description>
              <xccdf-1.2:value>single</xccdf-1.2:value>
              <xccdf-1.2:value selector="exec">exec</xccdf-1.2:value>
              <xccdf-1.2:value selector="halt">halt</xccdf-1.2:value>
              <xccdf-1.2:value selector="single">single</xccdf-1.2:value>
              <xccdf-1.2:value selector="suspend">suspend</xccdf-1.2:value>
              <xccdf-1.2:value selector="syslog">syslog</xccdf-1.2:value>
              <xccdf-1.2:value selector="warn_once">warn_once</xccdf-1.2:value>
              <xccdf-1.2:value selector="stop">stop</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_audispd_network_failure_action" type="string">
              <xccdf-1.2:title>Action for audispd to take when network fails</xccdf-1.2:title>
              <xccdf-1.2:description>The setting for network_failure_action in /etc/audisp/audisp-remote.conf</xccdf-1.2:description>
              <xccdf-1.2:value>single</xccdf-1.2:value>
              <xccdf-1.2:value selector="exec">exec</xccdf-1.2:value>
              <xccdf-1.2:value selector="halt">halt</xccdf-1.2:value>
              <xccdf-1.2:value selector="single">single</xccdf-1.2:value>
              <xccdf-1.2:value selector="suspend">suspend</xccdf-1.2:value>
              <xccdf-1.2:value selector="syslog">syslog</xccdf-1.2:value>
              <xccdf-1.2:value selector="warn_once">warn_once</xccdf-1.2:value>
              <xccdf-1.2:value selector="stop">stop</xccdf-1.2:value>
              <xccdf-1.2:value selector="ignore">ignore</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_audispd_remote_server" type="string" interactive="true">
              <xccdf-1.2:title>Remote server for audispd to send audit records</xccdf-1.2:title>
              <xccdf-1.2:description>
The setting for remote_server in /etc/audit/audisp-remote.conf</xccdf-1.2:description>
              <xccdf-1.2:value>logcollector</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" type="string">
              <xccdf-1.2:title>Account for auditd to send email when actions occurs</xccdf-1.2:title>
              <xccdf-1.2:description>The setting for action_mail_acct in /etc/audit/auditd.conf</xccdf-1.2:description>
              <xccdf-1.2:value selector="admin">admin</xccdf-1.2:value>
              <xccdf-1.2:value>root</xccdf-1.2:value>
              <xccdf-1.2:value selector="root">root</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action" type="string">
              <xccdf-1.2:title>Action for auditd to take when disk space is low</xccdf-1.2:title>
              <xccdf-1.2:description>The setting for admin_space_left_action in /etc/audit/auditd.conf</xccdf-1.2:description>
              <xccdf-1.2:value>single</xccdf-1.2:value>
              <xccdf-1.2:value selector="email">email</xccdf-1.2:value>
              <xccdf-1.2:value selector="exec">exec</xccdf-1.2:value>
              <xccdf-1.2:value selector="halt">halt</xccdf-1.2:value>
              <xccdf-1.2:value selector="single">single</xccdf-1.2:value>
              <xccdf-1.2:value selector="suspend">suspend</xccdf-1.2:value>
              <xccdf-1.2:value selector="syslog">syslog</xccdf-1.2:value>
              <xccdf-1.2:value selector="rotate">rotate</xccdf-1.2:value>
              <xccdf-1.2:value selector="ignore">ignore</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_disk_error_action" type="string">
              <xccdf-1.2:title>Action for auditd to take when disk errors</xccdf-1.2:title>
              <xccdf-1.2:description>The setting for disk_error_action in /etc/audit/auditd.conf</xccdf-1.2:description>
              <xccdf-1.2:value>single</xccdf-1.2:value>
              <xccdf-1.2:value selector="exec">exec</xccdf-1.2:value>
              <xccdf-1.2:value selector="halt">halt</xccdf-1.2:value>
              <xccdf-1.2:value selector="single">single</xccdf-1.2:value>
              <xccdf-1.2:value selector="suspend">suspend</xccdf-1.2:value>
              <xccdf-1.2:value selector="syslog">syslog</xccdf-1.2:value>
              <xccdf-1.2:value selector="ignore">ignore</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_disk_full_action" type="string">
              <xccdf-1.2:title>Action for auditd to take when disk is full</xccdf-1.2:title>
              <xccdf-1.2:description>The setting for disk_full_action in /etc/audit/auditd.conf</xccdf-1.2:description>
              <xccdf-1.2:value>single</xccdf-1.2:value>
              <xccdf-1.2:value selector="exec">exec</xccdf-1.2:value>
              <xccdf-1.2:value selector="halt">halt</xccdf-1.2:value>
              <xccdf-1.2:value selector="single">single</xccdf-1.2:value>
              <xccdf-1.2:value selector="suspend">suspend</xccdf-1.2:value>
              <xccdf-1.2:value selector="syslog">syslog</xccdf-1.2:value>
              <xccdf-1.2:value selector="ignore">ignore</xccdf-1.2:value>
              <xccdf-1.2:value selector="rotate">rotate</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_flush" type="string">
              <xccdf-1.2:title>Auditd priority for flushing data to disk</xccdf-1.2:title>
              <xccdf-1.2:description>The setting for flush in /etc/audit/auditd.conf</xccdf-1.2:description>
              <xccdf-1.2:value selector="data">data</xccdf-1.2:value>
              <xccdf-1.2:value>data</xccdf-1.2:value>
              <xccdf-1.2:value selector="incremental">incremental</xccdf-1.2:value>
              <xccdf-1.2:value selector="incremental_async">incremental_async</xccdf-1.2:value>
              <xccdf-1.2:value selector="none">none</xccdf-1.2:value>
              <xccdf-1.2:value selector="sync">sync</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_max_log_file" type="number">
              <xccdf-1.2:title>Maximum audit log file size for auditd</xccdf-1.2:title>
              <xccdf-1.2:description>The setting for max_log_file in /etc/audit/auditd.conf</xccdf-1.2:description>
              <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
              <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
              <xccdf-1.2:value selector="20">20</xccdf-1.2:value>
              <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
              <xccdf-1.2:value selector="6">6</xccdf-1.2:value>
              <xccdf-1.2:value>6</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action" type="string">
              <xccdf-1.2:title>Action for auditd to take when log files reach their maximum size</xccdf-1.2:title>
              <xccdf-1.2:description>The setting for max_log_file_action in /etc/audit/auditd.conf. The following options are available:
<html:br/>ignore - audit daemon does nothing.
<html:br/>syslog - audit daemon will issue a warning to syslog.
<html:br/>suspend - audit daemon will stop writing records to the disk.
<html:br/>rotate - audit daemon will rotate logs in the same convention used by logrotate.
<html:br/>keep_logs - similar to rotate but prevents audit logs to be overwritten. May trigger space_left_action if volume is full.</xccdf-1.2:description>
              <xccdf-1.2:value>rotate</xccdf-1.2:value>
              <xccdf-1.2:value selector="keep_logs">keep_logs</xccdf-1.2:value>
              <xccdf-1.2:value selector="rotate">rotate</xccdf-1.2:value>
              <xccdf-1.2:value selector="suspend">suspend</xccdf-1.2:value>
              <xccdf-1.2:value selector="syslog">syslog</xccdf-1.2:value>
              <xccdf-1.2:value selector="ignore">ignore</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_num_logs" type="number">
              <xccdf-1.2:title>Number of log files for auditd to retain</xccdf-1.2:title>
              <xccdf-1.2:description>The setting for num_logs in /etc/audit/auditd.conf</xccdf-1.2:description>
              <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
              <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
              <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
              <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
              <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
              <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
              <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
              <xccdf-1.2:value selector="20">20</xccdf-1.2:value>
              <xccdf-1.2:value selector="50">50</xccdf-1.2:value>
              <xccdf-1.2:value selector="100">100</xccdf-1.2:value>
              <xccdf-1.2:value>5</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_space_left" type="number">
              <xccdf-1.2:title>Size remaining in disk space before prompting space_left_action</xccdf-1.2:title>
              <xccdf-1.2:description>The setting for space_left (MB) in /etc/audit/auditd.conf</xccdf-1.2:description>
              <xccdf-1.2:value selector="1000MB">1000</xccdf-1.2:value>
              <xccdf-1.2:value selector="100MB">100</xccdf-1.2:value>
              <xccdf-1.2:value selector="250MB">250</xccdf-1.2:value>
              <xccdf-1.2:value selector="500MB">500</xccdf-1.2:value>
              <xccdf-1.2:value selector="750MB">750</xccdf-1.2:value>
              <xccdf-1.2:value>100</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_space_left_action" type="string">
              <xccdf-1.2:title>Action for auditd to take when disk space just starts to run low</xccdf-1.2:title>
              <xccdf-1.2:description>The setting for space_left_action in /etc/audit/auditd.conf</xccdf-1.2:description>
              <xccdf-1.2:value>email</xccdf-1.2:value>
              <xccdf-1.2:value selector="email">email</xccdf-1.2:value>
              <xccdf-1.2:value selector="exec">exec</xccdf-1.2:value>
              <xccdf-1.2:value selector="halt">halt</xccdf-1.2:value>
              <xccdf-1.2:value selector="single">single</xccdf-1.2:value>
              <xccdf-1.2:value selector="suspend">suspend</xccdf-1.2:value>
              <xccdf-1.2:value selector="syslog">syslog</xccdf-1.2:value>
              <xccdf-1.2:value selector="rotate">rotate</xccdf-1.2:value>
              <xccdf-1.2:value selector="ignore">ignore</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_space_left_percentage" type="number" interactive="true">
              <xccdf-1.2:title>The percentage remaining in disk space before prompting space_left_action</xccdf-1.2:title>
              <xccdf-1.2:description>The setting for space_left as a percentage in /etc/audit/auditd.conf</xccdf-1.2:description>
              <xccdf-1.2:value selector="25pc">25</xccdf-1.2:value>
              <xccdf-1.2:value selector="50pc">50</xccdf-1.2:value>
              <xccdf-1.2:value selector="75pc">75</xccdf-1.2:value>
              <xccdf-1.2:value>25</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_audispd_configure_remote_server" severity="medium">
              <xccdf-1.2:title>Configure audispd Plugin To Send Logs To Remote Server</xccdf-1.2:title>
              <xccdf-1.2:description>Configure the audispd plugin to off-load audit records onto a different
system or media from the system being audited.

Set the <html:code>remote_server</html:code> option in <html:pre>/etc/audit/audisp-remote.conf</html:pre>
with an IP address or hostname of the system that the audispd plugin should
send audit records to. For example
<html:pre>remote_server = <html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_audispd_remote_server" use="legacy"/></html:i></html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000051-VMM-000230</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000058-VMM-000270</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000059-VMM-000280</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000479-VMM-001990</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000479-VMM-001990</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Information stored in one location is vulnerable to accidental or incidental
deletion or alteration.Off-loading is a common process in information systems
with limited audit storage capacity.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_audispd_configure_remote_server"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

var_audispd_remote_server='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_audispd_remote_server" use="legacy"/>'



AUDITCONFIG=/etc/audit/audisp-remote.conf




# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "$AUDITCONFIG"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^remote_server")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_audispd_remote_server"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^remote_server\\&gt;" "$AUDITCONFIG"; then
    "${sed_command[@]}" "s/^remote_server\\&gt;.*/$formatted_output/gi" "$AUDITCONFIG"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDITCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_audispd_configure_remote_server" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - auditd_audispd_configure_remote_server
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
- name: XCCDF Value var_audispd_remote_server # promote to variable
  set_fact:
    var_audispd_remote_server: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_audispd_remote_server" use="legacy"/>
  tags:
    - always

- name: Make sure that a remote server is configured for Audispd
  lineinfile:
    path: /etc/audit/audisp-remote.conf
    line: remote_server = {{ var_audispd_remote_server }}
    regexp: ^\s*remote_server\s*=.*$
    create: true
    state: present
  when: '"audit" in ansible_facts.packages'
  tags:
    - auditd_audispd_configure_remote_server
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_audispd_remote_server:var:1" value-id="xccdf_org.ssgproject.content_value_var_audispd_remote_server"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-auditd_audispd_configure_remote_server:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-auditd_audispd_configure_remote_server_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_audispd_encrypt_sent_records" severity="medium">
              <xccdf-1.2:title>Encrypt Audit Records Sent With audispd Plugin</xccdf-1.2:title>
              <xccdf-1.2:description>Configure the operating system to encrypt the transfer of off-loaded audit
records onto a different system or media from the system being audited.

Set the <html:code>transport</html:code> option in <html:pre>/etc/audit/audisp-remote.conf</html:pre>
to <html:code>KRB5</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Information stored in one location is vulnerable to accidental or incidental deletion
or alteration. Off-loading is a common process in information systems with limited
audit storage capacity.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_audispd_encrypt_sent_records"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

AUDISP_REMOTE_CONFIG="/etc/audit/audisp-remote.conf"
option="^transport"
value="KRB5"


# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "$AUDISP_REMOTE_CONFIG"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "$option")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "$option\\&gt;" "$AUDISP_REMOTE_CONFIG"; then
    "${sed_command[@]}" "s/$option\\&gt;.*/$formatted_output/gi" "$AUDISP_REMOTE_CONFIG"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDISP_REMOTE_CONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-auditd_audispd_encrypt_sent_records:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-auditd_audispd_encrypt_sent_records_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_audispd_syslog_plugin_activated" severity="medium">
              <xccdf-1.2:title>Configure auditd to use audispd's syslog plugin</xccdf-1.2:title>
              <xccdf-1.2:description>To configure the <html:code>auditd</html:code> service to use the
<html:code>syslog</html:code> plug-in of the <html:code>audispd</html:code> audit event multiplexor, set
the <html:code>active</html:code> line in <html:code>/etc/audit/plugins.d/syslog.conf</html:code> to <html:code>yes</html:code>.
Restart the <html:code>auditd</html:code> service:
<html:pre>$ sudo service auditd restart</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000136</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(6)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(8)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.314(a)(2)(i)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.314(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000051-VMM-000230</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000058-VMM-000270</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000059-VMM-000280</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000479-VMM-001990</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000479-VMM-001990</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The auditd service does not include the ability to send audit
records to a centralized server for management directly. It does, however,
include a plug-in for audit event multiplexor (audispd) to pass audit records
to the local syslog server</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_audispd_syslog_plugin_activated"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

var_syslog_active="yes"


AUDISP_SYSLOGCONFIG=/etc/audit/plugins.d/syslog.conf


# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "$AUDISP_SYSLOGCONFIG"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^active")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_syslog_active"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^active\\&gt;" "$AUDISP_SYSLOGCONFIG"; then
    "${sed_command[@]}" "s/^active\\&gt;.*/$formatted_output/gi" "$AUDISP_SYSLOGCONFIG"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDISP_SYSLOGCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_audispd_syslog_plugin_activated" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-4(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.3
    - auditd_audispd_syslog_plugin_activated
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: enable syslog plugin
  lineinfile:
    dest: /etc/audit/plugins.d/syslog.conf
    regexp: ^active
    line: active = yes
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-4(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.3
    - auditd_audispd_syslog_plugin_activated
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-auditd_audispd_syslog_plugin_activated:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-auditd_audispd_syslog_plugin_activated_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_data_disk_error_action" severity="medium">
              <xccdf-1.2:title>Configure auditd Disk Error Action on Disk Error</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>auditd</html:code> service can be configured to take an action
when there is a disk error.
Edit the file <html:code>/etc/audit/auditd.conf</html:code>. Add or modify the following line,
substituting <html:i>ACTION</html:i> appropriately:
<html:pre>disk_error_action = <html:i>ACTION</html:i></html:pre>
Set this value to <html:code>single</html:code> to cause the system to switch to single-user
mode for corrective action. Acceptable values also include <html:code>syslog</html:code>,
<html:code>exec</html:code>, <html:code>single</html:code>, and <html:code>halt</html:code>. For certain systems, the need for availability
outweighs the need to log all actions, and a different setting should be
determined. Details regarding all possible values for <html:i>ACTION</html:i> are described in the
<html:code>auditd.conf</html:code> man page.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000140</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000047-GPOS-00023</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Taking appropriate action in case of disk errors will minimize the possibility of
losing audit records.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_data_disk_error_action" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - auditd_data_disk_error_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_auditd_disk_error_action # promote to variable
  set_fact:
    var_auditd_disk_error_action: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_disk_error_action" use="legacy"/>
  tags:
    - always

- name: Configure auditd Disk Error Action on Disk Error
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: disk_error_action = {{ var_auditd_disk_error_action }}
    regexp: ^\s*disk_error_action\s*=\s*.*$
    state: present
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - auditd_data_disk_error_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="auditd_data_disk_error_action" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }}
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_disk_error_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_disk_error_action"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-auditd_data_disk_error_action:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-auditd_data_disk_error_action_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_data_disk_full_action" severity="medium">
              <xccdf-1.2:title>Configure auditd Disk Full Action when Disk Space Is Full</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>auditd</html:code> service can be configured to take an action
when disk space is running low but prior to running out of space completely.
Edit the file <html:code>/etc/audit/auditd.conf</html:code>. Add or modify the following line,
substituting <html:i>ACTION</html:i> appropriately:
<html:pre>disk_full_action = <html:i>ACTION</html:i></html:pre>
Set this value to <html:code>single</html:code> to cause the system to switch to single-user
mode for corrective action. Acceptable values also include <html:code>syslog</html:code>,

<html:code>exec</html:code>,

<html:code>single</html:code>, and <html:code>halt</html:code>. For certain systems, the need for availability
outweighs the need to log all actions, and a different setting should be
determined. Details regarding all possible values for <html:i>ACTION</html:i> are described in the
<html:code>auditd.conf</html:code> man page.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000140</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000047-GPOS-00023</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Taking appropriate action in case of a filled audit storage volume will minimize
the possibility of losing audit records.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_data_disk_full_action" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - auditd_data_disk_full_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_auditd_disk_full_action # promote to variable
  set_fact:
    var_auditd_disk_full_action: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_disk_full_action" use="legacy"/>
  tags:
    - always

- name: Configure auditd Disk Full Action when Disk Space Is Full
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: disk_full_action = {{ var_auditd_disk_full_action }}
    regexp: ^\s*disk_full_action\s*=\s*.*$
    state: present
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - auditd_data_disk_full_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="auditd_data_disk_full_action" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }}
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_disk_full_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_disk_full_action"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-auditd_data_disk_full_action:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-auditd_data_disk_full_action_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct" severity="medium">
              <xccdf-1.2:title>Configure auditd mail_acct Action on Low Disk Space</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>auditd</html:code> service can be configured to send email to
a designated account in certain situations. Add or correct the following line
in <html:code>/etc/audit/auditd.conf</html:code> to ensure that administrators are notified
via email for those situations:
<html:pre>action_mail_acct = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" use="legacy"/></html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000139</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001855</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.7.a</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000046-GPOS-00022</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000343-GPOS-00134</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000046-VMM-000210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000343-VMM-001240</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Email sent to the root account is typically aliased to the
administrators of the system, who can take appropriate action.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_data_retention_action_mail_acct"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

var_auditd_action_mail_acct='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" use="legacy"/>'


AUDITCONFIG=/etc/audit/auditd.conf

# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "$AUDITCONFIG"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^action_mail_acct")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_action_mail_acct"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^action_mail_acct\\&gt;" "$AUDITCONFIG"; then
    "${sed_command[@]}" "s/^action_mail_acct\\&gt;.*/$formatted_output/gi" "$AUDITCONFIG"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDITCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_data_retention_action_mail_acct" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)
    - PCI-DSS-Req-10.7.a
    - auditd_data_retention_action_mail_acct
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_auditd_action_mail_acct # promote to variable
  set_fact:
    var_auditd_action_mail_acct: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" use="legacy"/>
  tags:
    - always

- name: Configure auditd mail_acct Action on Low Disk Space
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: action_mail_acct = {{ var_auditd_action_mail_acct }}
    state: present
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)
    - PCI-DSS-Req-10.7.a
    - auditd_data_retention_action_mail_acct
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_action_mail_acct:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-auditd_data_retention_action_mail_acct:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-auditd_data_retention_action_mail_acct_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action" severity="medium">
              <xccdf-1.2:title>Configure auditd admin_space_left Action on Low Disk Space</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>auditd</html:code> service can be configured to take an action
when disk space is running low but prior to running out of space completely.
Edit the file <html:code>/etc/audit/auditd.conf</html:code>. Add or modify the following line,
substituting <html:i>ACTION</html:i> appropriately:
<html:pre>admin_space_left_action = <html:i>ACTION</html:i></html:pre>
Set this value to <html:code>single</html:code> to cause the system to switch to single user
mode for corrective action. Acceptable values also include <html:code>suspend</html:code> and
<html:code>halt</html:code>. For certain systems, the need for availability
outweighs the need to log all actions, and a different setting should be
determined. Details regarding all possible values for <html:i>ACTION</html:i> are described in the
<html:code>auditd.conf</html:code> man page.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000140</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001343</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001855</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000343-GPOS-00134</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Administrators should be made aware of an inability to record
audit records. If a separate partition or logical volume of adequate size
is used, running low on space for audit records should never occur.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_data_retention_admin_space_left_action"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

var_auditd_admin_space_left_action='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action" use="legacy"/>'


AUDITCONFIG=/etc/audit/auditd.conf

# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "$AUDITCONFIG"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^admin_space_left_action")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_admin_space_left_action"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^admin_space_left_action\\&gt;" "$AUDITCONFIG"; then
    "${sed_command[@]}" "s/^admin_space_left_action\\&gt;.*/$formatted_output/gi" "$AUDITCONFIG"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDITCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_data_retention_admin_space_left_action" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_admin_space_left_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_auditd_admin_space_left_action # promote to variable
  set_fact:
    var_auditd_admin_space_left_action: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action" use="legacy"/>
  tags:
    - always

- name: Configure auditd admin_space_left Action on Low Disk Space
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: admin_space_left_action = {{ var_auditd_admin_space_left_action }}
    regexp: ^\s*admin_space_left_action\s*=\s*.*$
    state: present
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_admin_space_left_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="auditd_data_retention_admin_space_left_action" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }}
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_admin_space_left_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-auditd_data_retention_admin_space_left_action:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-auditd_data_retention_admin_space_left_action_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_data_retention_flush" severity="medium">
              <xccdf-1.2:title>Configure auditd flush priority</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>auditd</html:code> service can be configured to
synchronously write audit event data to disk. Add or correct the following
line in <html:code>/etc/audit/auditd.conf</html:code> to ensure that audit event data is
fully synchronized with the log files on the disk:
<html:pre>flush = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_flush" use="legacy"/></html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001576</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Audit data should be synchronously written to disk to ensure
log integrity. These parameters assure that all audit event data is fully
synchronized with the log files on the disk.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_data_retention_flush" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-11
    - NIST-800-53-CM-6(a)
    - auditd_data_retention_flush
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_auditd_flush # promote to variable
  set_fact:
    var_auditd_flush: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_flush" use="legacy"/>
  tags:
    - always

- name: Configure auditd Flush Priority
  lineinfile:
    dest: /etc/audit/auditd.conf
    regexp: ^\s*flush\s*=\s*.*$
    line: flush = {{ var_auditd_flush }}
    state: present
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-11
    - NIST-800-53-CM-6(a)
    - auditd_data_retention_flush
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="auditd_data_retention_flush" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }}
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_flush:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_flush"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-auditd_data_retention_flush:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-auditd_data_retention_flush_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file" severity="medium">
              <xccdf-1.2:title>Configure auditd Max Log File Size</xccdf-1.2:title>
              <xccdf-1.2:description>Determine the amount of audit data (in megabytes)
which should be retained in each log file. Edit the file
<html:code>/etc/audit/auditd.conf</html:code>. Add or modify the following line, substituting
the correct value of <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file" use="legacy"/> for <html:i>STOREMB</html:i>:
<html:pre>max_log_file = <html:i>STOREMB</html:i></html:pre>
Set the value to <html:code>6</html:code> (MB) or higher for general-purpose systems.
Larger values, of course,
support retention of even more audit data.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.7</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The total storage for audit log files must be large enough to retain
log information over the period required. This is a function of the maximum
log file size and the number of logs retained.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_data_retention_max_log_file"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

var_auditd_max_log_file='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file" use="legacy"/>'


AUDITCONFIG=/etc/audit/auditd.conf

# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "$AUDITCONFIG"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^max_log_file")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_max_log_file"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^max_log_file\\&gt;" "$AUDITCONFIG"; then
    "${sed_command[@]}" "s/^max_log_file\\&gt;.*/$formatted_output/gi" "$AUDITCONFIG"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDITCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_data_retention_max_log_file" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-53-AU-11
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_max_log_file
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_auditd_max_log_file # promote to variable
  set_fact:
    var_auditd_max_log_file: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file" use="legacy"/>
  tags:
    - always

- name: Configure auditd Max Log File Size
  lineinfile:
    dest: /etc/audit/auditd.conf
    regexp: ^\s*max_log_file\s*=\s*.*$
    line: max_log_file = {{ var_auditd_max_log_file }}
    state: present
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-53-AU-11
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_max_log_file
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="auditd_data_retention_max_log_file" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }}
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_max_log_file:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_max_log_file"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-auditd_data_retention_max_log_file:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-auditd_data_retention_max_log_file_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action" severity="medium">
              <xccdf-1.2:title>Configure auditd max_log_file_action Upon Reaching Maximum Log Size</xccdf-1.2:title>
              <xccdf-1.2:description>The default action to take when the logs reach their maximum size
is to rotate the log files, discarding the oldest one. To configure the action taken
by <html:code>auditd</html:code>, add or correct the line in <html:code>/etc/audit/auditd.conf</html:code>:
<html:pre>max_log_file_action = <html:i>ACTION</html:i></html:pre>
Possible values for <html:i>ACTION</html:i> are described in the <html:code>auditd.conf</html:code> man
page. These include:
<html:ul><html:li><html:code>ignore</html:code></html:li><html:li><html:code>syslog</html:code></html:li><html:li><html:code>suspend</html:code></html:li><html:li><html:code>rotate</html:code></html:li><html:li><html:code>keep_logs</html:code></html:li></html:ul>
Set the <html:code><html:i>ACTION</html:i></html:code> to <html:code>rotate</html:code> to ensure log rotation
occurs. This is the default. The setting is case-insensitive.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000140</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000047-GPOS-00023</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Automatically rotating logs (by setting this to <html:code>rotate</html:code>)
minimizes the chances of the system unexpectedly running out of disk space by
being overwhelmed with log data. However, for systems that must never discard
log data, or which use external processes to transfer it and reclaim space,
<html:code>keep_logs</html:code> can be employed.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_data_retention_max_log_file_action"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

var_auditd_max_log_file_action='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action" use="legacy"/>'


AUDITCONFIG=/etc/audit/auditd.conf

# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "$AUDITCONFIG"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^max_log_file_action")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_max_log_file_action"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^max_log_file_action\\&gt;" "$AUDITCONFIG"; then
    "${sed_command[@]}" "s/^max_log_file_action\\&gt;.*/$formatted_output/gi" "$AUDITCONFIG"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDITCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_data_retention_max_log_file_action" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_max_log_file_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_auditd_max_log_file_action # promote to variable
  set_fact:
    var_auditd_max_log_file_action: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action" use="legacy"/>
  tags:
    - always

- name: Configure auditd max_log_file_action Upon Reaching Maximum Log Size
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: max_log_file_action = {{ var_auditd_max_log_file_action }}
    regexp: ^\s*max_log_file_action\s*=\s*.*$
    state: present
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_max_log_file_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="auditd_data_retention_max_log_file_action" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }}
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_max_log_file_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-auditd_data_retention_max_log_file_action:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-auditd_data_retention_max_log_file_action_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_data_retention_num_logs" severity="medium">
              <xccdf-1.2:title>Configure auditd Number of Logs Retained</xccdf-1.2:title>
              <xccdf-1.2:description>Determine how many log files
<html:code>auditd</html:code> should retain when it rotates logs.
Edit the file <html:code>/etc/audit/auditd.conf</html:code>. Add or modify the following
line, substituting <html:i>NUMLOGS</html:i> with the correct value of <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_num_logs" use="legacy"/>:
<html:pre>num_logs = <html:i>NUMLOGS</html:i></html:pre>
Set the value to 5 for general-purpose systems.
Note that values less than 2 result in no log rotation.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.7</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The total storage for audit log files must be large enough to retain
log information over the period required. This is a function of the maximum log
file size and the number of logs retained.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_data_retention_num_logs"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

var_auditd_num_logs='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_num_logs" use="legacy"/>'


AUDITCONFIG=/etc/audit/auditd.conf

# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "$AUDITCONFIG"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^num_logs")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_num_logs"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^num_logs\\&gt;" "$AUDITCONFIG"; then
    "${sed_command[@]}" "s/^num_logs\\&gt;.*/$formatted_output/gi" "$AUDITCONFIG"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDITCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_data_retention_num_logs" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-11
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_num_logs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_auditd_num_logs # promote to variable
  set_fact:
    var_auditd_num_logs: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_num_logs" use="legacy"/>
  tags:
    - always

- name: Configure auditd Number of Logs Retained
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: num_logs = {{ var_auditd_num_logs }}
    regexp: ^\s*num_logs\s*=\s*.*$
    state: present
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-11
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_num_logs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="auditd_data_retention_num_logs" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }}
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_num_logs:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_num_logs"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-auditd_data_retention_num_logs:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-auditd_data_retention_num_logs_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action" severity="medium">
              <xccdf-1.2:title>Configure auditd space_left Action on Low Disk Space</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>auditd</html:code> service can be configured to take an action
when disk space <html:i>starts</html:i> to run low.
Edit the file <html:code>/etc/audit/auditd.conf</html:code>. Modify the following line,
substituting <html:i>ACTION</html:i> appropriately:
<html:pre>space_left_action = <html:i>ACTION</html:i></html:pre>
Possible values for <html:i>ACTION</html:i> are described in the <html:code>auditd.conf</html:code> man page.
These include:
<html:ul><html:li><html:code>syslog</html:code></html:li><html:li><html:code>email</html:code></html:li><html:li><html:code>exec</html:code></html:li><html:li><html:code>suspend</html:code></html:li><html:li><html:code>single</html:code></html:li><html:li><html:code>halt</html:code></html:li></html:ul>
Set this to <html:code>email</html:code> (instead of the default,
which is <html:code>suspend</html:code>) as it is more likely to get prompt attention. Acceptable values
also include <html:code>suspend</html:code>, <html:code>single</html:code>, and <html:code>halt</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001855</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000343-GPOS-00134</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000343-VMM-001240</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Notifying administrators of an impending disk space problem may
allow them to take corrective action prior to any disruption.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_data_retention_space_left_action"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

var_auditd_space_left_action='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_action" use="legacy"/>'


#
# If space_left_action present in /etc/audit/auditd.conf, change value
# to var_auditd_space_left_action, else
# add "space_left_action = $var_auditd_space_left_action" to /etc/audit/auditd.conf
#

AUDITCONFIG=/etc/audit/auditd.conf

# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "$AUDITCONFIG"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^space_left_action")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_space_left_action"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^space_left_action\\&gt;" "$AUDITCONFIG"; then
    "${sed_command[@]}" "s/^space_left_action\\&gt;.*/$formatted_output/gi" "$AUDITCONFIG"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDITCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_data_retention_space_left_action" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_space_left_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_auditd_space_left_action # promote to variable
  set_fact:
    var_auditd_space_left_action: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_action" use="legacy"/>
  tags:
    - always

- name: Configure auditd space_left Action on Low Disk Space
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: space_left_action = {{ var_auditd_space_left_action }}
    regexp: ^\s*space_left_action\s*=\s*.*$
    state: present
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_space_left_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="auditd_data_retention_space_left_action" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }}
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_space_left_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_space_left_action"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-auditd_data_retention_space_left_action:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-auditd_data_retention_space_left_action_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_percentage" severity="medium">
              <xccdf-1.2:title>Configure auditd space_left on Low Disk Space</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>auditd</html:code> service can be configured to take an action
when disk space is running low but prior to running out of space completely.
Edit the file <html:code>/etc/audit/auditd.conf</html:code>. Add or modify the following line,
substituting <html:i>PERCENTAGE</html:i> appropriately:
<html:pre>space_left = <html:i>PERCENTAGE</html:i>%</html:pre>
Set this value to at least 25 to cause the system to
notify the user of an issue.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001855</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000343-GPOS-00134</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000343-VMM-001240</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Notifying administrators of an impending disk space problem may allow them to
take corrective action prior to any disruption.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_data_retention_space_left_percentage"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

var_auditd_space_left_percentage='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_percentage" use="legacy"/>'


grep -q "^space_left[[:space:]]*=.*$" /etc/audit/auditd.conf &amp;&amp; \
  sed -i "s/^space_left[[:space:]]*=.*$/space_left = $var_auditd_space_left_percentage%/g" /etc/audit/auditd.conf || \
  echo "space_left = $var_auditd_space_left_percentage%" &gt;&gt; /etc/audit/auditd.conf

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_data_retention_space_left_percentage" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_space_left_percentage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_auditd_space_left_percentage # promote to variable
  set_fact:
    var_auditd_space_left_percentage: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_percentage" use="legacy"/>
  tags:
    - always

- name: Configure auditd space_left on Low Disk Space
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: space_left = {{ var_auditd_space_left_percentage }}%
    regexp: ^\s*space_left\s*=\s*.*$
    state: present
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_space_left_percentage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_space_left_percentage:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_space_left_percentage"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-auditd_data_retention_space_left_percentage:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-auditd_data_retention_space_left_percentage_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_freq" severity="medium">
              <xccdf-1.2:title>Set number of records to cause an explicit flush to audit logs</xccdf-1.2:title>
              <xccdf-1.2:description>To configure Audit daemon to issue an explicit flush to disk command
after writing 50 records, set <html:code>freq</html:code> to <html:code>50</html:code>
in <html:code>/etc/audit/auditd.conf</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000051-GPOS-00024</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If option <html:code>freq</html:code> isn't set to <html:code>50</html:code>, the flush to disk
may happen after higher number of records, increasing the danger
of audit loss.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_freq" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

if [ -e "/etc/audit/auditd.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*freq\s*=\s*/Id" "/etc/audit/auditd.conf"
else
    touch "/etc/audit/auditd.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/audit/auditd.conf"

cp "/etc/audit/auditd.conf" "/etc/audit/auditd.conf.bak"
# Insert at the end of the file
printf '%s\n' "freq = 50" &gt;&gt; "/etc/audit/auditd.conf"
# Clean up after ourselves.
rm "/etc/audit/auditd.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_freq" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6
    - auditd_freq
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set number of records to cause an explicit flush to audit logs
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/audit/auditd.conf
        create: false
        regexp: (?i)^\s*freq\s*=\s*
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/audit/auditd.conf
      lineinfile:
        path: /etc/audit/auditd.conf
        create: false
        regexp: (?i)^\s*freq\s*=\s*
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/audit/auditd.conf
      lineinfile:
        path: /etc/audit/auditd.conf
        create: true
        regexp: (?i)^\s*freq\s*=\s*
        line: freq = 50
        state: present
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6
    - auditd_freq
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="auditd_freq" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }}
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-auditd_freq:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-auditd_freq_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_local_events" severity="medium">
              <xccdf-1.2:title>Include Local Events in Audit Logs</xccdf-1.2:title>
              <xccdf-1.2:description>To configure Audit daemon to include local events in Audit logs, set
<html:code>local_events</html:code> to <html:code>yes</html:code> in <html:code>/etc/audit/auditd.conf</html:code>.
This is the default setting.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If option <html:code>local_events</html:code> isn't set to <html:code>yes</html:code> only events from
network will be aggregated.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_local_events" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

if [ -e "/etc/audit/auditd.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*local_events\s*=\s*/Id" "/etc/audit/auditd.conf"
else
    touch "/etc/audit/auditd.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/audit/auditd.conf"

cp "/etc/audit/auditd.conf" "/etc/audit/auditd.conf.bak"
# Insert at the end of the file
printf '%s\n' "local_events = yes" &gt;&gt; "/etc/audit/auditd.conf"
# Clean up after ourselves.
rm "/etc/audit/auditd.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_local_events" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6
    - auditd_local_events
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Include Local Events in Audit Logs
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/audit/auditd.conf
        create: false
        regexp: (?i)^\s*local_events\s*=\s*
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/audit/auditd.conf
      lineinfile:
        path: /etc/audit/auditd.conf
        create: false
        regexp: (?i)^\s*local_events\s*=\s*
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/audit/auditd.conf
      lineinfile:
        path: /etc/audit/auditd.conf
        create: true
        regexp: (?i)^\s*local_events\s*=\s*
        line: local_events = yes
        state: present
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6
    - auditd_local_events
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="auditd_local_events" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }}
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-auditd_local_events:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-auditd_local_events_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_log_format" severity="medium">
              <xccdf-1.2:title>Resolve information before writing to audit logs</xccdf-1.2:title>
              <xccdf-1.2:description>To configure Audit daemon to resolve all uid, gid, syscall,
architecture, and socket address information before writing the
events to disk, set <html:code>log_format</html:code> to <html:code>ENRICHED</html:code>
in <html:code>/etc/audit/auditd.conf</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000255-GPOS-00096</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If option <html:code>log_format</html:code> isn't set to <html:code>ENRICHED</html:code>, the
audit records will be stored in a format exactly as the kernel sends them.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_log_format" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

if [ -e "/etc/audit/auditd.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*log_format\s*=\s*/Id" "/etc/audit/auditd.conf"
else
    touch "/etc/audit/auditd.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/audit/auditd.conf"

cp "/etc/audit/auditd.conf" "/etc/audit/auditd.conf.bak"
# Insert at the end of the file
printf '%s\n' "log_format = ENRICHED" &gt;&gt; "/etc/audit/auditd.conf"
# Clean up after ourselves.
rm "/etc/audit/auditd.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_log_format" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AU-3
    - NIST-800-53-CM-6
    - auditd_log_format
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Resolve information before writing to audit logs
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/audit/auditd.conf
        create: false
        regexp: (?i)^\s*log_format\s*=\s*
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/audit/auditd.conf
      lineinfile:
        path: /etc/audit/auditd.conf
        create: false
        regexp: (?i)^\s*log_format\s*=\s*
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/audit/auditd.conf
      lineinfile:
        path: /etc/audit/auditd.conf
        create: true
        regexp: (?i)^\s*log_format\s*=\s*
        line: log_format = ENRICHED
        state: present
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-3
    - NIST-800-53-CM-6
    - auditd_log_format
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="auditd_log_format" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }}
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-auditd_log_format:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-auditd_log_format_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_name_format" severity="medium">
              <xccdf-1.2:title>Set hostname as computer node name in audit logs</xccdf-1.2:title>
              <xccdf-1.2:description>To configure Audit daemon to use value returned by gethostname
syscall as computer node name in the audit events,
set <html:code>name_format</html:code> to <html:code>hostname</html:code>
in <html:code>/etc/audit/auditd.conf</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000039-GPOS-00017</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If option <html:code>name_format</html:code> is left at its default value of
<html:code>none</html:code>, audit events from different computers may be hard
to distinguish.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_name_format" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

if [ -e "/etc/audit/auditd.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*name_format\s*=\s*/Id" "/etc/audit/auditd.conf"
else
    touch "/etc/audit/auditd.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/audit/auditd.conf"

cp "/etc/audit/auditd.conf" "/etc/audit/auditd.conf.bak"
# Insert at the end of the file
printf '%s\n' "name_format = hostname" &gt;&gt; "/etc/audit/auditd.conf"
# Clean up after ourselves.
rm "/etc/audit/auditd.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_name_format" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AU-3
    - NIST-800-53-CM-6
    - auditd_name_format
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set hostname as computer node name in audit logs
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/audit/auditd.conf
        create: false
        regexp: (?i)^\s*name_format\s*=\s*
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/audit/auditd.conf
      lineinfile:
        path: /etc/audit/auditd.conf
        create: false
        regexp: (?i)^\s*name_format\s*=\s*
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/audit/auditd.conf
      lineinfile:
        path: /etc/audit/auditd.conf
        create: true
        regexp: (?i)^\s*name_format\s*=\s*
        line: name_format = hostname
        state: present
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-3
    - NIST-800-53-CM-6
    - auditd_name_format
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="auditd_name_format" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }}
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-auditd_name_format:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-auditd_name_format_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_overflow_action" severity="medium">
              <xccdf-1.2:title>Appropriate Action Must be Setup When the Internal Audit Event Queue is Full</xccdf-1.2:title>
              <xccdf-1.2:description>The audit system should have an action setup in the event the internal event queue becomes full.
To setup an overflow action edit <html:code>/etc/audit/auditd.conf</html:code>. Set <html:code>overflow_action</html:code>
to one of the following values: <html:code>syslog</html:code>, <html:code>single</html:code>, <html:code>halt</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The audit system should have an action setup in the event the internal event queue becomes full
so that no data is lost.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_overflow_action" complexity="low" disruption="low" reboot="true" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

if [ -e "/etc/audit/auditd.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*overflow_action\s*=\s*/Id" "/etc/audit/auditd.conf"
else
    touch "/etc/audit/auditd.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/audit/auditd.conf"

cp "/etc/audit/auditd.conf" "/etc/audit/auditd.conf.bak"
# Insert at the end of the file
printf '%s\n' "overflow_action = syslog" &gt;&gt; "/etc/audit/auditd.conf"
# Clean up after ourselves.
rm "/etc/audit/auditd.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_overflow_action" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AU-4(1)
    - auditd_overflow_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Appropriate Action Must be Setup When the Internal Audit Event Queue is Full
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/audit/auditd.conf
        create: false
        regexp: (?i)^\s*overflow_action\s*=\s*
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/audit/auditd.conf
      lineinfile:
        path: /etc/audit/auditd.conf
        create: false
        regexp: (?i)^\s*overflow_action\s*=\s*
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/audit/auditd.conf
      lineinfile:
        path: /etc/audit/auditd.conf
        create: true
        regexp: (?i)^\s*overflow_action\s*=\s*
        line: overflow_action = syslog
        state: present
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-4(1)
    - auditd_overflow_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-auditd_overflow_action:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-auditd_overflow_action_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_write_logs" severity="medium">
              <xccdf-1.2:title>Write Audit Logs to the Disk</xccdf-1.2:title>
              <xccdf-1.2:description>To configure Audit daemon to write Audit logs to the disk, set
<html:code>write_logs</html:code> to <html:code>yes</html:code> in <html:code>/etc/audit/auditd.conf</html:code>.
This is the default setting.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_STG.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If <html:code>write_logs</html:code> isn't set to <html:code>yes</html:code>, the Audit logs will
not be written to the disk.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_write_logs" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

if [ -e "/etc/audit/auditd.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*write_logs\s*=\s*/Id" "/etc/audit/auditd.conf"
else
    touch "/etc/audit/auditd.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/audit/auditd.conf"

cp "/etc/audit/auditd.conf" "/etc/audit/auditd.conf.bak"
# Insert at the end of the file
printf '%s\n' "write_logs = yes" &gt;&gt; "/etc/audit/auditd.conf"
# Clean up after ourselves.
rm "/etc/audit/auditd.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_write_logs" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6
    - auditd_write_logs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Write Audit Logs to the Disk
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/audit/auditd.conf
        create: false
        regexp: (?i)^\s*write_logs\s*=\s*
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/audit/auditd.conf
      lineinfile:
        path: /etc/audit/auditd.conf
        create: false
        regexp: (?i)^\s*write_logs\s*=\s*
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/audit/auditd.conf
      lineinfile:
        path: /etc/audit/auditd.conf
        create: true
        regexp: (?i)^\s*write_logs\s*=\s*
        line: write_logs = yes
        state: present
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6
    - auditd_write_logs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="auditd_write_logs" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20%7B%7B.var_auditd_flush%7D%7D%0Afreq%20%3D%2050%0Amax_log_file%20%3D%20%7B%7B.var_auditd_max_log_file%7D%7D%0Anum_logs%20%3D%20%7B%7B.var_auditd_num_logs%7D%7D%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20%7B%7B.var_auditd_max_log_file_action%7D%7D%0Aspace_left%20%3D%20%7B%7B.var_auditd_space_left%7D%7D%0Aspace_left_action%20%3D%20%7B%7B.var_auditd_space_left_action%7D%7D%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20%7B%7B.var_auditd_action_mail_acct%7D%7D%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20%7B%7B.var_auditd_disk_full_action%7D%7D%0Adisk_error_action%20%3D%20%7B%7B.var_auditd_disk_error_action%7D%7D%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d }}
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-auditd_write_logs:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-auditd_write_logs_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_policy_rules">
            <xccdf-1.2:title>System Accounting with auditd</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>auditd</html:code> program can perform comprehensive
monitoring of system activity. This section makes use of recommended
configuration settings for specific policies or use cases.
The rules in this section make use of rules defined in <html:code>/usr/share/doc/audit-VERSION/rules</html:code>.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#machine"/>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_apparmor">
          <xccdf-1.2:title>AppArmor</xccdf-1.2:title>
          <xccdf-1.2:description>Many security vulnerabilities result from bugs in trusted programs. A trusted
program runs with privileges that attackers want to possess. The program fails
to keep that trust if there is a bug in the program that allows the attacker to
acquire said privilege.
<html:br/><html:br/>
AppArmor® is an application security solution designed specifically to apply
privilege confinement to suspect programs. AppArmor allows the administrator to
specify the domain of activities the program can perform by developing a
security profile. A security profile is a listing of files that the program may
access and the operations the program may perform. AppArmor secures
applications by enforcing good application behavior without relying on attack
signatures, so it can prevent attacks even if previously unknown
vulnerabilities are being exploited.</xccdf-1.2:description>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_bootloader-grub2">
          <xccdf-1.2:title>GRUB2 bootloader configuration</xccdf-1.2:title>
          <xccdf-1.2:description>During the boot process, the boot loader is
responsible for starting the execution of the kernel and passing
options to it. The boot loader allows for the selection of
different kernels - possibly on different partitions or media.
The default Fedora boot loader for x86 systems is called GRUB2.
Options it can pass to the kernel include <html:i>single-user mode</html:i>, which
provides root access without any authentication, and the ability to
disable SELinux. To prevent local users from modifying the boot
parameters and endangering security, protect the boot loader configuration
with a password and ensure its configuration file's permissions
are set properly.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#grub2"/>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_l1tf_options" type="string">
            <xccdf-1.2:title>L1TF vulnerability mitigation</xccdf-1.2:title>
            <xccdf-1.2:description>Defines the L1TF vulneratility mitigations to employ.</xccdf-1.2:description>
            <xccdf-1.2:value>flush</xccdf-1.2:value>
            <xccdf-1.2:value selector="full">full</xccdf-1.2:value>
            <xccdf-1.2:value selector="full_force">full,force</xccdf-1.2:value>
            <xccdf-1.2:value selector="flush">flush</xccdf-1.2:value>
            <xccdf-1.2:value selector="flush_nosmt">flush,nosmt</xccdf-1.2:value>
            <xccdf-1.2:value selector="flush_nowarn">flush,nowarn</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mds_options" type="string">
            <xccdf-1.2:title>MDS vulnerability mitigation</xccdf-1.2:title>
            <xccdf-1.2:description>Defines the MDS vulneratility mitigation to employ.</xccdf-1.2:description>
            <xccdf-1.2:value>full</xccdf-1.2:value>
            <xccdf-1.2:value selector="full">full</xccdf-1.2:value>
            <xccdf-1.2:value selector="full_nosmt">full,nosmt</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_rng_core_default_quality" type="string" interactive="true">
            <xccdf-1.2:title>Confidence level on Hardware Random Number Generator</xccdf-1.2:title>
            <xccdf-1.2:description>Defines the level of trust on the hardware random number generators available in the
system and the percentage of entropy to credit.</xccdf-1.2:description>
            <xccdf-1.2:value>500</xccdf-1.2:value>
            <xccdf-1.2:value selector="500">500</xccdf-1.2:value>
            <xccdf-1.2:value selector="512">512</xccdf-1.2:value>
            <xccdf-1.2:value selector="1000">1000</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_spec_store_bypass_disable_options" type="string">
            <xccdf-1.2:title>Spec Store Bypass Mitigation</xccdf-1.2:title>
            <xccdf-1.2:description>This controls how the Speculative Store Bypass (SSB) vulnerability is mitigated.</xccdf-1.2:description>
            <xccdf-1.2:value>prctl</xccdf-1.2:value>
            <xccdf-1.2:value selector="on">on</xccdf-1.2:value>
            <xccdf-1.2:value selector="auto">auto</xccdf-1.2:value>
            <xccdf-1.2:value selector="prctl">prctl</xccdf-1.2:value>
            <xccdf-1.2:value selector="seccomp">seccomp</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_enable_iommu_force" severity="unknown">
            <xccdf-1.2:title>IOMMU configuration directive</xccdf-1.2:title>
            <xccdf-1.2:description>On x86 architecture supporting VT-d, the IOMMU manages the access control policy between the hardware devices and some
    of the system critical units such as the memory.
Configure the default Grub2 kernel command line to contain iommu=force as follows:
<html:pre># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) iommu=force"</html:pre></xccdf-1.2:description>
            <xccdf-1.2:warning category="functionality">Depending on the hardware, devices and operating system used, enabling IOMMU can cause hardware instabilities. Proper function and stability should be assessed before applying remediation to production systems.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R11)</xccdf-1.2:reference>
            <xccdf-1.2:rationale>On x86 architectures, activating the I/OMMU prevents the system from arbitrary accesses potentially made by
    hardware devices.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_enable_iommu_force"># Remediation is applicable only in certain platforms
if rpm --quiet -q grub2-common &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

grubby --update-kernel=ALL --args=iommu=force

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_enable_iommu_force" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - grub2_enable_iommu_force
    - low_disruption
    - medium_complexity
    - reboot_required
    - restrict_strategy
    - unknown_severity

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="iommu=force"
  when:
    - '"grub2-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - grub2_enable_iommu_force
    - low_disruption
    - medium_complexity
    - reboot_required
    - restrict_strategy
    - unknown_severity
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_enable_iommu_force">[customizations.kernel]
append = "iommu=force"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-grub2_enable_iommu_force:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-grub2_enable_iommu_force_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_l1tf_argument" severity="high">
            <xccdf-1.2:title>Configure L1 Terminal Fault mitigations</xccdf-1.2:title>
            <xccdf-1.2:description>L1 Terminal Fault (L1TF) is a hardware vulnerability which allows unprivileged
speculative access to data which is available in the Level 1 Data Cache when
the page table entry isn't present.

Select the appropriate mitigation by adding the argument
<html:code>l1tf=<xccdf-1.2:sub idref="dangling reference to !" use="legacy"/></html:code> to the default
GRUB 2 command line for the Linux operating system.
Configure the default Grub2 kernel command line to contain l1tf=xccdf_value(var_l1tf_options) as follows:
<html:pre># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) l1tf=xccdf_value(var_l1tf_options)"</html:pre>

Since Linux Kernel 4.19 you can check the L1TF vulnerability state with the
following command:
<html:code>cat /sys/devices/system/cpu/vulnerabilities/l1tf</html:code></xccdf-1.2:description>
            <xccdf-1.2:warning category="performance">Enabling L1TF mitigations may impact performance of the system.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>The L1TF vulnerability allows an attacker to bypass memory access security controls imposed
by the system or hypervisor. The L1TF vulnerability allows read access to any physical memory
location that is cached in the L1 Data Cache.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_l1tf_argument"># Remediation is applicable only in certain platforms
if rpm --quiet -q grub2-common &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

var_l1tf_options='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_l1tf_options" use="legacy"/>'



grubby --update-kernel=ALL --args=l1tf=$var_l1tf_options

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_l1tf_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - grub2_l1tf_argument
    - high_severity
    - low_disruption
    - medium_complexity
    - reboot_required
    - restrict_strategy
- name: XCCDF Value var_l1tf_options # promote to variable
  set_fact:
    var_l1tf_options: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_l1tf_options" use="legacy"/>
  tags:
    - always

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="l1tf={{ var_l1tf_options }}"
  when:
    - '"grub2-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - grub2_l1tf_argument
    - high_severity
    - low_disruption
    - medium_complexity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_l1tf_argument">[customizations.kernel]
append = "l1tf=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_l1tf_options" use="legacy"/>"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_l1tf_options:var:1" value-id="xccdf_org.ssgproject.content_value_var_l1tf_options"/>
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-grub2_l1tf_argument:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-grub2_l1tf_argument_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_mce_argument" severity="medium">
            <xccdf-1.2:title>Force kernel panic on uncorrected MCEs</xccdf-1.2:title>
            <xccdf-1.2:description>A Machine Check Exception is an error generated by the CPU itdetects an error
in itself, memory or I/O devices.
These errors may be corrected and generate a check log entry, if an error
cannot be corrected the kernel may panic or SIGBUS.

To force the kernel to panic on any uncorrected error reported by Machine Check
set the MCE tolerance to zero by adding <html:code>mce=0</html:code>
to the default GRUB 2 command line for the Linux operating system.
Configure the default Grub2 kernel command line to contain mce=0 as follows:
<html:pre># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) mce=0"</html:pre></xccdf-1.2:description>
            <xccdf-1.2:rationale>Allowing uncorrected errors to result on a SIGBUS may allow an attacker to continue
trying to exploit a vulnerability such as Rowhammer.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_mce_argument"># Remediation is applicable only in certain platforms
if rpm --quiet -q grub2-common &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

grubby --update-kernel=ALL --args=mce=0

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_mce_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - grub2_mce_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="mce=0"
  when:
    - '"grub2-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - grub2_mce_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_mce_argument">[customizations.kernel]
append = "mce=0"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-grub2_mce_argument:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-grub2_mce_argument_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_mds_argument" severity="medium">
            <xccdf-1.2:title>Configure Microarchitectural Data Sampling mitigation</xccdf-1.2:title>
            <xccdf-1.2:description>Microarchitectural Data Sampling (MDS) is a hardware vulnerability which allows unprivileged
speculative access to data which is available in various CPU internal buffers.

When performing store, load, L1 refill operations, processors write data into temporary
microarchitectural structures (buffers), and the data in the buffer can be forwarded to load
operations as an optimization.

Under certain conditions, data unrelated to the load operations can be speculatively
forwarded from the buffers to a disclosure gadget which allows in turn to infer the value
via a cache side channel attack.

Select the appropriate mitigation by adding the argument
<html:code>mds=<xccdf-1.2:sub idref="dangling reference to !" use="legacy"/></html:code> to the default
GRUB 2 command line for the Linux operating system.
Configure the default Grub2 kernel command line to contain mds=xccdf_value(var_mds_options) as follows:
<html:pre># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) mds=xccdf_value(var_mds_options)"</html:pre>

Not all processors are affected by all variants of MDS, but the mitigation mechanism is
identical for all of them.

Since Linux Kernel 5.2 you can check whether the system is vulnerable or mitigated with the
following command:
<html:code>cat /sys/devices/system/cpu/vulnerabilities/mds</html:code></xccdf-1.2:description>
            <xccdf-1.2:warning category="performance">Enabling MDS mitigations will impact performance of the system, mainly by workloads with
high rates of user-kernel-user space transitions. For example, system calls, NMIs and interrupts.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>The MDS vulnerability allows an attacker to sample data from internal CPU buffers.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_mds_argument"># Remediation is applicable only in certain platforms
if rpm --quiet -q grub2-common &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

var_mds_options='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_mds_options" use="legacy"/>'



grubby --update-kernel=ALL --args=mds=$var_mds_options

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_mds_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - grub2_mds_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy
- name: XCCDF Value var_mds_options # promote to variable
  set_fact:
    var_mds_options: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_mds_options" use="legacy"/>
  tags:
    - always

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="mds={{ var_mds_options }}"
  when:
    - '"grub2-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - grub2_mds_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_mds_argument">[customizations.kernel]
append = "mds=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_mds_options" use="legacy"/>"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_mds_options:var:1" value-id="xccdf_org.ssgproject.content_value_var_mds_options"/>
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-grub2_mds_argument:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-grub2_mds_argument_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_nosmap_argument_absent" severity="medium">
            <xccdf-1.2:title>Ensure SMAP is not disabled during boot</xccdf-1.2:title>
            <xccdf-1.2:description>The SMAP is used to prevent the supervisor mode from unintentionally reading/writing into
memory pages in the user space, it is enabled by default since Linux kernel 3.7.
But it could be disabled through kernel boot parameters.

Ensure that Supervisor Mode Access Prevention (SMAP) is not disabled by
the <html:code>nosmap</html:code> boot paramenter option.

Check that the line <html:pre>GRUB_CMDLINE_LINUX="..."</html:pre> within <html:code>/etc/default/grub</html:code>
doesn't contain the argument <html:code>nosmap</html:code>.
Run the following command to update command line for already installed kernels:
<html:pre># grubby --update-kernel=ALL --remove-args="nosmap"</html:pre></xccdf-1.2:description>
            <xccdf-1.2:rationale>Disabling SMAP can facilitate exploitation of vulnerabilities caused by unintended access and
manipulation of data in the user space.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_nosmap_argument_absent"># Remediation is applicable only in certain platforms
if rpm --quiet -q grub2-common &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

grubby --update-kernel=ALL --remove-args=nosmap

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_nosmap_argument_absent" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - grub2_nosmap_argument_absent
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --remove-args="nosmap"
  when:
    - '"grub2-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - grub2_nosmap_argument_absent
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-grub2_nosmap_argument_absent:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-grub2_nosmap_argument_absent_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_nosmep_argument_absent" severity="medium">
            <xccdf-1.2:title>Ensure SMEP is not disabled during boot</xccdf-1.2:title>
            <xccdf-1.2:description>The SMEP is used to prevent the supervisor mode from executing user space code,
it is enabled by default since Linux kernel 3.0. But it could be disabled through
kernel boot parameters.

Ensure that Supervisor Mode Execution Prevention (SMEP) is not disabled by
the <html:code>nosmep</html:code> boot paramenter option.

Check that the line <html:pre>GRUB_CMDLINE_LINUX="..."</html:pre> within <html:code>/etc/default/grub</html:code>
doesn't contain the argument <html:code>nosmep</html:code>.
Run the following command to update command line for already installed kernels:
<html:pre># grubby --update-kernel=ALL --remove-args="nosmep"</html:pre></xccdf-1.2:description>
            <xccdf-1.2:rationale>Disabling SMEP can facilitate exploitation of certain vulnerabilities because it allows
the kernel to unintentionally execute code in less privileged memory space.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_nosmep_argument_absent"># Remediation is applicable only in certain platforms
if rpm --quiet -q grub2-common &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

grubby --update-kernel=ALL --remove-args=nosmep

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_nosmep_argument_absent" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - grub2_nosmep_argument_absent
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --remove-args="nosmep"
  when:
    - '"grub2-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - grub2_nosmep_argument_absent
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-grub2_nosmep_argument_absent:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-grub2_nosmep_argument_absent_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_pti_argument" severity="low">
            <xccdf-1.2:title>Enable Kernel Page-Table Isolation (KPTI)</xccdf-1.2:title>
            <xccdf-1.2:description>To enable Kernel page-table isolation,
add the argument <html:code>pti=on</html:code> to the default
GRUB 2 command line for the Linux operating system.
Configure the default Grub2 kernel command line to contain pti=on as follows:
<html:pre># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) pti=on"</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000433-GPOS-00193</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Kernel page-table isolation is a kernel feature that mitigates
the Meltdown security vulnerability and hardens the kernel
against attempts to bypass kernel address space layout
randomization (KASLR).</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_pti_argument"># Remediation is applicable only in certain platforms
if rpm --quiet -q grub2-common &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

grubby --update-kernel=ALL --args=pti=on

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_pti_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-SI-16
    - grub2_pti_argument
    - low_disruption
    - low_severity
    - medium_complexity
    - reboot_required
    - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="pti=on"
  when:
    - '"grub2-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-SI-16
    - grub2_pti_argument
    - low_disruption
    - low_severity
    - medium_complexity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_pti_argument">[customizations.kernel]
append = "pti=on"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-grub2_pti_argument:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-grub2_pti_argument_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_rng_core_default_quality_argument" severity="low">
            <xccdf-1.2:title>Configure the confidence in TPM for entropy</xccdf-1.2:title>
            <xccdf-1.2:description>The TPM security chip that is available in most modern systems has a hardware RNG.
It is also used to feed the entropy pool, but generally not credited entropy.

Use <html:code>rng_core.default_quality</html:code> in the kernel command line to set the trust
level on the hardware generators. The trust level defines the amount of entropy to credit.
A value of <html:code>0</html:code> tells the system not to trust the hardware random number generators
available, and doesn't credit any entropy to the pool.
A value of <html:code>1000</html:code> assigns full confidence in the generators, and credits all the
entropy it provides to the pool.

Note that the value of <html:code>rng_core.default_quality</html:code> is global, affecting the trust
on all hardware random number generators.

Select the appropriate confidence by adding the argument
<html:code>rng_core.default_quality=<xccdf-1.2:sub idref="dangling reference to !" use="legacy"/></html:code> to the default
GRUB 2 command line for the Linux operating system.
Configure the default Grub2 kernel command line to contain rng_core.default_quality=xccdf_value(var_rng_core_default_quality) as follows:
<html:pre># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) rng_core.default_quality=xccdf_value(var_rng_core_default_quality)"</html:pre></xccdf-1.2:description>
            <xccdf-1.2:rationale>A system may struggle to initialize its entropy pool and end up starving. Crediting entropy
from the hardware number generators available in the system helps fill up the entropy pool.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_rng_core_default_quality_argument"># Remediation is applicable only in certain platforms
if rpm --quiet -q grub2-common &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

var_rng_core_default_quality='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rng_core_default_quality" use="legacy"/>'



grubby --update-kernel=ALL --args=rng_core.default_quality=$var_rng_core_default_quality

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_rng_core_default_quality_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - grub2_rng_core_default_quality_argument
    - low_disruption
    - low_severity
    - medium_complexity
    - reboot_required
    - restrict_strategy
- name: XCCDF Value var_rng_core_default_quality # promote to variable
  set_fact:
    var_rng_core_default_quality: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rng_core_default_quality" use="legacy"/>
  tags:
    - always

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="rng_core.default_quality={{ var_rng_core_default_quality
    }}"
  when:
    - '"grub2-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - grub2_rng_core_default_quality_argument
    - low_disruption
    - low_severity
    - medium_complexity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_rng_core_default_quality_argument">[customizations.kernel]
append = "rng_core.default_quality=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rng_core_default_quality" use="legacy"/>"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_rng_core_default_quality:var:1" value-id="xccdf_org.ssgproject.content_value_var_rng_core_default_quality"/>
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-grub2_rng_core_default_quality_argument:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-grub2_rng_core_default_quality_argument_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_slab_nomerge_argument" severity="medium">
            <xccdf-1.2:title>Disable merging of slabs with similar size</xccdf-1.2:title>
            <xccdf-1.2:description>The kernel may merge similar slabs together to reduce overhead and increase
cache hotness of objects.
Disabling merging of slabs keeps the slabs separate and reduces the risk of
kernel heap overflows overwriting objects in merged caches.

To disable merging of slabs in the Kernel add the argument <html:code>slab_nomerge=yes</html:code>
to the default GRUB 2 command line for the Linux operating system.
Configure the default Grub2 kernel command line to contain slab_nomerge=yes as follows:
<html:pre># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) slab_nomerge=yes"</html:pre></xccdf-1.2:description>
            <xccdf-1.2:warning category="performance">Disabling merge of slabs will slightly increase kernel memory utilization.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>Disabling the merge of slabs of similar sizes prevents the kernel from
merging a seemingly useless but vulnerable slab with a useful and valuable slab.
This increase the risk that a heap overflow could overwrite objects from merged caches,
with unmerged caches the heap overflow would only affect the objects in the same cache.
Overall, this reduces the kernel attack surface area by isolating slabs from each other.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_slab_nomerge_argument"># Remediation is applicable only in certain platforms
if rpm --quiet -q grub2-common &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

grubby --update-kernel=ALL --args=slab_nomerge=yes

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_slab_nomerge_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - grub2_slab_nomerge_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="slab_nomerge=yes"
  when:
    - '"grub2-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - grub2_slab_nomerge_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_slab_nomerge_argument">[customizations.kernel]
append = "slab_nomerge=yes"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-grub2_slab_nomerge_argument:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-grub2_slab_nomerge_argument_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_spec_store_bypass_disable_argument" severity="medium">
            <xccdf-1.2:title>Configure Speculative Store Bypass Mitigation</xccdf-1.2:title>
            <xccdf-1.2:description>Certain CPUs are vulnerable to an exploit against a common wide industry wide performance
optimization known as Speculative Store Bypass (SSB).

In such cases, recent stores to the same memory location cannot always be observed by later
loads during speculative execution. However, such stores are unlikely and thus they can be
detected prior to instruction retirement at the end of a particular speculation execution
window.

Since Linux Kernel 4.17 you can check the SSB mitigation state with the following command:
<html:code>cat /sys/devices/system/cpu/vulnerabilities/spec_store_bypass</html:code>

Select the appropriate SSB state by adding the argument
<html:code>spec_store_bypass_disable=<xccdf-1.2:sub idref="dangling reference to !" use="legacy"/></html:code> to the default
GRUB 2 command line for the Linux operating system.
Configure the default Grub2 kernel command line to contain spec_store_bypass_disable=xccdf_value(var_spec_store_bypass_disable_options) as follows:
<html:pre># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) spec_store_bypass_disable=xccdf_value(var_spec_store_bypass_disable_options)"</html:pre></xccdf-1.2:description>
            <xccdf-1.2:warning category="performance">Disabling Speculative Store Bypass may impact performance of the system.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>In vulnerable processsors, the speculatively forwarded store can be used in a cache side channel
attack. An example of this is reading memory to which the attacker does not directly have access,
for example inside the sandboxed code.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_spec_store_bypass_disable_argument"># Remediation is applicable only in certain platforms
if rpm --quiet -q grub2-common &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

var_spec_store_bypass_disable_options='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_spec_store_bypass_disable_options" use="legacy"/>'



grubby --update-kernel=ALL --args=spec_store_bypass_disable=$var_spec_store_bypass_disable_options

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_spec_store_bypass_disable_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - grub2_spec_store_bypass_disable_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy
- name: XCCDF Value var_spec_store_bypass_disable_options # promote to variable
  set_fact:
    var_spec_store_bypass_disable_options: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_spec_store_bypass_disable_options" use="legacy"/>
  tags:
    - always

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="spec_store_bypass_disable={{ var_spec_store_bypass_disable_options
    }}"
  when:
    - '"grub2-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - grub2_spec_store_bypass_disable_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_spec_store_bypass_disable_argument">[customizations.kernel]
append = "spec_store_bypass_disable=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_spec_store_bypass_disable_options" use="legacy"/>"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_spec_store_bypass_disable_options:var:1" value-id="xccdf_org.ssgproject.content_value_var_spec_store_bypass_disable_options"/>
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-grub2_spec_store_bypass_disable_argument:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-grub2_spec_store_bypass_disable_argument_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_spectre_v2_argument" severity="high">
            <xccdf-1.2:title>Enforce Spectre v2 mitigation</xccdf-1.2:title>
            <xccdf-1.2:description>Spectre V2 is an indirect branch poisoning attack that can lead to data leakage.
An exploit for Spectre V2 tricks the indirect branch predictor into executing
code from a future indirect branch chosen by the attacker, even if the privilege
level is different.

Since Linux Kernel 4.15 you can check the Spectre V2 mitigation state with the following command:
<html:code>cat /sys/devices/system/cpu/vulnerabilities/spectre_v2</html:code>

Enforce the Spectre V2 mitigation by adding the argument
<html:code>spectre_v2=on</html:code> to the default
GRUB 2 command line for the Linux operating system.
Configure the default Grub2 kernel command line to contain spectre_v2=on) as follows:
<html:pre># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) spectre_v2=on)"</html:pre></xccdf-1.2:description>
            <xccdf-1.2:rationale>The Spectre V2 vulnerability allows an attacker to read memory that he should not have
access to.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_spectre_v2_argument"># Remediation is applicable only in certain platforms
if rpm --quiet -q grub2-common &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

grubby --update-kernel=ALL --args=spectre_v2=on

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_spectre_v2_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - grub2_spectre_v2_argument
    - high_severity
    - low_disruption
    - medium_complexity
    - reboot_required
    - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="spectre_v2=on"
  when:
    - '"grub2-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - grub2_spectre_v2_argument
    - high_severity
    - low_disruption
    - medium_complexity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_spectre_v2_argument">[customizations.kernel]
append = "spectre_v2=on"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-grub2_spectre_v2_argument:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-grub2_spectre_v2_argument_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument" severity="medium">
            <xccdf-1.2:title>Disable vsyscalls</xccdf-1.2:title>
            <xccdf-1.2:description>To disable use of virtual syscalls,
add the argument <html:code>vsyscall=none</html:code> to the default
GRUB 2 command line for the Linux operating system.
Configure the default Grub2 kernel command line to contain vsyscall=none as follows:
<html:pre># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) vsyscall=none"</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001084</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_ASLR_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000134-GPOS-00068</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Virtual Syscalls provide an opportunity of attack for a user who has control
of the return instruction pointer.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_vsyscall_argument"># Remediation is applicable only in certain platforms
if rpm --quiet -q grub2-common &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

grubby --update-kernel=ALL --args=vsyscall=none

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_vsyscall_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-7(a)
    - grub2_vsyscall_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="vsyscall=none"
  when:
    - '"grub2-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-7(a)
    - grub2_vsyscall_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_vsyscall_argument">[customizations.kernel]
append = "vsyscall=none"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-grub2_vsyscall_argument:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-grub2_vsyscall_argument_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_non-uefi">
            <xccdf-1.2:title>Non-UEFI GRUB2 bootloader configuration</xccdf-1.2:title>
            <xccdf-1.2:description>Non-UEFI GRUB2 bootloader configuration</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#non-uefi"/>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg" severity="medium">
              <xccdf-1.2:title>Verify /boot/grub2/grub.cfg Group Ownership</xccdf-1.2:title>
              <xccdf-1.2:description>The file <html:code>/boot/grub2/grub.cfg</html:code> should
be group-owned by the <html:code>root</html:code> group to prevent
destruction or modification of the file.

To properly set the group owner of <html:code>/boot/grub2/grub.cfg</html:code>, run the command:
<html:pre>$ sudo chgrp root /boot/grub2/grub.cfg</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-7.1</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>root</html:code> group is a highly-privileged group. Furthermore, the group-owner of this
file should not have any access privileges anyway.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_grub2_cfg" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

chgrp 0 /boot/grub2/grub.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_grub2_cfg" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /boot/grub2/grub.cfg
  stat:
    path: /boot/grub2/grub.cfg
  register: file_exists
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.2.2
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-7.1
    - configure_strategy
    - file_groupowner_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /boot/grub2/grub.cfg
  file:
    path: /boot/grub2/grub.cfg
    group: '0'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-7.1
    - configure_strategy
    - file_groupowner_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_groupowner_grub2_cfg:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_groupowner_grub2_cfg_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg" severity="medium">
              <xccdf-1.2:title>Verify /boot/grub2/grub.cfg User Ownership</xccdf-1.2:title>
              <xccdf-1.2:description>The file <html:code>/boot/grub2/grub.cfg</html:code> should
be owned by the <html:code>root</html:code> user to prevent destruction
or modification of the file.

To properly set the owner of <html:code>/boot/grub2/grub.cfg</html:code>, run the command:
<html:pre>$ sudo chown root /boot/grub2/grub.cfg </html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-7.1</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Only root should be able to modify important boot parameters.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_grub2_cfg" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

chown 0 /boot/grub2/grub.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_grub2_cfg" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /boot/grub2/grub.cfg
  stat:
    path: /boot/grub2/grub.cfg
  register: file_exists
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.2.2
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-7.1
    - configure_strategy
    - file_owner_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /boot/grub2/grub.cfg
  file:
    path: /boot/grub2/grub.cfg
    owner: '0'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-7.1
    - configure_strategy
    - file_owner_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_owner_grub2_cfg:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_owner_grub2_cfg_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg" severity="medium">
              <xccdf-1.2:title>Verify /boot/grub2/grub.cfg Permissions</xccdf-1.2:title>
              <xccdf-1.2:description>File permissions for <html:code>/boot/grub2/grub.cfg</html:code> should be set to 600.

To properly set the permissions of <html:code>/boot/grub2/grub.cfg</html:code>, run the command:
<html:pre>$ sudo chmod 600 /boot/grub2/grub.cfg</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Proper permissions ensure that only the root user can modify important boot
parameters.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_grub2_cfg" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

chmod u-xs,g-xwrs,o-xwrt /boot/grub2/grub.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_grub2_cfg" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /boot/grub2/grub.cfg
  stat:
    path: /boot/grub2/grub.cfg
  register: file_exists
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission u-xs,g-xwrs,o-xwrt on /boot/grub2/grub.cfg
  file:
    path: /boot/grub2/grub.cfg
    mode: u-xs,g-xwrs,o-xwrt
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - file_exists.stat is defined and file_exists.stat.exists
  tags:
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_grub2_cfg:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_grub2_cfg_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_admin_username" severity="medium">
              <xccdf-1.2:title>Set the Boot Loader Admin Username to a Non-Default Value</xccdf-1.2:title>
              <xccdf-1.2:description>The grub2 boot loader should have a superuser account and password
protection enabled to protect boot-time settings.
<html:br/><html:br/>
To maximize the protection, select a password-protected superuser account with unique name, and modify the
<html:code>/etc/grub.d/01_users</html:code> configuration file to reflect the account name change.
<html:br/><html:br/>
Do not to use common administrator account names like root,
admin, or administrator for the grub2 superuser account.
<html:br/><html:br/>
Change the superuser to a different username (The default is 'root').
<html:pre>$ sed -i 's/\(set superuser=\).*/\1"&lt;unique user ID&gt;"/g' /etc/grub.d/01_users</html:pre>
<html:br/><html:br/>
Once the superuser account has been added,
update the
<html:code>grub.cfg</html:code> file by running:
<html:pre>grub2-mkconfig -o /boot/grub2/grub.cfg</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">To prevent hard-coded admin usernames, automatic remediation of this control is not available. Remediation
must be automated as a component of machine provisioning, or followed manually as outlined above.

Also, do NOT manually add the superuser account and password to the
<html:code>grub.cfg</html:code> file as the grub2-mkconfig command overwrites this file.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R17)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000213</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000080-GPOS-00048</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Having a non-default grub superuser username makes password-guessing attacks less effective.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-grub2_admin_username:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-grub2_admin_username_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_password" severity="high">
              <xccdf-1.2:title>Set Boot Loader Password in grub2</xccdf-1.2:title>
              <xccdf-1.2:description>The grub2 boot loader should have a superuser account and password
protection enabled to protect boot-time settings.
<html:br/><html:br/>
Since plaintext passwords are a security risk, generate a hash for the password
by running the following command:

<html:pre># grub2-setpassword</html:pre>

When prompted, enter the password that was selected.
<html:br/><html:br/></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">To prevent hard-coded passwords, automatic remediation of this control is not available. Remediation
must be automated as a component of machine provisioning, or followed manually as outlined above.

Also, do NOT manually add the superuser account and password to the
<html:code>grub.cfg</html:code> file as the grub2-mkconfig command overwrites this file.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R17)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000213</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000080-GPOS-00048</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Password protection on the boot loader configuration ensures
users with physical access cannot trivially alter
important bootloader settings. These include which kernel to use,
and whether to enter single-user mode.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-grub2_password:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-grub2_password_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_uefi">
            <xccdf-1.2:title>UEFI GRUB2 bootloader configuration</xccdf-1.2:title>
            <xccdf-1.2:description>UEFI GRUB2 bootloader configuration</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#uefi"/>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_efi_grub2_cfg" severity="medium">
              <xccdf-1.2:title>Verify the UEFI Boot Loader grub.cfg Group Ownership</xccdf-1.2:title>
              <xccdf-1.2:description>The file <html:code>/boot/grub2/grub.cfg</html:code> should
be group-owned by the <html:code>root</html:code> group to prevent
destruction or modification of the file.

To properly set the group owner of <html:code>/boot/grub2/grub.cfg</html:code>, run the command:
<html:pre>$ sudo chgrp root /boot/grub2/grub.cfg</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-7.1</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>root</html:code> group is a highly-privileged group. Furthermore, the group-owner of this
file should not have any access privileges anyway.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_efi_grub2_cfg" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

chgrp 0 /boot/grub2/grub.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_efi_grub2_cfg" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /boot/grub2/grub.cfg
  stat:
    path: /boot/grub2/grub.cfg
  register: file_exists
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.2.2
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-7.1
    - configure_strategy
    - file_groupowner_efi_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /boot/grub2/grub.cfg
  file:
    path: /boot/grub2/grub.cfg
    group: '0'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-7.1
    - configure_strategy
    - file_groupowner_efi_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_groupowner_efi_grub2_cfg:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_groupowner_efi_grub2_cfg_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_efi_grub2_cfg" severity="medium">
              <xccdf-1.2:title>Verify the UEFI Boot Loader grub.cfg User Ownership</xccdf-1.2:title>
              <xccdf-1.2:description>The file <html:code>/boot/grub2/grub.cfg</html:code> should
be owned by the <html:code>root</html:code> user to prevent destruction
or modification of the file.

To properly set the owner of <html:code>/boot/grub2/grub.cfg</html:code>, run the command:
<html:pre>$ sudo chown root /boot/grub2/grub.cfg </html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-7.1</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Only root should be able to modify important boot parameters.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_efi_grub2_cfg" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

chown 0 /boot/grub2/grub.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_efi_grub2_cfg" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /boot/grub2/grub.cfg
  stat:
    path: /boot/grub2/grub.cfg
  register: file_exists
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.2.2
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-7.1
    - configure_strategy
    - file_owner_efi_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /boot/grub2/grub.cfg
  file:
    path: /boot/grub2/grub.cfg
    owner: '0'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-7.1
    - configure_strategy
    - file_owner_efi_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_owner_efi_grub2_cfg:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_owner_efi_grub2_cfg_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_efi_grub2_cfg" severity="medium">
              <xccdf-1.2:title>Verify the UEFI Boot Loader grub.cfg Permissions</xccdf-1.2:title>
              <xccdf-1.2:description>File permissions for <html:code>/boot/grub2/grub.cfg</html:code> should be set to 700.

To properly set the permissions of <html:code>/boot/grub2/grub.cfg</html:code>, run the command:
<html:pre>$ sudo chmod 700 /boot/grub2/grub.cfg</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Proper permissions ensure that only the root user can modify important boot
parameters.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_efi_grub2_cfg" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

chmod u-s,g-xwrs,o-xwrt /boot/grub2/grub.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_efi_grub2_cfg" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /boot/grub2/grub.cfg
  stat:
    path: /boot/grub2/grub.cfg
  register: file_exists
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_efi_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission u-s,g-xwrs,o-xwrt on /boot/grub2/grub.cfg
  file:
    path: /boot/grub2/grub.cfg
    mode: u-s,g-xwrs,o-xwrt
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - file_exists.stat is defined and file_exists.stat.exists
  tags:
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_efi_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_efi_grub2_cfg:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_efi_grub2_cfg_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_uefi_admin_username" severity="medium">
              <xccdf-1.2:title>Set the UEFI Boot Loader Admin Username to a Non-Default Value</xccdf-1.2:title>
              <xccdf-1.2:description>The grub2 boot loader should have a superuser account and password
protection enabled to protect boot-time settings.
<html:br/><html:br/>
To maximize the protection, select a password-protected superuser account with unique name, and modify the
<html:code>/etc/grub.d/01_users</html:code> configuration file to reflect the account name change.
<html:br/><html:br/>
It is highly suggested not to use common administrator account names like root,
admin, or administrator for the grub2 superuser account.
<html:br/><html:br/>
Change the superuser to a different username (The default is 'root').
<html:pre>$ sed -i 's/\(set superuser=\).*/\1"&lt;unique user ID&gt;"/g' /etc/grub.d/01_users</html:pre>
<html:br/><html:br/>
Once the superuser account has been added,
update the
<html:code>grub.cfg</html:code> file by running:
<html:pre>grub2-mkconfig -o /boot/grub2/grub.cfg</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">To prevent hard-coded admin usernames, automatic remediation of this control is not available. Remediation
must be automated as a component of machine provisioning, or followed manually as outlined above.

Also, do NOT manually add the superuser account and password to the
<html:code>grub.cfg</html:code> file as the grub2-mkconfig command overwrites this file.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R17)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000213</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000080-GPOS-00048</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Having a non-default grub superuser username makes password-guessing attacks less effective.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-grub2_uefi_admin_username:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-grub2_uefi_admin_username_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_uefi_password" severity="high">
              <xccdf-1.2:title>Set the UEFI Boot Loader Password</xccdf-1.2:title>
              <xccdf-1.2:description>The grub2 boot loader should have a superuser account and password
protection enabled to protect boot-time settings.
<html:br/><html:br/>
Since plaintext passwords are a security risk, generate a hash for the password
by running the following command:

<html:pre># grub2-setpassword</html:pre>

When prompted, enter the password that was selected.
<html:br/><html:br/></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">To prevent hard-coded passwords, automatic remediation of this control is not available. Remediation
must be automated as a component of machine provisioning, or followed manually as outlined above.

Also, do NOT manually add the superuser account and password to the
<html:code>grub.cfg</html:code> file as the grub2-mkconfig command overwrites this file.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R17)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000213</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000080-GPOS-00048</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Password protection on the boot loader configuration ensures
users with physical access cannot trivially alter
important bootloader settings. These include which kernel to use,
and whether to enter single-user mode.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-grub2_uefi_password:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-grub2_uefi_password_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_bootloader-zipl">
          <xccdf-1.2:title>zIPL bootloader configuration</xccdf-1.2:title>
          <xccdf-1.2:description>During the boot process, the bootloader is
responsible for starting the execution of the kernel and passing
options to it.
The default Fedora boot loader for s390x systems is called zIPL.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#s390x_arch"/>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_entropy">
          <xccdf-1.2:title>Protect Random-Number Entropy Pool</xccdf-1.2:title>
          <xccdf-1.2:description>The I/O operations of the Linux kernel block layer due to their inherently
unpredictable execution times have been traditionally considered as a reliable
source to contribute to random-number entropy pool of the Linux kernel. This
has changed with introduction of solid-state storage devices (SSDs) though.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#machine"/>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_disable_entropy_contribution_for_solid_state_drives" severity="medium">
            <xccdf-1.2:title>Ensure Solid State Drives Do Not Contribute To Random-Number Entropy Pool</xccdf-1.2:title>
            <xccdf-1.2:description>For each solid-state drive on the system, run:
<html:pre> # echo 0 &gt; /sys/block/DRIVE/queue/add_random</html:pre></xccdf-1.2:description>
            <xccdf-1.2:rationale>In contrast to traditional electromechanical magnetic disks, containing
spinning disks and / or movable read / write heads, the solid-state storage
devices (SSDs) do not contain moving / mechanical components. Therefore the
I/O operation completion times are much more predictable for them.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
          </xccdf-1.2:Rule>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_kernel_build_config">
          <xccdf-1.2:title>Kernel Configuration</xccdf-1.2:title>
          <xccdf-1.2:description>Contains rules that check the kernel configuration that was used to build it.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#machine"/>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_kernel_config_module_sig_hash" type="string">
            <xccdf-1.2:title>Hash function for kernel module signing</xccdf-1.2:title>
            <xccdf-1.2:description>The hash function to use when signing modules during kernel build process.</xccdf-1.2:description>
            <xccdf-1.2:value>sha512</xccdf-1.2:value>
            <xccdf-1.2:value selector="sha1">sha1</xccdf-1.2:value>
            <xccdf-1.2:value selector="sha224">sha224</xccdf-1.2:value>
            <xccdf-1.2:value selector="sha256">sha256</xccdf-1.2:value>
            <xccdf-1.2:value selector="sha384">sha384</xccdf-1.2:value>
            <xccdf-1.2:value selector="sha512">sha512</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_kernel_config_module_sig_key" type="string" interactive="true">
            <xccdf-1.2:title>Key and certificate for kernel module signing</xccdf-1.2:title>
            <xccdf-1.2:description>The private key and certificate to use when signing modules during kernel build process.
On systems where the OpenSSL ENGINE_pkcs11 is functional — a PKCS#11 URI as defined by RFC7512
In the latter case, the PKCS#11 URI should reference both a certificate and a private key.</xccdf-1.2:description>
            <xccdf-1.2:value>certs/signing_key.pem</xccdf-1.2:value>
            <xccdf-1.2:value selector="kernel_default">certs/signing_key.pem</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_kernel_config_panic_timeout" type="string" interactive="true">
            <xccdf-1.2:title>Kernel panic timeout</xccdf-1.2:title>
            <xccdf-1.2:description>The time, in seconds, to wait until a reboot occurs.
If the value is <html:code>0</html:code> the system never reboots.
If the value is less than <html:code>0</html:code> the system reboots immediately.</xccdf-1.2:description>
            <xccdf-1.2:value>0</xccdf-1.2:value>
            <xccdf-1.2:value selector="never">0</xccdf-1.2:value>
            <xccdf-1.2:value selector="5_minutes">300</xccdf-1.2:value>
            <xccdf-1.2:value selector="1_minute">60</xccdf-1.2:value>
            <xccdf-1.2:value selector="immediately">-1</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_acpi_custom_method" severity="low">
            <xccdf-1.2:title>Do not allow ACPI methods to be inserted/replaced at run time</xccdf-1.2:title>
            <xccdf-1.2:description>This debug facility allows ACPI AML methods to be inserted and/or replaced without rebooting
the system.
This configuration is available from kernel 3.0.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_ACPI_CUSTOM_METHOD</html:code>, run the following command:
    <html:code>grep CONFIG_ACPI_CUSTOM_METHOD /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>Enabling this feature allows arbitrary kernel memory to be written to by root (uid=0) users,
allowing them to bypass certain security measures</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_acpi_custom_method:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_acpi_custom_method_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_arm64_sw_ttbr0_pan" severity="medium">
            <xccdf-1.2:title>Emulate Privileged Access Never (PAN)</xccdf-1.2:title>
            <xccdf-1.2:description>Enabling this option prevents the kernel from accessing user-space memory directly by pointing
TTBR0_EL1 to a reserved zeroed area and reserved ASID.
The user access routines restore the valid TTBR0_EL1 temporarily.
This configuration is available from kernel 4.10, but may be available if backported
by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_ARM64_SW_TTBR0_PAN</html:code>, run the following command:
    <html:code>grep CONFIG_ARM64_SW_TTBR0_PAN /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>The Privileged Access Never (PAN) is the ARM equivalent of the x86 Supervisor Mode Access
Prevention (SMAP), and it prevents privileged acccess to user data unless explicitly enabled.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#aarch64_arch"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_arm64_sw_ttbr0_pan:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_arm64_sw_ttbr0_pan_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_binfmt_misc" severity="medium">
            <xccdf-1.2:title>Disable kernel support for MISC binaries</xccdf-1.2:title>
            <xccdf-1.2:description>Enabling <html:code>CONFIG_BINFMT_MISC</html:code> makes it possible to plug wrapper-driven binary formats
into the kernel. This is specially useful for programs that need an interpreter to run like
Java, Python and DOS emulators. Once you have registered such a binary class with the kernel,
you can start one of those programs simply by typing in its name at a shell prompt.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_BINFMT_MISC</html:code>, run the following command:
    <html:code>grep CONFIG_BINFMT_MISC /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This disables arbitrary binary format support and helps reduce attack surface.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_binfmt_misc:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_binfmt_misc_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_bug" severity="medium">
            <xccdf-1.2:title>Enable support for BUG()</xccdf-1.2:title>
            <xccdf-1.2:description>Disabling this option eliminates support for BUG and WARN, reducing the size of your kernel
image and potentially quietly ignoring numerous fatal conditions. You should only consider
disabling this option for embedded systems with no facilities for reporting errors.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_BUG</html:code>, run the following command:
    <html:code>grep CONFIG_BUG /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>Not setting this variable may hide a number of critical errors.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_bug:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_bug_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_bug_on_data_corruption" severity="low">
            <xccdf-1.2:title>Trigger a kernel BUG when data corruption is detected</xccdf-1.2:title>
            <xccdf-1.2:description>This option makes the kernel BUG when it encounters data corruption in kernel memory structures
when they get checked for validity.
This configuration is available from kernel 4.10.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_BUG_ON_DATA_CORRUPTION</html:code>, run the following command:
    <html:code>grep CONFIG_BUG_ON_DATA_CORRUPTION /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This helps detect data corruptions early and stop with a BUG() error message.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_bug_on_data_corruption:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_bug_on_data_corruption_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_compat_brk" severity="medium">
            <xccdf-1.2:title>Disable compatibility with brk()</xccdf-1.2:title>
            <xccdf-1.2:description>Enabling compatiliby with <html:code>brk()</html:code> allows legacy binaries to run (i.e. those linked
against libc5). But this compatibility comes at the cost of not being able to randomize
the heap placement (ASLR).

Unless legacy binaries need to run on the system, set <html:code>CONFIG_COMPAT_BRK</html:code> to <html:code>"n"</html:code>.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_COMPAT_BRK</html:code>, run the following command:
    <html:code>grep CONFIG_COMPAT_BRK /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>Enabling compatibility with brk() disables support for ASLR.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_compat_brk:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_compat_brk_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_compat_vdso" severity="low">
            <xccdf-1.2:title>Disable the 32-bit vDSO</xccdf-1.2:title>
            <xccdf-1.2:description>Certain buggy versions of glibc (2.3.3) will crash if they are presented with a 32-bit vDSO
that is not mapped at the address indicated in its segment table.
Setting <html:code>CONFIG_COMPAT_VDSO</html:code> to <html:code>y</html:code> turns off the 32-bit VDSO and works
aroud the glibc bug.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_COMPAT_VDSO</html:code>, run the following command:
    <html:code>grep CONFIG_COMPAT_VDSO /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>Enabling VDSO compatibility hurts performance and disables ASLR.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_compat_vdso:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_compat_vdso_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_debug_credentials" severity="low">
            <xccdf-1.2:title>Enable checks on credential management</xccdf-1.2:title>
            <xccdf-1.2:description>Enable this to turn on some debug checking for credential management. The additional code keeps
track of the number of pointers from task_structs to any given cred struct, and checks to see
that this number never exceeds the usage count of the cred struct.

Furthermore, if SELinux is enabled, this also checks that the security pointer in the cred
struct is never seen to be invalid.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_DEBUG_CREDENTIALS</html:code>, run the following command:
    <html:code>grep CONFIG_DEBUG_CREDENTIALS /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This adds sanity checks and validations to credential data structures.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_debug_credentials:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_debug_credentials_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_debug_fs" severity="low">
            <xccdf-1.2:title>Disable kernel debugfs</xccdf-1.2:title>
            <xccdf-1.2:description><html:code>debugfs</html:code> is a virtual file system that kernel developers use to put debugging files
into. Enable this option to be able to read and write to these files.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_DEBUG_FS</html:code>, run the following command:
    <html:code>grep CONFIG_DEBUG_FS /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>To reduce the attack surface, this file system should be disabled if not in use.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_debug_fs:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_debug_fs_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_debug_list" severity="low">
            <xccdf-1.2:title>Enable checks on linked list manipulation</xccdf-1.2:title>
            <xccdf-1.2:description>Enable this to turn on extended checks in the linked-list walking routines.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_DEBUG_LIST</html:code>, run the following command:
    <html:code>grep CONFIG_DEBUG_LIST /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This add sanity checks to manipulation of linked lists structures in the kernel and may
prevent exploits such as CVE-2017-1661, where a race condition and simultaneos operations
caused a list to corrupt.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_debug_list:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_debug_list_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_debug_notifiers" severity="low">
            <xccdf-1.2:title>Enable checks on notifier call chains</xccdf-1.2:title>
            <xccdf-1.2:description>Enable this to turn on sanity checking for notifier call chains. This is most useful for kernel
developers to make sure that modules properly unregister themselves from notifier chains.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_DEBUG_NOTIFIERS</html:code>, run the following command:
    <html:code>grep CONFIG_DEBUG_NOTIFIERS /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This provides validation of notifier chains, it checks whether the notifiers are from the
kernel or a module that is still loaded prior to being invoked.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_debug_notifiers:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_debug_notifiers_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_debug_sg" severity="low">
            <xccdf-1.2:title>Enable checks on scatter-gather (SG) table operations</xccdf-1.2:title>
            <xccdf-1.2:description>Scatter-gather tables are mechanism used for high performance I/O on DMA devices.
Enable this to turn on checks on scatter-gather tables.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_DEBUG_SG</html:code>, run the following command:
    <html:code>grep CONFIG_DEBUG_SG /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This can help find problems with drivers that do not properly initialize their SG tables.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_debug_sg:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_debug_sg_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_debug_wx" severity="medium">
            <xccdf-1.2:title>Warn on W+X mappings found at boot</xccdf-1.2:title>
            <xccdf-1.2:description>Generate a warning if any W+X mappings are found at boot.
This configuration is available from kernel 5.8.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_DEBUG_WX</html:code>, run the following command:
    <html:code>grep CONFIG_DEBUG_WX /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This is useful for discovering cases where the kernel is leaving W+X mappings after applying NX,
as such mappings are a security risk.
Note that even if the check fails, your kernel is possibly still fine, as W+X mappings are not
a security hole in themselves, what they do is that they make the exploitation of other unfixed
kernel bugs easier.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_debug_wx:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_debug_wx_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_default_mmap_min_addr" severity="medium">
            <xccdf-1.2:title>Configure low address space to protect from user allocation</xccdf-1.2:title>
            <xccdf-1.2:description>This is the portion of low virtual memory which should be protected from userspace allocation.
This configuration is available from kernel 3.14, but may be available if backported
by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_DEFAULT_MMAP_MIN_ADDR</html:code>, run the following command:
    <html:code>grep CONFIG_DEFAULT_MMAP_MIN_ADDR /boot/config-*</html:code>
    
    For each kernel installed, a line with value "65536" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>Keeping a user from writing to low pages can help reduce the impact of kernel NULL pointer bugs.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_default_mmap_min_addr:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_default_mmap_min_addr_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_devkmem" severity="low">
            <xccdf-1.2:title>Disable /dev/kmem virtual device support</xccdf-1.2:title>
            <xccdf-1.2:description>Disable support for the /dev/kmem device.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_DEVKMEM</html:code>, run the following command:
    <html:code>grep CONFIG_DEVKMEM /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>The /dev/kmem device is rarely used, but can be used for certain kind of kernel debugging
operations.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_devkmem:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_devkmem_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_fortify_source" severity="medium">
            <xccdf-1.2:title>Harden common str/mem functions against buffer overflows</xccdf-1.2:title>
            <xccdf-1.2:description>Detect overflows of buffers in common string and memory functions where the compiler can
determine and validate the buffer sizes.
This configuration is available from kernel 4.13, but may be available if backported by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_FORTIFY_SOURCE</html:code>, run the following command:
    <html:code>grep CONFIG_FORTIFY_SOURCE /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This features helps reduce likelihood of memory corruption of kernel structures.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_fortify_source:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_fortify_source_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_hardened_usercopy" severity="high">
            <xccdf-1.2:title>Harden memory copies between kernel and userspace</xccdf-1.2:title>
            <xccdf-1.2:description>This option checks for obviously wrong memory regions when copying memory to/from the kernel
(via copy_to_user() and copy_from_user() functions) by rejecting memory ranges that are larger
than the specified heap object, span multiple separately allocated pages, are not on the
process stack, or are part of the kernel text.
This configuration is available from kernel 4.8, and may be available if backported by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_HARDENED_USERCOPY</html:code>, run the following command:
    <html:code>grep CONFIG_HARDENED_USERCOPY /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This config prevents entire classes of heap overflow exploits and similar kernel memory exposures.
</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_hardened_usercopy:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_hardened_usercopy_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_hardened_usercopy_fallback" severity="high">
            <xccdf-1.2:title>Do not allow usercopy whitelist violations to fallback to object size</xccdf-1.2:title>
            <xccdf-1.2:description>This is a temporary option that allows missing usercopy whitelists to be discovered via a WARN()
to the kernel log, instead of rejecting the copy, falling back to non-whitelisted hardened
usercopy that checks the slab allocation size instead of the whitelist size.
This configuration is available from kernel 4.16.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_HARDENED_USERCOPY_FALLBACK</html:code>, run the following command:
    <html:code>grep CONFIG_HARDENED_USERCOPY_FALLBACK /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This config prevents entire classes of heap overflow exploits and similar kernel memory exposures.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_hardened_usercopy_fallback:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_hardened_usercopy_fallback_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_hibernation" severity="medium">
            <xccdf-1.2:title>Disable hibernation</xccdf-1.2:title>
            <xccdf-1.2:description>Enable the suspend to disk (STD) functionality, which is usually called "hibernation" in user
interfaces. STD checkpoints the system and powers it off; and restores that checkpoint on
reboot.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_HIBERNATION</html:code>, run the following command:
    <html:code>grep CONFIG_HIBERNATION /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>Suspending to disk allows one to replace the running kernel.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_hibernation:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_hibernation_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_ia32_emulation" severity="medium">
            <xccdf-1.2:title>Disable IA32 emulation</xccdf-1.2:title>
            <xccdf-1.2:description>Disables support for legacy 32-bit programs under a 64-bit kernel.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_IA32_EMULATION</html:code>, run the following command:
    <html:code>grep CONFIG_IA32_EMULATION /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:warning category="general">Only disable support for 32-bit programs if you are sure you don't need any 32-bit program.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>Disabling 32-bit backwards compatibility helps reduce the attack surface.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_ia32_emulation:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_ia32_emulation_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_ipv6" severity="medium">
            <xccdf-1.2:title>Disable the IPv6 protocol</xccdf-1.2:title>
            <xccdf-1.2:description>Disable support for IP version 6 (IPv6).

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_IPV6</html:code>, run the following command:
    <html:code>grep CONFIG_IPV6 /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>Any unnecessary network stacks, including IPv6, should be disabled to reduce
the vulnerability to exploitation.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_ipv6:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_ipv6_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_kexec" severity="low">
            <xccdf-1.2:title>Disable kexec system call</xccdf-1.2:title>
            <xccdf-1.2:description><html:code>kexec</html:code> is a system call that implements the ability to shutdown your current kernel,
and to start another kernel. It is like a reboot but it is independent of the system firmware.
And like a reboot you can start any kernel with it, not just Linux.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_KEXEC</html:code>, run the following command:
    <html:code>grep CONFIG_KEXEC /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>Prohibits the execution of a new kernel image after reboot.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_kexec:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_kexec_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_legacy_ptys" severity="medium">
            <xccdf-1.2:title>Disable legacy (BSD) PTY support</xccdf-1.2:title>
            <xccdf-1.2:description>Disable the Linux traditional BSD-like terminal names /dev/ptyxx for masters and /dev/ttyxx for
slaves of pseudo terminals, and use only the modern ptys (devpts) interface.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_LEGACY_PTYS</html:code>, run the following command:
    <html:code>grep CONFIG_LEGACY_PTYS /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>The legacy scheme has a number of security problems.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_legacy_ptys:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_legacy_ptys_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_legacy_vsyscall_emulate" severity="medium">
            <xccdf-1.2:title>Disable vsyscall emulation</xccdf-1.2:title>
            <xccdf-1.2:description>The kernel traps and emulates calls into the fixed vsyscall address mapping.
This configuration is available from kernel 5.3, but may be available if backported by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_LEGACY_VSYSCALL_EMULATE</html:code>, run the following command:
    <html:code>grep CONFIG_LEGACY_VSYSCALL_EMULATE /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>The mapping is non-executable, but it still contains known contents, which could be
used in certain rare security vulnerability exploits.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_legacy_vsyscall_emulate:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_legacy_vsyscall_emulate_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_legacy_vsyscall_none" severity="medium">
            <xccdf-1.2:title>Disable vsyscall mapping</xccdf-1.2:title>
            <xccdf-1.2:description>This config disables the vsyscall mapping at all. Attempts to use the vsyscalls will be reported to
dmesg, so that either old or malicious userspace programs can be identified.
This configuration is available from kernel 4.4.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_LEGACY_VSYSCALL_NONE</html:code>, run the following command:
    <html:code>grep CONFIG_LEGACY_VSYSCALL_NONE /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This will eliminate any risk of ASLR bypass due to the vsyscall fixed address mapping.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_legacy_vsyscall_none:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_legacy_vsyscall_none_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_legacy_vsyscall_xonly" severity="medium">
            <xccdf-1.2:title>Disable vsyscall emulate execution only</xccdf-1.2:title>
            <xccdf-1.2:description>The kernel traps and emulates calls into the fixed vsyscall address mapping and does not allow
reads.
This configuration is available from kernel 5.3.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_LEGACY_VSYSCALL_XONLY</html:code>, run the following command:
    <html:code>grep CONFIG_LEGACY_VSYSCALL_XONLY /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>Disabling this mitigates certain uses of the vsyscall area as an ASLR-bypassing buffer.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_legacy_vsyscall_xonly:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_legacy_vsyscall_xonly_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_modify_ldt_syscall" severity="medium">
            <xccdf-1.2:title>Disable the LDT (local descriptor table)</xccdf-1.2:title>
            <xccdf-1.2:description>Linux can allow user programs to install a per-process x86 Local Descriptor Table (LDT) using
the modify_ldt(2) system call. This is required to run 16-bit or segmented code such as DOSEMU
or some Wine programs. It is also used by some very old threading libraries.
This configuration is available from kernel 4.3, but may be available if backported
by distros.

Disable LDT if 16-bit program emulation is not necessary.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_MODIFY_LDT_SYSCALL</html:code>, run the following command:
    <html:code>grep CONFIG_MODIFY_LDT_SYSCALL /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>Disabling support for unnecessary code reduces attack surface.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_modify_ldt_syscall:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_modify_ldt_syscall_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_module_sig" severity="medium">
            <xccdf-1.2:title>Enable module signature verification</xccdf-1.2:title>
            <xccdf-1.2:description>Check modules for valid signatures upon load.
Note that this option adds the OpenSSL development packages as a kernel build dependency so
that the signing tool can use its crypto library.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_MODULE_SIG</html:code>, run the following command:
    <html:code>grep CONFIG_MODULE_SIG /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>Loaded modules must be signed.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_module_sig:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_module_sig_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_module_sig_all" severity="medium">
            <xccdf-1.2:title>Enable automatic signing of all modules</xccdf-1.2:title>
            <xccdf-1.2:description>Sign all modules during make modules_install. Without this option, modules must be signed
manually, using the scripts/sign-file tool.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_MODULE_SIG_ALL</html:code>, run the following command:
    <html:code>grep CONFIG_MODULE_SIG_ALL /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This ensures the modules are signed during install process.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_module_sig_all:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_module_sig_all_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_module_sig_force" severity="medium">
            <xccdf-1.2:title>Require modules to be validly signed</xccdf-1.2:title>
            <xccdf-1.2:description>Reject unsigned modules or signed modules with an unknown key.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_MODULE_SIG_FORCE</html:code>, run the following command:
    <html:code>grep CONFIG_MODULE_SIG_FORCE /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>Prevent loading modules that are unsigned or signed with an unknown key.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_module_sig_force:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_module_sig_force_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_module_sig_hash" severity="medium">
            <xccdf-1.2:title>Specify the hash to use when signing modules</xccdf-1.2:title>
            <xccdf-1.2:description>This configures the kernel to build and sign modules using
<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_kernel_config_module_sig_hash" use="legacy"/> as the hash function.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_MODULE_SIG_HASH</html:code>, run the following command:
    <html:code>grep CONFIG_MODULE_SIG_HASH /boot/config-*</html:code>
    
    For each kernel installed, a line with value "<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_kernel_config_module_sig_hash" use="legacy"/>" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>Use of strong hash function is important to secure the module against counterfeit signatures.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_kernel_config_module_sig_hash:var:1" value-id="xccdf_org.ssgproject.content_value_var_kernel_config_module_sig_hash"/>
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_module_sig_hash:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_module_sig_hash_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_module_sig_key" severity="medium">
            <xccdf-1.2:title>Specify module signing key to use</xccdf-1.2:title>
            <xccdf-1.2:description>Setting this option to something other than its default of <html:code>certs/signing_key.pem</html:code> will
disable the autogeneration of signing keys and allow the kernel modules to be signed with a key
of your choosing.

The string provided should identify a file containing both a private key and
its corresponding X.509 certificate in PEM form, or — on systems where the OpenSSL ENGINE_pkcs11
is functional — a PKCS#11 URI as defined by RFC7512. In the latter case, the PKCS#11 URI should
reference both a certificate and a private key.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_MODULE_SIG_KEY</html:code>, run the following command:
    <html:code>grep CONFIG_MODULE_SIG_KEY /boot/config-*</html:code>
    
    For each kernel installed, a line with value "<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_kernel_config_module_sig_key" use="legacy"/>" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>A key and certificate is required to sign the built modules.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_kernel_config_module_sig_key:var:1" value-id="xccdf_org.ssgproject.content_value_var_kernel_config_module_sig_key"/>
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_module_sig_key:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_module_sig_key_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_module_sig_sha512" severity="medium">
            <xccdf-1.2:title>Sign kernel modules with SHA-512</xccdf-1.2:title>
            <xccdf-1.2:description>This configures the kernel to build and sign modules using SHA512 as the hash function.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_MODULE_SIG_SHA512</html:code>, run the following command:
    <html:code>grep CONFIG_MODULE_SIG_SHA512 /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>Use of strong hash function is important to secure the module against counterfeit signatures.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_module_sig_sha512:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_module_sig_sha512_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_page_poisoning" severity="medium">
            <xccdf-1.2:title>Enable poison of pages after freeing</xccdf-1.2:title>
            <xccdf-1.2:description>Fill the pages with poison patterns after free_pages() and verify the patterns before
alloc_pages. This does have a potential performance impact if enabled with the "page_poison=1"
kernel boot option.
This configuration is available from kernel 4.6.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_PAGE_POISONING</html:code>, run the following command:
    <html:code>grep CONFIG_PAGE_POISONING /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>The filling of the memory helps reduce the risk of information leaks from freed data.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_page_poisoning:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_page_poisoning_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_page_poisoning_no_sanity" severity="medium">
            <xccdf-1.2:title>Enable poison without sanity check</xccdf-1.2:title>
            <xccdf-1.2:description>Skip the sanity checking on alloc, only fill the pages with poison on free. This reduces some
of the overhead of the poisoning feature.
This configuration is available from kernel 4.6.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_PAGE_POISONING_NO_SANITY</html:code>, run the following command:
    <html:code>grep CONFIG_PAGE_POISONING_NO_SANITY /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This configuration helps alleviates the performance impact of poisonining.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_page_poisoning_no_sanity:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_page_poisoning_no_sanity_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_page_poisoning_zero" severity="medium">
            <xccdf-1.2:title>Use zero for poisoning instead of debugging value</xccdf-1.2:title>
            <xccdf-1.2:description>Instead of using the existing poison value, fill the pages with zeros. This makes it harder to
detect when errors are occurring due to sanitization but the zeroing at free means that it is
no longer necessary to write zeros when GFP_ZERO is used on allocation.
This configuration is available from kernel 4.19.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_PAGE_POISONING_ZERO</html:code>, run the following command:
    <html:code>grep CONFIG_PAGE_POISONING_ZERO /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This configuration helps alleviates the performance impact of poisonining.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_page_poisoning_zero:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_page_poisoning_zero_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_page_table_isolation" severity="high">
            <xccdf-1.2:title>Remove the kernel mapping in user mode</xccdf-1.2:title>
            <xccdf-1.2:description>This feature reduces the number of hardware side channels by ensuring that the majority of
kernel addresses are not mapped into userspace.
This configuration is available from kernel 4.15, but may be available if backported
by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_PAGE_TABLE_ISOLATION</html:code>, run the following command:
    <html:code>grep CONFIG_PAGE_TABLE_ISOLATION /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This is a countermeasure to the Meltdown attack.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_page_table_isolation:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_page_table_isolation_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_panic_on_oops" severity="medium">
            <xccdf-1.2:title>Kernel panic oops</xccdf-1.2:title>
            <xccdf-1.2:description>Enable the kernel to panic when it oopses.
This has the same effect as setting oops=panic on the kernel command line.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_PANIC_ON_OOPS</html:code>, run the following command:
    <html:code>grep CONFIG_PANIC_ON_OOPS /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This feature ensures that the kernel does not do anything erroneous after an oops which
could result in data corruption or other issues.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_panic_on_oops:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_panic_on_oops_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_panic_timeout" severity="medium">
            <xccdf-1.2:title>Kernel panic timeout</xccdf-1.2:title>
            <xccdf-1.2:description>Set the timeout value (in seconds) until a reboot occurs when the kernel panics.
A timeout of 0 configures the system to wait forever. With a timeout value greater than 0,
the system will wait the specified amount of seconds before rebooting. While a timeout value
less than 0 makes the system reboot immediately.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_PANIC_TIMEOUT</html:code>, run the following command:
    <html:code>grep CONFIG_PANIC_TIMEOUT /boot/config-*</html:code>
    
    For each kernel installed, a line with value "<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_kernel_config_panic_timeout" use="legacy"/>" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This is required to enable protection against Spectre v2.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_kernel_config_panic_timeout:var:1" value-id="xccdf_org.ssgproject.content_value_var_kernel_config_panic_timeout"/>
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_panic_timeout:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_panic_timeout_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_proc_kcore" severity="low">
            <xccdf-1.2:title>Disable support for /proc/kkcore</xccdf-1.2:title>
            <xccdf-1.2:description>Provides a virtual ELF core file of the live kernel.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_PROC_KCORE</html:code>, run the following command:
    <html:code>grep CONFIG_PROC_KCORE /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This feature exposes the memory to the userspace and can assist an attacker in discovering
attack vectors.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_proc_kcore:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_proc_kcore_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_randomize_base" severity="medium">
            <xccdf-1.2:title>Randomize the address of the kernel image (KASLR)</xccdf-1.2:title>
            <xccdf-1.2:description>In support of Kernel Address Space Layout Randomization (KASLR), this randomizes the physical
address at which the kernel image is decompressed and the virtual address where the kernel
image is mapped.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_RANDOMIZE_BASE</html:code>, run the following command:
    <html:code>grep CONFIG_RANDOMIZE_BASE /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>An unpredictable kernel address makes it more difficult to succeed with exploits that rely on
knowledge of the location of kernel code internals.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_randomize_base:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_randomize_base_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_randomize_memory" severity="medium">
            <xccdf-1.2:title>Randomize the kernel memory sections</xccdf-1.2:title>
            <xccdf-1.2:description>Randomizes the base virtual address of kernel memory sections (physical memory mapping,
vmalloc &amp; vmemmap).
This configuration is available from kernel 4.8, but may be available if backported
by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_RANDOMIZE_MEMORY</html:code>, run the following command:
    <html:code>grep CONFIG_RANDOMIZE_MEMORY /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This security feature makes exploits relying on predictable memory locations less reliable.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_randomize_memory:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_randomize_memory_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_refcount_full" severity="medium">
            <xccdf-1.2:title>Perform full reference count validation</xccdf-1.2:title>
            <xccdf-1.2:description>Enabling this switches the refcounting infrastructure from a fast unchecked atomic_t
implementation to a fully state checked implementation, which can have a slight
impact in performance.
This configuration is available from kernel 4.13, but may be available if backported
by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_REFCOUNT_FULL</html:code>, run the following command:
    <html:code>grep CONFIG_REFCOUNT_FULL /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>Refcounting provides protections against various use-after-free conditions that can be
used in security flaw exploits.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_refcount_full:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_refcount_full_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_retpoline" severity="medium">
            <xccdf-1.2:title>Avoid speculative indirect branches in kernel</xccdf-1.2:title>
            <xccdf-1.2:description>Compile kernel with the retpoline compiler options to guard against kernel-to-user data leaks
by avoiding speculative indirect branches.
Requires a compiler with -mindirect-branch=thunk-extern support for full protection.
The kernel may run slower.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_RETPOLINE</html:code>, run the following command:
    <html:code>grep CONFIG_RETPOLINE /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This is required to enable protection against Spectre v2.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_retpoline:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_retpoline_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_sched_stack_end_check" severity="medium">
            <xccdf-1.2:title>Detect stack corruption on calls to schedule()</xccdf-1.2:title>
            <xccdf-1.2:description>This option checks for a stack overrun on calls to schedule(). If the stack end location is
found to be overwritten always panic as the content of the corrupted region can no longer
be trusted.
This configuration is available from kernel 3.18.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_SCHED_STACK_END_CHECK</html:code>, run the following command:
    <html:code>grep CONFIG_SCHED_STACK_END_CHECK /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This ensures no erroneous behaviour occurs which could result in data corruption or a
sporadic crash at a later stage once the region is examined.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_sched_stack_end_check:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_sched_stack_end_check_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_seccomp" severity="medium">
            <xccdf-1.2:title>Enable seccomp to safely compute untrusted bytecode</xccdf-1.2:title>
            <xccdf-1.2:description>This kernel feature is useful for number crunching applications that may need to compute
untrusted bytecode during their execution. By using pipes or other transports made available
to the process as file descriptors supporting the read/write syscalls, it's possible to isolate
those applications in their own address space using seccomp.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_SECCOMP</html:code>, run the following command:
    <html:code>grep CONFIG_SECCOMP /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale><html:code>seccomp</html:code> enables the ability to filter system calls made by an application, effectively
isolating the system's resources from it.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_seccomp:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_seccomp_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_seccomp_filter" severity="medium">
            <xccdf-1.2:title>Enable use of Berkeley Packet Filter with seccomp</xccdf-1.2:title>
            <xccdf-1.2:description>Enable tasks to build secure computing environments defined in terms of Berkeley Packet Filter
programs which implement task-defined system call filtering polices.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_SECCOMP_FILTER</html:code>, run the following command:
    <html:code>grep CONFIG_SECCOMP_FILTER /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>Use of BPF filters allows for expressive filtering of system calls using a filter program
language with a long history of being exposed to userland.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_seccomp_filter:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_seccomp_filter_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_security" severity="medium">
            <xccdf-1.2:title>Enable different security models</xccdf-1.2:title>
            <xccdf-1.2:description>This allows you to choose different security modules to be configured into your kernel.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_SECURITY</html:code>, run the following command:
    <html:code>grep CONFIG_SECURITY /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This is enables kernel security primitives required by the LSM framework.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_security:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_security_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_security_dmesg_restrict" severity="medium">
            <xccdf-1.2:title>Restrict unprivileged access to the kernel syslog</xccdf-1.2:title>
            <xccdf-1.2:description>Enforce restrictions on unprivileged users reading the kernel syslog via dmesg(8).

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_SECURITY_DMESG_RESTRICT</html:code>, run the following command:
    <html:code>grep CONFIG_SECURITY_DMESG_RESTRICT /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>Prevents unprivileged users from retrieving kernel addresses with dmesg.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_security_dmesg_restrict:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_security_dmesg_restrict_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_security_writable_hooks" severity="medium">
            <xccdf-1.2:title>Disable mutable hooks</xccdf-1.2:title>
            <xccdf-1.2:description>Ensure kernel structures associated with LSMs are always mapped as read-only after system boot.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_SECURITY_WRITABLE_HOOKS</html:code>, run the following command:
    <html:code>grep CONFIG_SECURITY_WRITABLE_HOOKS /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>If CONFIG_SECURITY_WRITABLE_HOOKS is enabled, then hooks can be loaded at runtime and
being able to manipulate hooks is a way to bypass all LSMs.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_security_writable_hooks:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_security_writable_hooks_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_security_yama" severity="medium">
            <xccdf-1.2:title>Enable Yama support</xccdf-1.2:title>
            <xccdf-1.2:description>This enables support for LSM module Yama, which extends DAC support with additional system-wide
security settings beyond regular Linux discretionary access controls. The module will limit the
use of the system call <html:code>ptrace()</html:code>.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_SECURITY_YAMA</html:code>, run the following command:
    <html:code>grep CONFIG_SECURITY_YAMA /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>Unrestricted usage of ptrace allows compromised binaries to run ptrace
on another processes of the user.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_security_yama:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_security_yama_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_slab_freelist_hardened" severity="medium">
            <xccdf-1.2:title>Harden slab freelist metadata</xccdf-1.2:title>
            <xccdf-1.2:description>This feature protects integrity of the allocator's metadata.
This configuration is available from kernel 4.14.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_SLAB_FREELIST_HARDENED</html:code>, run the following command:
    <html:code>grep CONFIG_SLAB_FREELIST_HARDENED /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>Many kernel heap attacks try to target slab cache metadata and other infrastructure.
This options makes minor performance sacrifices to harden the kernel slab allocator against
common freelist exploit methods.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_slab_freelist_hardened:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_slab_freelist_hardened_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_slab_freelist_random" severity="medium">
            <xccdf-1.2:title>Randomize slab freelist</xccdf-1.2:title>
            <xccdf-1.2:description>Randomizes the freelist order used on creating new pages.
This configuration is available from kernel 5.9, but may be available if backported by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_SLAB_FRELIST_RANDOM</html:code>, run the following command:
    <html:code>grep CONFIG_SLAB_FRELIST_RANDOM /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This security feature reduces the predictability of the kernel slab allocator against heap overflows.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_slab_freelist_random:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_slab_freelist_random_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_slab_merge_default" severity="medium">
            <xccdf-1.2:title>Disallow merge of slab caches</xccdf-1.2:title>
            <xccdf-1.2:description>For reduced kernel memory fragmentation, slab caches can be merged when they share the same
size and other characteristics. This carries a risk of kernel heap overflows being able to
overwrite objects from merged caches (and more easily control cache layout), which makes such
heap attacks easier to exploit by attackers.
This configuration is available from kernel 4.13.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_SLAB_MERGE_DEFAULT</html:code>, run the following command:
    <html:code>grep CONFIG_SLAB_MERGE_DEFAULT /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>Disabling the merge of slabs of similar sizes prevents the kernel from
merging a seemingly useless but vulnerable slab with a useful and valuable slab.
This increase the risk that a heap overflow could overwrite objects from merged caches,
with unmerged caches the heap overflow would only affect the objects in the same cache.
Overall, this reduces the kernel attack surface area by isolating slabs from each other.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_slab_merge_default:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_slab_merge_default_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_slub_debug" severity="medium">
            <xccdf-1.2:title>Enable SLUB debugging support</xccdf-1.2:title>
            <xccdf-1.2:description>SLUB has extensive debug support features and this allows the allocator validation checking to
be enabled.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_SLUB_DEBUG</html:code>, run the following command:
    <html:code>grep CONFIG_SLUB_DEBUG /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This activates the checking of the memory allocator structures and resets to zero the zones
allocated when they are released.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_slub_debug:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_slub_debug_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_stackprotector" severity="medium">
            <xccdf-1.2:title>Stack Protector buffer overlow detection</xccdf-1.2:title>
            <xccdf-1.2:description>This feature puts, at the beginning of functions, a canary value on the stack just before the
return address, and validates the value just before actually returning.
This configuration is available from kernel 4.18.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_STACKPROTECTOR</html:code>, run the following command:
    <html:code>grep CONFIG_STACKPROTECTOR /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This halts the program when a stack overflow is detected, potentially reducing the impact of
exploits.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_stackprotector:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_stackprotector_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_stackprotector_strong" severity="medium">
            <xccdf-1.2:title>Strong Stack Protector</xccdf-1.2:title>
            <xccdf-1.2:description>This features adds canary logic protection to more kinds of vulnerable functions than
CONFIG_STACKPROTECTOR, but not to all functions so that performance is not severily impacted.
This configuration is available from kernel 4.18.
This config requires gcc version 4.9 or above, or a distribution gcc with the feature
backported ("-fstack-protector-strong").

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_STACKPROTECTOR_STRONG</html:code>, run the following command:
    <html:code>grep CONFIG_STACKPROTECTOR_STRONG /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This provides a mechanism that protects more vulnerable functions than CONFIG_STACKPROTECTOR,
balancing between security and performance.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_stackprotector_strong:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_stackprotector_strong_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_strict_kernel_rwx" severity="medium">
            <xccdf-1.2:title>Make the kernel text and rodata read-only</xccdf-1.2:title>
            <xccdf-1.2:description>When set, kernel text and rodata memory will be made read-only, and non-text memory will be made non-executable.
This configuration is available from kernel 4.11.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_STRICT_KERNEL_RWX</html:code>, run the following command:
    <html:code>grep CONFIG_STRICT_KERNEL_RWX /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This provides protection against certain security exploits (e.g. executing the heap or modifying text)</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_strict_kernel_rwx:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_strict_kernel_rwx_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_strict_module_rwx" severity="medium">
            <xccdf-1.2:title>Make the module text and rodata read-only</xccdf-1.2:title>
            <xccdf-1.2:description>When set, module text and rodata memory will be made read-only, and non-text memory will be made non-executable.
This configuration is available from kernel 4.11.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_STRICT_MODULE_RWX</html:code>, run the following command:
    <html:code>grep CONFIG_STRICT_MODULE_RWX /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This provides protection against certain security exploits (e.g. executing the heap or modifying text)</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_strict_module_rwx:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_strict_module_rwx_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_syn_cookies" severity="medium">
            <xccdf-1.2:title>Enable TCP/IP syncookie support</xccdf-1.2:title>
            <xccdf-1.2:description>Normal TCP/IP networking is open to an attack known as SYN flooding.
It is denial-of-service attack that prevents legitimate remote users from being able to connect
to your computer during an ongoing attack.

When enabled the TCP/IP stack will use a cryptographic challenge protocol known as SYN cookies
to enable legitimate users to continue to connect, even when your machine is under attack.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_SYN_COOKIES</html:code>, run the following command:
    <html:code>grep CONFIG_SYN_COOKIES /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>SYN cookies provide protection against SYN flooding attacks.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_syn_cookies:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_syn_cookies_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_unmap_kernel_at_el0" severity="medium">
            <xccdf-1.2:title>Unmap kernel when running in userspace (aka KAISER)</xccdf-1.2:title>
            <xccdf-1.2:description>Speculation attacks against some high-performance processors can be used to bypass MMU
permission checks and leak kernel data to userspace. This can be defended against by unmapping
the kernel when running in userspace, mapping it back in on exception entry via a trampoline
page in the vector table.
This configuration is available from kernel 4.16, but may be available if backported
by distros.
The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_UNMAP_KERNEL_AT_EL0</html:code>, run the following command:
    <html:code>grep CONFIG_UNMAP_KERNEL_AT_EL0 /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This is a countermeasure to the Meltdown attack.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#aarch64_arch"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_unmap_kernel_at_el0:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_unmap_kernel_at_el0_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_vmap_stack" severity="medium">
            <xccdf-1.2:title>User a virtually-mapped stack</xccdf-1.2:title>
            <xccdf-1.2:description>Enable this to use virtually-mapped kernel stacks with guard pages.
This configuration is available from kernel 4.9.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_VMAP_STACK</html:code>, run the following command:
    <html:code>grep CONFIG_VMAP_STACK /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>This causes kernel stack overflows to be caught immediately rather than causing difficult-to-diagnose corruption.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_vmap_stack:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_vmap_stack_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_x86_vsyscall_emulation" severity="low">
            <xccdf-1.2:title>Disable x86 vsyscall emulation</xccdf-1.2:title>
            <xccdf-1.2:description>Disabling it is roughly equivalent to booting with vsyscall=none, except that it will also
disable the helpful warning if a program tries to use a vsyscall. With this option set to N,
offending programs will just segfault, citing addresses of the form 0xffffffffff600?00.
This configuration is available from kernel 3.19.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_X86_VSYSCALL_EMULATION</html:code>, run the following command:
    <html:code>grep CONFIG_X86_VSYSCALL_EMULATION /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>The vsyscall table is no longer required and is a potential source of ROP gadgets.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_x86_vsyscall_emulation:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_x86_vsyscall_emulation_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gcc_plugin">
            <xccdf-1.2:title>Kernel GCC plugin configuration</xccdf-1.2:title>
            <xccdf-1.2:description>Contains rules that check the configuration of GCC plugins used by the compiler</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_gcc_plugin_latent_entropy" severity="medium">
              <xccdf-1.2:title>Generate some entropy during boot and runtime</xccdf-1.2:title>
              <xccdf-1.2:description>Instrument some kernel code to extract some entropy from both original and artificially created
program state. This will help especially embedded systems where there is little 'natural' source
of entropy normally.

This configuration is available from kernel 4.9, but may be available if backported
by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_GCC_PLUGIN_LATENT_ENTROPY</html:code>, run the following command:
    <html:code>grep CONFIG_GCC_PLUGIN_LATENT_ENTROPY /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
              <xccdf-1.2:warning category="general">Note that entropy extracted this way is not cryptographically secure!</xccdf-1.2:warning>
              <xccdf-1.2:warning category="performance">There is a performance cost during the boot process (about 0.5%) and fork and irq processing.</xccdf-1.2:warning>
              <xccdf-1.2:rationale>This helps generate entropy during startup and is particularly relevant for devices with
inappropriate entropy sources.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_gcc_plugin_latent_entropy:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_gcc_plugin_latent_entropy_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_gcc_plugin_randstruct" severity="medium">
              <xccdf-1.2:title>Randomize layout of sensitive kernel structures</xccdf-1.2:title>
              <xccdf-1.2:description>Randomize at compile-time the layouts of structures that are entirely function pointers
(and have not been manually annotated with __no_randomize_layout), or structures that have
been explicitly marked with __randomize_layout.
This configuration is available from kernel 4.13, but may be available if backported
by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_GCC_PLUGIN_RANDSTRUCT</html:code>, run the following command:
    <html:code>grep CONFIG_GCC_PLUGIN_RANDSTRUCT /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
              <xccdf-1.2:rationale>Randomizing the layout of kernel data structures make it more difficult for an attacker to
know the location of sensitive data.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_gcc_plugin_randstruct:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_gcc_plugin_randstruct_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_gcc_plugin_stackleak" severity="medium">
              <xccdf-1.2:title>Poison kernel stack before returning from syscalls</xccdf-1.2:title>
              <xccdf-1.2:description>This option makes the kernel erase the kernel stack before returning from system calls.
This has the effect of leaving the stack initialized to the poison value, which both reduces
the lifetime of any sensitive stack contents and reduces potential for uninitialized stack
variable exploits or information exposures (it does not cover functions reaching the same
stack depth as prior functions during the same syscall).

This configuration is available from kernel 4.20, but may be available if backported
by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_GCC_PLUGIN_STACKLEAK</html:code>, run the following command:
    <html:code>grep CONFIG_GCC_PLUGIN_STACKLEAK /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
              <xccdf-1.2:warning category="performance">The performance impact on a single CPU system kernel is of 1% slowdown.</xccdf-1.2:warning>
              <xccdf-1.2:rationale>This blocks most uninitialized stack variable attacks, with the performance impact being
driven by the depth of the stack usage, rather than the function calling complexity.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_gcc_plugin_stackleak:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_gcc_plugin_stackleak_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_gcc_plugin_structleak" severity="medium">
              <xccdf-1.2:title>Force initialization of variables containing userspace addresses</xccdf-1.2:title>
              <xccdf-1.2:description>While the kernel is built with warnings enabled for any missed stack variable initializations,
this warning is silenced for anything passed by reference to another function, under the
occasionally misguided assumption that the function will do the initialization. As this
regularly leads to exploitable flaws, this plugin is available to identify and zero-initialize
such variables, depending on the chosen level of coverage.
This configuration is available from kernel 4.11, but may be available if backported
by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_GCC_PLUGIN_STRUCTLEAK</html:code>, run the following command:
    <html:code>grep CONFIG_GCC_PLUGIN_STRUCTLEAK /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
              <xccdf-1.2:rationale>Initializing structures from userspace can prevent some classes of information exposure.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_gcc_plugin_structleak:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_gcc_plugin_structleak_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_gcc_plugin_structleak_byref_all" severity="medium">
              <xccdf-1.2:title>zero-init everything passed by reference</xccdf-1.2:title>
              <xccdf-1.2:description>Zero-initialize any stack variables that may be passed by reference and had not already been explicitly initialized.
This configuration is available from kernel 4.14, but may be available if backported
by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL</html:code>, run the following command:
    <html:code>grep CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
              <xccdf-1.2:rationale>This eliminates all classes of uninitialized stack variable exploits and information exposures.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_config_gcc_plugin_structleak_byref_all:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_config_gcc_plugin_structleak_byref_all_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_logging">
          <xccdf-1.2:title>Configure Syslog</xccdf-1.2:title>
          <xccdf-1.2:description>The syslog service has been the default Unix logging mechanism for
many years. It has a number of downsides, including inconsistent log format,
lack of authentication for received messages, and lack of authentication,
encryption, or reliable transport for messages sent over a network. However,
due to its long history, syslog is a de facto standard which is supported by
almost all Unix applications.
<html:br/>
<html:br/>
In Fedora, rsyslog has replaced ksyslogd as the
syslog daemon of choice, and it includes some additional security features
such as reliable, connection-oriented (i.e. TCP) transmission of logs, the
option to log to database formats, and the encryption of log data en route to
a central logging server.
This section discusses how to configure rsyslog for
best effect, and how to use tools provided with the system to maintain and
monitor logs.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#machine"/>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed" severity="medium">
            <xccdf-1.2:title>Ensure rsyslog-gnutls is installed</xccdf-1.2:title>
            <xccdf-1.2:description>TLS protocol support for rsyslog is installed.
The <html:code>rsyslog-gnutls</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install rsyslog-gnutls</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R43)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FTP_ITC_EXT.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The rsyslog-gnutls package provides Transport Layer Security (TLS) support
for the rsyslog daemon, which enables secure remote logging.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_rsyslog-gnutls_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "rsyslog-gnutls" ; then
    dnf install -y "rsyslog-gnutls"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_rsyslog-gnutls_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure rsyslog-gnutls is installed
  package:
    name: rsyslog-gnutls
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_rsyslog-gnutls_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_rsyslog-gnutls_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_rsyslog-gnutls

class install_rsyslog-gnutls {
  package { 'rsyslog-gnutls':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_rsyslog-gnutls_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=rsyslog-gnutls
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_rsyslog-gnutls_installed">
[[packages]]
name = "rsyslog-gnutls"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_rsyslog-gnutls_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_rsyslog-gnutls_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_rsyslog_installed" severity="medium">
            <xccdf-1.2:title>Ensure rsyslog is Installed</xccdf-1.2:title>
            <xccdf-1.2:description>Rsyslog is installed by default. The <html:code>rsyslog</html:code> package can be installed with the following command: <html:pre> $ sudo dnf install rsyslog</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R5)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R46)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001311</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001312</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FTP_ITC_EXT.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000051-GPOS-00024</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The rsyslog package provides the rsyslog daemon, which provides
system logging services.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_rsyslog_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "rsyslog" ; then
    dnf install -y "rsyslog"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_rsyslog_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure rsyslog is installed
  package:
    name: rsyslog
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_rsyslog_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_rsyslog_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_rsyslog

class install_rsyslog {
  package { 'rsyslog':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_rsyslog_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=rsyslog
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_rsyslog_installed">
[[packages]]
name = "rsyslog"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_rsyslog_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_rsyslog_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_rsyslog_enabled" severity="medium">
            <xccdf-1.2:title>Enable rsyslog Service</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>rsyslog</html:code> service provides syslog-style logging by default on Fedora.

The <html:code>rsyslog</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable rsyslog.service</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R5)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R46)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001311</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001312</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001557</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The <html:code>rsyslog</html:code> service must be running in order to provide
logging services, which are essential to system administration.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_rsyslog_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'rsyslog.service'
"$SYSTEMCTL_EXEC" start 'rsyslog.service'
"$SYSTEMCTL_EXEC" enable 'rsyslog.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_rsyslog_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Enable service rsyslog
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service rsyslog
      service:
        name: rsyslog
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"rsyslog" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-4(1)
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_rsyslog_enabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_rsyslog_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_rsyslog

class enable_rsyslog {
  service {'rsyslog':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_rsyslog_enabled">
[customizations.services]
enabled = ["rsyslog"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_rsyslog_enabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-service_rsyslog_enabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_disable_logwatch_for_logserver" severity="unknown">
            <xccdf-1.2:title>Disable Logwatch on Clients if a Logserver Exists</xccdf-1.2:title>
            <xccdf-1.2:description>Does your site have a central logserver which has been configured to report
on logs received from all systems? If so:
<html:pre>$ sudo rm /etc/cron.daily/0logwatch</html:pre>
If no logserver exists, it will be necessary for each system to run
Logwatch individually. Using a central logserver provides the security and
reliability benefits discussed earlier, and also makes monitoring logs
easier and less time-intensive for administrators.</xccdf-1.2:description>
            <xccdf-1.2:rationale/>
            <xccdf-1.2:platform idref="#machine"/>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_configure_logwatch_on_logserver">
            <xccdf-1.2:title>Configure Logwatch on the Central Log Server</xccdf-1.2:title>
            <xccdf-1.2:description>Is this system the central log server? If so, edit the file <html:code>/etc/logwatch/conf/logwatch.conf</html:code> as shown below.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_logwatch_configured_hostlimit" severity="unknown">
              <xccdf-1.2:title>Configure Logwatch HostLimit Line</xccdf-1.2:title>
              <xccdf-1.2:description>On a central logserver, you want Logwatch to summarize all syslog entries,
including those which did not originate on the logserver itself. The
<html:code>HostLimit</html:code> setting tells Logwatch to report on all hosts, not just
the one on which it is running.
<html:pre> HostLimit = no </html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale/>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-logwatch_configured_hostlimit:def:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_logwatch_configured_splithosts" severity="unknown">
              <xccdf-1.2:title>Configure Logwatch SplitHosts Line</xccdf-1.2:title>
              <xccdf-1.2:description>If <html:code>SplitHosts</html:code> is set, Logwatch will separate entries by hostname.
This makes the report longer but significantly more usable. If it is not
set, then Logwatch will not report which host generated a given log entry,
and that information is almost always necessary
<html:pre> SplitHosts = yes </html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale/>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-logwatch_configured_splithosts:def:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ensure_rsyslog_log_file_configuration">
            <xccdf-1.2:title>Ensure Proper Configuration of Log Files</xccdf-1.2:title>
            <xccdf-1.2:description>The file <html:code>/etc/rsyslog.conf</html:code> controls where log message are written.
These are controlled by lines called <html:i>rules</html:i>, which consist of a
<html:i>selector</html:i> and an <html:i>action</html:i>.
These rules are often customized depending on the role of the system, the
requirements of the environment, and whatever may enable
the administrator to most effectively make use of log data.
The default rules in Fedora are:
<html:pre>*.info;mail.none;authpriv.none;cron.none                /var/log/messages
authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  /var/log/cron
*.emerg                                                 *
uucp,news.crit                                          /var/log/spooler
local7.*                                                /var/log/boot.log</html:pre>
See the man page <html:code>rsyslog.conf(5)</html:code> for more information.
<html:i>Note that the <html:code>rsyslog</html:code> daemon can be configured to use a timestamp format that
some log processing programs may not understand. If this occurs,
edit the file <html:code>/etc/rsyslog.conf</html:code> and add or edit the following line:</html:i>
<html:pre>$ ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat</html:pre></xccdf-1.2:description>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_file_groupowner_logfiles_value" type="string">
              <xccdf-1.2:title>group who owns log files</xccdf-1.2:title>
              <xccdf-1.2:description>Specify group owner of all logfiles specified in
<html:code>/etc/rsyslog.conf.</html:code></xccdf-1.2:description>
              <xccdf-1.2:value>root</xccdf-1.2:value>
              <xccdf-1.2:value selector="adm">adm</xccdf-1.2:value>
              <xccdf-1.2:value selector="root">root</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_file_owner_logfiles_value" type="string">
              <xccdf-1.2:title>User who owns log files</xccdf-1.2:title>
              <xccdf-1.2:description>Specify user owner of all logfiles specified in
<html:code>/etc/rsyslog.conf</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:value>root</xccdf-1.2:value>
              <xccdf-1.2:value selector="adm">adm</xccdf-1.2:value>
              <xccdf-1.2:value selector="root">root</xccdf-1.2:value>
              <xccdf-1.2:value selector="syslog">syslog</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_cron_logging" severity="medium">
              <xccdf-1.2:title>Ensure cron Is Logging To Rsyslog</xccdf-1.2:title>
              <xccdf-1.2:description>Cron logging must be implemented to spot intrusions or trace
cron job status. If <html:code>cron</html:code> is not logging to <html:code>rsyslog</html:code>, it
can be implemented by adding the following to the <html:i>RULES</html:i> section of
<html:code>/etc/rsyslog.conf</html:code>:
<html:pre>cron.*                                                  /var/log/cron</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0988</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Cron logging can be used to trace the successful or unsuccessful execution
of cron jobs. It can also be used to spot intrusions into the use of the cron
facility by unauthorized and malicious users.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="rsyslog_cron_logging"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! grep -s "^\s*cron\.\*\s*/var/log/cron$" /etc/rsyslog.conf /etc/rsyslog.d/*.conf; then
	mkdir -p /etc/rsyslog.d
	echo "cron.*	/var/log/cron" &gt;&gt; /etc/rsyslog.d/cron.conf
fi


systemctl restart rsyslog.service

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-rsyslog_cron_logging:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-rsyslog_cron_logging_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdriverauthmode" severity="medium">
              <xccdf-1.2:title>Ensure Rsyslog Authenticates Off-Loaded Audit Records</xccdf-1.2:title>
              <xccdf-1.2:description>Rsyslogd is a system utility providing support for message logging. Support
for both internet and UNIX domain sockets enables this utility to support both local
and remote logging.  Couple this utility with <html:code>gnutls</html:code> (which is a secure communications
library implementing the SSL, TLS and DTLS protocols), and you have a method to securely
encrypt and off-load auditing.

When using <html:code>rsyslogd</html:code> to off-load logs the remote system must be authenticated.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The audit records generated by Rsyslog contain valuable information regarding system
configuration, user authentication, and other such information. Audit records should be
protected from unauthorized access.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="rsyslog_encrypt_offload_actionsendstreamdriverauthmode" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! grep -s "\$ActionSendStreamDriverAuthMode\s*x509/name" /etc/rsyslog.conf /etc/rsyslog.d/*.conf; then
	mkdir -p /etc/rsyslog.d
    sed -i '/^.*\$ActionSendStreamDriverAuthMode.*/d' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
    echo "\$ActionSendStreamDriverAuthMode x509/name" &gt; /etc/rsyslog.d/stream_driver_auth.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="rsyslog_encrypt_offload_actionsendstreamdriverauthmode" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Ensure Rsyslog Authenticates Off-Loaded Audit Records
  block:

    - name: Deduplicate values from /etc/rsyslog.conf
      lineinfile:
        path: /etc/rsyslog.conf
        create: false
        regexp: ^\s*{{ "$ActionSendStreamDriverAuthMode"| regex_escape }}\s
        state: absent

    - name: Check if /etc/rsyslog.d exists
      stat:
        path: /etc/rsyslog.d
      register: _etc_rsyslog_d_exists

    - name: Check if the parameter $ActionSendStreamDriverAuthMode is present in /etc/rsyslog.d
      find:
        paths: /etc/rsyslog.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "$ActionSendStreamDriverAuthMode"| regex_escape }}\s
      register: _etc_rsyslog_d_has_parameter
      when: _etc_rsyslog_d_exists.stat.isdir is defined and _etc_rsyslog_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/rsyslog.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "$ActionSendStreamDriverAuthMode"| regex_escape }}\s
        state: absent
      with_items: '{{ _etc_rsyslog_d_has_parameter.files }}'
      when: _etc_rsyslog_d_has_parameter.matched

    - name: Insert correct line to /etc/rsyslog.conf
      lineinfile:
        path: /etc/rsyslog.conf
        create: true
        regexp: ^\s*{{ "$ActionSendStreamDriverAuthMode"| regex_escape }}\s
        line: $ActionSendStreamDriverAuthMode x509/name
        state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_actionsendstreamdriverauthmode
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdrivermode" severity="medium">
              <xccdf-1.2:title>Ensure Rsyslog Encrypts Off-Loaded Audit Records</xccdf-1.2:title>
              <xccdf-1.2:description>Rsyslogd is a system utility providing support for message logging. Support
for both internet and UNIX domain sockets enables this utility to support both local
and remote logging.  Couple this utility with <html:code>gnutls</html:code> (which is a secure communications
library implementing the SSL, TLS and DTLS protocols), and you have a method to securely
encrypt and off-load auditing.

When using <html:code>rsyslogd</html:code> to off-load logs off a encrpytion system must be used.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The audit records generated by Rsyslog contain valuable information regarding system
configuration, user authentication, and other such information. Audit records should be
protected from unauthorized access.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="rsyslog_encrypt_offload_actionsendstreamdrivermode"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/rsyslog.d/encrypt.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*\$ActionSendStreamDriverMode /Id" "/etc/rsyslog.d/encrypt.conf"
else
    touch "/etc/rsyslog.d/encrypt.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/rsyslog.d/encrypt.conf"

cp "/etc/rsyslog.d/encrypt.conf" "/etc/rsyslog.d/encrypt.conf.bak"
# Insert at the end of the file
printf '%s\n' "\$ActionSendStreamDriverMode 1" &gt;&gt; "/etc/rsyslog.d/encrypt.conf"
# Clean up after ourselves.
rm "/etc/rsyslog.d/encrypt.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="rsyslog_encrypt_offload_actionsendstreamdrivermode" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Ensure Rsyslog Encrypts Off-Loaded Audit Records
  block:

    - name: Deduplicate values from /etc/rsyslog.conf
      lineinfile:
        path: /etc/rsyslog.conf
        create: false
        regexp: '^\s*{{ "$ActionSendStreamDriverMode"| regex_escape }} '
        state: absent

    - name: Check if /etc/rsyslog.d exists
      stat:
        path: /etc/rsyslog.d
      register: _etc_rsyslog_d_exists

    - name: Check if the parameter $ActionSendStreamDriverMode is present in /etc/rsyslog.d
      find:
        paths: /etc/rsyslog.d
        recurse: 'yes'
        follow: 'no'
        contains: '^\s*{{ "$ActionSendStreamDriverMode"| regex_escape }} '
      register: _etc_rsyslog_d_has_parameter
      when: _etc_rsyslog_d_exists.stat.isdir is defined and _etc_rsyslog_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/rsyslog.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: '^\s*{{ "$ActionSendStreamDriverMode"| regex_escape }} '
        state: absent
      with_items: '{{ _etc_rsyslog_d_has_parameter.files }}'
      when: _etc_rsyslog_d_has_parameter.matched

    - name: Insert correct line to /etc/rsyslog.conf
      lineinfile:
        path: /etc/rsyslog.conf
        create: true
        regexp: '^\s*{{ "$ActionSendStreamDriverMode"| regex_escape }} '
        line: $ActionSendStreamDriverMode 1
        state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_actionsendstreamdrivermode
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_defaultnetstreamdriver" severity="medium">
              <xccdf-1.2:title>Ensure Rsyslog Encrypts Off-Loaded Audit Records</xccdf-1.2:title>
              <xccdf-1.2:description>Rsyslogd is a system utility providing support for message logging. Support
for both internet and UNIX domain sockets enables this utility to support both local
and remote logging.  Couple this utility with <html:code>gnutls</html:code> (which is a secure communications
library implementing the SSL, TLS and DTLS protocols), and you have a method to securely
encrypt and off-load auditing.

When using <html:code>rsyslogd</html:code> to off-load logs off a encrpytion system must be used.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The audit records generated by Rsyslog contain valuable information regarding system
configuration, user authentication, and other such information. Audit records should be
protected from unauthorized access.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="rsyslog_encrypt_offload_defaultnetstreamdriver"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if [ -e "/etc/rsyslog.d/encrypt.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*\$DefaultNetstreamDriver /Id" "/etc/rsyslog.d/encrypt.conf"
else
    touch "/etc/rsyslog.d/encrypt.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/rsyslog.d/encrypt.conf"

cp "/etc/rsyslog.d/encrypt.conf" "/etc/rsyslog.d/encrypt.conf.bak"
# Insert at the end of the file
printf '%s\n' "\$DefaultNetstreamDriver gtls" &gt;&gt; "/etc/rsyslog.d/encrypt.conf"
# Clean up after ourselves.
rm "/etc/rsyslog.d/encrypt.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="rsyslog_encrypt_offload_defaultnetstreamdriver" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Ensure Rsyslog Encrypts Off-Loaded Audit Records
  block:

    - name: Deduplicate values from /etc/rsyslog.conf
      lineinfile:
        path: /etc/rsyslog.conf
        create: false
        regexp: '^\s*{{ "$DefaultNetstreamDriver"| regex_escape }} '
        state: absent

    - name: Check if /etc/rsyslog.d exists
      stat:
        path: /etc/rsyslog.d
      register: _etc_rsyslog_d_exists

    - name: Check if the parameter $DefaultNetstreamDriver is present in /etc/rsyslog.d
      find:
        paths: /etc/rsyslog.d
        recurse: 'yes'
        follow: 'no'
        contains: '^\s*{{ "$DefaultNetstreamDriver"| regex_escape }} '
      register: _etc_rsyslog_d_has_parameter
      when: _etc_rsyslog_d_exists.stat.isdir is defined and _etc_rsyslog_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/rsyslog.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: '^\s*{{ "$DefaultNetstreamDriver"| regex_escape }} '
        state: absent
      with_items: '{{ _etc_rsyslog_d_has_parameter.files }}'
      when: _etc_rsyslog_d_has_parameter.matched

    - name: Insert correct line to /etc/rsyslog.conf
      lineinfile:
        path: /etc/rsyslog.conf
        create: true
        regexp: '^\s*{{ "$DefaultNetstreamDriver"| regex_escape }} '
        line: $DefaultNetstreamDriver gtls
        state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_defaultnetstreamdriver
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership" severity="medium">
              <xccdf-1.2:title>Ensure Log Files Are Owned By Appropriate Group</xccdf-1.2:title>
              <xccdf-1.2:description>The group-owner of all log files written by
<html:code>rsyslog</html:code> should be <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_file_groupowner_logfiles_value" use="legacy"/></html:code>.
These log files are determined by the second part of each Rule line in
<html:code>/etc/rsyslog.conf</html:code> and typically all appear in <html:code>/var/log</html:code>.
For each log file <html:i>LOGFILE</html:i> referenced in <html:code>/etc/rsyslog.conf</html:code>,
run the following command to inspect the file's group owner:
<html:pre>$ ls -l <html:i>LOGFILE</html:i></html:pre>
If the owner is not <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_file_groupowner_logfiles_value" use="legacy"/></html:code>, run the following command to
correct this:
<html:pre>$ sudo chgrp <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_file_groupowner_logfiles_value" use="legacy"/> <html:i>LOGFILE</html:i></html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R46)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0988</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The log files generated by rsyslog contain valuable information regarding system
configuration, user authentication, and other such information. Log files should be
protected from unauthorized access.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-rsyslog_files_groupownership:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-rsyslog_files_groupownership_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_files_ownership" severity="medium">
              <xccdf-1.2:title>Ensure Log Files Are Owned By Appropriate User</xccdf-1.2:title>
              <xccdf-1.2:description>The owner of all log files written by
<html:code>rsyslog</html:code> should be <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_file_owner_logfiles_value" use="legacy"/></html:code>.
These log files are determined by the second part of each Rule line in
<html:code>/etc/rsyslog.conf</html:code> and typically all appear in <html:code>/var/log</html:code>.
For each log file <html:i>LOGFILE</html:i> referenced in <html:code>/etc/rsyslog.conf</html:code>,
run the following command to inspect the file's owner:
<html:pre>$ ls -l <html:i>LOGFILE</html:i></html:pre>
If the owner is not <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_file_owner_logfiles_value" use="legacy"/></html:code>, run the following command to
correct this:
<html:pre>$ sudo chown <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_file_owner_logfiles_value" use="legacy"/> <html:i>LOGFILE</html:i></html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R46)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0988</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The log files generated by rsyslog contain valuable information regarding system
configuration, user authentication, and other such information. Log files should be
protected from unauthorized access.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-rsyslog_files_ownership:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-rsyslog_files_ownership_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_files_permissions" severity="medium">
              <xccdf-1.2:title>Ensure System Log Files Have Correct Permissions</xccdf-1.2:title>
              <xccdf-1.2:description>The file permissions for all log files written by <html:code>rsyslog</html:code> should
be set to 600, or more restrictive. These log files are determined by the
second part of each Rule line in <html:code>/etc/rsyslog.conf</html:code> and typically
all appear in <html:code>/var/log</html:code>. For each log file <html:i>LOGFILE</html:i>
referenced in <html:code>/etc/rsyslog.conf</html:code>, run the following command to
inspect the file's permissions:
<html:pre>$ ls -l <html:i>LOGFILE</html:i></html:pre>
If the permissions are not 600 or more restrictive, run the following
command to correct this:
<html:pre>$ sudo chmod 0600 <html:i>LOGFILE</html:i></html:pre>"</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R36)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0988</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Log files can contain valuable information regarding system
configuration. If the system log files are not protected unauthorized
users could change the logged data, eliminating their forensic value.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="rsyslog_files_permissions"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# List of log file paths to be inspected for correct permissions
# * Primarily inspect log file paths listed in /etc/rsyslog.conf
RSYSLOG_ETC_CONFIG="/etc/rsyslog.conf"
# * And also the log file paths listed after rsyslog's $IncludeConfig directive
#   (store the result into array for the case there's shell glob used as value of IncludeConfig)
readarray -t RSYSLOG_INCLUDE_CONFIG &lt; &lt;(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2)
readarray -t RSYSLOG_INCLUDE &lt; &lt;(awk '/)/{f=0} /include\(/{f=1} f{nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){print nf}}' /etc/rsyslog.conf)

# Declare an array to hold the final list of different log file paths
declare -a LOG_FILE_PATHS

RSYSLOG_CONFIGS=()
RSYSLOG_CONFIGS=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}")

# Get full list of files to be checked
# RSYSLOG_CONFIGS may contain globs such as 
# /etc/rsyslog.d/*.conf /etc/rsyslog.d/*.frule
# So, loop over the entries in RSYSLOG_CONFIGS and use find to get the list of included files.
RSYSLOG_FILES=()
for ENTRY in "${RSYSLOG_CONFIGS[@]}"
do
     mapfile -t FINDOUT &lt; &lt;(find "$(dirname "${ENTRY}")" -maxdepth 1 -name "$(basename "${ENTRY}")")
     RSYSLOG_FILES+=("${FINDOUT[@]}")
done

# Check file and fix if needed.
for LOG_FILE in "${RSYSLOG_FILES[@]}"
do
	# From each of these files extract just particular log file path(s), thus:
	# * Ignore lines starting with space (' '), comment ('#"), or variable syntax ('$') characters,
	# * Ignore empty lines,
	# * Strip quotes and closing brackets from paths.
	# * Ignore paths that match /dev|/etc.*\.conf, as those are paths, but likely not log files
	# * From the remaining valid rows select only fields constituting a log file path
	# Text file column is understood to represent a log file path if and only if all of the following are met:
	# * it contains at least one slash '/' character,
	# * it is preceded by space
	# * it doesn't contain space (' '), colon (':'), and semicolon (';') characters
	# Search log file for path(s) only in case it exists!
	if [[ -f "${LOG_FILE}" ]]
	then
		NORMALIZED_CONFIG_FILE_LINES=$(sed -e "/^[#|$]/d" "${LOG_FILE}")
		LINES_WITH_PATHS=$(grep '[^/]*\s\+\S*/\S\+$' &lt;&lt;&lt; "${NORMALIZED_CONFIG_FILE_LINES}")
		FILTERED_PATHS=$(sed -e 's/[^\/]*[[:space:]]*\([^:;[:space:]]*\)/\1/g' &lt;&lt;&lt; "${LINES_WITH_PATHS}")
		CLEANED_PATHS=$(sed -e "s/[\"')]//g; /\\/etc.*\.conf/d; /\\/dev\\//d" &lt;&lt;&lt; "${FILTERED_PATHS}")
		MATCHED_ITEMS=$(sed -e "/^$/d" &lt;&lt;&lt; "${CLEANED_PATHS}")
		# Since above sed command might return more than one item (delimited by newline), split the particular
		# matches entries into new array specific for this log file
		readarray -t ARRAY_FOR_LOG_FILE &lt;&lt;&lt; "$MATCHED_ITEMS"
		# Concatenate the two arrays - previous content of $LOG_FILE_PATHS array with
		# items from newly created array for this log file
		LOG_FILE_PATHS+=("${ARRAY_FOR_LOG_FILE[@]}")
		# Delete the temporary array
		unset ARRAY_FOR_LOG_FILE
	fi
done

DESIRED_PERM_MOD=600

# Correct the form o
for LOG_FILE_PATH in "${LOG_FILE_PATHS[@]}"
do
	# Sanity check - if particular $LOG_FILE_PATH is empty string, skip it from further processing
	if [ -z "$LOG_FILE_PATH" ]
	then
		continue
	fi

	# Also for each log file check if its permissions differ from 600. If so, correct them
	if [ -f "$LOG_FILE_PATH" ] &amp;&amp; [ "$(/usr/bin/stat -c %a "$LOG_FILE_PATH")" -ne $DESIRED_PERM_MOD ]
	then
		/bin/chmod $DESIRED_PERM_MOD "$LOG_FILE_PATH"
	fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-rsyslog_files_permissions:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-rsyslog_files_permissions_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_remote_access_monitoring" severity="medium">
              <xccdf-1.2:title>Ensure remote access methods are monitored in Rsyslog</xccdf-1.2:title>
              <xccdf-1.2:description>Logging of remote access methods must be implemented to help identify cyber
attacks and ensure ongoing compliance with remote access policies are being
audited and upheld. An examples of a remote access method is the use of the
Remote Desktop Protocol (RDP) from an external, non-organization controlled
network. The <html:code>/etc/rsyslog.conf</html:code> or
<html:code>/etc/rsyslog.d/*.conf</html:code> file should contain a match for the following
selectors: <html:code>auth.*</html:code>, <html:code>authpriv.*</html:code>, and <html:code>daemon.*</html:code>. If
not, use the following as an example configuration:
<html:pre>auth.*;authpriv.*;daemon.*                              /var/log/secure</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000067</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000032-GPOS-00013</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Logging remote access methods can be used to trace the decrease the risks
associated with remote user access management. It can also be used to spot
cyber attacks and ensure ongoing compliance with organizational policies
surrounding the use of remote access methods.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="rsyslog_remote_access_monitoring"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

declare -A REMOTE_METHODS=( ['auth.*']='^.*auth\.\*.*$' ['authpriv.*']='^.*authpriv\.\*.*$' ['daemon.*']='^.*daemon\.\*.*$' )

if [[ ! -f /etc/rsyslog.conf ]]; then
	# Something is not right, create the file
	touch /etc/rsyslog.conf
fi

APPEND_LINE=$(sed -rn '/^\S+\s+\/var\/log\/secure$/p' /etc/rsyslog.conf)

# Loop through the remote methods associative array
for K in "${!REMOTE_METHODS[@]}"
do
	# Check to see if selector/value exists
	if ! grep -rq "${REMOTE_METHODS[$K]}" /etc/rsyslog.*; then
		# Make sure we have a line to insert after, otherwise append to end
		if [[ ! -z ${APPEND_LINE} ]]; then
			# Add selector to file
			sed -r -i "0,/^(\S+\s+\/var\/log\/secure$)/s//\1\n${K} \/var\/log\/secure/" /etc/rsyslog.conf
		else
			echo "${K} \/var\/log\/secure/" &gt;&gt; /etc/rsyslog.conf
		fi
	fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="rsyslog_remote_access_monitoring" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: 'Ensure remote access methods are monitored in Rsyslog: Set facts'
  set_fact:
    conf_files:
      - /etc/rsyslog.conf
    remote_methods:
      - selector: auth.*
        regexp: ^.*auth\.\*.*$
      - selector: authpriv.*
        regexp: ^.*authpriv\.\*.*$
      - selector: daemon.*
        regexp: ^.*daemon\.\*.*$
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-17(1)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_remote_access_monitoring

- name: 'Ensure remote access methods are monitored in Rsyslog: Ensure rsyslog.conf
    exists'
  file:
    path: '{{ conf_files.0 }}'
    state: touch
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-17(1)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_remote_access_monitoring

- name: 'Ensure remote access methods are monitored in Rsyslog: Gather conf.d files'
  find:
    patterns:
      - '*.conf'
    paths:
      - /etc/rsyslog.d
  register: rsyslogd
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-17(1)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_remote_access_monitoring

- name: 'Ensure remote access methods are monitored in Rsyslog: Set conf file(s)'
  set_fact:
    conf_files: '{{ conf_files + [item.path] }}'
  loop: '{{ rsyslogd.files }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - rsyslogd.matched &gt; 0
  tags:
    - NIST-800-53-AC-17(1)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_remote_access_monitoring

- name: 'Ensure remote access methods are monitored in Rsyslog: Check for existing
    values'
  lineinfile:
    path: '{{ item.1 }}'
    regexp: '{{ item.0.regexp }}'
    state: absent
  check_mode: true
  changed_when: false
  register: remote_method_values
  loop: '{{ remote_methods|product(conf_files)|list }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-17(1)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_remote_access_monitoring

- name: 'Ensure remote access methods are monitored in Rsyslog: Configure'
  lineinfile:
    path: /etc/rsyslog.conf
    line: '{{ item.item.0.selector }} /var/log/secure'
    insertafter: ^.*\/var\/log\/secure.*$
    create: true
  loop: '{{ remote_method_values.results }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - item.found == 0
  tags:
    - NIST-800-53-AC-17(1)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_remote_access_monitoring
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-rsyslog_remote_access_monitoring:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-rsyslog_remote_access_monitoring_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_journald">
            <xccdf-1.2:title>systemd-journald</xccdf-1.2:title>
            <xccdf-1.2:description>systemd-journald is a system service that collects and stores
logging data. It creates and maintains structured, indexed
journals based on logging information that is received from a
variety of sources.

For more information on <html:code>systemd-journald </html:code> and additional <html:code>systemd-journald</html:code> configuration options, see
<html:b><html:a href="https://systemd.io/">https://systemd.io/</html:a></html:b>.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#machine"/>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_log_rotation">
            <xccdf-1.2:title>Ensure All Logs are Rotated by logrotate</xccdf-1.2:title>
            <xccdf-1.2:description>
Edit the file <html:code>/etc/logrotate.d/syslog</html:code>. Find the first

line, which should look like this (wrapped for clarity):
<html:pre>/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler \
  /var/log/boot.log /var/log/cron {</html:pre>
Edit this line so that it contains a one-space-separated
listing of each log file referenced in <html:code>/etc/rsyslog.conf</html:code>.
<html:br/><html:br/>
All logs in use on a system must be rotated regularly, or the
log files will consume disk space over time, eventually interfering
with system operation. The file <html:code>/etc/logrotate.d/syslog</html:code> is the
configuration file used by the <html:code>logrotate</html:code> program to maintain all
log files written by <html:code>syslog</html:code>. By default, it rotates logs weekly and
stores four archival copies of each log. These settings can be
modified by editing <html:code>/etc/logrotate.conf</html:code>, but the defaults are
sufficient for purposes of this guide.
<html:br/><html:br/>
Note that <html:code>logrotate</html:code> is run nightly by the cron job
<html:code>/etc/cron.daily/logrotate</html:code>. If particularly active logs need to be
rotated more often than once a day, some other mechanism must be
used.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ensure_logrotate_activated" severity="medium">
              <xccdf-1.2:title>Ensure Logrotate Runs Periodically</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>logrotate</html:code> utility allows for the automatic rotation of
log files.  The frequency of rotation is specified in <html:code>/etc/logrotate.conf</html:code>,
which triggers a cron task.  To configure logrotate to run daily, add or correct
the following line in <html:code>/etc/logrotate.conf</html:code>:
<html:pre># rotate log files <html:i>frequency</html:i>
daily</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R43)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT12(R18)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.7</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Log files that are not properly rotated run the risk of growing so large
that they fill up the /var/log partition. Valuable logging information could be lost
if the /var/log partition becomes full.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="ensure_logrotate_activated"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

LOGROTATE_CONF_FILE="/etc/logrotate.conf"
CRON_DAILY_LOGROTATE_FILE="/etc/cron.daily/logrotate"

# daily rotation is configured
grep -q "^daily$" $LOGROTATE_CONF_FILE|| echo "daily" &gt;&gt; $LOGROTATE_CONF_FILE

# remove any line configuring weekly, monthly or yearly rotation
sed -i '/^\s*\(weekly\|monthly\|yearly\).*$/d' $LOGROTATE_CONF_FILE

# configure cron.daily if not already
if ! grep -q "^[[:space:]]*/usr/sbin/logrotate[[:alnum:][:blank:][:punct:]]*$LOGROTATE_CONF_FILE$" $CRON_DAILY_LOGROTATE_FILE; then
	echo "#!/bin/sh" &gt; $CRON_DAILY_LOGROTATE_FILE
	echo "/usr/sbin/logrotate $LOGROTATE_CONF_FILE" &gt;&gt; $CRON_DAILY_LOGROTATE_FILE
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="ensure_logrotate_activated" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Configure daily log rotation in /etc/logrotate.conf
  lineinfile:
    create: true
    dest: /etc/logrotate.conf
    regexp: ^daily$
    line: daily
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - configure_strategy
    - ensure_logrotate_activated
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Make sure daily log rotation setting is not overriden in /etc/logrotate.conf
  lineinfile:
    create: false
    dest: /etc/logrotate.conf
    regexp: ^[\s]*(weekly|monthly|yearly)$
    state: absent
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - configure_strategy
    - ensure_logrotate_activated
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Configure cron.daily if not already
  block:

    - name: Add shebang
      lineinfile:
        path: /etc/cron.daily/logrotate
        line: '#!/bin/sh'
        insertbefore: BOF
        create: true

    - name: Add logrotate call
      lineinfile:
        path: /etc/cron.daily/logrotate
        line: /usr/sbin/logrotate /etc/logrotate.conf
        regexp: ^[\s]*/usr/sbin/logrotate[\s\S]*/etc/logrotate.conf$
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - configure_strategy
    - ensure_logrotate_activated
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="ensure_logrotate_activated" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ %23%20see%20%22man%20logrotate%22%20for%20details%0A%23%20rotate%20log%20files%20daily%0Adaily%0A%0A%23%20keep%204%20weeks%20worth%20of%20backlogs%0Arotate%2030%0A%0A%23%20create%20new%20%28empty%29%20log%20files%20after%20rotating%20old%20ones%0Acreate%0A%0A%23%20use%20date%20as%20a%20suffix%20of%20the%20rotated%20file%0Adateext%0A%0A%23%20uncomment%20this%20if%20you%20want%20your%20log%20files%20compressed%0A%23compress%0A%0A%23%20RPM%20packages%20drop%20log%20rotation%20information%20into%20this%20directory%0Ainclude%20/etc/logrotate.d%0A%0A%23%20system-specific%20logs%20may%20be%20also%20be%20configured%20here. }}
        mode: 0644
        path: /etc/logrotate.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-ensure_logrotate_activated:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-ensure_logrotate_activated_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_rsyslog_accepting_remote_messages">
            <xccdf-1.2:title>Configure rsyslogd to Accept Remote Messages If Acting as a Log Server</xccdf-1.2:title>
            <xccdf-1.2:description>By default, <html:code>rsyslog</html:code> does not listen over the network
for log messages. If needed, modules can be enabled to allow
the rsyslog daemon to receive messages from other systems and for the system
thus to act as a log server.
If the system is not a log server, then lines concerning these modules
should remain commented out.
<html:br/><html:br/></xccdf-1.2:description>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_syslogng_installed" severity="medium">
              <xccdf-1.2:title>Ensure syslog-ng is Installed</xccdf-1.2:title>
              <xccdf-1.2:description>syslog-ng can be installed in replacement of rsyslog.
The <html:code>syslog-ng-core</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install syslog-ng-core</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R46)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001311</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001312</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The syslog-ng-core package provides the syslog-ng daemon, which provides
system logging services.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_syslogng_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "syslog-ng" ; then
    dnf install -y "syslog-ng"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_syslogng_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure syslog-ng is installed
  package:
    name: syslog-ng
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_syslogng_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_syslogng_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_syslog-ng

class install_syslog-ng {
  package { 'syslog-ng':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_syslogng_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=syslog-ng
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_syslogng_installed">
[[packages]]
name = "syslog-ng"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_syslogng_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_syslogng_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_syslogng_enabled" severity="medium">
              <xccdf-1.2:title>Enable syslog-ng Service</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>syslog-ng</html:code> service (in replacement of rsyslog) provides syslog-style logging by default on Debian.

The <html:code>syslog-ng</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable syslog-ng.service</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R46)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001311</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001312</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001557</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>syslog-ng</html:code> service must be running in order to provide
logging services, which are essential to system administration.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_syslogng_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'syslog-ng.service'
"$SYSTEMCTL_EXEC" start 'syslog-ng.service'
"$SYSTEMCTL_EXEC" enable 'syslog-ng.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_syslogng_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Enable service syslog-ng
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service syslog-ng
      service:
        name: syslog-ng
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"syslog-ng" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-4(1)
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_syslogng_enabled
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_syslogng_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_syslog-ng

class enable_syslog-ng {
  service {'syslog-ng':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_syslogng_enabled">
[customizations.services]
enabled = ["syslog-ng"]
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_syslogng_enabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-service_syslogng_enabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_accept_remote_messages_tcp" severity="unknown">
              <xccdf-1.2:title>Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>rsyslog</html:code> daemon should not accept remote messages
unless the system acts as a log server.
If the system needs to act as a central log server, add the following lines to
<html:code>/etc/rsyslog.conf</html:code> to enable reception of messages over TCP:
<html:pre>$ModLoad imtcp
$InputTCPServerRun 514</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-6(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-6(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If the system needs to act as a log server, this ensures that it can receive
messages over a reliable TCP connection.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_accept_remote_messages_udp" severity="unknown">
              <xccdf-1.2:title>Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>rsyslog</html:code> daemon should not accept remote messages
unless the system acts as a log server.
If the system needs to act as a central log server, add the following lines to
<html:code>/etc/rsyslog.conf</html:code> to enable reception of messages over UDP:
<html:pre>$ModLoad imudp
$UDPServerRun 514</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-6(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-6(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Many devices, such as switches, routers, and other Unix-like systems, may only support
the traditional syslog transmission over UDP. If the system must act as a log server,
this enables it to receive their messages as well.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_nolisten" severity="medium">
              <xccdf-1.2:title>Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>rsyslog</html:code> daemon should not accept remote messages
unless the system acts as a log server.
To ensure that it is not listening on the network, ensure the following lines are
<html:i>not</html:i> found in <html:code>/etc/rsyslog.conf</html:code>:
<html:pre>$ModLoad imtcp
$InputTCPServerRun <html:i>port</html:i>
$ModLoad imudp
$UDPServerRun <html:i>port</html:i>
$ModLoad imrelp
$InputRELPServerRun <html:i>port</html:i></html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000318</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000368</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001812</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001813</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001814</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0988</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Any process which receives messages from the network incurs some risk
of receiving malicious messages. This risk can be eliminated for
rsyslog by configuring it not to listen on the network.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-rsyslog_nolisten:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-rsyslog_nolisten_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_rsyslog_sending_messages">
            <xccdf-1.2:title>Rsyslog Logs Sent To Remote Host</xccdf-1.2:title>
            <xccdf-1.2:description>If system logs are to be useful in detecting malicious
activities, it is necessary to send logs to a remote server. An
intruder who has compromised the root account on a system may
delete the log entries which indicate that the system was attacked
before they are seen by an administrator.
<html:br/><html:br/>
However, it is recommended that logs be stored on the local
host in addition to being sent to the loghost, especially if
<html:code>rsyslog</html:code> has been configured to use the UDP protocol to send
messages over a network. UDP does not guarantee reliable delivery,
and moderately busy sites will lose log messages occasionally,
especially in periods of high traffic which may be the result of an
attack. In addition, remote <html:code>rsyslog</html:code> messages are not
authenticated in any way by default, so it is easy for an attacker to
introduce spurious messages to the central log server. Also, some
problems cause loss of network connectivity, which will prevent the
sending of messages to the central server. For all of these reasons, it is
better to store log messages both centrally and on each host, so
that they can be correlated if necessary.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" type="string" interactive="true">
              <xccdf-1.2:title>Remote Log Server</xccdf-1.2:title>
              <xccdf-1.2:description>Specify an URI or IP address of a remote host where the log messages will be sent and stored.</xccdf-1.2:description>
              <xccdf-1.2:value>logcollector</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" severity="medium">
              <xccdf-1.2:title>Ensure Logs Sent To Remote Host</xccdf-1.2:title>
              <xccdf-1.2:description>To configure rsyslog to send logs to a remote log server,
open <html:code>/etc/rsyslog.conf</html:code> and read and understand the last section of the file,
which describes the multiple directives necessary to activate remote
logging.
Along with these other directives, the system can be configured
to forward its logs to a particular log server by
adding or correcting one of the following lines,
substituting <html:code><html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/></html:i></html:code> appropriately.
The choice of protocol depends on the environment of the system;
although TCP and RELP provide more reliable message delivery,
they may not be supported in all environments.
<html:br/>
To use UDP for log message delivery:
<html:pre>*.* @<html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/></html:i></html:pre>
<html:br/>
To use TCP for log message delivery:
<html:pre>*.* @@<html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/></html:i></html:pre>
<html:br/>
To use RELP for log message delivery:
<html:pre>*.* :omrelp:<html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/></html:i></html:pre>
<html:br/>
There must be a resolvable DNS CNAME or Alias record set to "<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/>" for logs to be sent correctly to the centralized logging utility.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R7)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT28(R43)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT12(R5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001348</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000136</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(6)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(8)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.314(a)(2)(i)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.314(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0988</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000032-VMM-000130</xccdf-1.2:reference>
              <xccdf-1.2:rationale>A log server (loghost) receives syslog messages from one or more
systems. This data can be used as an additional log source in the event a
system is compromised and its local logs are suspect. Forwarding log messages
to a remote loghost also provides system administrators with a centralized
place to view the status of multiple hosts within the enterprise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="rsyslog_remote_loghost"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

rsyslog_remote_loghost_address='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/>'


# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/rsyslog.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^\*\.\*")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "@@$rsyslog_remote_loghost_address"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^\*\.\*\\&gt;" "/etc/rsyslog.conf"; then
    "${sed_command[@]}" "s/^\*\.\*\\&gt;.*/$formatted_output/gi" "/etc/rsyslog.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/rsyslog.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="rsyslog_remote_loghost" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: XCCDF Value rsyslog_remote_loghost_address # promote to variable
  set_fact:
    rsyslog_remote_loghost_address: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/>
  tags:
    - always

- name: Set rsyslog remote loghost
  lineinfile:
    dest: /etc/rsyslog.conf
    regexp: ^\*\.\*
    line: '*.* @@{{ rsyslog_remote_loghost_address }}'
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-4(1)
    - NIST-800-53-AU-9(2)
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - rsyslog_remote_loghost
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-rsyslog_remote_loghost:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-rsyslog_remote_loghost_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_remote_tls" severity="medium">
              <xccdf-1.2:title>Configure TLS for rsyslog remote logging</xccdf-1.2:title>
              <xccdf-1.2:description>Configure <html:code>rsyslog</html:code> to use Transport Layer
Security (TLS) support for logging to remote server
for the Forwarding Output Module in <html:code>/etc/rsyslog.conf</html:code>
using action. You can use the following command:
<html:pre>echo 'action(type="omfwd" protocol="tcp" Target="&lt;remote system&gt;" port="6514"
    StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" streamdriver.CheckExtendedKeyPurpose="on")' &gt;&gt; /etc/rsyslog.conf
</html:pre>
Replace the <html:code>&lt;remote system&gt;</html:code> in the above command with an IP address or a host name of the remote logging server.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R43)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0988</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_TLSC_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FTP_ITC_EXT.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_X509_EXT.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</xccdf-1.2:reference>
              <xccdf-1.2:rationale>For protection of data being logged, the connection to the
remote logging server needs to be authenticated and encrypted.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-rsyslog_remote_tls:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-rsyslog_remote_tls_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_remote_tls_cacert" severity="medium">
              <xccdf-1.2:title>Configure CA certificate for rsyslog remote logging</xccdf-1.2:title>
              <xccdf-1.2:description>Configure CA certificate for <html:code>rsyslog</html:code> logging
to remote server using Transport Layer Security (TLS)
using correct path for the <html:code>DefaultNetstreamDriverCAFile</html:code>
global option in <html:code>/etc/rsyslog.conf</html:code>, for example with the following command:
<html:pre>echo 'global(DefaultNetstreamDriverCAFile="/etc/pki/tls/cert.pem")' &gt;&gt; /etc/rsyslog.conf</html:pre>
Replace the <html:code>/etc/pki/tls/cert.pem</html:code> in the above command with the path to the file with CA certificate generated for the purpose of remote logging.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R43)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0988</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_TLSC_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The CA certificate needs to be set or <html:code>rsyslog.service</html:code>
fails to start with
<html:pre>error: ca certificate is not set, cannot continue</html:pre></xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-rsyslog_remote_tls_cacert:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-rsyslog_remote_tls_cacert_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network">
          <xccdf-1.2:title>Network Configuration and Firewalls</xccdf-1.2:title>
          <xccdf-1.2:description>Most systems must be connected to a network of some
sort, and this brings with it the substantial risk of network
attack. This section discusses the security impact of decisions
about networking which must be made when configuring a system.
<html:br/><html:br/>
This section also discusses firewalls, network access
controls, and other network security frameworks, which allow
system-level rules to be written that can limit an attackers' ability
to connect to your system. These rules can specify that network
traffic should be allowed or denied from certain IP addresses,
hosts, and networks. The rules can also specify which of the
system's network services are available to particular hosts or
networks.</xccdf-1.2:description>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_network_disable_zeroconf" severity="unknown">
            <xccdf-1.2:title>Disable Zeroconf Networking</xccdf-1.2:title>
            <xccdf-1.2:description>Zeroconf networking allows the system to assign itself an IP
address and engage in IP communication without a statically-assigned address or
even a DHCP server. Automatic address assignment via Zeroconf (or DHCP) is not
recommended. To disable Zeroconf automatic route assignment in the 169.254.0.0
subnet, add or correct the following line in <html:code>/etc/sysconfig/network</html:code>:
<html:pre>NOZEROCONF=yes</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Zeroconf addresses are in the network 169.254.0.0. The networking
scripts add entries to the system's routing table for these addresses. Zeroconf
address assignment commonly occurs when the system is configured to use DHCP
but fails to receive an address assignment from the DHCP server.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-network_disable_zeroconf:def:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_network_nmcli_permissions" severity="medium">
            <xccdf-1.2:title>Prevent non-Privileged Users from Modifying Network Interfaces using nmcli</xccdf-1.2:title>
            <xccdf-1.2:description>By default, non-privileged users are given permissions to modify networking
interfaces and configurations using the <html:code>nmcli</html:code> command. Non-privileged
users should not be making configuration changes to network configurations. To
ensure that non-privileged users do not have permissions to make changes to the
network configuration using <html:code>nmcli</html:code>, create the following configuration in
<html:code>/etc/polkit-1/localauthority/20-org.d/10-nm-harden-access.pkla</html:code>:
<html:pre>
[Disable General User Access to NetworkManager]
Identity=default
Action=org.freedesktop.NetworkManager.*
ResultAny=no
ResultInactive=no
ResultActive=auth_admin
</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">0418</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1055</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1402</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Allowing non-privileged users to make changes to network settings can allow
untrusted access, prevent system availability, and/or can lead to a compromise or
attack.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#polkit"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="network_nmcli_permissions" complexity="low" disruption="low" reboot="false" strategy="restrict">
printf "[Disable General User Access to NetworkManager]\nIdentity=default\nAction=org.freedesktop.NetworkManager.*\nResultAny=no\nResultInactive=no\nResultActive=auth_admin\n" &gt; /etc/polkit-1/localauthority/20-org.d/10-nm-harden-access.pkla
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="network_nmcli_permissions" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Ensure non-privileged users do not have access to nmcli
  ini_file:
    path: /etc/polkit-1/localauthority/20-org.d/10-nm-harden-access.pkla
    section: Disable General User Access to NetworkManager
    option: '{{ item.option }}'
    value: '{{ item.value }}'
    no_extra_spaces: true
    create: true
  loop:
    - option: Identity
      value: default
    - option: Action
      value: org.freedesktop.NetworkManager.*
    - option: ResultAny
      value: 'no'
    - option: ResultInactive
      value: 'no'
    - option: ResultActive
      value: auth_admin
  tags:
    - NIST-800-171-3.1.16
    - NIST-800-53-AC-18(4)
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - network_nmcli_permissions
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-network_nmcli_permissions:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-network_nmcli_permissions_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_network_sniffer_disabled" severity="medium">
            <xccdf-1.2:title>Ensure System is Not Acting as a Network Sniffer</xccdf-1.2:title>
            <xccdf-1.2:description>The system should not be acting as a network sniffer, which can
capture all traffic on the network to which it is connected. Run the following
to determine if any interface is running in promiscuous mode:
<html:pre>$ ip link | grep PROMISC</html:pre>
Promiscuous mode of an interface can be disabled with the following command:
<html:pre>$ sudo ip link set dev <html:code>device_name</html:code> multicast off promisc off</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI09.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI09.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI09.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS04.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(2)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.DP-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Network interfaces in promiscuous mode allow for the capture of all network traffic
visible to the system. If unauthorized individuals can access these applications, it
may allow them to collect information such as logon IDs, passwords, and key exchanges
between systems.
<html:br/><html:br/>
If the system is being used to perform a network troubleshooting function, the use of these
tools must be documented with the Information Systems Security Manager (ISSM) and restricted
to only authorized personnel.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-network_sniffer_disabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-network_sniffer_disabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-firewalld">
            <xccdf-1.2:title>firewalld</xccdf-1.2:title>
            <xccdf-1.2:description>The dynamic firewall daemon <html:code>firewalld</html:code> provides a
dynamically managed firewall with support for network “zones” to assign
a level of trust to a network and its associated connections and interfaces.
It has support for IPv4 and IPv6 firewall settings. It supports Ethernet
bridges and has a separation of runtime and permanent configuration options.
It also has an interface for services or applications to add firewall rules
directly.
<html:br/>
A graphical configuration tool, <html:code>firewall-config</html:code>, is used to configure
<html:code>firewalld</html:code>, which in turn uses <html:code>iptables</html:code> tool to communicate
with <html:code>Netfilter</html:code> in the kernel which implements packet filtering.
<html:br/>
The firewall service provided by <html:code>firewalld</html:code> is dynamic rather than
static because changes to the configuration can be made at anytime and are
immediately implemented. There is no need to save or apply the changes. No
unintended disruption of existing network connections occurs as no part of
the firewall has to be reloaded.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_firewalld_activation">
              <xccdf-1.2:title>Inspect and Activate Default firewalld Rules</xccdf-1.2:title>
              <xccdf-1.2:description>Firewalls can be used to separate networks into different zones
based on the level of trust the user has decided to place on the devices and
traffic within that network. <html:code>NetworkManager</html:code> informs firewalld to which
zone an interface belongs. An interface's assigned zone can be changed by
<html:code>NetworkManager</html:code> or via the <html:code>firewall-config</html:code> tool.
<html:br/>
The zone settings in <html:code>/etc/firewalld/</html:code> are a range of preset settings
which can be quickly applied to a network interface. These are the zones
provided by firewalld sorted according to the default trust level of the
zones from untrusted to trusted:
<html:ul><html:li><html:code>drop</html:code><html:br/><html:p>Any incoming network packets are dropped, there is no
reply. Only outgoing network connections are possible.</html:p></html:li><html:li><html:code>block</html:code><html:br/><html:p>Any incoming network connections are rejected with an
<html:code>icmp-host-prohibited</html:code> message for IPv4 and <html:code>icmp6-adm-prohibited</html:code>
for IPv6. Only network connections initiated from within the system are
possible.</html:p></html:li><html:li><html:code>public</html:code><html:br/><html:p>For use in public areas. You do not trust the other
computers on the network to not harm your computer. Only selected incoming
connections are accepted.</html:p></html:li><html:li><html:code>external</html:code><html:br/><html:p>For use on external networks with masquerading enabled
especially for routers. You do not trust the other computers on the network to
not harm your computer. Only selected incoming connections are accepted.</html:p></html:li><html:li><html:code>dmz</html:code><html:br/><html:p>For computers in your demilitarized zone that are
publicly-accessible with limited access to your internal network. Only selected
incoming connections are accepted.</html:p></html:li><html:li><html:code>work</html:code><html:br/><html:p>For use in work areas. You mostly trust the other computers
on networks to not harm your computer. Only selected incoming connections are
accepted.</html:p></html:li><html:li><html:code>home</html:code><html:br/><html:p>For use in home areas. You mostly trust the other computers
on networks to not harm your computer. Only selected incoming connections are
accepted.</html:p></html:li><html:li><html:code>internal</html:code><html:br/><html:p>For use on internal networks. You mostly trust the
other computers on the networks to not harm your computer. Only selected
incoming connections are accepted.</html:p></html:li><html:li><html:code>trusted</html:code><html:br/><html:p>All network connections are accepted.</html:p></html:li></html:ul>
<html:br/>
It is possible to designate one of these zones to be the default zone. When
interface connections are added to <html:code>NetworkManager</html:code>, they are assigned
to the default zone. On installation, the default zone in firewalld is set to
be the public zone.
<html:br/>
To find out all the settings of a zone, for example the <html:code>public zone,</html:code>
enter the following command as root:
<html:pre># firewall-cmd --zone=public --list-all</html:pre>
Example output of this command might look like the following:
<html:pre>
# firewall-cmd --zone=public --list-all
public
  interfaces:
  services: mdns dhcpv6-client ssh
  ports:
  forward-ports:
  icmp-blocks: source-quench
</html:pre>
To view the network zones currently active, enter the following command as root:
<html:pre># firewall-cmd --get-service</html:pre>
The following listing displays the result of this command
on common Fedora system:
<html:pre>
# firewall-cmd --get-service
amanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns ftp
high-availability http https imaps ipp ipp-client ipsec kerberos kpasswd
ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn
pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius rpc-bind
samba samba-client smtp ssh telnet tftp tftp-client transmission-client
vnc-server wbem-https
</html:pre>
Finally to view the network zones that will be active after the next firewalld
service reload, enter the following command as root:
<html:pre># firewall-cmd --get-service --permanent</html:pre></xccdf-1.2:description>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_firewalld_enabled" severity="medium">
                <xccdf-1.2:title>Verify firewalld Enabled</xccdf-1.2:title>
                <xccdf-1.2:description>
The <html:code>firewalld</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable firewalld.service</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000382</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002314</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CA-3(5)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(21)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000096-GPOS-00050</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000297-GPOS-00115</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00231</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00232</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Access control methods provide the ability to enhance system security posture
by restricting services and known good IP addresses and address ranges. This
prevents connections from unknown hosts and protocols.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_firewalld_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'firewalld.service'
"$SYSTEMCTL_EXEC" start 'firewalld.service'
"$SYSTEMCTL_EXEC" enable 'firewalld.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_firewalld_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Enable service firewalld
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service firewalld
      service:
        name: firewalld
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"firewalld" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.3
    - NIST-800-171-3.4.7
    - NIST-800-53-AC-4
    - NIST-800-53-CA-3(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(21)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_firewalld_enabled
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_firewalld_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_firewalld

class enable_firewalld {
  service {'firewalld':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_firewalld_enabled">
[customizations.services]
enabled = ["firewalld"]
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_firewalld_enabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-service_firewalld_enabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ruleset_modifications">
              <xccdf-1.2:title>Strengthen the Default Ruleset</xccdf-1.2:title>
              <xccdf-1.2:description>The default rules can be strengthened. The system
scripts that activate the firewall rules expect them to be defined
in configuration files under the <html:code>/etc/firewalld/services</html:code>
and <html:code>/etc/firewalld/zones</html:code> directories.
<html:br/><html:br/>
The following recommendations describe how to strengthen the
default ruleset configuration file. An alternative to editing this
configuration file is to create a shell script that makes calls to
the <html:code>firewall-cmd</html:code> program to load in rules under the <html:code>/etc/firewalld/services</html:code>
and <html:code>/etc/firewalld/zones</html:code> directories.
<html:br/><html:br/>
Instructions apply to both unless otherwise noted. Language and address
conventions for regular firewalld rules are used throughout this section.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">The program <html:code>firewall-config</html:code>
allows additional services to penetrate the default firewall rules
and automatically adjusts the <html:code>firewalld</html:code> ruleset(s).</xccdf-1.2:warning>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_set_firewalld_default_zone" severity="medium">
                <xccdf-1.2:title>Set Default firewalld Zone for Incoming Packets</xccdf-1.2:title>
                <xccdf-1.2:description>To set the default zone to <html:code>drop</html:code> for
the built-in default zone which processes incoming IPv4 and IPv6 packets,
modify the following line in
<html:code>/etc/firewalld/firewalld.conf</html:code> to be:
<html:pre>DefaultZone=drop</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="general">To prevent denying any access to the system, automatic remediation
of this control is not available. Remediation must be automated as
a component of machine provisioning, or followed manually as outlined
above.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1416</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CA-3(5)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(23)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000480-VMM-002000</xccdf-1.2:reference>
                <xccdf-1.2:rationale>In <html:code>firewalld</html:code> the default zone is applied only after all
the applicable rules in the table are examined for a match. Setting the
default zone to <html:code>drop</html:code> implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-set_firewalld_default_zone:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-set_firewalld_default_zone_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-ipsec">
            <xccdf-1.2:title>IPSec Support</xccdf-1.2:title>
            <xccdf-1.2:description>Support for Internet Protocol Security (IPsec)
is provided with Libreswan.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_libreswan_installed" severity="medium">
              <xccdf-1.2:title>Install libreswan Package</xccdf-1.2:title>
              <xccdf-1.2:description>The Libreswan package provides an implementation of IPsec
and IKE, which permits the creation of secure tunnels over
untrusted networks. The <html:code>libreswan</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install libreswan</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001131</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Providing the ability for remote users or systems
to initiate a secure VPN connection protects information when it is
transmitted over a wide area network.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_libreswan_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
if ! rpm -q --quiet "libreswan" ; then
    dnf install -y "libreswan"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_libreswan_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure libreswan is installed
  package:
    name: libreswan
    state: present
  tags:
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-4.1
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_libreswan_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_libreswan_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_libreswan

class install_libreswan {
  package { 'libreswan':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_libreswan_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=libreswan
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_libreswan_installed">
[[packages]]
name = "libreswan"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_libreswan_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_libreswan_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_libreswan_approved_tunnels" severity="medium">
              <xccdf-1.2:title>Verify Any Configured IPSec Tunnel Connections</xccdf-1.2:title>
              <xccdf-1.2:description>Libreswan provides an implementation of IPsec
and IKE, which permits the creation of secure tunnels over
untrusted networks. As such, IPsec can be used to circumvent certain
network requirements such as filtering. Verify that if any IPsec connection
(<html:code>conn</html:code>) configured in <html:code>/etc/ipsec.conf</html:code> and <html:code>/etc/ipsec.d</html:code>
exists is an approved organizational connection.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Automatic remediation of this control is not available due to the unique
requirements of each system.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000336</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>IP tunneling mechanisms can be used to bypass network filtering.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-libreswan_approved_tunnels_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-iptables">
            <xccdf-1.2:title>iptables and ip6tables</xccdf-1.2:title>
            <xccdf-1.2:description>A host-based firewall called <html:code>netfilter</html:code> is included as
part of the Linux kernel distributed with the system. It is
activated by default. This firewall is controlled by the program
<html:code>iptables</html:code>, and the entire capability is frequently referred to by
this name. An analogous program called <html:code>ip6tables</html:code> handles filtering
for IPv6.
<html:br/><html:br/>
Unlike TCP Wrappers, which depends on the network server
program to support and respect the rules written, <html:code>netfilter</html:code>
filtering occurs at the kernel level, before a program can even
process the data from the network packet. As such, any program on
the system is affected by the rules written.
<html:br/><html:br/>
This section provides basic information about strengthening
the <html:code>iptables</html:code> and <html:code>ip6tables</html:code> configurations included with the system.
For more complete information that may allow the construction of a
sophisticated ruleset tailored to your environment, please consult
the references at the end of this section.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_iptables_installed" severity="medium">
              <xccdf-1.2:title>Install iptables Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>iptables</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install iptables</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>iptables</html:code> controls the Linux kernel network packet filtering
code. <html:code>iptables</html:code> allows system operators to set up firewalls and IP
masquerading, etc.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_iptables_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
if ! rpm -q --quiet "iptables" ; then
    dnf install -y "iptables"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_iptables_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure iptables is installed
  package:
    name: iptables
    state: present
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_iptables_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_iptables_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_iptables

class install_iptables {
  package { 'iptables':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_iptables_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=iptables
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_iptables_installed">
[[packages]]
name = "iptables"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_iptables_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_iptables_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_iptables_activation">
              <xccdf-1.2:title>Inspect and Activate Default Rules</xccdf-1.2:title>
              <xccdf-1.2:description>View the currently-enforced <html:code>iptables</html:code> rules by running
the command:
<html:pre>$ sudo iptables -nL --line-numbers</html:pre>
The command is analogous for <html:code>ip6tables</html:code>.
<html:br/><html:br/>
If the firewall does not appear to be active (i.e., no rules
appear), activate it and ensure that it starts at boot by issuing
the following commands (and analogously for <html:code>ip6tables</html:code>):
<html:pre>$ sudo service iptables restart</html:pre>
The default iptables rules are:
<html:pre>Chain INPUT (policy ACCEPT)
num  target     prot opt source       destination
1    ACCEPT     all  --  0.0.0.0/0    0.0.0.0/0    state RELATED,ESTABLISHED 
2    ACCEPT     icmp --  0.0.0.0/0    0.0.0.0/0
3    ACCEPT     all  --  0.0.0.0/0    0.0.0.0/0
4    ACCEPT     tcp  --  0.0.0.0/0    0.0.0.0/0    state NEW tcp dpt:22 
5    REJECT     all  --  0.0.0.0/0    0.0.0.0/0    reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
num  target     prot opt source       destination
1    REJECT     all  --  0.0.0.0/0    0.0.0.0/0    reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source       destination</html:pre>
The <html:code>ip6tables</html:code> default rules are essentially the same.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_ip6tables_enabled" severity="medium">
                <xccdf-1.2:title>Verify ip6tables Enabled if Using IPv6</xccdf-1.2:title>
                <xccdf-1.2:description>
The <html:code>ip6tables</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable ip6tables.service</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CA-3(5)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(21)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>ip6tables</html:code> service provides the system's host-based firewalling
capability for IPv6 and ICMPv6.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_ip6tables_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'ip6tables.service'
"$SYSTEMCTL_EXEC" start 'ip6tables.service'
"$SYSTEMCTL_EXEC" enable 'ip6tables.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_ip6tables_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Enable service ip6tables
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service ip6tables
      service:
        name: ip6tables
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"iptables-ipv6" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-4
    - NIST-800-53-CA-3(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(21)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_ip6tables_enabled
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_ip6tables_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_ip6tables

class enable_ip6tables {
  service {'ip6tables':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_ip6tables_enabled">
[customizations.services]
enabled = ["ip6tables"]
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_ip6tables_enabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-service_ip6tables_enabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_iptables_enabled" severity="medium">
                <xccdf-1.2:title>Verify iptables Enabled</xccdf-1.2:title>
                <xccdf-1.2:description>
The <html:code>iptables</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable iptables.service</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CA-3(5)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(21)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>iptables</html:code> service provides the system's host-based firewalling
capability for IPv4 and ICMP.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_iptables_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'iptables.service'
"$SYSTEMCTL_EXEC" start 'iptables.service'
"$SYSTEMCTL_EXEC" enable 'iptables.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_iptables_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Enable service iptables
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service iptables
      service:
        name: iptables
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"iptables" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-4
    - NIST-800-53-CA-3(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(21)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_iptables_enabled
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_iptables_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_iptables

class enable_iptables {
  service {'iptables':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_iptables_enabled">
[customizations.services]
enabled = ["iptables"]
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_iptables_enabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-service_iptables_enabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_set_ip6tables_default_rule" severity="medium">
                <xccdf-1.2:title>Set Default ip6tables Policy for Incoming Packets</xccdf-1.2:title>
                <xccdf-1.2:description>To set the default policy to DROP (instead of ACCEPT) for
the built-in INPUT chain which processes incoming packets,
add or correct the following line in
<html:code>/etc/sysconfig/ip6tables</html:code>:
<html:pre>:INPUT DROP [0:0]</html:pre>
If changes were required, reload the ip6tables rules:
<html:pre>$ sudo service ip6tables reload</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CA-3(5)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(21)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>In <html:code>ip6tables</html:code>, the default policy is applied only after all
the applicable rules in the table are examined for a match. Setting the
default policy to <html:code>DROP</html:code> implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="set_ip6tables_default_rule">sed -i 's/^:INPUT ACCEPT.*/:INPUT DROP [0:0]/g' /etc/sysconfig/ip6tables
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-set_ip6tables_default_rule_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_iptables_ruleset_modifications">
              <xccdf-1.2:title>Strengthen the Default Ruleset</xccdf-1.2:title>
              <xccdf-1.2:description>The default rules can be strengthened. The system
scripts that activate the firewall rules expect them to be defined
in the configuration files <html:code>iptables</html:code> and <html:code>ip6tables</html:code> in the directory
<html:code>/etc/sysconfig</html:code>. Many of the lines in these files are similar
to the command line arguments that would be provided to the programs
<html:code>/sbin/iptables</html:code> or <html:code>/sbin/ip6tables</html:code> - but some are quite
different.
<html:br/><html:br/>
The following recommendations describe how to strengthen the
default ruleset configuration file. An alternative to editing this
configuration file is to create a shell script that makes calls to
the iptables program to load in rules, and then invokes service
iptables save to write those loaded rules to
<html:code>/etc/sysconfig/iptables.</html:code>
<html:br/><html:br/>
The following alterations can be made directly to
<html:code>/etc/sysconfig/iptables</html:code> and <html:code>/etc/sysconfig/ip6tables</html:code>.
Instructions apply to both unless otherwise noted. Language and address
conventions for regular iptables are used throughout this section;
configuration for ip6tables will be either analogous or explicitly
covered.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">The program <html:code>system-config-securitylevel</html:code>
allows additional services to penetrate the default firewall rules
and automatically adjusts <html:code>/etc/sysconfig/iptables</html:code>. This program
is only useful if the default ruleset meets your security
requirements. Otherwise, this program should not be used to make
changes to the firewall configuration because it re-writes the
saved configuration file.</xccdf-1.2:warning>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_set_iptables_default_rule" severity="medium">
                <xccdf-1.2:title>Set Default iptables Policy for Incoming Packets</xccdf-1.2:title>
                <xccdf-1.2:description>To set the default policy to DROP (instead of ACCEPT) for
the built-in INPUT chain which processes incoming packets,
add or correct the following line in
<html:code>/etc/sysconfig/iptables</html:code>:
<html:pre>:INPUT DROP [0:0]</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CA-3(5)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(23)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>In <html:code>iptables</html:code> the default policy is applied only after all
the applicable rules in the table are examined for a match. Setting the
default policy to <html:code>DROP</html:code> implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="set_iptables_default_rule">sed -i 's/^:INPUT ACCEPT.*/:INPUT DROP [0:0]/g' /etc/sysconfig/iptables
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-set_iptables_default_rule_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_set_iptables_default_rule_forward" severity="medium">
                <xccdf-1.2:title>Set Default iptables Policy for Forwarded Packets</xccdf-1.2:title>
                <xccdf-1.2:description>To set the default policy to DROP (instead of ACCEPT) for
the built-in FORWARD chain which processes packets that will be forwarded from
one interface to another,
add or correct the following line in
<html:code>/etc/sysconfig/iptables</html:code>:
<html:pre>:FORWARD DROP [0:0]</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CA-3(5)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(23)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>In <html:code>iptables</html:code>, the default policy is applied only after all
the applicable rules in the table are examined for a match. Setting the
default policy to <html:code>DROP</html:code> implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="set_iptables_default_rule_forward">sed -i 's/^:FORWARD ACCEPT.*/:FORWARD DROP [0:0]/g' /etc/sysconfig/iptables
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-set_iptables_default_rule_forward_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_iptables_icmp_disabled">
                <xccdf-1.2:title>Restrict ICMP Message Types</xccdf-1.2:title>
                <xccdf-1.2:description>In <html:code>/etc/sysconfig/iptables</html:code>, the accepted ICMP messages
types can be restricted. To accept only ICMP echo reply, destination
unreachable, and time exceeded messages, remove the line:<html:br/>
<html:pre>-A INPUT -p icmp --icmp-type any -j ACCEPT</html:pre>
and insert the lines:
<html:pre>-A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
-A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
-A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT</html:pre>
To allow the system to respond to pings, also insert the following line:
<html:pre>-A INPUT -p icmp --icmp-type echo-request -j ACCEPT</html:pre>
Ping responses can also be limited to certain networks or hosts by using the -s
option in the previous rule.  Because IPv6 depends so heavily on ICMPv6, it is
preferable to deny the ICMPv6 packets you know you don't need (e.g. ping
requests) in <html:code>/etc/sysconfig/ip6tables</html:code>, while letting everything else
through:
<html:pre>-A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP</html:pre>
If you are going to statically configure the system's address, it should
ignore Router Advertisements which could add another IPv6 address to the
interface or alter important network settings:
<html:pre>-A INPUT -p icmpv6 --icmpv6-type router-advertisement -j DROP</html:pre>
Restricting ICMPv6 message types in <html:code>/etc/sysconfig/ip6tables</html:code> is not
recommended because the operation of IPv6 depends heavily on ICMPv6. Thus, great
care must be taken if any other ICMPv6 types are blocked.</xccdf-1.2:description>
              </xccdf-1.2:Group>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_iptables_log_and_drop_suspicious">
                <xccdf-1.2:title>Log and Drop Packets with Suspicious Source Addresses</xccdf-1.2:title>
                <xccdf-1.2:description>Packets with non-routable source addresses should be rejected, as they may indicate spoofing. Because the
modified policy will reject non-matching packets, you only need to add these rules if you are interested in also
logging these spoofing or suspicious attempts before they are dropped. If you do choose to log various suspicious
traffic, add identical rules with a target of <html:code>DROP</html:code> after each <html:i>LOG</html:i>.
To log and then drop these IPv4 packets, insert the following rules in <html:code>/etc/sysconfig/iptables</html:code> (excepting
any that are intentionally used):
<html:pre>-A INPUT -s 10.0.0.0/8 -j LOG --log-prefix "IP DROP SPOOF A: "
-A INPUT -s 172.16.0.0/12 -j LOG --log-prefix "IP DROP SPOOF B: "
-A INPUT -s 192.168.0.0/16 -j LOG --log-prefix "IP DROP SPOOF C: "
-A INPUT -s 224.0.0.0/4 -j LOG --log-prefix "IP DROP MULTICAST D: "
-A INPUT -s 240.0.0.0/5 -j LOG --log-prefix "IP DROP SPOOF E: "
-A INPUT -d 127.0.0.0/8 -j LOG --log-prefix "IP DROP LOOPBACK: "</html:pre>
Similarly, you might wish to log packets containing some IPv6 reserved addresses if they are not expected
on your network:
<html:pre>-A INPUT -i eth0 -s ::1 -j LOG --log-prefix "IPv6 DROP LOOPBACK: "
-A INPUT -s 2002:E000::/20 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "
-A INPUT -s 2002:7F00::/24 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "
-A INPUT -s 2002:0000::/24 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "
-A INPUT -s 2002:FF00::/24 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "
-A INPUT -s 2002:0A00::/24 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "
-A INPUT -s 2002:AC10::/28 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "
-A INPUT -s 2002:C0A8::/32 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "</html:pre>
If you are not expecting to see site-local multicast or auto-tunneled traffic, you can log those:
<html:pre>-A INPUT -s FF05::/16 -j LOG --log-prefix "IPv6 SITE-LOCAL MULTICAST: "
-A INPUT -s ::0.0.0.0/96 -j LOG --log-prefix "IPv4 COMPATIBLE IPv6 ADDR: "</html:pre>
If you wish to block multicasts to all link-local nodes (e.g. if you are not using router auto-configuration and
do not plan to have any services that multicast to the entire local network), you can block the link-local
all-nodes multicast address (before accepting incoming ICMPv6):
<html:pre>-A INPUT -d FF02::1 -j LOG --log-prefix "Link-local All-Nodes Multicast: "</html:pre>
However, if you're going to allow IPv4 compatible IPv6 addresses (of the form ::0.0.0.0/96), you should
then consider logging the non-routable IPv4-compatible addresses:
<html:pre>-A INPUT -s ::0.0.0.0/104 -j LOG --log-prefix "IP NON-ROUTABLE ADDR: "
-A INPUT -s ::127.0.0.0/104 -j LOG --log-prefix "IP DROP LOOPBACK: "
-A INPUT -s ::224.0.0.0.0/100 -j LOG --log-prefix "IP DROP MULTICAST D: "
-A INPUT -s ::255.0.0.0/104 -j LOG --log-prefix "IP BROADCAST: "</html:pre>
If you are not expecting to see any IPv4 (or IPv4-compatible) traffic on your network, consider logging it before it gets dropped:
<html:pre>-A INPUT -s ::FFFF:0.0.0.0/96 -j LOG --log-prefix "IPv4 MAPPED IPv6 ADDR: "
-A INPUT -s 2002::/16 -j LOG --log-prefix "IPv6 6to4 ADDR: "</html:pre>
The following rule will log all traffic originating from a site-local address, which is deprecated address space:
<html:pre>-A INPUT -s FEC0::/10 -j LOG --log-prefix "SITE-LOCAL ADDRESS TRAFFIC: "</html:pre></xccdf-1.2:description>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-ipv6">
            <xccdf-1.2:title>IPv6</xccdf-1.2:title>
            <xccdf-1.2:description>The system includes support for Internet Protocol
version 6. A major and often-mentioned improvement over IPv4 is its
enormous increase in the number of available addresses. Another
important feature is its support for automatic configuration of
many network settings.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_ipv6">
              <xccdf-1.2:title>Disable Support for IPv6 Unless Needed</xccdf-1.2:title>
              <xccdf-1.2:description>Despite configuration that suggests support for IPv6 has
been disabled, link-local IPv6 address auto-configuration occurs
even when only an IPv4 address is assigned. The only way to
effectively prevent execution of the IPv6 networking stack is to
instruct the system not to activate the IPv6 kernel module.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_ipv6_disable_argument" severity="low">
                <xccdf-1.2:title>Ensure IPv6 is disabled through kernel boot parameter</xccdf-1.2:title>
                <xccdf-1.2:description>To disable IPv6 protocol support in the Linux kernel,
add the argument <html:code>ipv6.disable=1</html:code> to the default
GRUB2 command line for the Linux operating system.
Configure the default Grub2 kernel command line to contain ipv6.disable=1 as follows:
<html:pre># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) ipv6.disable=1"</html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale>Any unnecessary network stacks, including IPv6, should be disabled to reduce
the vulnerability to exploitation.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#grub2"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_ipv6_disable_argument"># Remediation is applicable only in certain platforms
if rpm --quiet -q grub2-common; then

grubby --update-kernel=ALL --args=ipv6.disable=1

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_ipv6_disable_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - grub2_ipv6_disable_argument
    - low_disruption
    - low_severity
    - medium_complexity
    - reboot_required
    - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="ipv6.disable=1"
  when: '"grub2-common" in ansible_facts.packages'
  tags:
    - grub2_ipv6_disable_argument
    - low_disruption
    - low_severity
    - medium_complexity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_ipv6_disable_argument">[customizations.kernel]
append = "ipv6.disable=1"
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-grub2_ipv6_disable_argument:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-grub2_ipv6_disable_argument_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_ipv6_option_disabled" severity="medium">
                <xccdf-1.2:title>Disable IPv6 Networking Support Automatic Loading</xccdf-1.2:title>
                <xccdf-1.2:description>To prevent the IPv6 kernel module (<html:code>ipv6</html:code>) from binding to the
IPv6 networking stack, add the following line to
<html:code>/etc/modprobe.d/disabled.conf</html:code> (or another file in
<html:code>/etc/modprobe.d</html:code>):
<html:pre>options ipv6 disable=1</html:pre>
This permits the IPv6 module to be loaded (and thus satisfy other modules that
depend on it), while disabling support for the IPv6 protocol.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Any unnecessary network stacks - including IPv6 - should be disabled, to reduce
the vulnerability to exploitation.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_ipv6_option_disabled"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Prevent the IPv6 kernel module (ipv6) from loading the IPv6 networking stack
echo "options ipv6 disable=1" &gt; /etc/modprobe.d/ipv6.conf

# Since according to: https://access.redhat.com/solutions/72733
# "ipv6 disable=1" options doesn't always disable the IPv6 networking stack from
# loading, instruct also sysctl configuration to disable IPv6 according to:
# https://access.redhat.com/solutions/8709#rhel6disable

declare -a IPV6_SETTINGS=("net.ipv6.conf.all.disable_ipv6" "net.ipv6.conf.default.disable_ipv6")

for setting in "${IPV6_SETTINGS[@]}"
do
	# Set runtime =1 for setting
	/sbin/sysctl -q -n -w "$setting=1"

	# If setting is present in /etc/sysctl.conf, change value to "1"
	# else, add "$setting = 1" to /etc/sysctl.conf
	if grep -q ^"$setting" /etc/sysctl.conf ; then
		sed -i "s/^$setting.*/$setting = 1/g" /etc/sysctl.conf
	else
		echo "" &gt;&gt; /etc/sysctl.conf
		echo "# Set $setting = 1 per security requirements" &gt;&gt; /etc/sysctl.conf
		echo "$setting = 1" &gt;&gt; /etc/sysctl.conf
	fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_ipv6_option_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Disable IPv6 Networking kernel module
  lineinfile:
    create: true
    dest: /etc/modprobe.d/ipv6.conf
    regexp: ^options\s+ipv6\s+disable=\d
    line: options ipv6 disable=1
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_ipv6_option_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required

- name: Ensure disable_ipv6 (all and default) is set to 1
  sysctl:
    name: '{{ item }}'
    value: '1'
    state: present
    reload: true
  with_items:
    - net.ipv6.conf.all.disable_ipv6
    - net.ipv6.conf.default.disable_ipv6
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_ipv6_option_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_module_ipv6_option_disabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_module_ipv6_option_disabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_network_ipv6_disable_interfaces" severity="unknown">
                <xccdf-1.2:title>Disable Interface Usage of IPv6</xccdf-1.2:title>
                <xccdf-1.2:description>To disable interface usage of IPv6, add or correct the following lines in <html:code>/etc/sysconfig/network</html:code>:
<html:pre>NETWORKING_IPV6=no
IPV6INIT=no</html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale/>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_network_ipv6_disable_rpc" severity="unknown">
                <xccdf-1.2:title>Disable Support for RPC IPv6</xccdf-1.2:title>
                <xccdf-1.2:description>RPC services for NFSv4 try to load transport modules for
<html:code>udp6</html:code> and <html:code>tcp6</html:code> by default, even if IPv6 has been disabled in
<html:code>/etc/modprobe.d</html:code>. To prevent RPC services such as <html:code>rpc.mountd</html:code>
from attempting to start IPv6 network listeners, remove or comment out the
following two lines in <html:code>/etc/netconfig</html:code>:
<html:pre>udp6       tpi_clts      v     inet6    udp     -       -
tcp6       tpi_cots_ord  v     inet6    tcp     -       -</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:rationale/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-network_ipv6_disable_rpc:def:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_disable_ipv6" severity="medium">
                <xccdf-1.2:title>Disable IPv6 Addressing on All IPv6 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To disable support for (<html:code>ipv6</html:code>) addressing on all interface add the following line to
<html:code>/etc/sysctl.d/ipv6.conf</html:code> (or another file in <html:code>/etc/sysctl.d</html:code>):
<html:pre>net.ipv6.conf.all.disable_ipv6 = 1</html:pre>
This disables IPv6 on all network interfaces as other services and system
functionality require the IPv6 stack loaded to work.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Any unnecessary network stacks - including IPv6 - should be disabled, to reduce
the vulnerability to exploitation.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_all_disable_ipv6" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv6.conf.all.disable_ipv6 from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.all.disable_ipv6.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv6.conf.all.disable_ipv6" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for net.ipv6.conf.all.disable_ipv6
#
/sbin/sysctl -q -n -w net.ipv6.conf.all.disable_ipv6="1"

#
# If net.ipv6.conf.all.disable_ipv6 present in /etc/sysctl.conf, change value to "1"
#	else, add "net.ipv6.conf.all.disable_ipv6 = 1" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.all.disable_ipv6")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.disable_ipv6\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv6.conf.all.disable_ipv6\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_all_disable_ipv6" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.all.disable_ipv6.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_disable_ipv6

- name: Comment out any occurrences of net.ipv6.conf.all.disable_ipv6 from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.all.disable_ipv6
    replace: '#net.ipv6.conf.all.disable_ipv6'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_disable_ipv6

- name: Ensure sysctl net.ipv6.conf.all.disable_ipv6 is set to 1
  sysctl:
    name: net.ipv6.conf.all.disable_ipv6
    value: '1'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_disable_ipv6
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_all_disable_ipv6:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_disable_ipv6" severity="medium">
                <xccdf-1.2:title>Disable IPv6 Addressing on IPv6 Interfaces by Default</xccdf-1.2:title>
                <xccdf-1.2:description>To disable support for (<html:code>ipv6</html:code>) addressing on interfaces by default add the following line to
<html:code>/etc/sysctl.d/ipv6.conf</html:code> (or another file in <html:code>/etc/sysctl.d</html:code>):
<html:pre>net.ipv6.conf.default.disable_ipv6 = 1</html:pre>
This disables IPv6 on network interfaces by default as other services and system
functionality require the IPv6 stack loaded to work.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Any unnecessary network stacks - including IPv6 - should be disabled, to reduce
the vulnerability to exploitation.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_default_disable_ipv6" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv6.conf.default.disable_ipv6 from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.default.disable_ipv6.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv6.conf.default.disable_ipv6" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for net.ipv6.conf.default.disable_ipv6
#
/sbin/sysctl -q -n -w net.ipv6.conf.default.disable_ipv6="1"

#
# If net.ipv6.conf.default.disable_ipv6 present in /etc/sysctl.conf, change value to "1"
#	else, add "net.ipv6.conf.default.disable_ipv6 = 1" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.default.disable_ipv6")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.disable_ipv6\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv6.conf.default.disable_ipv6\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_default_disable_ipv6" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.default.disable_ipv6.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_disable_ipv6

- name: Comment out any occurrences of net.ipv6.conf.default.disable_ipv6 from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.default.disable_ipv6
    replace: '#net.ipv6.conf.default.disable_ipv6'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_disable_ipv6

- name: Ensure sysctl net.ipv6.conf.default.disable_ipv6 is set to 1
  sysctl:
    name: net.ipv6.conf.default.disable_ipv6
    value: '1'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_disable_ipv6
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_default_disable_ipv6:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_default_disable_ipv6_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_configuring_ipv6">
              <xccdf-1.2:title>Configure IPv6 Settings if Necessary</xccdf-1.2:title>
              <xccdf-1.2:description>A major feature of IPv6 is the extent to which systems
implementing it can automatically configure their networking
devices using information from the network. From a security
perspective, manually configuring important configuration
information is preferable to accepting it from the network
in an unauthenticated fashion.</xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysconfig_network_IPV6_AUTOCONF_value" type="string">
                <xccdf-1.2:title>IPV6_AUTOCONF</xccdf-1.2:title>
                <xccdf-1.2:description>Toggle global IPv6 auto-configuration (only, if global
forwarding is disabled)</xccdf-1.2:description>
                <xccdf-1.2:value>no</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">no</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">yes</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_defrtr_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.all.accept_ra_defrtr</xccdf-1.2:title>
                <xccdf-1.2:description>Accept default router in router advertisements?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_pinfo_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.all.accept_ra_pinfo</xccdf-1.2:title>
                <xccdf-1.2:description>Accept prefix information in router advertisements?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.all.accept_ra_rtr_pref</xccdf-1.2:title>
                <xccdf-1.2:description>Accept router preference in router advertisements?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.all.accept_ra</xccdf-1.2:title>
                <xccdf-1.2:description>Accept all router advertisements?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_redirects_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.all.accept_redirects</xccdf-1.2:title>
                <xccdf-1.2:description>Toggle ICMP Redirect Acceptance</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_source_route_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.all.accept_source_route</xccdf-1.2:title>
                <xccdf-1.2:description>Trackers could be using source-routed packets to
generate traffic that seems to be intra-net, but actually was
created outside and has been redirected.</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_autoconf_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.all.autoconf</xccdf-1.2:title>
                <xccdf-1.2:description>Enable auto configuration on IPv6 interfaces</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_forwarding_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.all.forwarding</xccdf-1.2:title>
                <xccdf-1.2:description>Toggle IPv6 Forwarding</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_max_addresses_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.all.max_addresses</xccdf-1.2:title>
                <xccdf-1.2:description>Maximum number of autoconfigured IPv6 addresses</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_router_solicitations_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.all.router_solicitations</xccdf-1.2:title>
                <xccdf-1.2:description>Accept all router solicitations?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_defrtr_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.default.accept_ra_defrtr</xccdf-1.2:title>
                <xccdf-1.2:description>Accept default router in router advertisements?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_pinfo_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.default.accept_ra_pinfo</xccdf-1.2:title>
                <xccdf-1.2:description>Accept prefix information in router advertisements?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.default.accept_ra_rtr_pref</xccdf-1.2:title>
                <xccdf-1.2:description>Accept router preference in router advertisements?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.default.accept_ra</xccdf-1.2:title>
                <xccdf-1.2:description>Accept default router advertisements by default?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.default.accept_redirects</xccdf-1.2:title>
                <xccdf-1.2:description>Toggle ICMP Redirect Acceptance By Default</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_source_route_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.default.accept_source_route</xccdf-1.2:title>
                <xccdf-1.2:description>Trackers could be using source-routed packets to
generate traffic that seems to be intra-net, but actually was
created outside and has been redirected.</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_autoconf_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.default.autoconf</xccdf-1.2:title>
                <xccdf-1.2:description>Enable auto configuration on IPv6 interfaces</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_forwarding_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.default.forwarding</xccdf-1.2:title>
                <xccdf-1.2:description>Toggle IPv6 default Forwarding</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_max_addresses_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.default.max_addresses</xccdf-1.2:title>
                <xccdf-1.2:description>Maximum number of autoconfigured IPv6 addresses</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_router_solicitations_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.default.router_solicitations</xccdf-1.2:title>
                <xccdf-1.2:description>Accept all router solicitations by default?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_network_ipv6_default_gateway" severity="unknown">
                <xccdf-1.2:title>Manually Assign IPv6 Router Address</xccdf-1.2:title>
                <xccdf-1.2:description>Edit the file
<html:code>/etc/sysconfig/network-scripts/ifcfg-<html:i>interface</html:i></html:code>, and add or correct
the following line (substituting your gateway IP as appropriate):
<html:pre>IPV6_DEFAULTGW=2001:0DB8::0001</html:pre>
Router addresses should be manually set and not accepted via any
auto-configuration or router advertisement.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:rationale/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-network_ipv6_default_gateway:def:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_network_ipv6_privacy_extensions" severity="unknown">
                <xccdf-1.2:title>Use Privacy Extensions for Address</xccdf-1.2:title>
                <xccdf-1.2:description>To introduce randomness into the automatic generation of IPv6
addresses, add or correct the following line in
<html:code>/etc/sysconfig/network-scripts/ifcfg-<html:i>interface</html:i></html:code>:
<html:pre>IPV6_PRIVACY=rfc3041</html:pre>
Automatically-generated IPv6 addresses are based on the underlying hardware
(e.g. Ethernet) address, and so it becomes possible to track a piece of
hardware over its lifetime using its traffic. If it is important for a system's
IP address to not trivially reveal its hardware address, this setting should be
applied.</xccdf-1.2:description>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:rationale/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-network_ipv6_privacy_extensions:def:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_network_ipv6_static_address" severity="unknown">
                <xccdf-1.2:title>Manually Assign Global IPv6 Address</xccdf-1.2:title>
                <xccdf-1.2:description>To manually assign an IP address for an interface, edit the
file <html:code>/etc/sysconfig/network-scripts/ifcfg-<html:i>interface</html:i></html:code>. Add or correct the
following line (substituting the correct IPv6 address):
<html:pre>IPV6ADDR=2001:0DB8::ABCD/64</html:pre>
Manually assigning an IP address is preferable to accepting one from routers or
from the network otherwise. The example address here is an IPv6 address
reserved for documentation purposes, as defined by RFC3849.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1315</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1319</xccdf-1.2:reference>
                <xccdf-1.2:rationale/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-network_ipv6_static_address:def:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra_defrtr" severity="unknown">
                <xccdf-1.2:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.all.accept_ra_defrtr</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.all.accept_ra_defrtr=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.all.accept_ra_defrtr = 0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An illicit router advertisement message could result in a man-in-the-middle attack.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_all_accept_ra_defrtr" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv6.conf.all.accept_ra_defrtr from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.all.accept_ra_defrtr.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv6.conf.all.accept_ra_defrtr" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv6_conf_all_accept_ra_defrtr_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_defrtr_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.all.accept_ra_defrtr
#
/sbin/sysctl -q -n -w net.ipv6.conf.all.accept_ra_defrtr="$sysctl_net_ipv6_conf_all_accept_ra_defrtr_value"

#
# If net.ipv6.conf.all.accept_ra_defrtr present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.accept_ra_defrtr = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.all.accept_ra_defrtr")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_all_accept_ra_defrtr_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.accept_ra_defrtr\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv6.conf.all.accept_ra_defrtr\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_all_accept_ra_defrtr" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.all.accept_ra_defrtr.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_ra_defrtr
    - unknown_severity

- name: Comment out any occurrences of net.ipv6.conf.all.accept_ra_defrtr from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.all.accept_ra_defrtr
    replace: '#net.ipv6.conf.all.accept_ra_defrtr'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_ra_defrtr
    - unknown_severity
- name: XCCDF Value sysctl_net_ipv6_conf_all_accept_ra_defrtr_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_accept_ra_defrtr_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_defrtr_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.accept_ra_defrtr is set
  sysctl:
    name: net.ipv6.conf.all.accept_ra_defrtr
    value: '{{ sysctl_net_ipv6_conf_all_accept_ra_defrtr_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_ra_defrtr
    - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_defrtr_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra_pinfo" severity="unknown">
                <xccdf-1.2:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.all.accept_ra_pinfo</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.all.accept_ra_pinfo=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.all.accept_ra_pinfo = 0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An illicit router advertisement message could result in a man-in-the-middle attack.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_all_accept_ra_pinfo" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv6.conf.all.accept_ra_pinfo from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.all.accept_ra_pinfo.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv6.conf.all.accept_ra_pinfo" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv6_conf_all_accept_ra_pinfo_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_pinfo_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.all.accept_ra_pinfo
#
/sbin/sysctl -q -n -w net.ipv6.conf.all.accept_ra_pinfo="$sysctl_net_ipv6_conf_all_accept_ra_pinfo_value"

#
# If net.ipv6.conf.all.accept_ra_pinfo present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.accept_ra_pinfo = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.all.accept_ra_pinfo")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_all_accept_ra_pinfo_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.accept_ra_pinfo\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv6.conf.all.accept_ra_pinfo\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_all_accept_ra_pinfo" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.all.accept_ra_pinfo.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_ra_pinfo
    - unknown_severity

- name: Comment out any occurrences of net.ipv6.conf.all.accept_ra_pinfo from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.all.accept_ra_pinfo
    replace: '#net.ipv6.conf.all.accept_ra_pinfo'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_ra_pinfo
    - unknown_severity
- name: XCCDF Value sysctl_net_ipv6_conf_all_accept_ra_pinfo_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_accept_ra_pinfo_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_pinfo_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.accept_ra_pinfo is set
  sysctl:
    name: net.ipv6.conf.all.accept_ra_pinfo
    value: '{{ sysctl_net_ipv6_conf_all_accept_ra_pinfo_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_ra_pinfo
    - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_pinfo_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref" severity="unknown">
                <xccdf-1.2:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.all.accept_ra_rtr_pref</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.all.accept_ra_rtr_pref=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.all.accept_ra_rtr_pref = 0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An illicit router advertisement message could result in a man-in-the-middle attack.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_all_accept_ra_rtr_pref" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv6.conf.all.accept_ra_rtr_pref from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.all.accept_ra_rtr_pref.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv6.conf.all.accept_ra_rtr_pref" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.all.accept_ra_rtr_pref
#
/sbin/sysctl -q -n -w net.ipv6.conf.all.accept_ra_rtr_pref="$sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value"

#
# If net.ipv6.conf.all.accept_ra_rtr_pref present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.accept_ra_rtr_pref = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.all.accept_ra_rtr_pref")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.accept_ra_rtr_pref\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv6.conf.all.accept_ra_rtr_pref\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_all_accept_ra_rtr_pref" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.all.accept_ra_rtr_pref.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_ra_rtr_pref
    - unknown_severity

- name: Comment out any occurrences of net.ipv6.conf.all.accept_ra_rtr_pref from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.all.accept_ra_rtr_pref
    replace: '#net.ipv6.conf.all.accept_ra_rtr_pref'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_ra_rtr_pref
    - unknown_severity
- name: XCCDF Value sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.accept_ra_rtr_pref is set
  sysctl:
    name: net.ipv6.conf.all.accept_ra_rtr_pref
    value: '{{ sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_ra_rtr_pref
    - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_autoconf" severity="unknown">
                <xccdf-1.2:title>Configure Auto Configuration on All IPv6 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.all.autoconf</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.all.autoconf=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.all.autoconf = 0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An illicit router advertisement message could result in a man-in-the-middle attack.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_all_autoconf" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv6.conf.all.autoconf from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.all.autoconf.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv6.conf.all.autoconf" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv6_conf_all_autoconf_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_autoconf_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.all.autoconf
#
/sbin/sysctl -q -n -w net.ipv6.conf.all.autoconf="$sysctl_net_ipv6_conf_all_autoconf_value"

#
# If net.ipv6.conf.all.autoconf present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.autoconf = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.all.autoconf")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_all_autoconf_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.autoconf\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv6.conf.all.autoconf\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_all_autoconf" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.all.autoconf.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_all_autoconf
    - unknown_severity

- name: Comment out any occurrences of net.ipv6.conf.all.autoconf from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.all.autoconf
    replace: '#net.ipv6.conf.all.autoconf'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_all_autoconf
    - unknown_severity
- name: XCCDF Value sysctl_net_ipv6_conf_all_autoconf_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_autoconf_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_autoconf_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.autoconf is set
  sysctl:
    name: net.ipv6.conf.all.autoconf
    value: '{{ sysctl_net_ipv6_conf_all_autoconf_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_all_autoconf
    - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_autoconf_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_autoconf_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_all_autoconf:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_all_autoconf_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_max_addresses" severity="unknown">
                <xccdf-1.2:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.all.max_addresses</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.all.max_addresses=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.all.max_addresses = 1</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The number of global unicast IPv6 addresses for each interface should be limited exactly to the number of statically configured addresses.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_all_max_addresses" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv6.conf.all.max_addresses from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.all.max_addresses.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv6.conf.all.max_addresses" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv6_conf_all_max_addresses_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_max_addresses_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.all.max_addresses
#
/sbin/sysctl -q -n -w net.ipv6.conf.all.max_addresses="$sysctl_net_ipv6_conf_all_max_addresses_value"

#
# If net.ipv6.conf.all.max_addresses present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.max_addresses = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.all.max_addresses")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_all_max_addresses_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.max_addresses\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv6.conf.all.max_addresses\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_all_max_addresses" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.all.max_addresses.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_all_max_addresses
    - unknown_severity

- name: Comment out any occurrences of net.ipv6.conf.all.max_addresses from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.all.max_addresses
    replace: '#net.ipv6.conf.all.max_addresses'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_all_max_addresses
    - unknown_severity
- name: XCCDF Value sysctl_net_ipv6_conf_all_max_addresses_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_max_addresses_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_max_addresses_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.max_addresses is set
  sysctl:
    name: net.ipv6.conf.all.max_addresses
    value: '{{ sysctl_net_ipv6_conf_all_max_addresses_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_all_max_addresses
    - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_max_addresses_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_all_max_addresses_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_router_solicitations" severity="unknown">
                <xccdf-1.2:title>Configure Denying Router Solicitations on All IPv6 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.all.router_solicitations</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.all.router_solicitations=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.all.router_solicitations = 0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:rationale>To prevent discovery of the system by other systems, router solicitation requests should be denied.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_all_router_solicitations" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv6.conf.all.router_solicitations from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.all.router_solicitations.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv6.conf.all.router_solicitations" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv6_conf_all_router_solicitations_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_router_solicitations_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.all.router_solicitations
#
/sbin/sysctl -q -n -w net.ipv6.conf.all.router_solicitations="$sysctl_net_ipv6_conf_all_router_solicitations_value"

#
# If net.ipv6.conf.all.router_solicitations present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.router_solicitations = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.all.router_solicitations")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_all_router_solicitations_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.router_solicitations\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv6.conf.all.router_solicitations\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_all_router_solicitations" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.all.router_solicitations.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_all_router_solicitations
    - unknown_severity

- name: Comment out any occurrences of net.ipv6.conf.all.router_solicitations from
    /etc/sysctl.d/*.conf files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.all.router_solicitations
    replace: '#net.ipv6.conf.all.router_solicitations'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_all_router_solicitations
    - unknown_severity
- name: XCCDF Value sysctl_net_ipv6_conf_all_router_solicitations_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_router_solicitations_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_router_solicitations_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.router_solicitations is set
  sysctl:
    name: net.ipv6.conf.all.router_solicitations
    value: '{{ sysctl_net_ipv6_conf_all_router_solicitations_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_all_router_solicitations
    - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_router_solicitations_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_all_router_solicitations_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra" severity="medium">
                <xccdf-1.2:title>Disable Accepting Router Advertisements on all IPv6 Interfaces by Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.default.accept_ra</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.default.accept_ra=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.default.accept_ra = 0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An illicit router advertisement message could result in a man-in-the-middle attack.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_default_accept_ra" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv6.conf.default.accept_ra from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.default.accept_ra.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv6.conf.default.accept_ra" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv6_conf_default_accept_ra_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.default.accept_ra
#
/sbin/sysctl -q -n -w net.ipv6.conf.default.accept_ra="$sysctl_net_ipv6_conf_default_accept_ra_value"

#
# If net.ipv6.conf.default.accept_ra present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.accept_ra = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.default.accept_ra")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_default_accept_ra_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.accept_ra\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv6.conf.default.accept_ra\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_default_accept_ra" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.default.accept_ra.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra

- name: Comment out any occurrences of net.ipv6.conf.default.accept_ra from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.default.accept_ra
    replace: '#net.ipv6.conf.default.accept_ra'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra
- name: XCCDF Value sysctl_net_ipv6_conf_default_accept_ra_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_accept_ra_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.accept_ra is set
  sysctl:
    name: net.ipv6.conf.default.accept_ra
    value: '{{ sysctl_net_ipv6_conf_default_accept_ra_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_net_ipv6_conf_default_accept_ra">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv6.conf.default.accept_ra%3D0%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv6_conf_default_accept_ra.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra_defrtr" severity="unknown">
                <xccdf-1.2:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.default.accept_ra_defrtr</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.default.accept_ra_defrtr=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.default.accept_ra_defrtr = 0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An illicit router advertisement message could result in a man-in-the-middle attack.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_default_accept_ra_defrtr" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv6.conf.default.accept_ra_defrtr from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.default.accept_ra_defrtr.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv6.conf.default.accept_ra_defrtr" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv6_conf_default_accept_ra_defrtr_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_defrtr_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.default.accept_ra_defrtr
#
/sbin/sysctl -q -n -w net.ipv6.conf.default.accept_ra_defrtr="$sysctl_net_ipv6_conf_default_accept_ra_defrtr_value"

#
# If net.ipv6.conf.default.accept_ra_defrtr present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.accept_ra_defrtr = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.default.accept_ra_defrtr")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_default_accept_ra_defrtr_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.accept_ra_defrtr\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv6.conf.default.accept_ra_defrtr\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_default_accept_ra_defrtr" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.default.accept_ra_defrtr.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra_defrtr
    - unknown_severity

- name: Comment out any occurrences of net.ipv6.conf.default.accept_ra_defrtr from
    /etc/sysctl.d/*.conf files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.default.accept_ra_defrtr
    replace: '#net.ipv6.conf.default.accept_ra_defrtr'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra_defrtr
    - unknown_severity
- name: XCCDF Value sysctl_net_ipv6_conf_default_accept_ra_defrtr_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_accept_ra_defrtr_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_defrtr_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.accept_ra_defrtr is set
  sysctl:
    name: net.ipv6.conf.default.accept_ra_defrtr
    value: '{{ sysctl_net_ipv6_conf_default_accept_ra_defrtr_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra_defrtr
    - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_defrtr_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra_pinfo" severity="unknown">
                <xccdf-1.2:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.default.accept_ra_pinfo</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.default.accept_ra_pinfo=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.default.accept_ra_pinfo = 0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An illicit router advertisement message could result in a man-in-the-middle attack.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_default_accept_ra_pinfo" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv6.conf.default.accept_ra_pinfo from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.default.accept_ra_pinfo.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv6.conf.default.accept_ra_pinfo" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv6_conf_default_accept_ra_pinfo_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_pinfo_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.default.accept_ra_pinfo
#
/sbin/sysctl -q -n -w net.ipv6.conf.default.accept_ra_pinfo="$sysctl_net_ipv6_conf_default_accept_ra_pinfo_value"

#
# If net.ipv6.conf.default.accept_ra_pinfo present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.accept_ra_pinfo = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.default.accept_ra_pinfo")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_default_accept_ra_pinfo_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.accept_ra_pinfo\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv6.conf.default.accept_ra_pinfo\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_default_accept_ra_pinfo" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.default.accept_ra_pinfo.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra_pinfo
    - unknown_severity

- name: Comment out any occurrences of net.ipv6.conf.default.accept_ra_pinfo from
    /etc/sysctl.d/*.conf files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.default.accept_ra_pinfo
    replace: '#net.ipv6.conf.default.accept_ra_pinfo'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra_pinfo
    - unknown_severity
- name: XCCDF Value sysctl_net_ipv6_conf_default_accept_ra_pinfo_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_accept_ra_pinfo_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_pinfo_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.accept_ra_pinfo is set
  sysctl:
    name: net.ipv6.conf.default.accept_ra_pinfo
    value: '{{ sysctl_net_ipv6_conf_default_accept_ra_pinfo_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra_pinfo
    - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_pinfo_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref" severity="unknown">
                <xccdf-1.2:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.default.accept_ra_rtr_pref</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.default.accept_ra_rtr_pref=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.default.accept_ra_rtr_pref = 0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An illicit router advertisement message could result in a man-in-the-middle attack.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_default_accept_ra_rtr_pref" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv6.conf.default.accept_ra_rtr_pref from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.default.accept_ra_rtr_pref.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv6.conf.default.accept_ra_rtr_pref" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.default.accept_ra_rtr_pref
#
/sbin/sysctl -q -n -w net.ipv6.conf.default.accept_ra_rtr_pref="$sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value"

#
# If net.ipv6.conf.default.accept_ra_rtr_pref present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.accept_ra_rtr_pref = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.default.accept_ra_rtr_pref")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.accept_ra_rtr_pref\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv6.conf.default.accept_ra_rtr_pref\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_default_accept_ra_rtr_pref" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.default.accept_ra_rtr_pref.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra_rtr_pref
    - unknown_severity

- name: Comment out any occurrences of net.ipv6.conf.default.accept_ra_rtr_pref from
    /etc/sysctl.d/*.conf files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.default.accept_ra_rtr_pref
    replace: '#net.ipv6.conf.default.accept_ra_rtr_pref'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra_rtr_pref
    - unknown_severity
- name: XCCDF Value sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.accept_ra_rtr_pref is set
  sysctl:
    name: net.ipv6.conf.default.accept_ra_rtr_pref
    value: '{{ sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra_rtr_pref
    - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects" severity="medium">
                <xccdf-1.2:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.default.accept_redirects</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.default.accept_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.default.accept_redirects = 0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An illicit ICMP redirect message could result in a man-in-the-middle attack.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_default_accept_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv6.conf.default.accept_redirects from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.default.accept_redirects.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv6.conf.default.accept_redirects" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv6_conf_default_accept_redirects_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.default.accept_redirects
#
/sbin/sysctl -q -n -w net.ipv6.conf.default.accept_redirects="$sysctl_net_ipv6_conf_default_accept_redirects_value"

#
# If net.ipv6.conf.default.accept_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.accept_redirects = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.default.accept_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_default_accept_redirects_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.accept_redirects\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv6.conf.default.accept_redirects\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_default_accept_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.default.accept_redirects.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_redirects

- name: Comment out any occurrences of net.ipv6.conf.default.accept_redirects from
    /etc/sysctl.d/*.conf files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.default.accept_redirects
    replace: '#net.ipv6.conf.default.accept_redirects'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_redirects
- name: XCCDF Value sysctl_net_ipv6_conf_default_accept_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_accept_redirects_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.accept_redirects is set
  sysctl:
    name: net.ipv6.conf.default.accept_redirects
    value: '{{ sysctl_net_ipv6_conf_default_accept_redirects_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_redirects
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_net_ipv6_conf_default_accept_redirects">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv6.conf.default.accept_redirects%20%3D%200%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv6_conf_default_accept_redirects.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_autoconf" severity="unknown">
                <xccdf-1.2:title>Configure Auto Configuration on All IPv6 Interfaces By Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.default.autoconf</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.default.autoconf=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.default.autoconf = 0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An illicit router advertisement message could result in a man-in-the-middle attack.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_default_autoconf" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv6.conf.default.autoconf from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.default.autoconf.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv6.conf.default.autoconf" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv6_conf_default_autoconf_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_autoconf_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.default.autoconf
#
/sbin/sysctl -q -n -w net.ipv6.conf.default.autoconf="$sysctl_net_ipv6_conf_default_autoconf_value"

#
# If net.ipv6.conf.default.autoconf present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.autoconf = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.default.autoconf")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_default_autoconf_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.autoconf\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv6.conf.default.autoconf\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_default_autoconf" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.default.autoconf.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_default_autoconf
    - unknown_severity

- name: Comment out any occurrences of net.ipv6.conf.default.autoconf from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.default.autoconf
    replace: '#net.ipv6.conf.default.autoconf'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_default_autoconf
    - unknown_severity
- name: XCCDF Value sysctl_net_ipv6_conf_default_autoconf_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_autoconf_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_autoconf_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.autoconf is set
  sysctl:
    name: net.ipv6.conf.default.autoconf
    value: '{{ sysctl_net_ipv6_conf_default_autoconf_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_default_autoconf
    - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_autoconf_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_autoconf_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_default_autoconf:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_default_autoconf_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_max_addresses" severity="unknown">
                <xccdf-1.2:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.default.max_addresses</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.default.max_addresses=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.default.max_addresses = 1</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The number of global unicast IPv6 addresses for each interface should be limited exactly to the number of statically configured addresses.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_default_max_addresses" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv6.conf.default.max_addresses from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.default.max_addresses.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv6.conf.default.max_addresses" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv6_conf_default_max_addresses_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_max_addresses_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.default.max_addresses
#
/sbin/sysctl -q -n -w net.ipv6.conf.default.max_addresses="$sysctl_net_ipv6_conf_default_max_addresses_value"

#
# If net.ipv6.conf.default.max_addresses present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.max_addresses = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.default.max_addresses")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_default_max_addresses_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.max_addresses\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv6.conf.default.max_addresses\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_default_max_addresses" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.default.max_addresses.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_default_max_addresses
    - unknown_severity

- name: Comment out any occurrences of net.ipv6.conf.default.max_addresses from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.default.max_addresses
    replace: '#net.ipv6.conf.default.max_addresses'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_default_max_addresses
    - unknown_severity
- name: XCCDF Value sysctl_net_ipv6_conf_default_max_addresses_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_max_addresses_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_max_addresses_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.max_addresses is set
  sysctl:
    name: net.ipv6.conf.default.max_addresses
    value: '{{ sysctl_net_ipv6_conf_default_max_addresses_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_default_max_addresses
    - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_max_addresses_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_default_max_addresses_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_router_solicitations" severity="unknown">
                <xccdf-1.2:title>Configure Denying Router Solicitations on All IPv6 Interfaces By Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.default.router_solicitations</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.default.router_solicitations=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.default.router_solicitations = 0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:rationale>To prevent discovery of the system by other systems, router solicitation requests should be denied.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_default_router_solicitations" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv6.conf.default.router_solicitations from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.default.router_solicitations.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv6.conf.default.router_solicitations" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv6_conf_default_router_solicitations_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_router_solicitations_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.default.router_solicitations
#
/sbin/sysctl -q -n -w net.ipv6.conf.default.router_solicitations="$sysctl_net_ipv6_conf_default_router_solicitations_value"

#
# If net.ipv6.conf.default.router_solicitations present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.router_solicitations = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.default.router_solicitations")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_default_router_solicitations_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.router_solicitations\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv6.conf.default.router_solicitations\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_default_router_solicitations" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.default.router_solicitations.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_default_router_solicitations
    - unknown_severity

- name: Comment out any occurrences of net.ipv6.conf.default.router_solicitations
    from /etc/sysctl.d/*.conf files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.default.router_solicitations
    replace: '#net.ipv6.conf.default.router_solicitations'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_default_router_solicitations
    - unknown_severity
- name: XCCDF Value sysctl_net_ipv6_conf_default_router_solicitations_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_router_solicitations_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_router_solicitations_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.router_solicitations is set
  sysctl:
    name: net.ipv6.conf.default.router_solicitations
    value: '{{ sysctl_net_ipv6_conf_default_router_solicitations_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv6_conf_default_router_solicitations
    - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_router_solicitations_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_default_router_solicitations_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network_ipv6_limit_requests">
                <xccdf-1.2:title>Limit Network-Transmitted Configuration if Using Static IPv6 Addresses</xccdf-1.2:title>
                <xccdf-1.2:description>To limit the configuration information requested from other
systems and accepted from the network on a system that uses
statically-configured IPv6 addresses, add the following lines to
<html:code>/etc/sysctl.conf</html:code>:
<html:pre>net.ipv6.conf.default.router_solicitations = 0
net.ipv6.conf.default.accept_ra_rtr_pref = 0
net.ipv6.conf.default.accept_ra_pinfo = 0
net.ipv6.conf.default.accept_ra_defrtr = 0
net.ipv6.conf.default.autoconf = 0
net.ipv6.conf.default.dad_transmits = 0
net.ipv6.conf.default.max_addresses = 1</html:pre>
The <html:code>router_solicitations</html:code> setting determines how many router
solicitations are sent when bringing up the interface. If addresses are
statically assigned, there is no need to send any solicitations.
<html:br/><html:br/>
The <html:code>accept_ra_pinfo</html:code> setting controls whether the system will accept
prefix info from the router.
<html:br/><html:br/>
The <html:code>accept_ra_defrtr</html:code> setting controls whether the system will accept
Hop Limit settings from a router advertisement. Setting it to 0 prevents a
router from changing your default IPv6 Hop Limit for outgoing packets.
<html:br/><html:br/>
The <html:code>autoconf</html:code> setting controls whether router advertisements can cause
the system to assign a global unicast address to an interface.
<html:br/><html:br/>
The <html:code>dad_transmits</html:code> setting determines how many neighbor solicitations
to send out per address (global and link-local) when bringing up an interface
to ensure the desired address is unique on the network.
<html:br/><html:br/>
The <html:code>max_addresses</html:code> setting determines how many global unicast IPv6
addresses can be assigned to each interface.  The default is 16, but it should
be set to exactly the number of statically configured global addresses
required.</xccdf-1.2:description>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-kernel">
            <xccdf-1.2:title>Kernel Parameters Which Affect Networking</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>sysctl</html:code> utility is used to set
parameters which affect the operation of the Linux kernel. Kernel parameters
which affect networking and have security implications are described here.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network_host_and_router_parameters">
              <xccdf-1.2:title>Network Related Kernel Runtime Parameters for Hosts and Routers</xccdf-1.2:title>
              <xccdf-1.2:description>Certain kernel parameters should be set for systems which are
acting as either hosts or routers to improve the system's ability defend
against certain types of IPv4 protocol attacks.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.all.accept_redirects</xccdf-1.2:title>
                <xccdf-1.2:description>Disable ICMP Redirect Acceptance</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.all.accept_source_route</xccdf-1.2:title>
                <xccdf-1.2:description>Trackers could be using source-routed packets to
generate traffic that seems to be intra-net, but actually was
created outside and has been redirected.</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_filter_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.default.arp_filter</xccdf-1.2:title>
                <xccdf-1.2:description>Controls whether the ARP filter is enabled or not.

1 - Allows you to have multiple network interfaces on the same subnet, and have the ARPs for each
interface be answered based on whether or not the kernel would route a packet from the ARP’d IP out that interface.
In other words it allows control of which cards (usually 1) will respond to an ARP request.

0 - (default) The kernel can respond to arp requests with addresses from other interfaces.
This may seem wrong but it usually makes sense, because it increases the chance of successful communication.
IP addresses are owned by the complete host on Linux, not by particular interfaces.</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_ignore_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.default.arp_ignore</xccdf-1.2:title>
                <xccdf-1.2:description>Control the response modes for ARP queries that resolve local target IP addresses:

0 - (default): reply for any local target IP address, configured on any interface
1 - reply only if the target IP address is local address configured on the incoming interface
2 - reply only if the target IP address is local address configured on the incoming interface and both with the sender’s IP address are part from same subnet on this interface
3 - do not reply for local addresses configured with scope host, only resolutions for global and link addresses are replied
4-7 - reserved
8 - do not reply for all local addresses</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
                <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                <xccdf-1.2:value selector="8">8</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.all.log_martians</xccdf-1.2:title>
                <xccdf-1.2:description>Disable so you don't Log Spoofed Packets, Source
Routed Packets, Redirect Packets</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_rp_filter_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.all.rp_filter</xccdf-1.2:title>
                <xccdf-1.2:description>Enable to enforce sanity checking, also called ingress
filtering or egress filtering. The point is to drop a packet if the
source and destination IP addresses in the IP header do not make
sense when considered in light of the physical interface on which
it arrived.</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.all.secure_redirects</xccdf-1.2:title>
                <xccdf-1.2:description>Enable to prevent hijacking of routing path by only
allowing redirects from gateways known in routing
table. Disable to refuse acceptance of secure ICMP redirected packets on all interfaces.</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_shared_media_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.all.shared_media</xccdf-1.2:title>
                <xccdf-1.2:description>Controls whether the system can send (router) or accept (host) RFC1620 shared media redirects.
<html:code>shared_media</html:code> for the interface will be enabled if at least one of conf/{all,interface}/shared_media
is set to TRUE, it will be disabled otherwise.</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.default.accept_redirects</xccdf-1.2:title>
                <xccdf-1.2:description>Disable ICMP Redirect Acceptance?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.default.accept_source_route</xccdf-1.2:title>
                <xccdf-1.2:description>Disable IP source routing?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.default.log_martians</xccdf-1.2:title>
                <xccdf-1.2:description>Disable so you don't Log Spoofed Packets, Source
Routed Packets, Redirect Packets</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.default.rp_filter</xccdf-1.2:title>
                <xccdf-1.2:description>Enables source route verification</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.default.secure_redirects</xccdf-1.2:title>
                <xccdf-1.2:description>Enable to prevent hijacking of routing path by only
allowing redirects from gateways known in routing
table. Disable to refuse acceptance of secure ICMP redirected packages by default.</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_shared_media_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.default.shared_media</xccdf-1.2:title>
                <xccdf-1.2:description>Controls whether the system can send(router) or accept(host) RFC1620 shared media redirects.
<html:code>shared_media</html:code> for the interface will be enabled if at least one of conf/{all,interface}/shared_media
is set to TRUE, it will be disabled otherwise.</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" type="number">
                <xccdf-1.2:title>net.ipv4.icmp_echo_ignore_broadcasts</xccdf-1.2:title>
                <xccdf-1.2:description>Ignore all ICMP ECHO and TIMESTAMP requests sent to it
via broadcast/multicast</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" type="number">
                <xccdf-1.2:title>net.ipv4.icmp_ignore_bogus_error_responses</xccdf-1.2:title>
                <xccdf-1.2:description>Enable to prevent unnecessary logging</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_invalid_ratelimit_value" type="number">
                <xccdf-1.2:title>net.ipv4.tcp_invalid_ratelimit</xccdf-1.2:title>
                <xccdf-1.2:description>Configure  the maximal rate for sending duplicate acknowledgments in
response to incoming invalid TCP packets.</xccdf-1.2:description>
                <xccdf-1.2:value>500</xccdf-1.2:value>
                <xccdf-1.2:value selector="one_thousand">1000</xccdf-1.2:value>
                <xccdf-1.2:value selector="five_hundred">500</xccdf-1.2:value>
                <xccdf-1.2:value selector="two_hundred_fifty">250</xccdf-1.2:value>
                <xccdf-1.2:value selector="one_hundred">100</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_rfc1337_value" type="number">
                <xccdf-1.2:title>net.ipv4.tcp_rfc1337</xccdf-1.2:title>
                <xccdf-1.2:description>Enable to enable TCP behavior conformant with RFC 1337</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value" type="number">
                <xccdf-1.2:title>net.ipv4.tcp_syncookies</xccdf-1.2:title>
                <xccdf-1.2:description>Enable to turn on TCP SYN Cookie
Protection</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_local" severity="medium">
                <xccdf-1.2:title>Disable Accepting Packets Routed Between Local Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.accept_local</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.accept_local=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.accept_local = 0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale>Configure <html:code>net.ipv4.conf.all.accept_local=0</html:code> to consider as invalid the packets
received from outside whose source is the 127.0.0.0/8 address block.
In combination with suitable routing, this can be used to direct packets between two
local interfaces over the wire and have them accepted properly.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_accept_local" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv4.conf.all.accept_local from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.accept_local.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv4.conf.all.accept_local" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for net.ipv4.conf.all.accept_local
#
/sbin/sysctl -q -n -w net.ipv4.conf.all.accept_local="0"

#
# If net.ipv4.conf.all.accept_local present in /etc/sysctl.conf, change value to "0"
#	else, add "net.ipv4.conf.all.accept_local = 0" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.accept_local")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.accept_local\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.conf.all.accept_local\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_accept_local" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.accept_local.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_local

- name: Comment out any occurrences of net.ipv4.conf.all.accept_local from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.accept_local
    replace: '#net.ipv4.conf.all.accept_local'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_local

- name: Ensure sysctl net.ipv4.conf.all.accept_local is set to 0
  sysctl:
    name: net.ipv4.conf.all.accept_local
    value: '0'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_local
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_accept_local:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_accept_local_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects" severity="medium">
                <xccdf-1.2:title>Disable Accepting ICMP Redirects for All IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.accept_redirects</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.accept_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.accept_redirects = 0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001503</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages modify the
host's route table and are unauthenticated. An illicit ICMP redirect
message could result in a man-in-the-middle attack.
<html:br/>
This feature of the IPv4 protocol has few legitimate uses. It should be
disabled unless absolutely required."</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_accept_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv4.conf.all.accept_redirects from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.accept_redirects.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv4.conf.all.accept_redirects" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv4_conf_all_accept_redirects_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.all.accept_redirects
#
/sbin/sysctl -q -n -w net.ipv4.conf.all.accept_redirects="$sysctl_net_ipv4_conf_all_accept_redirects_value"

#
# If net.ipv4.conf.all.accept_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.accept_redirects = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.accept_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_all_accept_redirects_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.accept_redirects\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.conf.all.accept_redirects\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_accept_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.accept_redirects.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_redirects

- name: Comment out any occurrences of net.ipv4.conf.all.accept_redirects from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.accept_redirects
    replace: '#net.ipv4.conf.all.accept_redirects'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_redirects
- name: XCCDF Value sysctl_net_ipv4_conf_all_accept_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_accept_redirects_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.all.accept_redirects is set
  sysctl:
    name: net.ipv4.conf.all.accept_redirects
    value: '{{ sysctl_net_ipv4_conf_all_accept_redirects_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_redirects
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_net_ipv4_conf_all_accept_redirects">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.conf.all.accept_redirects%3D0%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_all_accept_redirects.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route" severity="medium">
                <xccdf-1.2:title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.accept_source_route</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.accept_source_route=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.accept_source_route = 0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Source-routed packets allow the source of the packet to suggest routers
forward the packet along a different path than configured on the router,
which can be used to bypass network security measures. This requirement
applies only to the forwarding of source-routerd traffic, such as when IPv4
forwarding is enabled and the system is functioning as a router.
<html:br/><html:br/>
Accepting source-routed packets in the IPv4 protocol has few legitimate
uses. It should be disabled unless it is absolutely required.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_accept_source_route" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv4.conf.all.accept_source_route from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.accept_source_route.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv4.conf.all.accept_source_route" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv4_conf_all_accept_source_route_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.all.accept_source_route
#
/sbin/sysctl -q -n -w net.ipv4.conf.all.accept_source_route="$sysctl_net_ipv4_conf_all_accept_source_route_value"

#
# If net.ipv4.conf.all.accept_source_route present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.accept_source_route = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.accept_source_route")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_all_accept_source_route_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.accept_source_route\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.conf.all.accept_source_route\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_accept_source_route" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.accept_source_route.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_source_route

- name: Comment out any occurrences of net.ipv4.conf.all.accept_source_route from
    /etc/sysctl.d/*.conf files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.accept_source_route
    replace: '#net.ipv4.conf.all.accept_source_route'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_source_route
- name: XCCDF Value sysctl_net_ipv4_conf_all_accept_source_route_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_accept_source_route_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.all.accept_source_route is set
  sysctl:
    name: net.ipv4.conf.all.accept_source_route
    value: '{{ sysctl_net_ipv4_conf_all_accept_source_route_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_source_route
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_net_ipv4_conf_all_accept_source_route">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.conf.all.accept_source_route%3D0%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_all_accept_source_route.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_arp_filter" severity="medium">
                <xccdf-1.2:title>Configure ARP filtering for All IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.arp_filter</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.arp_filter=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_filter_value" use="legacy"/></html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.arp_filter = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_filter_value" use="legacy"/></html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="functionality">This behaviour may cause problems to system on a high availability or load balancing configuration.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>Prevents the Linux Kernel from handling the ARP table globally.
By default, the kernel may respond to an ARP request from a certain interface with information
from another interface.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_arp_filter" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv4.conf.all.arp_filter from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.arp_filter.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv4.conf.all.arp_filter" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv4_conf_all_arp_filter_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_filter_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.all.arp_filter
#
/sbin/sysctl -q -n -w net.ipv4.conf.all.arp_filter="$sysctl_net_ipv4_conf_all_arp_filter_value"

#
# If net.ipv4.conf.all.arp_filter present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.arp_filter = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.arp_filter")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_all_arp_filter_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.arp_filter\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.conf.all.arp_filter\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_arp_filter" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.arp_filter.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_arp_filter

- name: Comment out any occurrences of net.ipv4.conf.all.arp_filter from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.arp_filter
    replace: '#net.ipv4.conf.all.arp_filter'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_arp_filter
- name: XCCDF Value sysctl_net_ipv4_conf_all_arp_filter_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_arp_filter_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_filter_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.all.arp_filter is set
  sysctl:
    name: net.ipv4.conf.all.arp_filter
    value: '{{ sysctl_net_ipv4_conf_all_arp_filter_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_arp_filter
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_arp_filter_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_filter_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_arp_filter:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_arp_ignore" severity="medium">
                <xccdf-1.2:title>Configure Response Mode of ARP Requests for All IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.arp_ignore</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.arp_ignore=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_ignore_value" use="legacy"/></html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.arp_ignore = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_ignore_value" use="legacy"/></html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="functionality">The ARP response mode may impact behaviour of workloads and firewalls on the system.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>Avoids ARP Flux on system that have more than one interface on the same subnet.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_arp_ignore" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv4.conf.all.arp_ignore from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.arp_ignore.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv4.conf.all.arp_ignore" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv4_conf_all_arp_ignore_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_ignore_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.all.arp_ignore
#
/sbin/sysctl -q -n -w net.ipv4.conf.all.arp_ignore="$sysctl_net_ipv4_conf_all_arp_ignore_value"

#
# If net.ipv4.conf.all.arp_ignore present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.arp_ignore = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.arp_ignore")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_all_arp_ignore_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.arp_ignore\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.conf.all.arp_ignore\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_arp_ignore" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.arp_ignore.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_arp_ignore

- name: Comment out any occurrences of net.ipv4.conf.all.arp_ignore from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.arp_ignore
    replace: '#net.ipv4.conf.all.arp_ignore'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_arp_ignore
- name: XCCDF Value sysctl_net_ipv4_conf_all_arp_ignore_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_arp_ignore_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_ignore_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.all.arp_ignore is set
  sysctl:
    name: net.ipv4.conf.all.arp_ignore
    value: '{{ sysctl_net_ipv4_conf_all_arp_ignore_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_arp_ignore
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_arp_ignore_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_ignore_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_arp_ignore:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_arp_ignore_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_drop_gratuitous_arp" severity="medium">
                <xccdf-1.2:title>Drop Gratuitious ARP frames on All IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.drop_gratuitous_arp</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.drop_gratuitous_arp=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.drop_gratuitous_arp = 1</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="functionality">This can cause problems if ARP proxies are used in the network.</xccdf-1.2:warning>
                <xccdf-1.2:rationale>Drop Gratuitous ARP frames to prevent ARP poisoning.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_drop_gratuitous_arp" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv4.conf.all.drop_gratuitous_arp from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.drop_gratuitous_arp.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv4.conf.all.drop_gratuitous_arp" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for net.ipv4.conf.all.drop_gratuitous_arp
#
/sbin/sysctl -q -n -w net.ipv4.conf.all.drop_gratuitous_arp="1"

#
# If net.ipv4.conf.all.drop_gratuitous_arp present in /etc/sysctl.conf, change value to "1"
#	else, add "net.ipv4.conf.all.drop_gratuitous_arp = 1" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.drop_gratuitous_arp")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.drop_gratuitous_arp\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.conf.all.drop_gratuitous_arp\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_drop_gratuitous_arp" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.drop_gratuitous_arp.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_drop_gratuitous_arp

- name: Comment out any occurrences of net.ipv4.conf.all.drop_gratuitous_arp from
    /etc/sysctl.d/*.conf files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.drop_gratuitous_arp
    replace: '#net.ipv4.conf.all.drop_gratuitous_arp'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_drop_gratuitous_arp

- name: Ensure sysctl net.ipv4.conf.all.drop_gratuitous_arp is set to 1
  sysctl:
    name: net.ipv4.conf.all.drop_gratuitous_arp
    value: '1'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_drop_gratuitous_arp
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_drop_gratuitous_arp:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_drop_gratuitous_arp_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians" severity="unknown">
                <xccdf-1.2:title>Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.log_martians</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.log_martians=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.log_martians = 1</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(3)(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The presence of "martian" packets (which have impossible addresses)
as well as spoofed packets, source-routed packets, and redirects could be a
sign of nefarious network activity. Logging these packets enables this activity
to be detected.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_log_martians" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv4.conf.all.log_martians from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.log_martians.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv4.conf.all.log_martians" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv4_conf_all_log_martians_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.all.log_martians
#
/sbin/sysctl -q -n -w net.ipv4.conf.all.log_martians="$sysctl_net_ipv4_conf_all_log_martians_value"

#
# If net.ipv4.conf.all.log_martians present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.log_martians = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.log_martians")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_all_log_martians_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.log_martians\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.conf.all.log_martians\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_log_martians" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.log_martians.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5(3)(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv4_conf_all_log_martians
    - unknown_severity

- name: Comment out any occurrences of net.ipv4.conf.all.log_martians from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.log_martians
    replace: '#net.ipv4.conf.all.log_martians'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5(3)(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv4_conf_all_log_martians
    - unknown_severity
- name: XCCDF Value sysctl_net_ipv4_conf_all_log_martians_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_log_martians_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.all.log_martians is set
  sysctl:
    name: net.ipv4.conf.all.log_martians
    value: '{{ sysctl_net_ipv4_conf_all_log_martians_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5(3)(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv4_conf_all_log_martians
    - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_net_ipv4_conf_all_log_martians">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.conf.all.log_martians%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_all_log_martians.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_log_martians:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_route_localnet" severity="medium">
                <xccdf-1.2:title>Prevent Routing External Traffic to Local Loopback on All IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.route_localnet</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.route_localnet=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.route_localnet = 0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale>Refuse the routing of packets whose source or destination address is the local loopback.
This prohibits the use of network 127/8 for local routing purposes.
Enabling <html:code>route_localnet</html:code> can expose applications listening on localhost to external traffic.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_route_localnet" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv4.conf.all.route_localnet from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.route_localnet.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv4.conf.all.route_localnet" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for net.ipv4.conf.all.route_localnet
#
/sbin/sysctl -q -n -w net.ipv4.conf.all.route_localnet="0"

#
# If net.ipv4.conf.all.route_localnet present in /etc/sysctl.conf, change value to "0"
#	else, add "net.ipv4.conf.all.route_localnet = 0" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.route_localnet")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.route_localnet\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.conf.all.route_localnet\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_route_localnet" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.route_localnet.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_route_localnet

- name: Comment out any occurrences of net.ipv4.conf.all.route_localnet from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.route_localnet
    replace: '#net.ipv4.conf.all.route_localnet'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_route_localnet

- name: Ensure sysctl net.ipv4.conf.all.route_localnet is set to 0
  sysctl:
    name: net.ipv4.conf.all.route_localnet
    value: '0'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_route_localnet
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_route_localnet:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_route_localnet_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter" severity="medium">
                <xccdf-1.2:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.rp_filter</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.rp_filter=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.rp_filter = 1</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Enabling reverse path filtering drops packets with source addresses
that should not have been able to be received on the interface they were
received on. It should not be used on systems which are routers for
complicated networks, but is helpful for end hosts and routers serving small
networks.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_rp_filter" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv4.conf.all.rp_filter from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.rp_filter.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv4.conf.all.rp_filter" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv4_conf_all_rp_filter_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_rp_filter_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.all.rp_filter
#
/sbin/sysctl -q -n -w net.ipv4.conf.all.rp_filter="$sysctl_net_ipv4_conf_all_rp_filter_value"

#
# If net.ipv4.conf.all.rp_filter present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.rp_filter = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.rp_filter")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_all_rp_filter_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.rp_filter\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.conf.all.rp_filter\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_rp_filter" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.rp_filter.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_rp_filter

- name: Comment out any occurrences of net.ipv4.conf.all.rp_filter from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.rp_filter
    replace: '#net.ipv4.conf.all.rp_filter'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_rp_filter
- name: XCCDF Value sysctl_net_ipv4_conf_all_rp_filter_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_rp_filter_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_rp_filter_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.all.rp_filter is set
  sysctl:
    name: net.ipv4.conf.all.rp_filter
    value: '{{ sysctl_net_ipv4_conf_all_rp_filter_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_rp_filter
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_net_ipv4_conf_all_rp_filter">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.conf.all.rp_filter%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_all_rp_filter.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_rp_filter_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects" severity="medium">
                <xccdf-1.2:title>Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.secure_redirects</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.secure_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.secure_redirects = 0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001503</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Accepting "secure" ICMP redirects (from those gateways listed as
default gateways) has few legitimate uses. It should be disabled unless it is
absolutely required.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_secure_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv4.conf.all.secure_redirects from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.secure_redirects.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv4.conf.all.secure_redirects" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv4_conf_all_secure_redirects_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.all.secure_redirects
#
/sbin/sysctl -q -n -w net.ipv4.conf.all.secure_redirects="$sysctl_net_ipv4_conf_all_secure_redirects_value"

#
# If net.ipv4.conf.all.secure_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.secure_redirects = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.secure_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_all_secure_redirects_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.secure_redirects\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.conf.all.secure_redirects\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_secure_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.secure_redirects.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_secure_redirects

- name: Comment out any occurrences of net.ipv4.conf.all.secure_redirects from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.secure_redirects
    replace: '#net.ipv4.conf.all.secure_redirects'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_secure_redirects
- name: XCCDF Value sysctl_net_ipv4_conf_all_secure_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_secure_redirects_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.all.secure_redirects is set
  sysctl:
    name: net.ipv4.conf.all.secure_redirects
    value: '{{ sysctl_net_ipv4_conf_all_secure_redirects_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_secure_redirects
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_net_ipv4_conf_all_secure_redirects">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.conf.all.secure_redirects%3D0%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_all_secure_redirects.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_shared_media" severity="medium">
                <xccdf-1.2:title>Configure Sending and Accepting Shared Media Redirects for All IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.shared_media</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.shared_media=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_shared_media_value" use="legacy"/></html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.shared_media = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_shared_media_value" use="legacy"/></html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale>This setting should be aligned with <html:code>net.ipv4.conf.all.secure_redirects</html:code> because it overrides it.
If <html:code>shared_media</html:code> is enabled for an interface <html:code>secure_redirects</html:code> will be enabled too.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_shared_media" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv4.conf.all.shared_media from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.shared_media.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv4.conf.all.shared_media" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv4_conf_all_shared_media_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_shared_media_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.all.shared_media
#
/sbin/sysctl -q -n -w net.ipv4.conf.all.shared_media="$sysctl_net_ipv4_conf_all_shared_media_value"

#
# If net.ipv4.conf.all.shared_media present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.shared_media = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.shared_media")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_all_shared_media_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.shared_media\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.conf.all.shared_media\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_shared_media" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.shared_media.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_shared_media

- name: Comment out any occurrences of net.ipv4.conf.all.shared_media from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.shared_media
    replace: '#net.ipv4.conf.all.shared_media'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_shared_media
- name: XCCDF Value sysctl_net_ipv4_conf_all_shared_media_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_shared_media_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_shared_media_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.all.shared_media is set
  sysctl:
    name: net.ipv4.conf.all.shared_media
    value: '{{ sysctl_net_ipv4_conf_all_shared_media_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_shared_media
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_shared_media_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_shared_media_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_shared_media:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_shared_media_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects" severity="medium">
                <xccdf-1.2:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.default.accept_redirects</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.default.accept_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.default.accept_redirects = 0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages modify the
host's route table and are unauthenticated. An illicit ICMP redirect
message could result in a man-in-the-middle attack.
<html:br/>This feature of the IPv4 protocol has few legitimate uses. It should
be disabled unless absolutely required.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_default_accept_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv4.conf.default.accept_redirects from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.default.accept_redirects.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv4.conf.default.accept_redirects" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv4_conf_default_accept_redirects_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.default.accept_redirects
#
/sbin/sysctl -q -n -w net.ipv4.conf.default.accept_redirects="$sysctl_net_ipv4_conf_default_accept_redirects_value"

#
# If net.ipv4.conf.default.accept_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.default.accept_redirects = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.default.accept_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_default_accept_redirects_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.default.accept_redirects\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.conf.default.accept_redirects\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_default_accept_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.default.accept_redirects.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_accept_redirects

- name: Comment out any occurrences of net.ipv4.conf.default.accept_redirects from
    /etc/sysctl.d/*.conf files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.default.accept_redirects
    replace: '#net.ipv4.conf.default.accept_redirects'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_accept_redirects
- name: XCCDF Value sysctl_net_ipv4_conf_default_accept_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_default_accept_redirects_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.default.accept_redirects is set
  sysctl:
    name: net.ipv4.conf.default.accept_redirects
    value: '{{ sysctl_net_ipv4_conf_default_accept_redirects_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_accept_redirects
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_net_ipv4_conf_default_accept_redirects">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.conf.default.accept_redirects%3D0%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_default_accept_redirects.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route" severity="medium">
                <xccdf-1.2:title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.default.accept_source_route</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.default.accept_source_route=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.default.accept_source_route = 0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Source-routed packets allow the source of the packet to suggest routers
forward the packet along a different path than configured on the router,
which can be used to bypass network security measures.
<html:br/>
Accepting source-routed packets in the IPv4 protocol has few legitimate
uses. It should be disabled unless it is absolutely required, such as when
IPv4 forwarding is enabled and the system is legitimately functioning as a
router.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_default_accept_source_route" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv4.conf.default.accept_source_route from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.default.accept_source_route.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv4.conf.default.accept_source_route" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv4_conf_default_accept_source_route_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.default.accept_source_route
#
/sbin/sysctl -q -n -w net.ipv4.conf.default.accept_source_route="$sysctl_net_ipv4_conf_default_accept_source_route_value"

#
# If net.ipv4.conf.default.accept_source_route present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.default.accept_source_route = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.default.accept_source_route")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_default_accept_source_route_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.default.accept_source_route\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.conf.default.accept_source_route\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_default_accept_source_route" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.default.accept_source_route.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_accept_source_route

- name: Comment out any occurrences of net.ipv4.conf.default.accept_source_route from
    /etc/sysctl.d/*.conf files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.default.accept_source_route
    replace: '#net.ipv4.conf.default.accept_source_route'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_accept_source_route
- name: XCCDF Value sysctl_net_ipv4_conf_default_accept_source_route_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_default_accept_source_route_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.default.accept_source_route is set
  sysctl:
    name: net.ipv4.conf.default.accept_source_route
    value: '{{ sysctl_net_ipv4_conf_default_accept_source_route_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_accept_source_route
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_net_ipv4_conf_default_accept_source_route">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.conf.default.accept_source_route%3D0%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_default_accept_source_route.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians" severity="unknown">
                <xccdf-1.2:title>Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.default.log_martians</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.default.log_martians=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.default.log_martians = 1</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(3)(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The presence of "martian" packets (which have impossible addresses)
as well as spoofed packets, source-routed packets, and redirects could be a
sign of nefarious network activity. Logging these packets enables this activity
to be detected.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_default_log_martians" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv4.conf.default.log_martians from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.default.log_martians.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv4.conf.default.log_martians" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv4_conf_default_log_martians_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.default.log_martians
#
/sbin/sysctl -q -n -w net.ipv4.conf.default.log_martians="$sysctl_net_ipv4_conf_default_log_martians_value"

#
# If net.ipv4.conf.default.log_martians present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.default.log_martians = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.default.log_martians")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_default_log_martians_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.default.log_martians\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.conf.default.log_martians\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_default_log_martians" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.default.log_martians.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5(3)(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv4_conf_default_log_martians
    - unknown_severity

- name: Comment out any occurrences of net.ipv4.conf.default.log_martians from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.default.log_martians
    replace: '#net.ipv4.conf.default.log_martians'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5(3)(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv4_conf_default_log_martians
    - unknown_severity
- name: XCCDF Value sysctl_net_ipv4_conf_default_log_martians_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_default_log_martians_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.default.log_martians is set
  sysctl:
    name: net.ipv4.conf.default.log_martians
    value: '{{ sysctl_net_ipv4_conf_default_log_martians_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5(3)(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv4_conf_default_log_martians
    - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_net_ipv4_conf_default_log_martians">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.conf.default.log_martians%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_default_log_martians.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_default_log_martians:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter" severity="medium">
                <xccdf-1.2:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.default.rp_filter</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.default.rp_filter=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.default.rp_filter = 1</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Enabling reverse path filtering drops packets with source addresses
that should not have been able to be received on the interface they were
received on. It should not be used on systems which are routers for
complicated networks, but is helpful for end hosts and routers serving small
networks.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_default_rp_filter" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv4.conf.default.rp_filter from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.default.rp_filter.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv4.conf.default.rp_filter" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv4_conf_default_rp_filter_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.default.rp_filter
#
/sbin/sysctl -q -n -w net.ipv4.conf.default.rp_filter="$sysctl_net_ipv4_conf_default_rp_filter_value"

#
# If net.ipv4.conf.default.rp_filter present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.default.rp_filter = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.default.rp_filter")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_default_rp_filter_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.default.rp_filter\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.conf.default.rp_filter\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_default_rp_filter" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.default.rp_filter.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_rp_filter

- name: Comment out any occurrences of net.ipv4.conf.default.rp_filter from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.default.rp_filter
    replace: '#net.ipv4.conf.default.rp_filter'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_rp_filter
- name: XCCDF Value sysctl_net_ipv4_conf_default_rp_filter_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_default_rp_filter_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.default.rp_filter is set
  sysctl:
    name: net.ipv4.conf.default.rp_filter
    value: '{{ sysctl_net_ipv4_conf_default_rp_filter_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_rp_filter
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_net_ipv4_conf_default_rp_filter">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.conf.default.rp_filter%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_default_rp_filter.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects" severity="medium">
                <xccdf-1.2:title>Configure Kernel Parameter for Accepting Secure Redirects By Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.default.secure_redirects</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.default.secure_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.default.secure_redirects = 0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Accepting "secure" ICMP redirects (from those gateways listed as
default gateways) has few legitimate uses. It should be disabled unless it is
absolutely required.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_default_secure_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv4.conf.default.secure_redirects from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.default.secure_redirects.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv4.conf.default.secure_redirects" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv4_conf_default_secure_redirects_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.default.secure_redirects
#
/sbin/sysctl -q -n -w net.ipv4.conf.default.secure_redirects="$sysctl_net_ipv4_conf_default_secure_redirects_value"

#
# If net.ipv4.conf.default.secure_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.default.secure_redirects = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.default.secure_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_default_secure_redirects_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.default.secure_redirects\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.conf.default.secure_redirects\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_default_secure_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.default.secure_redirects.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_secure_redirects

- name: Comment out any occurrences of net.ipv4.conf.default.secure_redirects from
    /etc/sysctl.d/*.conf files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.default.secure_redirects
    replace: '#net.ipv4.conf.default.secure_redirects'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_secure_redirects
- name: XCCDF Value sysctl_net_ipv4_conf_default_secure_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_default_secure_redirects_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.default.secure_redirects is set
  sysctl:
    name: net.ipv4.conf.default.secure_redirects
    value: '{{ sysctl_net_ipv4_conf_default_secure_redirects_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_secure_redirects
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_net_ipv4_conf_default_secure_redirects">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.conf.default.secure_redirects%3D0%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_default_secure_redirects.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_shared_media" severity="medium">
                <xccdf-1.2:title>Configure Sending and Accepting Shared Media Redirects by Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.default.shared_media</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.default.shared_media=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_shared_media_value" use="legacy"/></html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.default.shared_media = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_shared_media_value" use="legacy"/></html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale>This setting should be aligned with <html:code>net.ipv4.conf.default.secure_redirects</html:code> because it overrides it.
If <html:code>shared_media</html:code> is enabled for an interface <html:code>secure_redirects</html:code> will be enabled too.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_default_shared_media" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv4.conf.default.shared_media from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.default.shared_media.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv4.conf.default.shared_media" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv4_conf_default_shared_media_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_shared_media_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.default.shared_media
#
/sbin/sysctl -q -n -w net.ipv4.conf.default.shared_media="$sysctl_net_ipv4_conf_default_shared_media_value"

#
# If net.ipv4.conf.default.shared_media present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.default.shared_media = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.default.shared_media")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_default_shared_media_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.default.shared_media\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.conf.default.shared_media\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_default_shared_media" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.default.shared_media.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_shared_media

- name: Comment out any occurrences of net.ipv4.conf.default.shared_media from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.default.shared_media
    replace: '#net.ipv4.conf.default.shared_media'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_shared_media
- name: XCCDF Value sysctl_net_ipv4_conf_default_shared_media_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_default_shared_media_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_shared_media_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.default.shared_media is set
  sysctl:
    name: net.ipv4.conf.default.shared_media
    value: '{{ sysctl_net_ipv4_conf_default_shared_media_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_shared_media
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_shared_media_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_shared_media_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_default_shared_media:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_default_shared_media_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" severity="medium">
                <xccdf-1.2:title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.icmp_echo_ignore_broadcasts</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.icmp_echo_ignore_broadcasts = 1</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Responding to broadcast (ICMP) echoes facilitates network mapping
and provides a vector for amplification attacks.
<html:br/>
Ignoring ICMP echo requests (pings) sent to broadcast or multicast
addresses makes the system slightly more difficult to enumerate on the network.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv4.icmp_echo_ignore_broadcasts from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.icmp_echo_ignore_broadcasts.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv4.icmp_echo_ignore_broadcasts" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" use="legacy"/>'


#
# Set runtime for net.ipv4.icmp_echo_ignore_broadcasts
#
/sbin/sysctl -q -n -w net.ipv4.icmp_echo_ignore_broadcasts="$sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value"

#
# If net.ipv4.icmp_echo_ignore_broadcasts present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.icmp_echo_ignore_broadcasts = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.icmp_echo_ignore_broadcasts")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.icmp_echo_ignore_broadcasts\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.icmp_echo_ignore_broadcasts\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv4.icmp_echo_ignore_broadcasts.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_icmp_echo_ignore_broadcasts

- name: Comment out any occurrences of net.ipv4.icmp_echo_ignore_broadcasts from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.icmp_echo_ignore_broadcasts
    replace: '#net.ipv4.icmp_echo_ignore_broadcasts'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
- name: XCCDF Value sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value # promote to variable
  set_fact:
    sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.icmp_echo_ignore_broadcasts is set
  sysctl:
    name: net.ipv4.icmp_echo_ignore_broadcasts
    value: '{{ sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.icmp_echo_ignore_broadcasts%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_icmp_echo_ignore_broadcasts.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" severity="unknown">
                <xccdf-1.2:title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.icmp_ignore_bogus_error_responses</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.icmp_ignore_bogus_error_responses = 1</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Ignoring bogus ICMP error responses reduces
log size, although some activity would not be logged.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv4.icmp_ignore_bogus_error_responses from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.icmp_ignore_bogus_error_responses.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv4.icmp_ignore_bogus_error_responses" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" use="legacy"/>'


#
# Set runtime for net.ipv4.icmp_ignore_bogus_error_responses
#
/sbin/sysctl -q -n -w net.ipv4.icmp_ignore_bogus_error_responses="$sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value"

#
# If net.ipv4.icmp_ignore_bogus_error_responses present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.icmp_ignore_bogus_error_responses = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.icmp_ignore_bogus_error_responses")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.icmp_ignore_bogus_error_responses\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.icmp_ignore_bogus_error_responses\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv4.icmp_ignore_bogus_error_responses.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
    - unknown_severity

- name: Comment out any occurrences of net.ipv4.icmp_ignore_bogus_error_responses
    from /etc/sysctl.d/*.conf files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.icmp_ignore_bogus_error_responses
    replace: '#net.ipv4.icmp_ignore_bogus_error_responses'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
    - unknown_severity
- name: XCCDF Value sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value # promote to variable
  set_fact:
    sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.icmp_ignore_bogus_error_responses is set
  sysctl:
    name: net.ipv4.icmp_ignore_bogus_error_responses
    value: '{{ sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
    - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.icmp_ignore_bogus_error_responses%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_icmp_ignore_bogus_error_responses.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_local_port_range" severity="medium">
                <xccdf-1.2:title>Set Kernel Parameter to Increase Local Port Range</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.ip_local_port_range</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.ip_local_port_range=32768 65535</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.ip_local_port_range = 32768 65535</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:rationale>This setting defines the local port range that is used by TCP and UDP to
choose the local port. The first number is the first, the second the last
local port number.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_ip_local_port_range" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv4.ip_local_port_range from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.ip_local_port_range.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv4.ip_local_port_range" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for net.ipv4.ip_local_port_range
#
/sbin/sysctl -q -n -w net.ipv4.ip_local_port_range="32768 65535"

#
# If net.ipv4.ip_local_port_range present in /etc/sysctl.conf, change value to "32768 65535"
#	else, add "net.ipv4.ip_local_port_range = 32768 65535" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.ip_local_port_range")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "32768 65535"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.ip_local_port_range\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.ip_local_port_range\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_ip_local_port_range" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv4.ip_local_port_range.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_ip_local_port_range

- name: Comment out any occurrences of net.ipv4.ip_local_port_range from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.ip_local_port_range
    replace: '#net.ipv4.ip_local_port_range'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_ip_local_port_range

- name: Ensure sysctl net.ipv4.ip_local_port_range is set to 32768 65535
  sysctl:
    name: net.ipv4.ip_local_port_range
    value: 32768 65535
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_ip_local_port_range
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv4_ip_local_port_range:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_ip_local_port_range_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies" severity="medium">
                <xccdf-1.2:title>Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.tcp_syncookies</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.tcp_syncookies=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.tcp_syncookies = 1</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001095</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(3)(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000420-GPOS-00186</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000142-GPOS-00071</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A TCP SYN flood attack can cause a denial of service by filling a
system's TCP connection table with connections in the SYN_RCVD state.
Syncookies can be used to track a connection when a subsequent ACK is received,
verifying the initiator is attempting a valid connection and is not a flood
source. This feature is activated when a flood condition is detected, and
enables the system to continue servicing valid connection requests.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_tcp_syncookies" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv4.tcp_syncookies from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.tcp_syncookies.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv4.tcp_syncookies" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_net_ipv4_tcp_syncookies_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value" use="legacy"/>'


#
# Set runtime for net.ipv4.tcp_syncookies
#
/sbin/sysctl -q -n -w net.ipv4.tcp_syncookies="$sysctl_net_ipv4_tcp_syncookies_value"

#
# If net.ipv4.tcp_syncookies present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.tcp_syncookies = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.tcp_syncookies")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_tcp_syncookies_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.tcp_syncookies\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.tcp_syncookies\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_tcp_syncookies" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv4.tcp_syncookies.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5(1)
    - NIST-800-53-SC-5(2)
    - NIST-800-53-SC-5(3)(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_tcp_syncookies

- name: Comment out any occurrences of net.ipv4.tcp_syncookies from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.tcp_syncookies
    replace: '#net.ipv4.tcp_syncookies'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5(1)
    - NIST-800-53-SC-5(2)
    - NIST-800-53-SC-5(3)(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_tcp_syncookies
- name: XCCDF Value sysctl_net_ipv4_tcp_syncookies_value # promote to variable
  set_fact:
    sysctl_net_ipv4_tcp_syncookies_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.tcp_syncookies is set
  sysctl:
    name: net.ipv4.tcp_syncookies
    value: '{{ sysctl_net_ipv4_tcp_syncookies_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5(1)
    - NIST-800-53-SC-5(2)
    - NIST-800-53-SC-5(3)(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_tcp_syncookies
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_net_ipv4_tcp_syncookies">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.tcp_syncookies%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_tcp_syncookies.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv4_tcp_syncookies:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_tcp_syncookies_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network_host_parameters">
              <xccdf-1.2:title>Network Parameters for Hosts Only</xccdf-1.2:title>
              <xccdf-1.2:description>If the system is not going to be used as a router, then setting certain
kernel parameters ensure that the host will not perform routing
of network traffic.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects" severity="medium">
                <xccdf-1.2:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.send_redirects</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.send_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.send_redirects = 0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages contain information
from the system's route table possibly revealing portions of the network topology.
<html:br/>
The ability to send ICMP redirects is only appropriate for systems acting as routers.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_send_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv4.conf.all.send_redirects from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.send_redirects.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv4.conf.all.send_redirects" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for net.ipv4.conf.all.send_redirects
#
/sbin/sysctl -q -n -w net.ipv4.conf.all.send_redirects="0"

#
# If net.ipv4.conf.all.send_redirects present in /etc/sysctl.conf, change value to "0"
#	else, add "net.ipv4.conf.all.send_redirects = 0" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.send_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.send_redirects\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.conf.all.send_redirects\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_send_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.send_redirects.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_send_redirects

- name: Comment out any occurrences of net.ipv4.conf.all.send_redirects from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.send_redirects
    replace: '#net.ipv4.conf.all.send_redirects'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_send_redirects

- name: Ensure sysctl net.ipv4.conf.all.send_redirects is set to 0
  sysctl:
    name: net.ipv4.conf.all.send_redirects
    value: '0'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_send_redirects
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_net_ipv4_conf_all_send_redirects">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.conf.all.send_redirects%3D0%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_all_send_redirects.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_send_redirects:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects" severity="medium">
                <xccdf-1.2:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.default.send_redirects</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.default.send_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.default.send_redirects = 0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages contain information
from the system's route table possibly revealing portions of the network topology.
<html:br/>
The ability to send ICMP redirects is only appropriate for systems acting as routers.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_default_send_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv4.conf.default.send_redirects from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.default.send_redirects.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv4.conf.default.send_redirects" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for net.ipv4.conf.default.send_redirects
#
/sbin/sysctl -q -n -w net.ipv4.conf.default.send_redirects="0"

#
# If net.ipv4.conf.default.send_redirects present in /etc/sysctl.conf, change value to "0"
#	else, add "net.ipv4.conf.default.send_redirects = 0" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.default.send_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.default.send_redirects\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.conf.default.send_redirects\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_default_send_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.default.send_redirects.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_send_redirects

- name: Comment out any occurrences of net.ipv4.conf.default.send_redirects from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.default.send_redirects
    replace: '#net.ipv4.conf.default.send_redirects'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_send_redirects

- name: Ensure sysctl net.ipv4.conf.default.send_redirects is set to 0
  sysctl:
    name: net.ipv4.conf.default.send_redirects
    value: '0'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_send_redirects
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_net_ipv4_conf_default_send_redirects">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.ipv4.conf.default.send_redirects%3D0%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_default_send_redirects.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_default_send_redirects:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_forward" severity="medium">
                <xccdf-1.2:title>Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.ip_forward</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.ip_forward=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.ip_forward = 0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="functionality">Certain technologies such as virtual machines, containers, etc. rely on IPv4 forwarding to enable and use networking.
Disabling IPv4 forwarding would cause those technologies to stop working. Therefore, this rule should not be used in
profiles or benchmarks that target usage of IPv4 forwarding.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R22)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Routing protocol daemons are typically used on routers to exchange
network topology information with other routers. If this capability is used when
not required, system network information may be unnecessarily transmitted across
the network.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_ip_forward" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.ipv4.ip_forward from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.ip_forward.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.ipv4.ip_forward" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for net.ipv4.ip_forward
#
/sbin/sysctl -q -n -w net.ipv4.ip_forward="0"

#
# If net.ipv4.ip_forward present in /etc/sysctl.conf, change value to "0"
#	else, add "net.ipv4.ip_forward = 0" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.ip_forward")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.ip_forward\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.ip_forward\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_ip_forward" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.ipv4.ip_forward.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_ip_forward

- name: Comment out any occurrences of net.ipv4.ip_forward from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.ip_forward
    replace: '#net.ipv4.ip_forward'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_ip_forward

- name: Ensure sysctl net.ipv4.ip_forward is set to 0
  sysctl:
    name: net.ipv4.ip_forward
    value: '0'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_ip_forward
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_ipv4_ip_forward:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_ip_forward_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-susefirewall2">
            <xccdf-1.2:title>SuSEfirewall2</xccdf-1.2:title>
            <xccdf-1.2:description>The SuSEfirewall2 provides a managed firewall.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-uncommon">
            <xccdf-1.2:title>Uncommon Network Protocols</xccdf-1.2:title>
            <xccdf-1.2:description>The system includes support for several network protocols which are not commonly used.
Although security vulnerabilities in kernel networking code are not frequently discovered,
the consequences can be dramatic. Ensuring uncommon network protocols are disabled
reduces the system's risk to attacks targeted at its implementation of those protocols.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">Although these protocols are not commonly used, avoid disruption
in your network environment by ensuring they are not needed
prior to disabling them.</xccdf-1.2:warning>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_atm_disabled" severity="medium">
              <xccdf-1.2:title>Disable ATM Support</xccdf-1.2:title>
              <xccdf-1.2:description>The Asynchronous Transfer Mode (ATM) is a protocol operating on
network, data link, and physical layers, based on virtual circuits
and virtual paths.

To configure the system to prevent the <html:code>atm</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/atm.conf</html:code>:
<html:pre>install atm /bin/true</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Disabling ATM protects the system against exploitation of any
flaws in its implementation.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_atm_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install atm" /etc/modprobe.d/atm.conf ; then
	
	sed -i 's#^install atm.*#install atm /bin/true#g' /etc/modprobe.d/atm.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/atm.conf
	echo "install atm /bin/true" &gt;&gt; /etc/modprobe.d/atm.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_atm_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Ensure kernel module 'atm' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/atm.conf
    regexp: atm
    line: install atm /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-18
    - disable_strategy
    - kernel_module_atm_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="kernel_module_atm_disabled">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20atm%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_atm_disabled.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_module_atm_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_module_atm_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_can_disabled" severity="medium">
              <xccdf-1.2:title>Disable CAN Support</xccdf-1.2:title>
              <xccdf-1.2:description>The Controller Area Network (CAN) is a serial communications
protocol which was initially developed for automotive and
is now also used in marine, industrial, and medical applications.

To configure the system to prevent the <html:code>can</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/can.conf</html:code>:
<html:pre>install can /bin/true</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Disabling CAN protects the system against exploitation of any
flaws in its implementation.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_can_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install can" /etc/modprobe.d/can.conf ; then
	
	sed -i 's#^install can.*#install can /bin/true#g' /etc/modprobe.d/can.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/can.conf
	echo "install can /bin/true" &gt;&gt; /etc/modprobe.d/can.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_can_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Ensure kernel module 'can' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/can.conf
    regexp: can
    line: install can /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-18
    - disable_strategy
    - kernel_module_can_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="kernel_module_can_disabled">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20can%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_can_disabled.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_module_can_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_module_can_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_dccp_disabled" severity="medium">
              <xccdf-1.2:title>Disable DCCP Support</xccdf-1.2:title>
              <xccdf-1.2:description>The Datagram Congestion Control Protocol (DCCP) is a
relatively new transport layer protocol, designed to support
streaming media and telephony.

To configure the system to prevent the <html:code>dccp</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/dccp.conf</html:code>:
<html:pre>install dccp /bin/true</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001958</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000096-GPOS-00050</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Disabling DCCP protects
the system against exploitation of any flaws in its implementation.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_dccp_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install dccp" /etc/modprobe.d/dccp.conf ; then
	
	sed -i 's#^install dccp.*#install dccp /bin/true#g' /etc/modprobe.d/dccp.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/dccp.conf
	echo "install dccp /bin/true" &gt;&gt; /etc/modprobe.d/dccp.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_dccp_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Ensure kernel module 'dccp' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/dccp.conf
    regexp: dccp
    line: install dccp /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_dccp_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="kernel_module_dccp_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20dccp%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_dccp_disabled.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_module_dccp_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_module_dccp_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_firewire-core_disabled" severity="low">
              <xccdf-1.2:title>Disable IEEE 1394 (FireWire) Support</xccdf-1.2:title>
              <xccdf-1.2:description>The IEEE 1394 (FireWire) is a serial bus standard for
high-speed real-time communication.

To configure the system to prevent the <html:code>firewire-core</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/firewire-core.conf</html:code>:
<html:pre>install firewire-core /bin/true</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Disabling FireWire protects the system against exploitation of any
flaws in its implementation.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_firewire-core_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install firewire-core" /etc/modprobe.d/firewire-core.conf ; then
	
	sed -i 's#^install firewire-core.*#install firewire-core /bin/true#g' /etc/modprobe.d/firewire-core.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/firewire-core.conf
	echo "install firewire-core /bin/true" &gt;&gt; /etc/modprobe.d/firewire-core.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_firewire-core_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Ensure kernel module 'firewire-core' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/firewire-core.conf
    regexp: firewire-core
    line: install firewire-core /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-18
    - disable_strategy
    - kernel_module_firewire-core_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="kernel_module_firewire-core_disabled">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20firewire-core%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_firewire-core_disabled.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_module_firewire-core_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_module_firewire-core_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_rds_disabled" severity="low">
              <xccdf-1.2:title>Disable RDS Support</xccdf-1.2:title>
              <xccdf-1.2:description>The Reliable Datagram Sockets (RDS) protocol is a transport
layer protocol designed to provide reliable high-bandwidth,
low-latency communications between nodes in a cluster.

To configure the system to prevent the <html:code>rds</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/rds.conf</html:code>:
<html:pre>install rds /bin/true</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Disabling RDS protects
the system against exploitation of any flaws in its implementation.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_rds_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install rds" /etc/modprobe.d/rds.conf ; then
	
	sed -i 's#^install rds.*#install rds /bin/true#g' /etc/modprobe.d/rds.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/rds.conf
	echo "install rds /bin/true" &gt;&gt; /etc/modprobe.d/rds.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_rds_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Ensure kernel module 'rds' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/rds.conf
    regexp: rds
    line: install rds /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_rds_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="kernel_module_rds_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20rds%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_rds_disabled.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_module_rds_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_module_rds_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_tipc_disabled" severity="low">
              <xccdf-1.2:title>Disable TIPC Support</xccdf-1.2:title>
              <xccdf-1.2:description>The Transparent Inter-Process Communication (TIPC) protocol
is designed to provide communications between nodes in a
cluster.

To configure the system to prevent the <html:code>tipc</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/tipc.conf</html:code>:
<html:pre>install tipc /bin/true</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This configuration baseline was created to deploy the base operating system for general purpose
workloads. When the operating system is configured for certain purposes, such as
a node in High Performance Computing cluster, it is expected that
the <html:code>tipc</html:code> kernel module will be loaded.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Disabling TIPC protects
the system against exploitation of any flaws in its implementation.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_tipc_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install tipc" /etc/modprobe.d/tipc.conf ; then
	
	sed -i 's#^install tipc.*#install tipc /bin/true#g' /etc/modprobe.d/tipc.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/tipc.conf
	echo "install tipc /bin/true" &gt;&gt; /etc/modprobe.d/tipc.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_tipc_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Ensure kernel module 'tipc' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/tipc.conf
    regexp: tipc
    line: install tipc /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_tipc_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="kernel_module_tipc_disabled">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20tipc%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_tipc_disabled.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_module_tipc_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_module_tipc_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-wireless">
            <xccdf-1.2:title>Wireless Networking</xccdf-1.2:title>
            <xccdf-1.2:description>Wireless networking, such as 802.11
(WiFi) and Bluetooth, can present a security risk to sensitive or
classified systems and networks. Wireless networking hardware is
much more likely to be included in laptop or portable systems than
in desktops or servers. 
<html:br/><html:br/>
Removal of hardware provides the greatest assurance that the wireless
capability remains disabled. Acquisition policies often include provisions to
prevent the purchase of equipment that will be used in sensitive spaces and
includes wireless capabilities. If it is impractical to remove the wireless
hardware, and policy permits the device to enter sensitive spaces as long
as wireless is disabled, efforts should instead focus on disabling wireless capability
via software.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_wireless_software">
              <xccdf-1.2:title>Disable Wireless Through Software Configuration</xccdf-1.2:title>
              <xccdf-1.2:description>If it is impossible to remove the wireless hardware
from the device in question, disable as much of it as possible
through software. The following methods can disable software
support for wireless networking, but note that these methods do not
prevent malicious software or careless users from re-activating the
devices.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_bluetooth_disabled" severity="medium">
                <xccdf-1.2:title>Disable Bluetooth Service</xccdf-1.2:title>
                <xccdf-1.2:description>
The <html:code>bluetooth</html:code> service can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now bluetooth.service</html:pre>
<html:pre>$ sudo service bluetooth stop</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000085</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Disabling the <html:code>bluetooth</html:code> service prevents the system from attempting
connections to Bluetooth devices, which entails some security risk.
Nevertheless, variation in this risk decision may be expected due to the
utility of Bluetooth connectivity and its limited range.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_bluetooth_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'bluetooth.service'
"$SYSTEMCTL_EXEC" disable 'bluetooth.service'
"$SYSTEMCTL_EXEC" mask 'bluetooth.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^bluetooth.socket'; then
    "$SYSTEMCTL_EXEC" stop 'bluetooth.socket'
    "$SYSTEMCTL_EXEC" mask 'bluetooth.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'bluetooth.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_bluetooth_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Disable service bluetooth
  block:

    - name: Disable service bluetooth
      systemd:
        name: bluetooth.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      ignore_errors: 'yes'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.16
    - NIST-800-53-AC-18(3)
    - NIST-800-53-AC-18(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_bluetooth_disabled

- name: Unit Socket Exists - bluetooth.socket
  command: systemctl list-unit-files bluetooth.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.16
    - NIST-800-53-AC-18(3)
    - NIST-800-53-AC-18(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_bluetooth_disabled

- name: Disable socket bluetooth
  systemd:
    name: bluetooth.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"bluetooth.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - NIST-800-171-3.1.16
    - NIST-800-53-AC-18(3)
    - NIST-800-53-AC-18(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_bluetooth_disabled
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_bluetooth_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_bluetooth

class disable_bluetooth {
  service {'bluetooth':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="service_bluetooth_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: bluetooth.service
        enabled: false
        mask: true
      - name: bluetooth.socket
        enabled: false
        mask: true
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_bluetooth_disabled">
[customizations.services]
disabled = ["bluetooth"]
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_bluetooth_disabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-service_bluetooth_disabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_bluetooth_disabled" severity="medium">
                <xccdf-1.2:title>Disable Bluetooth Kernel Module</xccdf-1.2:title>
                <xccdf-1.2:description>The kernel's module loading system can be configured to prevent
loading of the Bluetooth module. Add the following to
the appropriate <html:code>/etc/modprobe.d</html:code> configuration file
to prevent the loading of the Bluetooth module:
<html:pre>install bluetooth /bin/true</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000085</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001443</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000300-GPOS-00118</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If Bluetooth functionality must be disabled, preventing the kernel
from loading the kernel module provides an additional safeguard against its
activation.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_bluetooth_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install bluetooth" /etc/modprobe.d/bluetooth.conf ; then
	
	sed -i 's#^install bluetooth.*#install bluetooth /bin/true#g' /etc/modprobe.d/bluetooth.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/bluetooth.conf
	echo "install bluetooth /bin/true" &gt;&gt; /etc/modprobe.d/bluetooth.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_bluetooth_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Ensure kernel module 'bluetooth' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/bluetooth.conf
    regexp: bluetooth
    line: install bluetooth /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.13.1.3
    - NIST-800-171-3.1.16
    - NIST-800-53-AC-18(3)
    - NIST-800-53-AC-18(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - disable_strategy
    - kernel_module_bluetooth_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="kernel_module_bluetooth_disabled">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20bluetooth%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_bluetooth_disabled.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_module_bluetooth_disabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_module_bluetooth_disabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_cfg80211_disabled" severity="medium">
                <xccdf-1.2:title>Disable Kernel cfg80211 Module</xccdf-1.2:title>
                <xccdf-1.2:description>
To configure the system to prevent the <html:code>cfg80211</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/cfg80211.conf</html:code>:
<html:pre>install cfg80211 /bin/true</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(4)</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If Wireless functionality must be disabled, preventing the kernel
from loading the kernel module provides an additional safeguard against its
activation.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_cfg80211_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install cfg80211" /etc/modprobe.d/cfg80211.conf ; then
	
	sed -i 's#^install cfg80211.*#install cfg80211 /bin/true#g' /etc/modprobe.d/cfg80211.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/cfg80211.conf
	echo "install cfg80211 /bin/true" &gt;&gt; /etc/modprobe.d/cfg80211.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_cfg80211_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Ensure kernel module 'cfg80211' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/cfg80211.conf
    regexp: cfg80211
    line: install cfg80211 /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-18(3)
    - NIST-800-53-AC-18(4)
    - NIST-800-53-AC-18(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - disable_strategy
    - kernel_module_cfg80211_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="kernel_module_cfg80211_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20cfg80211%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_cfg80211_disabled.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_module_cfg80211_disabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_module_cfg80211_disabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_iwlmvm_disabled" severity="medium">
                <xccdf-1.2:title>Disable Kernel iwlmvm Module</xccdf-1.2:title>
                <xccdf-1.2:description>
To configure the system to prevent the <html:code>iwlmvm</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/iwlmvm.conf</html:code>:
<html:pre>install iwlmvm /bin/true</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(4)</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If Wireless functionality must be disabled, preventing the kernel
from loading the kernel module provides an additional safeguard against its
activation.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_iwlmvm_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install iwlmvm" /etc/modprobe.d/iwlmvm.conf ; then
	
	sed -i 's#^install iwlmvm.*#install iwlmvm /bin/true#g' /etc/modprobe.d/iwlmvm.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/iwlmvm.conf
	echo "install iwlmvm /bin/true" &gt;&gt; /etc/modprobe.d/iwlmvm.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_iwlmvm_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Ensure kernel module 'iwlmvm' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/iwlmvm.conf
    regexp: iwlmvm
    line: install iwlmvm /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-18(3)
    - NIST-800-53-AC-18(4)
    - NIST-800-53-AC-18(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - disable_strategy
    - kernel_module_iwlmvm_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="kernel_module_iwlmvm_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20iwlmvm%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_iwlmvm_disabled.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_module_iwlmvm_disabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_module_iwlmvm_disabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_iwlwifi_disabled" severity="medium">
                <xccdf-1.2:title>Disable Kernel iwlwifi Module</xccdf-1.2:title>
                <xccdf-1.2:description>
To configure the system to prevent the <html:code>iwlwifi</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/iwlwifi.conf</html:code>:
<html:pre>install iwlwifi /bin/true</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(4)</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If Wireless functionality must be disabled, preventing the kernel
from loading the kernel module provides an additional safeguard against its
activation.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_iwlwifi_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install iwlwifi" /etc/modprobe.d/iwlwifi.conf ; then
	
	sed -i 's#^install iwlwifi.*#install iwlwifi /bin/true#g' /etc/modprobe.d/iwlwifi.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/iwlwifi.conf
	echo "install iwlwifi /bin/true" &gt;&gt; /etc/modprobe.d/iwlwifi.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_iwlwifi_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Ensure kernel module 'iwlwifi' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/iwlwifi.conf
    regexp: iwlwifi
    line: install iwlwifi /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-18(3)
    - NIST-800-53-AC-18(4)
    - NIST-800-53-AC-18(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - disable_strategy
    - kernel_module_iwlwifi_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="kernel_module_iwlwifi_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20iwlwifi%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_iwlwifi_disabled.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_module_iwlwifi_disabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_module_iwlwifi_disabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_mac80211_disabled" severity="medium">
                <xccdf-1.2:title>Disable Kernel mac80211 Module</xccdf-1.2:title>
                <xccdf-1.2:description>
To configure the system to prevent the <html:code>mac80211</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/mac80211.conf</html:code>:
<html:pre>install mac80211 /bin/true</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(4)</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If Wireless functionality must be disabled, preventing the kernel
from loading the kernel module provides an additional safeguard against its
activation.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_mac80211_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install mac80211" /etc/modprobe.d/mac80211.conf ; then
	
	sed -i 's#^install mac80211.*#install mac80211 /bin/true#g' /etc/modprobe.d/mac80211.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/mac80211.conf
	echo "install mac80211 /bin/true" &gt;&gt; /etc/modprobe.d/mac80211.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_mac80211_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Ensure kernel module 'mac80211' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/mac80211.conf
    regexp: mac80211
    line: install mac80211 /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-18(3)
    - NIST-800-53-AC-18(4)
    - NIST-800-53-AC-18(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - disable_strategy
    - kernel_module_mac80211_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="kernel_module_mac80211_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20mac80211%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_mac80211_disabled.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_module_mac80211_disabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_module_mac80211_disabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_wireless_disable_in_bios" severity="unknown">
                <xccdf-1.2:title>Disable WiFi or Bluetooth in BIOS</xccdf-1.2:title>
                <xccdf-1.2:description>Some machines that include built-in wireless support offer the
ability to disable the device through the BIOS. This is hardware-specific;
consult your hardware manual or explore the BIOS setup during
boot.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000085</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Disabling wireless support in the BIOS prevents easy
activation of the wireless interface, generally requiring administrators
to reboot the system first.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_wireless_disable_interfaces" severity="medium">
                <xccdf-1.2:title>Deactivate Wireless Network Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>Deactivating wireless network interfaces should prevent normal usage of the wireless
capability.
<html:br/><html:br/>

Configure the system to disable all wireless network interfaces with the following command:
<html:pre>$ sudo nmcli radio all off</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000085</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002421</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001444</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1315</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1319</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000299-GPOS-00117</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000300-GPOS-00118</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000424-GPOS-00188</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000481-GPOS-000481</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The use of wireless networking can introduce many different attack vectors into
the organization's network. Common attack vectors such as malicious association
and ad hoc networks will allow an attacker to spoof a wireless access point
(AP), allowing validated systems to connect to the malicious AP and enabling the
attacker to monitor and record network traffic. These malicious APs can also
serve to create a man-in-the-middle attack or be used to create a denial of
service to valid network resources.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#wifi-iface"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="wireless_disable_interfaces">
nmcli radio all off
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="wireless_disable_interfaces" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Deactivate Wireless Network Interfaces
  command: nmcli radio wifi off
  tags:
    - NIST-800-171-3.1.16
    - NIST-800-53-AC-18(3)
    - NIST-800-53-AC-18(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
    - wireless_disable_interfaces
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-wireless_disable_interfaces:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-wireless_disable_interfaces_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network_disable_unused_interfaces">
            <xccdf-1.2:title>Disable Unused Interfaces</xccdf-1.2:title>
            <xccdf-1.2:description>Network interfaces expand the attack surface of the
system.  Unused interfaces are not monitored or controlled, and
should be disabled.
<html:br/><html:br/>
If the system does not require network communications but still
needs to use the loopback interface, remove all files of the form
<html:code>ifcfg-<html:i>interface</html:i></html:code> except for <html:code>ifcfg-lo</html:code> from
<html:code>/etc/sysconfig/network-scripts</html:code>:
<html:pre>$ sudo rm /etc/sysconfig/network-scripts/ifcfg-<html:i>interface</html:i></html:pre>
If the system is a standalone machine with no need for network access or even
communication over the loopback device, then disable this service.

The <html:code>network</html:code> service can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now network.service</html:pre></xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network_ssl">
            <xccdf-1.2:title>Transport Layer Security Support</xccdf-1.2:title>
            <xccdf-1.2:description>Support for Transport Layer Security (TLS), and its predecessor, the Secure
Sockets Layer (SSL), is included in Red Hat Enterprise Linux in the OpenSSL software (RPM package
<html:code>openssl</html:code>).  TLS provides encrypted and authenticated network
communications, and many network services include support for it.  TLS or SSL
can be leveraged to avoid any plaintext transmission of sensitive data.
<html:br/>
For information on how to use OpenSSL, see
<html:b><html:a href="http://www.openssl.org/docs/">http://www.openssl.org/docs/</html:a></html:b>.  Information on FIPS validation
of OpenSSL is available at <html:b><html:a href="http://www.openssl.org/docs/fips.html">http://www.openssl.org/docs/fips.html</html:a></html:b>
and <html:b><html:a href="http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm">http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm</html:a></html:b>.</xccdf-1.2:description>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_permissions">
          <xccdf-1.2:title>File Permissions and Masks</xccdf-1.2:title>
          <xccdf-1.2:description>Traditional Unix security relies heavily on file and
directory permissions to prevent unauthorized users from reading or
modifying files to which they should not have access.
<html:br/><html:br/>
Several of the commands in this section search filesystems
for files or directories with certain characteristics, and are
intended to be run on every local partition on a given system.
When the variable <html:i>PART</html:i> appears in one of the commands below,
it means that the command is intended to be run repeatedly, with the
name of each local partition substituted for <html:i>PART</html:i> in turn.
<html:br/><html:br/>
The following command prints a list of all xfs partitions on the local
system, which is the default filesystem for Fedora
installations:
<html:pre>$ mount -t xfs | awk '{print $3}'</html:pre>
For any systems that use a different
local filesystem type, modify this command as appropriate.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_files">
            <xccdf-1.2:title>Verify Permissions on Important Files and
Directories</xccdf-1.2:title>
            <xccdf-1.2:description>Permissions for many files on a system must be set
restrictively to ensure sensitive information is properly protected.
This section discusses important
permission restrictions which can be verified
to ensure that no harmful discrepancies have
arisen.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_root_owned" severity="medium">
              <xccdf-1.2:title>Ensure All World-Writable Directories Are Owned by root user</xccdf-1.2:title>
              <xccdf-1.2:description>All directories in local partitions which are world-writable should be owned
by root. If any world-writable directories are not owned by root, this
should be investigated. Following this, the files should be deleted or
assigned to root user.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R40)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000138-GPOS-00069</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Allowing a user account to own a world-writable directory is
undesirable because it allows the owner of that directory to remove
or replace any files that may be placed in the directory by other
users.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dir_perms_world_writable_root_owned">
find / -not -fstype afs -not -fstype ceph -not -fstype cifs -not -fstype smb3 -not -fstype smbfs -not -fstype sshfs -not -fstype ncpfs -not -fstype ncp -not -fstype nfs -not -fstype nfs4 -not -fstype gfs -not -fstype gfs2 -not -fstype glusterfs -not -fstype gpfs -not -fstype pvfs2 -not -fstype ocfs2 -not -fstype lustre -not -fstype davfs -not -fstype fuse.sshfs -type d -perm -0002 -uid +0 -exec chown root {} \;
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dir_perms_world_writable_root_owned" complexity="low" disruption="medium" reboot="false" strategy="restrict">- name: Configure excluded (non local) file systems
  set_fact:
    excluded_fstypes:
      - afs
      - ceph
      - cifs
      - smb3
      - smbfs
      - sshfs
      - ncpfs
      - ncp
      - nfs
      - nfs4
      - gfs
      - gfs2
      - glusterfs
      - gpfs
      - pvfs2
      - ocfs2
      - lustre
      - davfs
      - fuse.sshfs
  tags:
    - dir_perms_world_writable_root_owned
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Create empty list of excluded paths
  set_fact:
    excluded_paths: []
  tags:
    - dir_perms_world_writable_root_owned
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Detect nonlocal file systems and add them to excluded paths
  set_fact:
    excluded_paths: '{{ excluded_paths | union([item.mount]) }}'
  loop: '{{ ansible_mounts }}'
  when: item.fstype in excluded_fstypes
  tags:
    - dir_perms_world_writable_root_owned
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Find all directories excluding non-local partitions
  find:
    paths: /
    excludes: excluded_paths
    file_type: directory
    hidden: true
    recurse: true
  register: found_dirs
  tags:
    - dir_perms_world_writable_root_owned
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Create list of world writable directories
  set_fact:
    world_writable_dirs: '{{ found_dirs.files | selectattr(''woth'') | list }}'
  tags:
    - dir_perms_world_writable_root_owned
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Change owner to root on directories which are world writable
  file:
    path: '{{ item.path }}'
    owner: root
  loop: '{{ world_writable_dirs }}'
  ignore_errors: true
  tags:
    - dir_perms_world_writable_root_owned
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dir_perms_world_writable_root_owned:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dir_perms_world_writable_root_owned_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits" severity="medium">
              <xccdf-1.2:title>Verify that All World-Writable Directories Have Sticky Bits Set</xccdf-1.2:title>
              <xccdf-1.2:description>When the so-called 'sticky bit' is set on a directory,
only the owner of a given file may remove that file from the
directory. Without the sticky bit, any user with write access to a
directory may remove any file in the directory. Setting the sticky
bit prevents users from removing each other's files. In cases where
there is no reason for a directory to be world-writable, a better
solution is to remove that permission rather than to set the sticky
bit. However, if a directory is used by a particular application,
consult that application's documentation instead of blindly
changing modes.
<html:br/>
To set the sticky bit on a world-writable directory <html:i>DIR</html:i>, run the
following command:
<html:pre>$ sudo chmod +t <html:i>DIR</html:i></html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R40)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000138-GPOS-00069</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Failing to set the sticky bit on public directories allows unauthorized
users to delete files in the directory structure.
<html:br/><html:br/>
The only authorized public directories are those temporary directories
supplied with the system, or those designed to be temporary file
repositories. The setting is normally reserved for directories used by the
system, by users for temporary file storage (such as <html:code>/tmp</html:code>), and
for directories requiring global read/write access.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dir_perms_world_writable_sticky_bits:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dir_perms_world_writable_sticky_bits_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_system_owned" severity="medium">
              <xccdf-1.2:title>Ensure All World-Writable Directories Are Owned by a System Account</xccdf-1.2:title>
              <xccdf-1.2:description>All directories in local partitions which are
world-writable should be owned by root or another
system account. If any world-writable directories are not
owned by a system account, this should be investigated.
Following this, the files should be deleted or assigned to an
appropriate owner.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Allowing a user account to own a world-writable directory is
undesirable because it allows the owner of that directory to remove
or replace any files that may be placed in the directory by other
users.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dir_perms_world_writable_system_owned:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dir_perms_world_writable_system_owned_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_system_owned_group" severity="medium">
              <xccdf-1.2:title>Ensure All World-Writable Directories Are Group Owned by a System Account</xccdf-1.2:title>
              <xccdf-1.2:description>All directories in local partitions which are
world-writable should be group owned by root or another
system account. If any world-writable directories are not
group owned by a system account, this should be investigated.
Following this, the files should be deleted or assigned to an
appropriate group.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Allowing a user account to group own a world-writable directory is
undesirable because it allows the owner of that directory to remove
or replace any files that may be placed in the directory by other
users.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dir_perms_world_writable_system_owned_group:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dir_perms_world_writable_system_owned_group_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_etc_audit_auditd" severity="medium">
              <xccdf-1.2:title>Verify Permissions on /etc/audit/auditd.conf</xccdf-1.2:title>
              <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/audit/auditd.conf</html:code>, run the command:
<html:pre>$ sudo chmod 0640 /etc/audit/auditd.conf</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000171</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000063-GPOS-00032</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Without the capability to restrict the roles and individuals that can select which events
are audited, unauthorized personnel may be able to prevent the auditing of critical
events. Misconfigured audits may degrade the system's performance by overwhelming
the audit log. Misconfigured audits may also make it more difficult to establish,
correlate, and investigate the events relating to an incident or identify
those responsible for one.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_audit_auditd" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xs,g-xws,o-xwrt /etc/audit/auditd.conf
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_audit_auditd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/audit/auditd.conf
  stat:
    path: /etc/audit/auditd.conf
  register: file_exists
  tags:
    - NIST-800-53-AU-12(b)
    - configure_strategy
    - file_permissions_etc_audit_auditd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwrt on /etc/audit/auditd.conf
  file:
    path: /etc/audit/auditd.conf
    mode: u-xs,g-xws,o-xwrt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - NIST-800-53-AU-12(b)
    - configure_strategy
    - file_permissions_etc_audit_auditd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_etc_audit_auditd:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_etc_audit_auditd_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_etc_audit_rulesd" severity="medium">
              <xccdf-1.2:title>Verify Permissions on /etc/audit/rules.d/*.rules</xccdf-1.2:title>
              <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/audit/rules.d/*.rules</html:code>, run the command:
<html:pre>$ sudo chmod 0640 /etc/audit/rules.d/*.rules</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000171</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000063-GPOS-00032</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Without the capability to restrict the roles and individuals that can select which events
are audited, unauthorized personnel may be able to prevent the auditing of critical
events. Misconfigured audits may degrade the system's performance by overwhelming
the audit log. Misconfigured audits may also make it more difficult to establish,
correlate, and investigate the events relating to an incident or identify
those responsible for one.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_audit_rulesd" complexity="low" disruption="low" reboot="false" strategy="configure">



find -H /etc/audit/rules.d/ -maxdepth 1 -perm /u+xs,g+xws,o+xwrt -type f -regex '^.*rules$' -exec chmod u-xs,g-xws,o-xwrt {} \;
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_audit_rulesd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Find /etc/audit/rules.d/ file(s)
  command: find -H /etc/audit/rules.d/ -maxdepth 1 -perm /u+xs,g+xws,o+xwrt -type
    f -regex "^.*rules$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
    - NIST-800-53-AU-12(b)
    - configure_strategy
    - file_permissions_etc_audit_rulesd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Set permissions for /etc/audit/rules.d/ file(s)
  file:
    path: '{{ item }}'
    mode: u-xs,g-xws,o-xwrt
    state: file
  with_items:
    - '{{ files_found.stdout_lines }}'
  tags:
    - NIST-800-53-AU-12(b)
    - configure_strategy
    - file_permissions_etc_audit_rulesd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_etc_audit_rulesd:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_etc_audit_rulesd_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_systemmap" severity="unknown">
              <xccdf-1.2:title>Verify that local System.map file (if exists) is readable only by root</xccdf-1.2:title>
              <xccdf-1.2:description>Files containing sensitive informations should be protected by restrictive
  permissions. Most of the time, there is no need that these files need to be read by any non-root user

To properly set the permissions of <html:code>/boot/System.map-*</html:code>, run the command:
<html:pre>$ sudo chmod 0600 /boot/System.map-*</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R13)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>System.map</html:code> file contains information about kernel symbols and
  can give some hints to generate local exploitation.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_systemmap:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_systemmap_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_sgid" severity="medium">
              <xccdf-1.2:title>Ensure All SGID Executables Are Authorized</xccdf-1.2:title>
              <xccdf-1.2:description>The SGID (set group id) bit should be set only on files that were
installed via authorized means. A straightforward means of identifying
unauthorized SGID files is determine if any were not installed as part of an
RPM package, which is cryptographically verified. Investigate the origin
of any unpackaged SGID files.
This configuration check considers authorized SGID files which were installed via RPM.
It is assumed that when an individual has sudo access to install an RPM
and all packages are signed with an organizationally-recognized GPG key,
the software should be considered an approved package on the system.
Any SGID file not deployed through an RPM will be flagged for further review.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R37)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R38)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Executable files with the SGID permission run with the privileges of
the owner of the file. SGID files of uncertain provenance could allow for
unprivileged users to elevate privileges. The presence of these files should be
strictly controlled on the system.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_unauthorized_sgid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_unauthorized_sgid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_suid" severity="medium">
              <xccdf-1.2:title>Ensure All SUID Executables Are Authorized</xccdf-1.2:title>
              <xccdf-1.2:description>The SUID (set user id) bit should be set only on files that were
installed via authorized means. A straightforward means of identifying
unauthorized SUID files is determine if any were not installed as part of an
RPM package, which is cryptographically verified. Investigate the origin
of any unpackaged SUID files.
This configuration check considers authorized SUID files which were installed via RPM.
It is assumed that when an individual has sudo access to install an RPM
and all packages are signed with an organizationally-recognized GPG key,
the software should be considered an approved package on the system.
Any SUID file not deployed through an RPM will be flagged for further review.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R37)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R38)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Executable files with the SUID permission run with the privileges of
the owner of the file. SUID files of uncertain provenance could allow for
unprivileged users to elevate privileges. The presence of these files should be
strictly controlled on the system.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_unauthorized_suid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_unauthorized_suid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_world_writable" severity="medium">
              <xccdf-1.2:title>Ensure No World-Writable Files Exist</xccdf-1.2:title>
              <xccdf-1.2:description>It is generally a good idea to remove global (other) write
access to a file when it is discovered. However, check with
documentation for specific applications before making changes.
Also, monitor for recurring world-writable files, as these may be
symptoms of a misconfigured application or user account. Finally,
this applies to real files and not virtual files that are a part of
pseudo file systems such as <html:code>sysfs</html:code> or <html:code>procfs</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R40)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Data in world-writable files can be modified by any
user on the system. In almost all circumstances, files can be
configured using a combination of user and group permissions to
support whatever legitimate access is needed without the risk
caused by world-writable files.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_unauthorized_world_writable">
find / -xdev -type f -perm -002 -exec chmod o-w {} \;
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_unauthorized_world_writable:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_unauthorized_world_writable_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_ungroupowned" severity="medium">
              <xccdf-1.2:title>Ensure All Files Are Owned by a Group</xccdf-1.2:title>
              <xccdf-1.2:description>If any files are not owned by a group, then the
cause of their lack of group-ownership should be investigated.
Following this, the files should be deleted or assigned to an
appropriate group. The following command will discover and print
any files on local partitions which do not belong to a valid group:
<html:pre>$ df --local -P | awk '{if (NR!=1) print $6}' | sudo xargs -I '{}' find '{}' -xdev -nogroup</html:pre>
To search all filesystems on a system including network mounted
filesystems the following command can be run manually for each partition:
<html:pre>$ sudo find PARTITION -xdev -nogroup</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This rule only considers local groups.
If you have your groups defined outside <html:code>/etc/group</html:code>, the rule won't consider those.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002165</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Unowned files do not directly imply a security problem, but they are generally
a sign that something is amiss. They may
be caused by an intruder, by incorrect software installation or
draft software removal, or by failure to remove all files belonging
to a deleted account. The files should be repaired so they
will not cause problems when accounts are created in the future,
and the cause should be discovered and addressed.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_ungroupowned:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_ungroupowned_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_files_unowned_by_user" severity="medium">
              <xccdf-1.2:title>Ensure All Files Are Owned by a User</xccdf-1.2:title>
              <xccdf-1.2:description>If any files are not owned by a user, then the
cause of their lack of ownership should be investigated.
Following this, the files should be deleted or assigned to an
appropriate user. The following command will discover and print
any files on local partitions which do not belong to a valid user:
<html:pre>$ df --local -P | awk {'if (NR!=1) print $6'} | sudo xargs -I '{}' find '{}' -xdev -nouser</html:pre>
To search all filesystems on a system including network mounted
filesystems the following command can be run manually for each partition:
<html:pre>$ sudo find PARTITION -xdev -nouser</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="functionality">For this rule to evaluate centralized user accounts, <html:code>getent</html:code> must be working properly
so that running the command <html:pre>getent passwd</html:pre> returns a list of all users in your organization.
If using the System Security Services Daemon (SSSD), <html:pre>enumerate = true</html:pre> must be configured
in your organization's domain to return a complete list of users</xccdf-1.2:warning>
              <xccdf-1.2:warning category="performance">Enabling this rule will result in slower scan times depending on the size of your organization
and number of centralized users.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002165</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Unowned files do not directly imply a security problem, but they are generally
a sign that something is amiss. They may
be caused by an intruder, by incorrect software installation or
draft software removal, or by failure to remove all files belonging
to a deleted account. The files should be repaired so they
will not cause problems when accounts are created in the future,
and the cause should be discovered and addressed.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-no_files_unowned_by_user:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-no_files_unowned_by_user_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_fifos" severity="medium">
              <xccdf-1.2:title>Enable Kernel Parameter to Enforce DAC on FIFOs</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>fs.protected_fifos</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w fs.protected_fifos=2</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>fs.protected_fifos = 2</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>This parameter is available since Linux Kernel 4.19 and allows to prohibit opening
FIFOs that are not owned by the user in world and group writeable sticky directories.
It avoids unintentional writes to an attacker-controlled FIFO where a program expects
to create the regular file.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_fs_protected_fifos" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of fs.protected_fifos from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*fs.protected_fifos.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "fs.protected_fifos" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for fs.protected_fifos
#
/sbin/sysctl -q -n -w fs.protected_fifos="2"

#
# If fs.protected_fifos present in /etc/sysctl.conf, change value to "2"
#	else, add "fs.protected_fifos = 2" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^fs.protected_fifos")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "2"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^fs.protected_fifos\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^fs.protected_fifos\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_fs_protected_fifos" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*fs.protected_fifos.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_fifos

- name: Comment out any occurrences of fs.protected_fifos from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*fs.protected_fifos
    replace: '#fs.protected_fifos'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_fifos

- name: Ensure sysctl fs.protected_fifos is set to 2
  sysctl:
    name: fs.protected_fifos
    value: '2'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_fifos
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_fs_protected_fifos:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_fs_protected_fifos_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_hardlinks" severity="medium">
              <xccdf-1.2:title>Enable Kernel Parameter to Enforce DAC on Hardlinks</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>fs.protected_hardlinks</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w fs.protected_hardlinks=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>fs.protected_hardlinks = 1</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R23)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002165</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000312-GPOS-00123</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000324-GPOS-00125</xccdf-1.2:reference>
              <xccdf-1.2:rationale>By enabling this kernel parameter, users can no longer create soft or hard links to
files which they do not own. Disallowing such hardlinks mitigate vulnerabilities
based on insecure file system accessed by privileged programs, avoiding an
exploitation vector exploiting unsafe use of <html:code>open()</html:code> or <html:code>creat()</html:code>.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_fs_protected_hardlinks" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of fs.protected_hardlinks from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*fs.protected_hardlinks.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "fs.protected_hardlinks" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for fs.protected_hardlinks
#
/sbin/sysctl -q -n -w fs.protected_hardlinks="1"

#
# If fs.protected_hardlinks present in /etc/sysctl.conf, change value to "1"
#	else, add "fs.protected_hardlinks = 1" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^fs.protected_hardlinks")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^fs.protected_hardlinks\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^fs.protected_hardlinks\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_fs_protected_hardlinks" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*fs.protected_hardlinks.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_hardlinks

- name: Comment out any occurrences of fs.protected_hardlinks from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*fs.protected_hardlinks
    replace: '#fs.protected_hardlinks'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_hardlinks

- name: Ensure sysctl fs.protected_hardlinks is set to 1
  sysctl:
    name: fs.protected_hardlinks
    value: '1'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_hardlinks
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_fs_protected_hardlinks">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,fs.protected_hardlinks%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_fs_protected_hardlinks.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_fs_protected_hardlinks:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_fs_protected_hardlinks_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_regular" severity="medium">
              <xccdf-1.2:title>Enable Kernel Parameter to Enforce DAC on Regular files</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>fs.protected_regular</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w fs.protected_regular=2</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>fs.protected_regular = 2</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>This parameter is available since Linux Kernel 4.19 and allows to prohibit opening
"regular" files that are not owned by the user in world and group writeable sticky
directories. It avoids writes to an attacker-controlled regular file, for example,
when a program expects to create the regular file.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_fs_protected_regular" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of fs.protected_regular from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*fs.protected_regular.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "fs.protected_regular" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for fs.protected_regular
#
/sbin/sysctl -q -n -w fs.protected_regular="2"

#
# If fs.protected_regular present in /etc/sysctl.conf, change value to "2"
#	else, add "fs.protected_regular = 2" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^fs.protected_regular")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "2"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^fs.protected_regular\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^fs.protected_regular\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_fs_protected_regular" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*fs.protected_regular.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_regular

- name: Comment out any occurrences of fs.protected_regular from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*fs.protected_regular
    replace: '#fs.protected_regular'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_regular

- name: Ensure sysctl fs.protected_regular is set to 2
  sysctl:
    name: fs.protected_regular
    value: '2'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_regular
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_fs_protected_regular:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_fs_protected_regular_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_symlinks" severity="medium">
              <xccdf-1.2:title>Enable Kernel Parameter to Enforce DAC on Symlinks</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>fs.protected_symlinks</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w fs.protected_symlinks=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>fs.protected_symlinks = 1</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R23)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002165</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000312-GPOS-00123</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000324-GPOS-00125</xccdf-1.2:reference>
              <xccdf-1.2:rationale>By enabling this kernel parameter, symbolic links are permitted to be followed
only when outside a sticky world-writable directory, or when the UID of the
link and follower match, or when the directory owner matches the symlink's owner.
Disallowing such symlinks helps mitigate vulnerabilities based on insecure file system
accessed by privileged programs, avoiding an exploitation vector exploiting unsafe use of
<html:code>open()</html:code> or <html:code>creat()</html:code>.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_fs_protected_symlinks" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of fs.protected_symlinks from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*fs.protected_symlinks.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "fs.protected_symlinks" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for fs.protected_symlinks
#
/sbin/sysctl -q -n -w fs.protected_symlinks="1"

#
# If fs.protected_symlinks present in /etc/sysctl.conf, change value to "1"
#	else, add "fs.protected_symlinks = 1" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^fs.protected_symlinks")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^fs.protected_symlinks\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^fs.protected_symlinks\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_fs_protected_symlinks" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*fs.protected_symlinks.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_symlinks

- name: Comment out any occurrences of fs.protected_symlinks from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*fs.protected_symlinks
    replace: '#fs.protected_symlinks'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_symlinks

- name: Ensure sysctl fs.protected_symlinks is set to 1
  sysctl:
    name: fs.protected_symlinks
    value: '1'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_symlinks
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_fs_protected_symlinks">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,fs.protected_symlinks%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_fs_protected_symlinks.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_fs_protected_symlinks:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_fs_protected_symlinks_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_permissions_important_account_files">
              <xccdf-1.2:title>Verify Permissions on Files with Local Account Information and Credentials</xccdf-1.2:title>
              <xccdf-1.2:description>The default restrictive permissions for files which act as
important security databases such as <html:code>passwd</html:code>, <html:code>shadow</html:code>,
<html:code>group</html:code>, and <html:code>gshadow</html:code> files must be maintained.  Many utilities
need read access to the <html:code>passwd</html:code> file in order to function properly, but
read access to the <html:code>shadow</html:code> file allows malicious attacks against system
passwords, and should never be enabled.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_group" severity="medium">
                <xccdf-1.2:title>Verify Group Who Owns Backup group File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/group-</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/group-</html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale>The <html:code>/etc/group-</html:code> file is a backup file of <html:code>/etc/group</html:code>, and as such,
it contains information regarding groups that are configured on the system.
Protection of this file is important for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_backup_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">


chgrp 0 /etc/group-
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_backup_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/group-
  stat:
    path: /etc/group-
  register: file_exists
  tags:
    - configure_strategy
    - file_groupowner_backup_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /etc/group-
  file:
    path: /etc/group-
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_groupowner_backup_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_groupowner_backup_etc_group:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_groupowner_backup_etc_group_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_gshadow" severity="medium">
                <xccdf-1.2:title>Verify Group Who Owns Backup gshadow File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/gshadow-</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/gshadow-</html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale>The <html:code>/etc/gshadow-</html:code> file is a backup of <html:code>/etc/gshadow</html:code>, and as such,
it contains group password hashes. Protection of this file is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_backup_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">


chgrp 0 /etc/gshadow-
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_backup_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/gshadow-
  stat:
    path: /etc/gshadow-
  register: file_exists
  tags:
    - configure_strategy
    - file_groupowner_backup_etc_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /etc/gshadow-
  file:
    path: /etc/gshadow-
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_groupowner_backup_etc_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_groupowner_backup_etc_gshadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_groupowner_backup_etc_gshadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_passwd" severity="medium">
                <xccdf-1.2:title>Verify Group Who Owns Backup passwd File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/passwd-</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/passwd-</html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale>The <html:code>/etc/passwd-</html:code> file is a backup file of <html:code>/etc/passwd</html:code>, and as such,
it contains information about the users that are configured on the system.
Protection of this file is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_backup_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">


chgrp 0 /etc/passwd-
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_backup_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/passwd-
  stat:
    path: /etc/passwd-
  register: file_exists
  tags:
    - configure_strategy
    - file_groupowner_backup_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /etc/passwd-
  file:
    path: /etc/passwd-
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_groupowner_backup_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_groupowner_backup_etc_passwd:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_groupowner_backup_etc_passwd_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_shadow" severity="medium">
                <xccdf-1.2:title>Verify User Who Owns Backup shadow File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/shadow-</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/shadow-</html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale>The <html:code>/etc/shadow-</html:code> file is a backup file of <html:code>/etc/shadow</html:code>, and as such,
it contains the list of local system accounts and password hashes.
Protection of this file is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_backup_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">


chgrp 0 /etc/shadow-
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_backup_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/shadow-
  stat:
    path: /etc/shadow-
  register: file_exists
  tags:
    - configure_strategy
    - file_groupowner_backup_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /etc/shadow-
  file:
    path: /etc/shadow-
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_groupowner_backup_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_groupowner_backup_etc_shadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_groupowner_backup_etc_shadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_group" severity="medium">
                <xccdf-1.2:title>Verify Group Who Owns group File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/group</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/group</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/group</html:code> file contains information regarding groups that are configured
on the system. Protection of this file is important for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">


chgrp 0 /etc/group
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/group
  stat:
    path: /etc/group
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_groupowner_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /etc/group
  file:
    path: /etc/group
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_groupowner_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_groupowner_etc_group:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_groupowner_etc_group_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow" severity="medium">
                <xccdf-1.2:title>Verify Group Who Owns gshadow File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/gshadow</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/gshadow</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/gshadow</html:code> file contains group password hashes. Protection of this file
is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">


chgrp 0 /etc/gshadow
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/gshadow
  stat:
    path: /etc/gshadow
  register: file_exists
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_groupowner_etc_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /etc/gshadow
  file:
    path: /etc/gshadow
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_groupowner_etc_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_groupowner_etc_gshadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_groupowner_etc_gshadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd" severity="medium">
                <xccdf-1.2:title>Verify Group Who Owns passwd File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/passwd</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/passwd</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/passwd</html:code> file contains information about the users that are configured on
the system. Protection of this file is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">


chgrp 0 /etc/passwd
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/passwd
  stat:
    path: /etc/passwd
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_groupowner_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /etc/passwd
  file:
    path: /etc/passwd
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_groupowner_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_groupowner_etc_passwd:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_groupowner_etc_passwd_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow" severity="medium">
                <xccdf-1.2:title>Verify Group Who Owns shadow File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/shadow</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/shadow</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/shadow</html:code> file stores password hashes. Protection of this file is
critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">


chgrp 0 /etc/shadow
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/shadow
  stat:
    path: /etc/shadow
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_groupowner_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /etc/shadow
  file:
    path: /etc/shadow
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_groupowner_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_groupowner_etc_shadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_groupowner_etc_shadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_group" severity="medium">
                <xccdf-1.2:title>Verify User Who Owns Backup group File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the owner of <html:code>/etc/group-</html:code>, run the command: <html:pre>$ sudo chown root /etc/group- </html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale>The <html:code>/etc/group-</html:code> file is a backup file of <html:code>/etc/group</html:code>, and as such,
it contains information regarding groups that are configured on the system.
Protection of this file is important for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_backup_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">


chown 0 /etc/group-
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_backup_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/group-
  stat:
    path: /etc/group-
  register: file_exists
  tags:
    - configure_strategy
    - file_owner_backup_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /etc/group-
  file:
    path: /etc/group-
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_owner_backup_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_owner_backup_etc_group:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_owner_backup_etc_group_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_gshadow" severity="medium">
                <xccdf-1.2:title>Verify User Who Owns Backup gshadow File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the owner of <html:code>/etc/gshadow-</html:code>, run the command: <html:pre>$ sudo chown root /etc/gshadow- </html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale>The <html:code>/etc/gshadow-</html:code> file is a backup of <html:code>/etc/gshadow</html:code>, and as such,
it contains group password hashes. Protection of this file is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_backup_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">


chown 0 /etc/gshadow-
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_backup_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/gshadow-
  stat:
    path: /etc/gshadow-
  register: file_exists
  tags:
    - configure_strategy
    - file_owner_backup_etc_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /etc/gshadow-
  file:
    path: /etc/gshadow-
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_owner_backup_etc_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_owner_backup_etc_gshadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_owner_backup_etc_gshadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_passwd" severity="medium">
                <xccdf-1.2:title>Verify User Who Owns Backup passwd File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the owner of <html:code>/etc/passwd-</html:code>, run the command: <html:pre>$ sudo chown root /etc/passwd- </html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale>The <html:code>/etc/passwd-</html:code> file is a backup file of <html:code>/etc/passwd</html:code>, and as such,
it contains information about the users that are configured on the system.
Protection of this file is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_backup_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">


chown 0 /etc/passwd-
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_backup_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/passwd-
  stat:
    path: /etc/passwd-
  register: file_exists
  tags:
    - configure_strategy
    - file_owner_backup_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /etc/passwd-
  file:
    path: /etc/passwd-
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_owner_backup_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_owner_backup_etc_passwd:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_owner_backup_etc_passwd_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_shadow" severity="medium">
                <xccdf-1.2:title>Verify Group Who Owns Backup shadow File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the owner of <html:code>/etc/shadow-</html:code>, run the command: <html:pre>$ sudo chown root /etc/shadow- </html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale>The <html:code>/etc/shadow-</html:code> file is a backup file of <html:code>/etc/shadow</html:code>, and as such,
it contains the list of local system accounts and password hashes.
Protection of this file is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_backup_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">


chown 0 /etc/shadow-
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_backup_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/shadow-
  stat:
    path: /etc/shadow-
  register: file_exists
  tags:
    - configure_strategy
    - file_owner_backup_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /etc/shadow-
  file:
    path: /etc/shadow-
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_owner_backup_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_owner_backup_etc_shadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_owner_backup_etc_shadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_etc_group" severity="medium">
                <xccdf-1.2:title>Verify User Who Owns group File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the owner of <html:code>/etc/group</html:code>, run the command: <html:pre>$ sudo chown root /etc/group </html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/group</html:code> file contains information regarding groups that are configured
on the system. Protection of this file is important for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">


chown 0 /etc/group
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/group
  stat:
    path: /etc/group
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_owner_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /etc/group
  file:
    path: /etc/group
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_owner_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_owner_etc_group:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_owner_etc_group_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_etc_gshadow" severity="medium">
                <xccdf-1.2:title>Verify User Who Owns gshadow File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the owner of <html:code>/etc/gshadow</html:code>, run the command: <html:pre>$ sudo chown root /etc/gshadow </html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R36)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/gshadow</html:code> file contains group password hashes. Protection of this file
is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">


chown 0 /etc/gshadow
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/gshadow
  stat:
    path: /etc/gshadow
  register: file_exists
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_owner_etc_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /etc/gshadow
  file:
    path: /etc/gshadow
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_owner_etc_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_owner_etc_gshadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_owner_etc_gshadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_etc_passwd" severity="medium">
                <xccdf-1.2:title>Verify User Who Owns passwd File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the owner of <html:code>/etc/passwd</html:code>, run the command: <html:pre>$ sudo chown root /etc/passwd </html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/passwd</html:code> file contains information about the users that are configured on
the system. Protection of this file is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">


chown 0 /etc/passwd
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/passwd
  stat:
    path: /etc/passwd
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_owner_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /etc/passwd
  file:
    path: /etc/passwd
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_owner_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_owner_etc_passwd:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_owner_etc_passwd_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_etc_shadow" severity="medium">
                <xccdf-1.2:title>Verify User Who Owns shadow File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the owner of <html:code>/etc/shadow</html:code>, run the command: <html:pre>$ sudo chown root /etc/shadow </html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R36)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/shadow</html:code> file contains the list of local
system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
to root provides the designated owner with access to sensitive information
which could weaken the system security posture.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">


chown 0 /etc/shadow
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/shadow
  stat:
    path: /etc/shadow
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_owner_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /etc/shadow
  file:
    path: /etc/shadow
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_owner_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_owner_etc_shadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_owner_etc_shadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_group" severity="medium">
                <xccdf-1.2:title>Verify Permissions on Backup group File</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/group-</html:code>, run the command:
<html:pre>$ sudo chmod 0644 /etc/group-</html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale>The <html:code>/etc/group-</html:code> file is a backup file of <html:code>/etc/group</html:code>, and as such,
it contains information regarding groups that are configured on the system.
Protection of this file is important for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_backup_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xs,g-xws,o-xwt /etc/group-
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_backup_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/group-
  stat:
    path: /etc/group-
  register: file_exists
  tags:
    - configure_strategy
    - file_permissions_backup_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwt on /etc/group-
  file:
    path: /etc/group-
    mode: u-xs,g-xws,o-xwt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_permissions_backup_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_backup_etc_group:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_backup_etc_group_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_gshadow" severity="medium">
                <xccdf-1.2:title>Verify Permissions on Backup gshadow File</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/gshadow-</html:code>, run the command:
<html:pre>$ sudo chmod 0000 /etc/gshadow-</html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale>The <html:code>/etc/gshadow-</html:code> file is a backup of <html:code>/etc/gshadow</html:code>, and as such,
it contains group password hashes. Protection of this file is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_backup_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xwrs,g-xwrs,o-xwrt /etc/gshadow-
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_backup_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/gshadow-
  stat:
    path: /etc/gshadow-
  register: file_exists
  tags:
    - configure_strategy
    - file_permissions_backup_etc_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission u-xwrs,g-xwrs,o-xwrt on /etc/gshadow-
  file:
    path: /etc/gshadow-
    mode: u-xwrs,g-xwrs,o-xwrt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_permissions_backup_etc_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_backup_etc_gshadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_backup_etc_gshadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_passwd" severity="medium">
                <xccdf-1.2:title>Verify Permissions on Backup passwd File</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/passwd-</html:code>, run the command:
<html:pre>$ sudo chmod 0644 /etc/passwd-</html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale>The <html:code>/etc/passwd-</html:code> file is a backup file of <html:code>/etc/passwd</html:code>, and as such,
it contains information about the users that are configured on the system.
Protection of this file is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_backup_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xs,g-xws,o-xwt /etc/passwd-
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_backup_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/passwd-
  stat:
    path: /etc/passwd-
  register: file_exists
  tags:
    - configure_strategy
    - file_permissions_backup_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwt on /etc/passwd-
  file:
    path: /etc/passwd-
    mode: u-xs,g-xws,o-xwt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_permissions_backup_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_backup_etc_passwd:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_backup_etc_passwd_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_shadow" severity="medium">
                <xccdf-1.2:title>Verify Permissions on Backup shadow File</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/shadow-</html:code>, run the command:
<html:pre>$ sudo chmod 0000 /etc/shadow-</html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale>The <html:code>/etc/shadow-</html:code> file is a backup file of <html:code>/etc/shadow</html:code>, and as such,
it contains the list of local system accounts and password hashes.
Protection of this file is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_backup_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xwrs,g-xwrs,o-xwrt /etc/shadow-
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_backup_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/shadow-
  stat:
    path: /etc/shadow-
  register: file_exists
  tags:
    - configure_strategy
    - file_permissions_backup_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission u-xwrs,g-xwrs,o-xwrt on /etc/shadow-
  file:
    path: /etc/shadow-
    mode: u-xwrs,g-xwrs,o-xwrt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_permissions_backup_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_backup_etc_shadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_backup_etc_shadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_etc_group" severity="medium">
                <xccdf-1.2:title>Verify Permissions on group File</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/passwd</html:code>, run the command:
<html:pre>$ sudo chmod 0644 /etc/passwd</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R36)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/group</html:code> file contains information regarding groups that are configured
on the system. Protection of this file is important for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xs,g-xws,o-xwt /etc/group
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/group
  stat:
    path: /etc/group
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_permissions_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwt on /etc/group
  file:
    path: /etc/group
    mode: u-xs,g-xws,o-xwt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_permissions_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_etc_group:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_etc_group_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_etc_gshadow" severity="medium">
                <xccdf-1.2:title>Verify Permissions on gshadow File</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/gshadow</html:code>, run the command:
<html:pre>$ sudo chmod 0000 /etc/gshadow</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R36)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/gshadow</html:code> file contains group password hashes. Protection of this file
is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xwrs,g-xwrs,o-xwrt /etc/gshadow
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/gshadow
  stat:
    path: /etc/gshadow
  register: file_exists
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_etc_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission u-xwrs,g-xwrs,o-xwrt on /etc/gshadow
  file:
    path: /etc/gshadow
    mode: u-xwrs,g-xwrs,o-xwrt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_etc_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_etc_gshadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_etc_gshadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd" severity="medium">
                <xccdf-1.2:title>Verify Permissions on passwd File</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/passwd</html:code>, run the command:
<html:pre>$ sudo chmod 0644 /etc/passwd</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R36)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If the <html:code>/etc/passwd</html:code> file is writable by a group-owner or the
world the risk of its compromise is increased. The file contains the list of
accounts on the system and associated information, and protection of this file
is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xs,g-xws,o-xwt /etc/passwd
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/passwd
  stat:
    path: /etc/passwd
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_permissions_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwt on /etc/passwd
  file:
    path: /etc/passwd
    mode: u-xs,g-xws,o-xwt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_permissions_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_etc_passwd:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_etc_passwd_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow" severity="medium">
                <xccdf-1.2:title>Verify Permissions on shadow File</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/shadow</html:code>, run the command:
<html:pre>$ sudo chmod 0000 /etc/shadow</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R36)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/shadow</html:code> file contains the list of local
system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
to root provides the designated owner with access to sensitive information
which could weaken the system security posture.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xwrs,g-xwrs,o-xwrt /etc/shadow
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/shadow
  stat:
    path: /etc/shadow
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_permissions_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission u-xwrs,g-xwrs,o-xwrt on /etc/shadow
  file:
    path: /etc/shadow
    mode: u-xwrs,g-xwrs,o-xwrt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_permissions_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_etc_shadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_etc_shadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_permissions_var_log_dir">
              <xccdf-1.2:title>Verify Permissions on Files within /var/log Directory</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>/var/log</html:code> directory contains files with logs of error
messages in the system and should only be accessed by authorized
personnel.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_var_log" severity="medium">
                <xccdf-1.2:title>Verify Group Who Owns /var/log Directory</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the group owner of <html:code>/var/log</html:code>, run the command: <html:pre>$ sudo chgrp root /var/log</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/var/log</html:code> directory contains files with logs of error
messages in the system and should only be accessed by authorized
personnel.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_var_log" complexity="low" disruption="low" reboot="false" strategy="configure">


find -H /var/log/ -maxdepth 1 -type d -exec chgrp 0 {} \;
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_var_log" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Ensure group owner on /var/log/
  file:
    path: /var/log/
    state: directory
    group: '0'
  tags:
    - configure_strategy
    - file_groupowner_var_log
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_groupowner_var_log:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_groupowner_var_log_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_var_log_messages" severity="medium">
                <xccdf-1.2:title>Verify Group Who Owns /var/log/messages File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the group owner of <html:code>/var/log/messages</html:code>, run the command: <html:pre>$ sudo chgrp root /var/log/messages</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/var/log/messages</html:code> file contains logs of error messages in
the system and should only be accessed by authorized personnel.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_var_log_messages" complexity="low" disruption="low" reboot="false" strategy="configure">


chgrp 0 /var/log/messages
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_var_log_messages" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /var/log/messages
  stat:
    path: /var/log/messages
  register: file_exists
  tags:
    - configure_strategy
    - file_groupowner_var_log_messages
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /var/log/messages
  file:
    path: /var/log/messages
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_groupowner_var_log_messages
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_groupowner_var_log_messages:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_groupowner_var_log_messages_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_var_log_syslog" severity="medium">
                <xccdf-1.2:title>Verify Group Who Owns /var/log/syslog File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the group owner of <html:code>/var/log/syslog</html:code>, run the command: <html:pre>$ sudo chgrp adm /var/log/syslog</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/var/log/syslog</html:code> file contains logs of error messages in
the system and should only be accessed by authorized personnel.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_var_log_syslog" complexity="low" disruption="low" reboot="false" strategy="configure">


chgrp 4 /var/log/syslog
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_var_log_syslog" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /var/log/syslog
  stat:
    path: /var/log/syslog
  register: file_exists
  tags:
    - configure_strategy
    - file_groupowner_var_log_syslog
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 4 on /var/log/syslog
  file:
    path: /var/log/syslog
    group: '4'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_groupowner_var_log_syslog
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_groupowner_var_log_syslog:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_groupowner_var_log_syslog_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_var_log" severity="medium">
                <xccdf-1.2:title>Verify User Who Owns /var/log Directory</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the owner of <html:code>/var/log</html:code>, run the command: <html:pre>$ sudo chown root /var/log </html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/var/log</html:code> directory contains files with logs of error
messages in the system and should only be accessed by authorized
personnel.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_var_log" complexity="low" disruption="low" reboot="false" strategy="configure">


find -H /var/log/ -maxdepth 1 -type d -exec chown 0 {} \;
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_var_log" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Ensure owner on directory /var/log/
  file:
    path: /var/log/
    state: directory
    owner: '0'
  tags:
    - configure_strategy
    - file_owner_var_log
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_owner_var_log:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_owner_var_log_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_var_log_messages" severity="medium">
                <xccdf-1.2:title>Verify User Who Owns /var/log/messages File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the owner of <html:code>/var/log/messages</html:code>, run the command: <html:pre>$ sudo chown root /var/log/messages </html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/var/log/messages</html:code> file contains logs of error messages in
the system and should only be accessed by authorized personnel.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_var_log_messages" complexity="low" disruption="low" reboot="false" strategy="configure">


chown 0 /var/log/messages
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_var_log_messages" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /var/log/messages
  stat:
    path: /var/log/messages
  register: file_exists
  tags:
    - configure_strategy
    - file_owner_var_log_messages
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /var/log/messages
  file:
    path: /var/log/messages
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_owner_var_log_messages
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_owner_var_log_messages:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_owner_var_log_messages_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_var_log_syslog" severity="medium">
                <xccdf-1.2:title>Verify User Who Owns /var/log/syslog File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the owner of <html:code>/var/log/syslog</html:code>, run the command: <html:pre>$ sudo chown syslog /var/log/syslog </html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/var/log/syslog</html:code> file contains logs of error messages in
the system and should only be accessed by authorized personnel.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_var_log_syslog" complexity="low" disruption="low" reboot="false" strategy="configure">


chown 104 /var/log/syslog
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_var_log_syslog" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /var/log/syslog
  stat:
    path: /var/log/syslog
  register: file_exists
  tags:
    - configure_strategy
    - file_owner_var_log_syslog
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 104 on /var/log/syslog
  file:
    path: /var/log/syslog
    owner: '104'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_owner_var_log_syslog
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_owner_var_log_syslog:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_owner_var_log_syslog_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_var_log" severity="medium">
                <xccdf-1.2:title>Verify Permissions on /var/log Directory</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the permissions of <html:code>/var/log</html:code>, run the command:
<html:pre>$ sudo chmod 0755 /var/log</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/var/log</html:code> directory contains files with logs of error
messages in the system and should only be accessed by authorized
personnel.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_var_log" complexity="low" disruption="low" reboot="false" strategy="configure">



find -H /var/log/ -maxdepth 1 -perm /u+s,g+ws,o+wt -type d -exec chmod u-s,g-ws,o-wt {} \;
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_var_log" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Set permissions for /var/log/
  file:
    path: /var/log/
    state: directory
    mode: u-s,g-ws,o-wt
  tags:
    - configure_strategy
    - file_permissions_var_log
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_var_log:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_var_log_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_var_log_messages" severity="medium">
                <xccdf-1.2:title>Verify Permissions on /var/log/messages File</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the permissions of <html:code>/var/log/messages</html:code>, run the command:
<html:pre>$ sudo chmod 0640 /var/log/messages</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/var/log/messages</html:code> file contains logs of error messages in
the system and should only be accessed by authorized personnel.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_var_log_messages" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xs,g-xws,o-xwrt /var/log/messages
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_var_log_messages" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /var/log/messages
  stat:
    path: /var/log/messages
  register: file_exists
  tags:
    - configure_strategy
    - file_permissions_var_log_messages
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwrt on /var/log/messages
  file:
    path: /var/log/messages
    mode: u-xs,g-xws,o-xwrt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_permissions_var_log_messages
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_var_log_messages:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_var_log_messages_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_var_log_syslog" severity="medium">
                <xccdf-1.2:title>Verify Permissions on /var/log/syslog File</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the permissions of <html:code>/var/log/syslog</html:code>, run the command:
<html:pre>$ sudo chmod 0640 /var/log/syslog</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/var/log/syslog</html:code> file contains logs of error messages in
the system and should only be accessed by authorized personnel.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_var_log_syslog" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xs,g-xws,o-xwrt /var/log/syslog
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_var_log_syslog" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /var/log/syslog
  stat:
    path: /var/log/syslog
  register: file_exists
  tags:
    - configure_strategy
    - file_permissions_var_log_syslog
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwrt on /var/log/syslog
  file:
    path: /var/log/syslog
    mode: u-xs,g-xws,o-xwrt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - configure_strategy
    - file_permissions_var_log_syslog
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_var_log_syslog:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_var_log_syslog_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_permissions_within_important_dirs">
              <xccdf-1.2:title>Verify File Permissions Within Some Important Directories</xccdf-1.2:title>
              <xccdf-1.2:description>Some directories contain files whose confidentiality or integrity
is notably important and may also be susceptible to misconfiguration over time, particularly if
unpackaged software is installed. As such,
an argument exists to verify that files' permissions within these directories remain
configured correctly and restrictively.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dir_group_ownership_library_dirs" severity="medium">
                <xccdf-1.2:title>Verify that Shared Library Directories Have Root Group Ownership</xccdf-1.2:title>
                <xccdf-1.2:description>System-wide shared library files, which are linked to executables
during process load time or run time, are stored in the following directories
by default:
<html:pre>/lib
/lib64
/usr/lib
/usr/lib64
</html:pre>
Kernel modules, which can be added to the kernel during runtime, are also
stored in <html:code>/lib/modules</html:code>. All files in these directories should be
group-owned by the <html:code>root</html:code> user. If the  directories, is found to be owned
by a user other than root correct its
ownership with the following command:
<html:pre>$ sudo chgrp root <html:i>DIR</html:i></html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6).1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000259-GPOS-00100</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Files from shared library directories are loaded into the address
space of processes (including privileged ones) or of the kernel itself at
runtime. Proper ownership of library directories is necessary to protect
the integrity of the system.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dir_group_ownership_library_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">


find -H /lib/  -type d -exec chgrp 0 {} \;

find -H /lib64/  -type d -exec chgrp 0 {} \;

find -H /usr/lib/  -type d -exec chgrp 0 {} \;

find -H /usr/lib64/  -type d -exec chgrp 0 {} \;
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dir_group_ownership_library_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Ensure group owner on /lib/ recursively
  file:
    path: /lib/
    state: directory
    recurse: true
    group: '0'
  tags:
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_group_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner on /lib64/ recursively
  file:
    path: /lib64/
    state: directory
    recurse: true
    group: '0'
  tags:
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_group_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner on /usr/lib/ recursively
  file:
    path: /usr/lib/
    state: directory
    recurse: true
    group: '0'
  tags:
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_group_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner on /usr/lib64/ recursively
  file:
    path: /usr/lib64/
    state: directory
    recurse: true
    group: '0'
  tags:
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_group_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dir_group_ownership_library_dirs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dir_group_ownership_library_dirs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dir_ownership_binary_dirs" severity="medium">
                <xccdf-1.2:title>Verify that System Executable Have Root Ownership</xccdf-1.2:title>
                <xccdf-1.2:description><html:pre>/bin
/sbin
/usr/bin
/usr/sbin
/usr/local/bin
/usr/local/sbin</html:pre>
All these directories should be owned by the <html:code>root</html:code> user.
If any directory <html:i>DIR</html:i> in these directories is found
to be owned by a user other than root, correct its ownership with the
following command:
<html:pre>$ sudo chown root <html:i>DIR</html:i></html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001495</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000258-GPOS-00099</xccdf-1.2:reference>
                <xccdf-1.2:rationale>System binaries are executed by privileged users as well as system services,
and restrictive permissions are necessary to ensure that their
execution of these programs cannot be co-opted.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dir_ownership_binary_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">


find -H /bin/  -type d -exec chown 0 {} \;

find -H /sbin/  -type d -exec chown 0 {} \;

find -H /usr/bin/  -type d -exec chown 0 {} \;

find -H /usr/sbin/  -type d -exec chown 0 {} \;

find -H /usr/local/bin/  -type d -exec chown 0 {} \;

find -H /usr/local/sbin/  -type d -exec chown 0 {} \;
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dir_ownership_binary_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Ensure owner on directory /bin/ recursively
  file:
    path: /bin/
    state: directory
    recurse: true
    owner: '0'
  tags:
    - configure_strategy
    - dir_ownership_binary_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner on directory /sbin/ recursively
  file:
    path: /sbin/
    state: directory
    recurse: true
    owner: '0'
  tags:
    - configure_strategy
    - dir_ownership_binary_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner on directory /usr/bin/ recursively
  file:
    path: /usr/bin/
    state: directory
    recurse: true
    owner: '0'
  tags:
    - configure_strategy
    - dir_ownership_binary_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner on directory /usr/sbin/ recursively
  file:
    path: /usr/sbin/
    state: directory
    recurse: true
    owner: '0'
  tags:
    - configure_strategy
    - dir_ownership_binary_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner on directory /usr/local/bin/ recursively
  file:
    path: /usr/local/bin/
    state: directory
    recurse: true
    owner: '0'
  tags:
    - configure_strategy
    - dir_ownership_binary_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner on directory /usr/local/sbin/ recursively
  file:
    path: /usr/local/sbin/
    state: directory
    recurse: true
    owner: '0'
  tags:
    - configure_strategy
    - dir_ownership_binary_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dir_ownership_binary_dirs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dir_ownership_binary_dirs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dir_ownership_library_dirs" severity="medium">
                <xccdf-1.2:title>Verify that Shared Library Directories Have Root Ownership</xccdf-1.2:title>
                <xccdf-1.2:description>System-wide shared library files, which are linked to executables
during process load time or run time, are stored in the following directories
by default:
<html:pre>/lib
/lib64
/usr/lib
/usr/lib64
</html:pre>
Kernel modules, which can be added to the kernel during runtime, are also
stored in <html:code>/lib/modules</html:code>. All files in these directories should be
owned by the <html:code>root</html:code> user. If the  directories, is found to be owned
by a user other than root correct its
ownership with the following command:
<html:pre>$ sudo chown root <html:i>DIR</html:i></html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6).1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000259-GPOS-00100</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Files from shared library directories are loaded into the address
space of processes (including privileged ones) or of the kernel itself at
runtime. Proper ownership of library directories is necessary to protect
the integrity of the system.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dir_ownership_library_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">


find -H /lib/  -type d -exec chown 0 {} \;

find -H /lib64/  -type d -exec chown 0 {} \;

find -H /usr/lib/  -type d -exec chown 0 {} \;

find -H /usr/lib64/  -type d -exec chown 0 {} \;
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dir_ownership_library_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Ensure owner on directory /lib/ recursively
  file:
    path: /lib/
    state: directory
    recurse: true
    owner: '0'
  tags:
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner on directory /lib64/ recursively
  file:
    path: /lib64/
    state: directory
    recurse: true
    owner: '0'
  tags:
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner on directory /usr/lib/ recursively
  file:
    path: /usr/lib/
    state: directory
    recurse: true
    owner: '0'
  tags:
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner on directory /usr/lib64/ recursively
  file:
    path: /usr/lib64/
    state: directory
    recurse: true
    owner: '0'
  tags:
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dir_ownership_library_dirs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dir_ownership_library_dirs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dir_permissions_binary_dirs" severity="medium">
                <xccdf-1.2:title>Verify that System Executable Directories Have Restrictive Permissions</xccdf-1.2:title>
                <xccdf-1.2:description>System executables are stored in the following directories by default:
<html:pre>/bin
/sbin
/usr/bin
/usr/sbin
/usr/local/bin
/usr/local/sbin</html:pre>
These directories should not be group-writable or world-writable.
If any directory <html:i>DIR</html:i> in these directories is found to be
group-writable or world-writable, correct its permission with the
following command:
<html:pre>$ sudo chmod go-w <html:i>DIR</html:i></html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001495</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000258-GPOS-00099</xccdf-1.2:reference>
                <xccdf-1.2:rationale>System binaries are executed by privileged users, as well as system services,
and restrictive permissions are necessary to ensure execution of these programs
cannot be co-opted.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dir_permissions_binary_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">



find -H /bin/  -perm /u+s,g+ws,o+wt -type d -exec chmod u-s,g-ws,o-wt {} \;

find -H /sbin/  -perm /u+s,g+ws,o+wt -type d -exec chmod u-s,g-ws,o-wt {} \;

find -H /usr/bin/  -perm /u+s,g+ws,o+wt -type d -exec chmod u-s,g-ws,o-wt {} \;

find -H /usr/sbin/  -perm /u+s,g+ws,o+wt -type d -exec chmod u-s,g-ws,o-wt {} \;

find -H /usr/local/bin/  -perm /u+s,g+ws,o+wt -type d -exec chmod u-s,g-ws,o-wt {} \;

find -H /usr/local/sbin/  -perm /u+s,g+ws,o+wt -type d -exec chmod u-s,g-ws,o-wt {} \;
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dir_permissions_binary_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Set permissions for /bin/ recursively
  file:
    path: /bin/
    state: directory
    recurse: true
    mode: u-s,g-ws,o-wt
  tags:
    - configure_strategy
    - dir_permissions_binary_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Set permissions for /sbin/ recursively
  file:
    path: /sbin/
    state: directory
    recurse: true
    mode: u-s,g-ws,o-wt
  tags:
    - configure_strategy
    - dir_permissions_binary_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Set permissions for /usr/bin/ recursively
  file:
    path: /usr/bin/
    state: directory
    recurse: true
    mode: u-s,g-ws,o-wt
  tags:
    - configure_strategy
    - dir_permissions_binary_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Set permissions for /usr/sbin/ recursively
  file:
    path: /usr/sbin/
    state: directory
    recurse: true
    mode: u-s,g-ws,o-wt
  tags:
    - configure_strategy
    - dir_permissions_binary_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Set permissions for /usr/local/bin/ recursively
  file:
    path: /usr/local/bin/
    state: directory
    recurse: true
    mode: u-s,g-ws,o-wt
  tags:
    - configure_strategy
    - dir_permissions_binary_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Set permissions for /usr/local/sbin/ recursively
  file:
    path: /usr/local/sbin/
    state: directory
    recurse: true
    mode: u-s,g-ws,o-wt
  tags:
    - configure_strategy
    - dir_permissions_binary_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dir_permissions_binary_dirs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dir_permissions_binary_dirs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dir_permissions_library_dirs" severity="medium">
                <xccdf-1.2:title>Verify that Shared Library Directories Have Restrictive Permissions</xccdf-1.2:title>
                <xccdf-1.2:description>System-wide shared library directories, which contain are linked to executables
during process load time or run time, are stored in the following directories
by default:
<html:pre>/lib
/lib64
/usr/lib
/usr/lib64
</html:pre>
Kernel modules, which can be added to the kernel during runtime, are
stored in <html:code>/lib/modules</html:code>. All sub-directories in these directories
should not be group-writable or world-writable. If any file in these
directories is found to be group-writable or world-writable, correct
its permission with the following command:
<html:pre>$ sudo chmod go-w <html:i>DIR</html:i></html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6).1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000259-GPOS-00100</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If the operating system were to allow any user to make changes to software libraries,
then those changes might be implemented without undergoing the appropriate testing
and approvals that are part of a robust change management process.

This requirement applies to operating systems with software libraries that are accessible
and configurable, as in the case of interpreted languages. Software libraries also include
privileged programs which execute with escalated privileges. Only qualified and authorized
individuals must be allowed to obtain access to information system components for purposes
of initiating changes, including upgrades and modifications.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dir_permissions_library_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">



find -H /lib/  -perm /u+s,g+ws,o+wt -type d -exec chmod u-s,g-ws,o-wt {} \;

find -H /lib64/  -perm /u+s,g+ws,o+wt -type d -exec chmod u-s,g-ws,o-wt {} \;

find -H /usr/lib/  -perm /u+s,g+ws,o+wt -type d -exec chmod u-s,g-ws,o-wt {} \;

find -H /usr/lib64/  -perm /u+s,g+ws,o+wt -type d -exec chmod u-s,g-ws,o-wt {} \;
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dir_permissions_library_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Set permissions for /lib/ recursively
  file:
    path: /lib/
    state: directory
    recurse: true
    mode: u-s,g-ws,o-wt
  tags:
    - NIST-800-53-CM-5
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Set permissions for /lib64/ recursively
  file:
    path: /lib64/
    state: directory
    recurse: true
    mode: u-s,g-ws,o-wt
  tags:
    - NIST-800-53-CM-5
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Set permissions for /usr/lib/ recursively
  file:
    path: /usr/lib/
    state: directory
    recurse: true
    mode: u-s,g-ws,o-wt
  tags:
    - NIST-800-53-CM-5
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Set permissions for /usr/lib64/ recursively
  file:
    path: /usr/lib64/
    state: directory
    recurse: true
    mode: u-s,g-ws,o-wt
  tags:
    - NIST-800-53-CM-5
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-dir_permissions_library_dirs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-dir_permissions_library_dirs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupownership_system_commands_dirs" severity="medium">
                <xccdf-1.2:title>Verify that system commands files are group owned by root</xccdf-1.2:title>
                <xccdf-1.2:description>System commands files are stored in the following directories by default:
<html:pre>/bin
/sbin
/usr/bin
/usr/sbin
/usr/local/bin
/usr/local/sbin
</html:pre>
All files in these directories should be owned by the <html:code>root</html:code> group.
If the directory, or any file in these directories, is found to be owned
by a group other than root correct its ownership with the following command:
<html:pre>$ sudo chgrp root <html:i>FILE</html:i></html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6).1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000259-GPOS-00100</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If the operating system allows any user to make changes to software
libraries, then those changes might be implemented without undergoing the
appropriate testing and approvals that are part of a robust change management
process.
This requirement applies to operating systems with software libraries
that are accessible and configurable, as in the case of interpreted languages.
Software libraries also include privileged programs which execute with
escalated privileges. Only qualified and authorized individuals must be
allowed to obtain access to information system components for purposes
of initiating changes, including upgrades and modifications.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupownership_system_commands_dirs">
for SYSCMDFILES in /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin
do
   find -L $SYSCMDFILES \! -group root -type f -exec chgrp root '{}' \;
done
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupownership_system_commands_dirs" complexity="medium" disruption="medium" reboot="false" strategy="restrict">- name: Retrieve the system command files and set their group ownership to root
  command: find -L {{ item }}  ! -group root -type f -exec chgrp root '{}' \;
  with_items:
    - /bin
    - /sbin
    - /usr/bin
    - /usr/sbin
    - /usr/local/bin
    - /usr/local/sbin
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - file_groupownership_system_commands_dirs
    - medium_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_groupownership_system_commands_dirs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_groupownership_system_commands_dirs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_ownership_binary_dirs" severity="medium">
                <xccdf-1.2:title>Verify that System Executables Have Root Ownership</xccdf-1.2:title>
                <xccdf-1.2:description>System executables are stored in the following directories by default:
<html:pre>/bin
/sbin
/usr/bin
/usr/libexec
/usr/local/bin
/usr/local/sbin
/usr/sbin</html:pre>
All files in these directories should be owned by the <html:code>root</html:code> user.
If any file <html:i>FILE</html:i> in these directories is found
to be owned by a user other than root, correct its ownership with the
following command:
<html:pre>$ sudo chown root <html:i>FILE</html:i></html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6).1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000259-GPOS-00100</xccdf-1.2:reference>
                <xccdf-1.2:rationale>System binaries are executed by privileged users as well as system services,
and restrictive permissions are necessary to ensure that their
execution of these programs cannot be co-opted.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_ownership_binary_dirs" complexity="medium" disruption="medium" reboot="false" strategy="restrict">- name: Read list of system executables without root ownership
  command: find /bin/ /usr/bin/ /usr/local/bin/ /sbin/ /usr/sbin/ /usr/local/sbin/
    /usr/libexec \! -user root
  register: no_root_system_executables
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - file_ownership_binary_dirs
    - medium_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set ownership to root of system executables
  file:
    path: '{{ item }}'
    owner: root
  with_items: '{{ no_root_system_executables.stdout_lines }}'
  when: no_root_system_executables.stdout_lines | length &gt; 0
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - file_ownership_binary_dirs
    - medium_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_ownership_binary_dirs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_ownership_binary_dirs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_ownership_library_dirs" severity="medium">
                <xccdf-1.2:title>Verify that Shared Library Files Have Root Ownership</xccdf-1.2:title>
                <xccdf-1.2:description>System-wide shared library files, which are linked to executables
during process load time or run time, are stored in the following directories
by default:
<html:pre>/lib
/lib64
/usr/lib
/usr/lib64
</html:pre>
Kernel modules, which can be added to the kernel during runtime, are also
stored in <html:code>/lib/modules</html:code>. All files in these directories should be
owned by the <html:code>root</html:code> user. If the directory, or any file in these
directories, is found to be owned by a user other than root correct its
ownership with the following command:
<html:pre>$ sudo chown root <html:i>FILE</html:i></html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6).1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000259-GPOS-00100</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Files from shared library directories are loaded into the address
space of processes (including privileged ones) or of the kernel itself at
runtime. Proper ownership is necessary to protect the integrity of the system.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_ownership_library_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">


find /lib/  -type f ! -uid 0 -regex '^.*$' -exec chown 0 {} \;

find /lib64/  -type f ! -uid 0 -regex '^.*$' -exec chown 0 {} \;

find /usr/lib/  -type f ! -uid 0 -regex '^.*$' -exec chown 0 {} \;

find /usr/lib64/  -type f ! -uid 0 -regex '^.*$' -exec chown 0 {} \;
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_ownership_library_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Find /lib/ file(s) matching ^.*$ recursively
  command: find -H /lib/  -type f ! -uid 0 -regex "^.*$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner on /lib/ file(s) matching ^.*$
  file:
    path: '{{ item }}'
    owner: '0'
    state: file
  with_items:
    - '{{ files_found.stdout_lines }}'
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Find /lib64/ file(s) matching ^.*$ recursively
  command: find -H /lib64/  -type f ! -uid 0 -regex "^.*$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner on /lib64/ file(s) matching ^.*$
  file:
    path: '{{ item }}'
    owner: '0'
    state: file
  with_items:
    - '{{ files_found.stdout_lines }}'
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Find /usr/lib/ file(s) matching ^.*$ recursively
  command: find -H /usr/lib/  -type f ! -uid 0 -regex "^.*$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner on /usr/lib/ file(s) matching ^.*$
  file:
    path: '{{ item }}'
    owner: '0'
    state: file
  with_items:
    - '{{ files_found.stdout_lines }}'
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Find /usr/lib64/ file(s) matching ^.*$ recursively
  command: find -H /usr/lib64/  -type f ! -uid 0 -regex "^.*$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner on /usr/lib64/ file(s) matching ^.*$
  file:
    path: '{{ item }}'
    owner: '0'
    state: file
  with_items:
    - '{{ files_found.stdout_lines }}'
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_ownership_library_dirs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_ownership_library_dirs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_binary_dirs" severity="medium">
                <xccdf-1.2:title>Verify that System Executables Have Restrictive Permissions</xccdf-1.2:title>
                <xccdf-1.2:description>System executables are stored in the following directories by default:
<html:pre>/bin
/sbin
/usr/bin
/usr/libexec
/usr/local/bin
/usr/local/sbin
/usr/sbin</html:pre>
All files in these directories should not be group-writable or world-writable.
If any file <html:i>FILE</html:i> in these directories is found
to be group-writable or world-writable, correct its permission with the
following command:
<html:pre>$ sudo chmod go-w <html:i>FILE</html:i></html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6).1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000259-GPOS-00100</xccdf-1.2:reference>
                <xccdf-1.2:rationale>System binaries are executed by privileged users, as well as system services,
and restrictive permissions are necessary to ensure execution of these programs
cannot be co-opted.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_binary_dirs" complexity="medium" disruption="medium" reboot="false" strategy="restrict">- name: Read list of world and group writable system executables
  command: find /bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbin /usr/libexec
    -perm /022 -type f
  register: world_writable_library_files
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - file_permissions_binary_dirs
    - medium_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Remove world/group writability of system executables
  file:
    path: '{{ item }}'
    mode: go-w
  with_items: '{{ world_writable_library_files.stdout_lines }}'
  when: world_writable_library_files.stdout_lines | length &gt; 0
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - file_permissions_binary_dirs
    - medium_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_binary_dirs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_binary_dirs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_library_dirs" severity="medium">
                <xccdf-1.2:title>Verify that Shared Library Files Have Restrictive Permissions</xccdf-1.2:title>
                <xccdf-1.2:description>System-wide shared library files, which are linked to executables
during process load time or run time, are stored in the following directories
by default:
<html:pre>/lib
/lib64
/usr/lib
/usr/lib64
</html:pre>
Kernel modules, which can be added to the kernel during runtime, are
stored in <html:code>/lib/modules</html:code>. All files in these directories
should not be group-writable or world-writable. If any file in these
directories is found to be group-writable or world-writable, correct
its permission with the following command:
<html:pre>$ sudo chmod go-w <html:i>FILE</html:i></html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6).1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000259-GPOS-00100</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Files from shared library directories are loaded into the address
space of processes (including privileged ones) or of the kernel itself at
runtime. Restrictive permissions are necessary to protect the integrity of the system.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_library_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">



find -H /lib/  -perm /g+w,o+w -type f -regex '^.*$' -exec chmod g-w,o-w {} \;

find -H /lib64/  -perm /g+w,o+w -type f -regex '^.*$' -exec chmod g-w,o-w {} \;

find -H /usr/lib/  -perm /g+w,o+w -type f -regex '^.*$' -exec chmod g-w,o-w {} \;

find -H /usr/lib64/  -perm /g+w,o+w -type f -regex '^.*$' -exec chmod g-w,o-w {} \;
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_library_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Find /lib/ file(s) recursively
  command: find -H /lib/  -perm /g+w,o+w -type f -regex "^.*$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Set permissions for /lib/ file(s)
  file:
    path: '{{ item }}'
    mode: g-w,o-w
    state: file
  with_items:
    - '{{ files_found.stdout_lines }}'
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Find /lib64/ file(s) recursively
  command: find -H /lib64/  -perm /g+w,o+w -type f -regex "^.*$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Set permissions for /lib64/ file(s)
  file:
    path: '{{ item }}'
    mode: g-w,o-w
    state: file
  with_items:
    - '{{ files_found.stdout_lines }}'
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Find /usr/lib/ file(s) recursively
  command: find -H /usr/lib/  -perm /g+w,o+w -type f -regex "^.*$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Set permissions for /usr/lib/ file(s)
  file:
    path: '{{ item }}'
    mode: g-w,o-w
    state: file
  with_items:
    - '{{ files_found.stdout_lines }}'
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Find /usr/lib64/ file(s) recursively
  command: find -H /usr/lib64/  -perm /g+w,o+w -type f -regex "^.*$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Set permissions for /usr/lib64/ file(s)
  file:
    path: '{{ item }}'
    mode: g-w,o-w
    state: file
  with_items:
    - '{{ files_found.stdout_lines }}'
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_library_dirs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_library_dirs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_root_permissions_syslibrary_files" severity="medium">
                <xccdf-1.2:title>Verify the system-wide library files in directories
"/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are group-owned by root.</xccdf-1.2:title>
                <xccdf-1.2:description>System-wide library files are stored in the following directories
by default:
<html:pre>/lib
/lib64
/usr/lib
/usr/lib64
</html:pre>
All system-wide shared library files should be protected from unauthorised
access. If any of these files is not group-owned by root, correct its group-owner with
the following command:
<html:pre>$ sudo chgrp root <html:i>FILE</html:i></html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6).1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000259-GPOS-00100</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If the operating system were to allow any user to make changes to software libraries,
then those changes might be implemented without undergoing the appropriate testing and
approvals that are part of a robust change management process.

This requirement applies to operating systems with software libraries that are
accessible and configurable, as in the case of interpreted languages. Software libraries
also include privileged programs which execute with escalated privileges. Only qualified
and authorized individuals must be allowed to obtain access to information system components
for purposes of initiating changes, including upgrades and modifications.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="root_permissions_syslibrary_files" complexity="low" disruption="low" reboot="false" strategy="configure">


find -H /lib/  -type d -exec chgrp 0 {} \;

find -H /lib64/  -type d -exec chgrp 0 {} \;

find -H /usr/lib/  -type d -exec chgrp 0 {} \;

find -H /usr/lib64/  -type d -exec chgrp 0 {} \;
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="root_permissions_syslibrary_files" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Ensure group owner on /lib/ recursively
  file:
    path: /lib/
    state: directory
    recurse: true
    group: '0'
  tags:
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - root_permissions_syslibrary_files

- name: Ensure group owner on /lib64/ recursively
  file:
    path: /lib64/
    state: directory
    recurse: true
    group: '0'
  tags:
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - root_permissions_syslibrary_files

- name: Ensure group owner on /usr/lib/ recursively
  file:
    path: /usr/lib/
    state: directory
    recurse: true
    group: '0'
  tags:
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - root_permissions_syslibrary_files

- name: Ensure group owner on /usr/lib64/ recursively
  file:
    path: /usr/lib64/
    state: directory
    recurse: true
    group: '0'
  tags:
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - root_permissions_syslibrary_files
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-root_permissions_syslibrary_files:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-root_permissions_syslibrary_files_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_mounting">
            <xccdf-1.2:title>Restrict Dynamic Mounting and Unmounting of
Filesystems</xccdf-1.2:title>
            <xccdf-1.2:description>Linux includes a number of facilities for the automated addition
and removal of filesystems on a running system.  These facilities may be
necessary in many environments, but this capability also carries some risk -- whether direct
risk from allowing users to introduce arbitrary filesystems,
or risk that software flaws in the automated mount facility itself could
allow an attacker to compromise the system.
<html:br/><html:br/>
This command can be used to list the types of filesystems that are
available to the currently executing kernel:
<html:pre>$ find /lib/modules/`uname -r`/kernel/fs -type f -name '*.ko'</html:pre>
If these filesystems are not required then they can be explicitly disabled
in a configuratio file in  <html:code>/etc/modprobe.d</html:code>.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_autofs_disabled" severity="medium">
              <xccdf-1.2:title>Disable the Automounter</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>autofs</html:code> daemon mounts and unmounts filesystems, such as user
home directories shared via NFS, on demand. In addition, autofs can be used to handle
removable media, and the default configuration provides the cdrom device as <html:code>/misc/cd</html:code>.
However, this method of providing access to removable media is not common, so autofs
can almost always be disabled if NFS is not in use. Even if NFS is required, it may be
possible to configure filesystem mounts statically by editing <html:code>/etc/fstab</html:code>
rather than relying on the automounter.
<html:br/><html:br/>

The <html:code>autofs</html:code> service can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now autofs.service</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000778</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001958</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(iv)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000114-GPOS-00059</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Disabling the automounter permits the administrator to
statically control filesystem mounting through <html:code>/etc/fstab</html:code>.
<html:br/><html:br/>
Additionally, automatically mounting filesystems permits easy introduction of
unknown devices, thereby facilitating malicious activity.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_autofs_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'autofs.service'
"$SYSTEMCTL_EXEC" disable 'autofs.service'
"$SYSTEMCTL_EXEC" mask 'autofs.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^autofs.socket'; then
    "$SYSTEMCTL_EXEC" stop 'autofs.socket'
    "$SYSTEMCTL_EXEC" mask 'autofs.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'autofs.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_autofs_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Disable service autofs
  block:

    - name: Disable service autofs
      systemd:
        name: autofs.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      ignore_errors: 'yes'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_autofs_disabled

- name: Unit Socket Exists - autofs.socket
  command: systemctl list-unit-files autofs.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_autofs_disabled

- name: Disable socket autofs
  systemd:
    name: autofs.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"autofs.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_autofs_disabled
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_autofs_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_autofs

class disable_autofs {
  service {'autofs':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="service_autofs_disabled">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - enabled: false
        name: autofs.service
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_autofs_disabled">
[customizations.services]
disabled = ["autofs"]
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_autofs_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-service_autofs_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_bios_assign_password" severity="unknown">
              <xccdf-1.2:title>Assign Password to Prevent Changes to Boot Firmware Configuration</xccdf-1.2:title>
              <xccdf-1.2:description>Assign a password to the system boot firmware (historically called BIOS on PC
systems) to require a password for any configuration changes.</xccdf-1.2:description>
              <xccdf-1.2:rationale>Assigning a password to the system boot firmware prevents anyone
with physical access from configuring the system to boot
from local media and circumvent the operating system's access controls.
For systems in physically secure locations, such as
a data center or Sensitive Compartmented Information Facility (SCIF), this risk must be weighed
against the risk of administrative personnel being unable to conduct recovery operations in
a timely fashion.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_bios_disable_usb_boot" severity="unknown">
              <xccdf-1.2:title>Disable Booting from USB Devices in Boot Firmware</xccdf-1.2:title>
              <xccdf-1.2:description>Configure the system boot firmware (historically called BIOS on PC
systems) to disallow booting from USB drives.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001250</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Booting a system from a USB device would allow an attacker to
circumvent any security measures provided by the operating system. Attackers
could mount partitions and modify the configuration of the OS.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_nousb_argument" severity="unknown">
              <xccdf-1.2:title>Disable Kernel Support for USB via Bootloader Configuration</xccdf-1.2:title>
              <xccdf-1.2:description>All USB support can be disabled by adding the <html:code>nousb</html:code>
argument to the kernel's boot loader configuration. To do so,
append "nousb" to the kernel line in <html:code>/etc/default/grub</html:code> as shown:
<html:pre>kernel /vmlinuz-<html:i>VERSION</html:i> ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet nousb</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="functionality">Disabling all kernel support for USB will cause problems for systems
with USB-based keyboards, mice, or printers. This configuration is
infeasible for systems which require USB devices, which is common.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001250</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(iv)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Disabling the USB subsystem within the Linux kernel at system boot will
protect against potentially malicious USB devices, although it is only practical
in specialized systems.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#grub2"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_nousb_argument"># Remediation is applicable only in certain platforms
if rpm --quiet -q grub2-common; then

# Correct the form of default kernel command line in /etc/default/grub
if ! grep -q '^GRUB_CMDLINE_LINUX=".*nousb.*"' /etc/default/grub;
then
  # Edit configuration setting
  # Append 'nousb' argument to /etc/default/grub (if not present yet)
  sed -i "s/\(GRUB_CMDLINE_LINUX=\)\"\(.*\)\"/\1\"\2 nousb\"/" /etc/default/grub
  # Edit runtime setting
  # Correct the form of kernel command line for each installed kernel in the bootloader
  /sbin/grubby --update-kernel=ALL --args="nousb"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-grub2_nousb_argument:def:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled" severity="low">
              <xccdf-1.2:title>Disable Mounting of cramfs</xccdf-1.2:title>
              <xccdf-1.2:description>
To configure the system to prevent the <html:code>cramfs</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/cramfs.conf</html:code>:
<html:pre>install cramfs /bin/true</html:pre>
This effectively prevents usage of this uncommon filesystem.

The <html:code>cramfs</html:code> filesystem type is a compressed read-only
Linux filesystem embedded in small footprint systems. A
<html:code>cramfs</html:code> image can be used without having to first
decompress the image.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Removing support for unneeded filesystem types reduces the local attack surface
of the server.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_cramfs_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install cramfs" /etc/modprobe.d/cramfs.conf ; then
	
	sed -i 's#^install cramfs.*#install cramfs /bin/true#g' /etc/modprobe.d/cramfs.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/cramfs.conf
	echo "install cramfs /bin/true" &gt;&gt; /etc/modprobe.d/cramfs.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_cramfs_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Ensure kernel module 'cramfs' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/cramfs.conf
    regexp: cramfs
    line: install cramfs /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_cramfs_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="kernel_module_cramfs_disabled">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20cramfs%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_cramfs_disabled.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_module_cramfs_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_module_cramfs_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_freevxfs_disabled" severity="low">
              <xccdf-1.2:title>Disable Mounting of freevxfs</xccdf-1.2:title>
              <xccdf-1.2:description>
To configure the system to prevent the <html:code>freevxfs</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/freevxfs.conf</html:code>:
<html:pre>install freevxfs /bin/true</html:pre>
This effectively prevents usage of this uncommon filesystem.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Linux kernel modules which implement filesystems that are not needed by the
local system should be disabled.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_freevxfs_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install freevxfs" /etc/modprobe.d/freevxfs.conf ; then
	
	sed -i 's#^install freevxfs.*#install freevxfs /bin/true#g' /etc/modprobe.d/freevxfs.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/freevxfs.conf
	echo "install freevxfs /bin/true" &gt;&gt; /etc/modprobe.d/freevxfs.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_freevxfs_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Ensure kernel module 'freevxfs' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/freevxfs.conf
    regexp: freevxfs
    line: install freevxfs /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_freevxfs_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="kernel_module_freevxfs_disabled">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20freevxfs%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_freevxfs_disabled.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_module_freevxfs_disabled:def:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_hfs_disabled" severity="low">
              <xccdf-1.2:title>Disable Mounting of hfs</xccdf-1.2:title>
              <xccdf-1.2:description>
To configure the system to prevent the <html:code>hfs</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/hfs.conf</html:code>:
<html:pre>install hfs /bin/true</html:pre>
This effectively prevents usage of this uncommon filesystem.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Linux kernel modules which implement filesystems that are not needed by the
local system should be disabled.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_hfs_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install hfs" /etc/modprobe.d/hfs.conf ; then
	
	sed -i 's#^install hfs.*#install hfs /bin/true#g' /etc/modprobe.d/hfs.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/hfs.conf
	echo "install hfs /bin/true" &gt;&gt; /etc/modprobe.d/hfs.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_hfs_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Ensure kernel module 'hfs' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/hfs.conf
    regexp: hfs
    line: install hfs /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_hfs_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="kernel_module_hfs_disabled">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20hfs%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_hfs_disabled.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_module_hfs_disabled:def:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_hfsplus_disabled" severity="low">
              <xccdf-1.2:title>Disable Mounting of hfsplus</xccdf-1.2:title>
              <xccdf-1.2:description>
To configure the system to prevent the <html:code>hfsplus</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/hfsplus.conf</html:code>:
<html:pre>install hfsplus /bin/true</html:pre>
This effectively prevents usage of this uncommon filesystem.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Linux kernel modules which implement filesystems that are not needed by the
local system should be disabled.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_hfsplus_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install hfsplus" /etc/modprobe.d/hfsplus.conf ; then
	
	sed -i 's#^install hfsplus.*#install hfsplus /bin/true#g' /etc/modprobe.d/hfsplus.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/hfsplus.conf
	echo "install hfsplus /bin/true" &gt;&gt; /etc/modprobe.d/hfsplus.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_hfsplus_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Ensure kernel module 'hfsplus' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/hfsplus.conf
    regexp: hfsplus
    line: install hfsplus /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_hfsplus_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="kernel_module_hfsplus_disabled">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20hfsplus%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_hfsplus_disabled.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_module_hfsplus_disabled:def:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_jffs2_disabled" severity="low">
              <xccdf-1.2:title>Disable Mounting of jffs2</xccdf-1.2:title>
              <xccdf-1.2:description>
To configure the system to prevent the <html:code>jffs2</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/jffs2.conf</html:code>:
<html:pre>install jffs2 /bin/true</html:pre>
This effectively prevents usage of this uncommon filesystem.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Linux kernel modules which implement filesystems that are not needed by the
local system should be disabled.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_jffs2_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install jffs2" /etc/modprobe.d/jffs2.conf ; then
	
	sed -i 's#^install jffs2.*#install jffs2 /bin/true#g' /etc/modprobe.d/jffs2.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/jffs2.conf
	echo "install jffs2 /bin/true" &gt;&gt; /etc/modprobe.d/jffs2.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_jffs2_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Ensure kernel module 'jffs2' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/jffs2.conf
    regexp: jffs2
    line: install jffs2 /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_jffs2_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="kernel_module_jffs2_disabled">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20jffs2%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_jffs2_disabled.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_module_jffs2_disabled:def:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_squashfs_disabled" severity="low">
              <xccdf-1.2:title>Disable Mounting of squashfs</xccdf-1.2:title>
              <xccdf-1.2:description>
To configure the system to prevent the <html:code>squashfs</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/squashfs.conf</html:code>:
<html:pre>install squashfs /bin/true</html:pre>
This effectively prevents usage of this uncommon filesystem.

The <html:code>squashfs</html:code> filesystem type is a compressed read-only Linux
filesystem embedded in small footprint systems (similar to
<html:code>cramfs</html:code>). A <html:code>squashfs</html:code> image can be used without having
to first decompress the image.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Removing support for unneeded filesystem types reduces the local attack
surface of the system.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_squashfs_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install squashfs" /etc/modprobe.d/squashfs.conf ; then
	
	sed -i 's#^install squashfs.*#install squashfs /bin/true#g' /etc/modprobe.d/squashfs.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/squashfs.conf
	echo "install squashfs /bin/true" &gt;&gt; /etc/modprobe.d/squashfs.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_squashfs_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Ensure kernel module 'squashfs' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/squashfs.conf
    regexp: squashfs
    line: install squashfs /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_squashfs_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="kernel_module_squashfs_disabled">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20squashfs%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_squashfs_disabled.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_module_squashfs_disabled:def:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_udf_disabled" severity="low">
              <xccdf-1.2:title>Disable Mounting of udf</xccdf-1.2:title>
              <xccdf-1.2:description>
To configure the system to prevent the <html:code>udf</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/udf.conf</html:code>:
<html:pre>install udf /bin/true</html:pre>
This effectively prevents usage of this uncommon filesystem.

The <html:code>udf</html:code> filesystem type is the universal disk format
used to implement the ISO/IEC 13346 and ECMA-167 specifications.
This is an open vendor filesystem type for data storage on a broad
range of media. This filesystem type is neccessary to support
writing DVDs and newer optical disc formats.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Removing support for unneeded filesystem types reduces the local
attack surface of the system.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_udf_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install udf" /etc/modprobe.d/udf.conf ; then
	
	sed -i 's#^install udf.*#install udf /bin/true#g' /etc/modprobe.d/udf.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/udf.conf
	echo "install udf /bin/true" &gt;&gt; /etc/modprobe.d/udf.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_udf_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Ensure kernel module 'udf' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/udf.conf
    regexp: udf
    line: install udf /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_udf_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="kernel_module_udf_disabled">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20udf%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_udf_disabled.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_module_udf_disabled:def:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled" severity="medium">
              <xccdf-1.2:title>Disable Modprobe Loading of USB Storage Driver</xccdf-1.2:title>
              <xccdf-1.2:description>To prevent USB storage devices from being used, configure the kernel module loading system
to prevent automatic loading of the USB storage driver.

To configure the system to prevent the <html:code>usb-storage</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/usb-storage.conf</html:code>:
<html:pre>install usb-storage /bin/true</html:pre>
This will prevent the <html:code>modprobe</html:code> program from loading the <html:code>usb-storage</html:code>
module, but will not prevent an administrator (or another program) from using the
<html:code>insmod</html:code> program to load the module manually.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.21</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000778</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001958</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(iv)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000114-GPOS-00059</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>USB storage devices such as thumb drives can be used to introduce
malicious software.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_usb-storage_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install usb-storage" /etc/modprobe.d/usb-storage.conf ; then
	
	sed -i 's#^install usb-storage.*#install usb-storage /bin/true#g' /etc/modprobe.d/usb-storage.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/usb-storage.conf
	echo "install usb-storage /bin/true" &gt;&gt; /etc/modprobe.d/usb-storage.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_usb-storage_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Ensure kernel module 'usb-storage' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/usb-storage.conf
    regexp: usb-storage
    line: install usb-storage /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.21
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - disable_strategy
    - kernel_module_usb-storage_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="kernel_module_usb-storage_disabled">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20usb-storage%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_usb-storage_disabled.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_module_usb-storage_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kernel_module_usb-storage_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_vfat_disabled" severity="low">
              <xccdf-1.2:title>Disable Mounting of vFAT filesystems</xccdf-1.2:title>
              <xccdf-1.2:description>
To configure the system to prevent the <html:code>vfat</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/vfat.conf</html:code>:
<html:pre>install vfat /bin/true</html:pre>
This effectively prevents usage of this uncommon filesystem.

The <html:code>vFAT</html:code> filesystem format is primarily used on older
windows systems and portable USB drives or flash modules. It comes
in three types <html:code>FAT12</html:code>, <html:code>FAT16</html:code>, and <html:code>FAT32</html:code>
all of which are supported by the <html:code>vfat</html:code> kernel module.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Removing support for unneeded filesystems reduces the local attack
surface of the system.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_vfat_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install vfat" /etc/modprobe.d/vfat.conf ; then
	
	sed -i 's#^install vfat.*#install vfat /bin/true#g' /etc/modprobe.d/vfat.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/vfat.conf
	echo "install vfat /bin/true" &gt;&gt; /etc/modprobe.d/vfat.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_vfat_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Ensure kernel module 'vfat' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/vfat.conf
    regexp: vfat
    line: install vfat /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_vfat_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="kernel_module_vfat_disabled">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,install%20vfat%20/bin/true%0A
        mode: 0644
        path: /etc/modprobe.d/75-kernel_module_vfat_disabled.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kernel_module_vfat_disabled:def:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_partitions">
            <xccdf-1.2:title>Restrict Partition Mount Options</xccdf-1.2:title>
            <xccdf-1.2:description>System partitions can be mounted with certain options
that limit what files on those partitions can do. These options
are set in the <html:code>/etc/fstab</html:code> configuration file, and can be
used to make certain types of malicious behavior more difficult.</xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mount_option_proc_hidepid" type="string">
              <xccdf-1.2:title>Value for hidepid option</xccdf-1.2:title>
              <xccdf-1.2:description>The hidepid mount option is applicable to /proc and is used to control who can access
the information in /proc/[pid] directories. The option can have one of the following
values:
0: Everybody may access all /proc/[pid] directories.
1: Users may not access files and subdirectories inside any /proc/[pid] directories
   but their own. The /proc/[pid] directories themselves remain visible.
2: Same as for mode 1, but in addition the /proc/[pid] directories belonging to other
   users become invisible.</xccdf-1.2:description>
              <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
              <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
              <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
              <xccdf-1.2:value>2</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_removable_partition" type="string">
              <xccdf-1.2:title>Removable Partition</xccdf-1.2:title>
              <xccdf-1.2:description>This value is used by the checks mount_option_nodev_removable_partitions, mount_option_nodev_removable_partitions,
and mount_option_nodev_removable_partitions to ensure that the correct mount options are set on partitions mounted from
removable media such as CD-ROMs, USB keys, and floppy drives. This value should be modified to reflect any removable
partitions that are required on the local system.</xccdf-1.2:description>
              <xccdf-1.2:value selector="dev_cdrom">/dev/cdrom</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_boot_noauto" severity="medium">
              <xccdf-1.2:title>Add noauto Option to /boot</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>noauto</html:code> mount option is used to prevent automatic mounting of th
<html:code>/boot</html:code> partition. 
Add the <html:code>noauto</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/boot</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Although contents of the <html:code>/boot</html:code> partition should not be needed
during normal system operation, they might need to be accessible during
system maintenance and upgrades. Make sure that applying this rule will
not break upgrade or maintenance processes affecting the system.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>/boot</html:code> partition contains the kernel and the bootloader. Access
to the partition after the boot process finishes should not be needed. Files
contained within this partition can be analysed and gained information can
be used for exploit creation.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_boot_noauto" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

function perform_remediation {
    
        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/boot")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/boot' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /boot in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /boot)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if [ "$(grep -c "$mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|noauto)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        echo " /boot  defaults,${previous_mount_opts}noauto 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif [ "$(grep "$mount_point_match_regexp" /etc/fstab | grep -c "noauto")" -eq 0 ]; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,noauto|" /etc/fstab
    fi


    if mkdir -p "/boot"; then
        if mountpoint -q "/boot"; then
            mount -o remount --target "/boot"
        else
            mount --target "/boot"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_boot_noauto" complexity="low" disruption="high" reboot="false" strategy="configure">- name: 'Add noauto Option to /boot: Check information associated to mountpoint'
  command: findmnt --fstab '/boot'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_noauto
    - no_reboot_needed

- name: 'Add noauto Option to /boot: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_noauto
    - no_reboot_needed

- name: 'Add noauto Option to /boot: If /boot not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /boot
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_noauto
    - no_reboot_needed

- name: 'Add noauto Option to /boot: Make sure noauto option is part of the to /boot
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noauto''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "noauto" not in mount_info.options
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_noauto
    - no_reboot_needed

- name: 'Add noauto Option to /boot: Ensure /boot is mounted with noauto option'
  mount:
    path: /boot
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_noauto
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_boot_noauto" complexity="low" disruption="high" reboot="false" strategy="enable">
part /boot --mountoptions="noauto"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_boot_noauto:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_boot_noauto_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_boot_nodev" severity="medium">
              <xccdf-1.2:title>Add nodev Option to /boot</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nodev</html:code> mount option can be used to prevent device files from
being created in <html:code>/boot</html:code>.
Legitimate character and block devices should exist only in
the <html:code>/dev</html:code> directory on the root partition or within chroot
jails built for system services.
Add the <html:code>nodev</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/boot</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The only legitimate location for device files is the <html:code>/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_boot_nodev" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

function perform_remediation {
    
        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/boot")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/boot' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /boot in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /boot)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if [ "$(grep -c "$mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nodev)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        echo " /boot  defaults,${previous_mount_opts}nodev 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif [ "$(grep "$mount_point_match_regexp" /etc/fstab | grep -c "nodev")" -eq 0 ]; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nodev|" /etc/fstab
    fi


    if mkdir -p "/boot"; then
        if mountpoint -q "/boot"; then
            mount -o remount --target "/boot"
        else
            mount --target "/boot"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_boot_nodev" complexity="low" disruption="high" reboot="false" strategy="configure">- name: 'Add nodev Option to /boot: Check information associated to mountpoint'
  command: findmnt --fstab '/boot'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nodev
    - no_reboot_needed

- name: 'Add nodev Option to /boot: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nodev
    - no_reboot_needed

- name: 'Add nodev Option to /boot: If /boot not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /boot
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nodev
    - no_reboot_needed

- name: 'Add nodev Option to /boot: Make sure nodev option is part of the to /boot
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nodev" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nodev
    - no_reboot_needed

- name: 'Add nodev Option to /boot: Ensure /boot is mounted with nodev option'
  mount:
    path: /boot
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nodev
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_boot_nodev" complexity="low" disruption="high" reboot="false" strategy="enable">
part /boot --mountoptions="nodev"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_boot_nodev:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_boot_nodev_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_boot_noexec" severity="medium">
              <xccdf-1.2:title>Add noexec Option to /boot</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>noexec</html:code> mount option can be used to prevent binaries from being
executed out of <html:code>/boot</html:code>. 
Add the <html:code>noexec</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/boot</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>/boot</html:code> partition contains the kernel and the bootloader. No
binaries should be executed from this partition after the booting process
finishes.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_boot_noexec" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

function perform_remediation {
    
        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/boot")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/boot' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /boot in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /boot)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if [ "$(grep -c "$mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|noexec)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        echo " /boot  defaults,${previous_mount_opts}noexec 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif [ "$(grep "$mount_point_match_regexp" /etc/fstab | grep -c "noexec")" -eq 0 ]; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,noexec|" /etc/fstab
    fi


    if mkdir -p "/boot"; then
        if mountpoint -q "/boot"; then
            mount -o remount --target "/boot"
        else
            mount --target "/boot"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_boot_noexec" complexity="low" disruption="high" reboot="false" strategy="configure">- name: 'Add noexec Option to /boot: Check information associated to mountpoint'
  command: findmnt --fstab '/boot'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /boot: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /boot: If /boot not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /boot
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /boot: Make sure noexec option is part of the to /boot
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "noexec" not in mount_info.options
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /boot: Ensure /boot is mounted with noexec option'
  mount:
    path: /boot
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_noexec
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_boot_noexec" complexity="low" disruption="high" reboot="false" strategy="enable">
part /boot --mountoptions="noexec"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_boot_noexec:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_boot_noexec_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_boot_nosuid" severity="medium">
              <xccdf-1.2:title>Add nosuid Option to /boot</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code>/boot</html:code>. The SUID and SGID permissions
should not be required on the boot partition.
Add the <html:code>nosuid</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/boot</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from boot partitions.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_boot_nosuid" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

function perform_remediation {
    
        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/boot")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/boot' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /boot in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /boot)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if [ "$(grep -c "$mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        echo " /boot  defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif [ "$(grep "$mount_point_match_regexp" /etc/fstab | grep -c "nosuid")" -eq 0 ]; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/boot"; then
        if mountpoint -q "/boot"; then
            mount -o remount --target "/boot"
        else
            mount --target "/boot"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_boot_nosuid" complexity="low" disruption="high" reboot="false" strategy="configure">- name: 'Add nosuid Option to /boot: Check information associated to mountpoint'
  command: findmnt --fstab '/boot'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /boot: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /boot: If /boot not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /boot
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /boot: Make sure nosuid option is part of the to /boot
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nosuid" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /boot: Ensure /boot is mounted with nosuid option'
  mount:
    path: /boot
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nosuid
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_boot_nosuid" complexity="low" disruption="high" reboot="false" strategy="enable">
part /boot --mountoptions="nosuid"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_boot_nosuid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_boot_nosuid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev" severity="medium">
              <xccdf-1.2:title>Add nodev Option to /dev/shm</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nodev</html:code> mount option can be used to prevent creation of device
files in <html:code>/dev/shm</html:code>. Legitimate character and block devices should
not exist within temporary directories like <html:code>/dev/shm</html:code>.
Add the <html:code>nodev</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/dev/shm</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The only legitimate location for device files is the <html:code>/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_dev_shm_nodev" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

function perform_remediation {
    


    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /dev/shm)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if [ "$(grep -c "$mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nodev)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        echo "tmpfs /dev/shm tmpfs defaults,${previous_mount_opts}nodev 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif [ "$(grep "$mount_point_match_regexp" /etc/fstab | grep -c "nodev")" -eq 0 ]; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nodev|" /etc/fstab
    fi


    if mkdir -p "/dev/shm"; then
        if mountpoint -q "/dev/shm"; then
            mount -o remount --target "/dev/shm"
        else
            mount --target "/dev/shm"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_dev_shm_nodev" complexity="low" disruption="high" reboot="false" strategy="configure">- name: 'Add nodev Option to /dev/shm: Check information associated to mountpoint'
  command: findmnt  '/dev/shm'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_nodev
    - no_reboot_needed

- name: 'Add nodev Option to /dev/shm: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_nodev
    - no_reboot_needed

- name: 'Add nodev Option to /dev/shm: If /dev/shm not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /dev/shm
      - tmpfs
      - tmpfs
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_nodev
    - no_reboot_needed

- name: 'Add nodev Option to /dev/shm: Make sure nodev option is part of the to /dev/shm
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nodev" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_nodev
    - no_reboot_needed

- name: 'Add nodev Option to /dev/shm: Ensure /dev/shm is mounted with nodev option'
  mount:
    path: /dev/shm
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (""
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_nodev
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_dev_shm_nodev:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_dev_shm_nodev_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec" severity="medium">
              <xccdf-1.2:title>Add noexec Option to /dev/shm</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>noexec</html:code> mount option can be used to prevent binaries
from being executed out of <html:code>/dev/shm</html:code>.
It can be dangerous to allow the execution of binaries
from world-writable temporary storage directories such as <html:code>/dev/shm</html:code>.
Add the <html:code>noexec</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/dev/shm</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Allowing users to execute binaries from world-writable directories
such as <html:code>/dev/shm</html:code> can expose the system to potential compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_dev_shm_noexec" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

function perform_remediation {
    


    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /dev/shm)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if [ "$(grep -c "$mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|noexec)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        echo "tmpfs /dev/shm tmpfs defaults,${previous_mount_opts}noexec 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif [ "$(grep "$mount_point_match_regexp" /etc/fstab | grep -c "noexec")" -eq 0 ]; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,noexec|" /etc/fstab
    fi


    if mkdir -p "/dev/shm"; then
        if mountpoint -q "/dev/shm"; then
            mount -o remount --target "/dev/shm"
        else
            mount --target "/dev/shm"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_dev_shm_noexec" complexity="low" disruption="high" reboot="false" strategy="configure">- name: 'Add noexec Option to /dev/shm: Check information associated to mountpoint'
  command: findmnt  '/dev/shm'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /dev/shm: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /dev/shm: If /dev/shm not mounted, craft mount_info
    manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /dev/shm
      - tmpfs
      - tmpfs
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /dev/shm: Make sure noexec option is part of the to
    /dev/shm options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "noexec" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /dev/shm: Ensure /dev/shm is mounted with noexec option'
  mount:
    path: /dev/shm
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (""
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_noexec
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_dev_shm_noexec:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_dev_shm_noexec_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid" severity="medium">
              <xccdf-1.2:title>Add nosuid Option to /dev/shm</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nosuid</html:code> mount option can be used to prevent execution
of setuid programs in <html:code>/dev/shm</html:code>.  The SUID and SGID permissions should not
be required in these world-writable directories.
Add the <html:code>nosuid</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/dev/shm</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from temporary storage partitions.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_dev_shm_nosuid" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

function perform_remediation {
    


    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /dev/shm)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if [ "$(grep -c "$mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        echo "tmpfs /dev/shm tmpfs defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif [ "$(grep "$mount_point_match_regexp" /etc/fstab | grep -c "nosuid")" -eq 0 ]; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/dev/shm"; then
        if mountpoint -q "/dev/shm"; then
            mount -o remount --target "/dev/shm"
        else
            mount --target "/dev/shm"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_dev_shm_nosuid" complexity="low" disruption="high" reboot="false" strategy="configure">- name: 'Add nosuid Option to /dev/shm: Check information associated to mountpoint'
  command: findmnt  '/dev/shm'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /dev/shm: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /dev/shm: If /dev/shm not mounted, craft mount_info
    manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /dev/shm
      - tmpfs
      - tmpfs
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /dev/shm: Make sure nosuid option is part of the to
    /dev/shm options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nosuid" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /dev/shm: Ensure /dev/shm is mounted with nosuid option'
  mount:
    path: /dev/shm
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (""
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_nosuid
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_dev_shm_nosuid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_dev_shm_nosuid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_home_noexec" severity="medium">
              <xccdf-1.2:title>Add noexec Option to /home</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>noexec</html:code> mount option can be used to prevent binaries from being
executed out of <html:code>/home</html:code>. 
Add the <html:code>noexec</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/home</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>/home</html:code> directory contains data of individual users. Binaries in
this directory should not be considered as trusted and users should not be
able to execute them.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_home_noexec" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

function perform_remediation {
    
        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/home")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/home' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /home in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /home)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if [ "$(grep -c "$mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|noexec)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        echo " /home  defaults,${previous_mount_opts}noexec 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif [ "$(grep "$mount_point_match_regexp" /etc/fstab | grep -c "noexec")" -eq 0 ]; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,noexec|" /etc/fstab
    fi


    if mkdir -p "/home"; then
        if mountpoint -q "/home"; then
            mount -o remount --target "/home"
        else
            mount --target "/home"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_home_noexec" complexity="low" disruption="high" reboot="false" strategy="configure">- name: 'Add noexec Option to /home: Check information associated to mountpoint'
  command: findmnt --fstab '/home'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(b)
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_home_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /home: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-CM-6(b)
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_home_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /home: If /home not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /home
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-CM-6(b)
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_home_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /home: Make sure noexec option is part of the to /home
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "noexec" not in mount_info.options
  tags:
    - NIST-800-53-CM-6(b)
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_home_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /home: Ensure /home is mounted with noexec option'
  mount:
    path: /home
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-CM-6(b)
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_home_noexec
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_home_noexec" complexity="low" disruption="high" reboot="false" strategy="enable">
part /home --mountoptions="noexec"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_home_noexec:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_home_noexec_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions" severity="medium">
              <xccdf-1.2:title>Add nodev Option to Non-Root Local Partitions</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nodev</html:code> mount option prevents files from being interpreted as
character or block devices. Legitimate character and block devices should
exist only in the <html:code>/dev</html:code> directory on the root partition or within
chroot jails built for system services.
Add the <html:code>nodev</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of

    any non-root local partitions.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>nodev</html:code> mount option prevents files from being
interpreted as character or block devices. The only legitimate location
for device files is the <html:code>/dev</html:code> directory located on the root partition.
The only exception to this is chroot jails, for which it is not advised
to set <html:code>nodev</html:code> on these filesystems.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_nodev_nonroot_local_partitions"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

MOUNT_OPTION="nodev"
# Create array of local non-root partitions
readarray -t partitions_records &lt; &lt;(findmnt --mtab --raw --evaluate | grep "^/\w" | grep "\s/dev/\w")

for partition_record in "${partitions_records[@]}"; do
    # Get all important information for fstab
    mount_point="$(echo ${partition_record} | cut -d " " -f1)"
    device="$(echo ${partition_record} | cut -d " " -f2)"
    device_type="$(echo ${partition_record} | cut -d " " -f3)"
    # device and device_type will be used only in case when the device doesn't have fstab record
    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" $mount_point)"

# If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
if [ "$(grep -c "$mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
    # runtime opts without some automatic kernel/userspace-added defaults
    previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                | sed -E "s/(rw|defaults|seclabel|$MOUNT_OPTION)(,|$)//g;s/,$//")
    [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
    echo "$device $mount_point $device_type defaults,${previous_mount_opts}$MOUNT_OPTION 0 0" &gt;&gt; /etc/fstab
# If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
elif [ "$(grep "$mount_point_match_regexp" /etc/fstab | grep -c "$MOUNT_OPTION")" -eq 0 ]; then
    previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
    sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,$MOUNT_OPTION|" /etc/fstab
fi
    if mkdir -p "$mount_point"; then
    if mountpoint -q "$mount_point"; then
        mount -o remount --target "$mount_point"
    else
        mount --target "$mount_point"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_nodev_nonroot_local_partitions" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Ensure non-root local partitions are mounted with nodev option
  mount:
    path: '{{ item.mount }}'
    src: '{{ item.device }}'
    opts: '{{ item.options }},nodev'
    state: mounted
    fstype: '{{ item.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - item.mount is match('/\w')
    - item.options is not search('nodev')
  with_items:
    - '{{ ansible_facts.mounts }}'
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_nodev_nonroot_local_partitions
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_nodev_nonroot_local_partitions:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_nodev_nonroot_local_partitions_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_nodev_removable_partitions" severity="medium">
              <xccdf-1.2:title>Add nodev Option to Removable Media Partitions</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nodev</html:code> mount option prevents files from being
interpreted as character or block devices.
Legitimate character and block devices should exist only in
the <html:code>/dev</html:code> directory on the root partition or within chroot
jails built for system services.
Add the <html:code>nodev</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of

    any removable media partitions.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The only legitimate location for device files is the <html:code>/dev</html:code> directory
located on the root partition. An exception to this is chroot jails, and it is
not advised to set <html:code>nodev</html:code> on partitions which contain their root
filesystems.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_nodev_removable_partitions" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

var_removable_partition='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_removable_partition" use="legacy"/>'


device_regex="^\s*$var_removable_partition\s\+"
mount_option="nodev"

if grep -q $device_regex /etc/fstab ; then
    previous_opts=$(grep $device_regex /etc/fstab | awk '{print $4}')
    sed -i "s|\($device_regex.*$previous_opts\)|\1,$mount_option|" /etc/fstab
else
    echo "Not remediating, because there is no record of $var_removable_partition in /etc/fstab" &gt;&amp;2
    return 1
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_nodev_removable_partitions" complexity="low" disruption="high" reboot="false" strategy="configure">- name: XCCDF Value var_removable_partition # promote to variable
  set_fact:
    var_removable_partition: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_removable_partition" use="legacy"/>
  tags:
    - always

- name: Ensure permission nodev are set on var_removable_partition
  lineinfile:
    path: /etc/fstab
    regexp: ^\s*({{ var_removable_partition }})\s+([^\s]*)\s+([^\s]*)\s+([^\s]*)(.*)$
    backrefs: true
    line: \1 \2 \3 \4,nodev \5
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_nodev_removable_partitions
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_removable_partition:var:1" value-id="xccdf_org.ssgproject.content_value_var_removable_partition"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_nodev_removable_partitions:def:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_noexec_removable_partitions" severity="medium">
              <xccdf-1.2:title>Add noexec Option to Removable Media Partitions</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>noexec</html:code> mount option prevents the direct execution of binaries
on the mounted filesystem. Preventing the direct execution of binaries from
removable media (such as a USB key) provides a defense against malicious
software that may be present on such untrusted media.
Add the <html:code>noexec</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of

    any removable media partitions.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000087</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Allowing users to execute binaries from removable media such as USB keys exposes
the system to potential compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_noexec_removable_partitions" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

var_removable_partition='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_removable_partition" use="legacy"/>'


device_regex="^\s*$var_removable_partition\s\+"
mount_option="noexec"

if grep -q $device_regex /etc/fstab ; then
    previous_opts=$(grep $device_regex /etc/fstab | awk '{print $4}')
    sed -i "s|\($device_regex.*$previous_opts\)|\1,$mount_option|" /etc/fstab
else
    echo "Not remediating, because there is no record of $var_removable_partition in /etc/fstab" &gt;&amp;2
    return 1
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_noexec_removable_partitions" complexity="low" disruption="high" reboot="false" strategy="configure">- name: XCCDF Value var_removable_partition # promote to variable
  set_fact:
    var_removable_partition: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_removable_partition" use="legacy"/>
  tags:
    - always

- name: Ensure permission noexec are set on var_removable_partition
  lineinfile:
    path: /etc/fstab
    regexp: ^\s*({{ var_removable_partition }})\s+([^\s]*)\s+([^\s]*)\s+([^\s]*)(.*)$
    backrefs: true
    line: \1 \2 \3 \4,noexec \5
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_noexec_removable_partitions
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_removable_partition:var:1" value-id="xccdf_org.ssgproject.content_value_var_removable_partition"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_noexec_removable_partitions:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_noexec_removable_partitions_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_nosuid_removable_partitions" severity="medium">
              <xccdf-1.2:title>Add nosuid Option to Removable Media Partitions</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nosuid</html:code> mount option prevents set-user-identifier (SUID)
and set-group-identifier (SGID) permissions from taking effect. These permissions
allow users to execute binaries with the same permissions as the owner and group
of the file respectively. Users should not be allowed to introduce SUID and SGID
files into the system via partitions mounted from removeable media.
Add the <html:code>nosuid</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of

    any removable media partitions.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The presence of SUID and SGID executables should be tightly controlled. Allowing
users to introduce SUID or SGID binaries from partitions mounted off of
removable media would allow them to introduce their own highly-privileged programs.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_nosuid_removable_partitions" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

var_removable_partition='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_removable_partition" use="legacy"/>'


device_regex="^\s*$var_removable_partition\s\+"
mount_option="nosuid"

if grep -q $device_regex /etc/fstab ; then
    previous_opts=$(grep $device_regex /etc/fstab | awk '{print $4}')
    sed -i "s|\($device_regex.*$previous_opts\)|\1,$mount_option|" /etc/fstab
else
    echo "Not remediating, because there is no record of $var_removable_partition in /etc/fstab" &gt;&amp;2
    return 1
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_nosuid_removable_partitions" complexity="low" disruption="high" reboot="false" strategy="configure">- name: XCCDF Value var_removable_partition # promote to variable
  set_fact:
    var_removable_partition: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_removable_partition" use="legacy"/>
  tags:
    - always

- name: Ensure permission nosuid are set on var_removable_partition
  lineinfile:
    path: /etc/fstab
    regexp: ^\s*({{ var_removable_partition }})\s+([^\s]*)\s+([^\s]*)\s+([^\s]*)(.*)$
    backrefs: true
    line: \1 \2 \3 \4,nosuid \5
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_nosuid_removable_partitions
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_removable_partition:var:1" value-id="xccdf_org.ssgproject.content_value_var_removable_partition"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_nosuid_removable_partitions:def:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_opt_nosuid" severity="medium">
              <xccdf-1.2:title>Add nosuid Option to /opt</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code>/opt</html:code>. The SUID and SGID permissions
should not be required in this directory.
Add the <html:code>nosuid</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/opt</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The presence of SUID and SGID executables should be tightly controlled. The
<html:code>/opt</html:code> directory contains additional software packages. Users should
not be able to execute SUID or SGID binaries from this directory.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_opt_nosuid" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

function perform_remediation {
    
        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/opt")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/opt' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /opt in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /opt)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if [ "$(grep -c "$mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        echo " /opt  defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif [ "$(grep "$mount_point_match_regexp" /etc/fstab | grep -c "nosuid")" -eq 0 ]; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/opt"; then
        if mountpoint -q "/opt"; then
            mount -o remount --target "/opt"
        else
            mount --target "/opt"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_opt_nosuid" complexity="low" disruption="high" reboot="false" strategy="configure">- name: 'Add nosuid Option to /opt: Check information associated to mountpoint'
  command: findmnt --fstab '/opt'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_opt_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /opt: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_opt_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /opt: If /opt not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /opt
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_opt_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /opt: Make sure nosuid option is part of the to /opt
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nosuid" not in mount_info.options
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_opt_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /opt: Ensure /opt is mounted with nosuid option'
  mount:
    path: /opt
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_opt_nosuid
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_opt_nosuid" complexity="low" disruption="high" reboot="false" strategy="enable">
part /opt --mountoptions="nosuid"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_opt_nosuid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_opt_nosuid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_proc_hidepid" severity="low">
              <xccdf-1.2:title>Add hidepid Option to /proc</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>hidepid</html:code> mount option is applicable to <html:code>/proc</html:code> and is used to
control who can access the information in <html:code>/proc/[pid]</html:code> directories.
The option can have one of the following values:
<html:pre>
0: Everybody may access all /proc/[pid] directories.
1: Users may not access files and subdirectories inside any /proc/[pid] directories
   but their own. The /proc/[pid] directories themselves remain visible.
2: Same as for mode 1, but in addition the /proc/[pid] directories belonging to other
   users become invisible.
</html:pre>
For example, if you choose the value 2:
Add the <html:code>hidepid=2</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/proc</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:warning category="functionality">Hiding the <html:code>pid</html:code> of processes may lead to problems with <html:code>PolicyKit</html:code> and <html:code>D-Bus</html:code>,
it may also convey a false sense of security.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Users should not be able to see and access directories within /proc, which are not
related to their own processes in a system. Otherwise, sensitive information from
other users could be seem.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_proc_hidepid" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

function perform_remediation {
    


    var_mount_option_proc_hidepid='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_mount_option_proc_hidepid" use="legacy"/>'

    mountoption="hidepid=$var_mount_option_proc_hidepid"
    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /proc)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if [ "$(grep -c "$mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|$mountoption)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        echo "proc /proc proc defaults,${previous_mount_opts}$mountoption 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif [ "$(grep "$mount_point_match_regexp" /etc/fstab | grep -c "$mountoption")" -eq 0 ]; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,$mountoption|" /etc/fstab
    fi


    if mkdir -p "/proc"; then
        if mountpoint -q "/proc"; then
            mount -o remount --target "/proc"
        else
            mount --target "/proc"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_proc_hidepid" complexity="low" disruption="high" reboot="false" strategy="configure">- name: XCCDF Value var_mount_option_proc_hidepid # promote to variable
  set_fact:
    var_mount_option_proc_hidepid: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_mount_option_proc_hidepid" use="legacy"/>
  tags:
    - always

- name: 'Add hidepid Option to /proc: Check information associated to mountpoint'
  command: findmnt  '/proc'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_proc_hidepid
    - no_reboot_needed

- name: 'Add hidepid Option to /proc: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_proc_hidepid
    - no_reboot_needed

- name: 'Add hidepid Option to /proc: If /proc not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /proc
      - proc
      - proc
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_proc_hidepid
    - no_reboot_needed

- name: 'Add hidepid Option to /proc: Make sure hidepid option is part of the to /proc
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',hidepid=''~var_mount_option_proc_hidepid~''''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "hidepid" not in mount_info.options
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_proc_hidepid
    - no_reboot_needed

- name: 'Add hidepid Option to /proc: Ensure /proc is mounted with hidepid option'
  mount:
    path: /proc
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (""
      | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_proc_hidepid
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_mount_option_proc_hidepid:var:1" value-id="xccdf_org.ssgproject.content_value_var_mount_option_proc_hidepid"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_proc_hidepid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_proc_hidepid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_srv_nosuid" severity="medium">
              <xccdf-1.2:title>Add nosuid Option to /srv</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code>/srv</html:code>. The SUID and SGID permissions
should not be required in this directory.
Add the <html:code>nosuid</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/srv</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The presence of SUID and SGID executables should be tightly controlled. The
<html:code>/srv</html:code> directory contains files served by various network services such as FTP. Users should
not be able to execute SUID or SGID binaries from this directory.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_srv_nosuid" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

function perform_remediation {
    
        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/srv")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/srv' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /srv in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /srv)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if [ "$(grep -c "$mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        echo " /srv  defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif [ "$(grep "$mount_point_match_regexp" /etc/fstab | grep -c "nosuid")" -eq 0 ]; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/srv"; then
        if mountpoint -q "/srv"; then
            mount -o remount --target "/srv"
        else
            mount --target "/srv"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_srv_nosuid" complexity="low" disruption="high" reboot="false" strategy="configure">- name: 'Add nosuid Option to /srv: Check information associated to mountpoint'
  command: findmnt --fstab '/srv'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_srv_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /srv: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_srv_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /srv: If /srv not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /srv
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_srv_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /srv: Make sure nosuid option is part of the to /srv
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nosuid" not in mount_info.options
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_srv_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /srv: Ensure /srv is mounted with nosuid option'
  mount:
    path: /srv
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_srv_nosuid
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_srv_nosuid" complexity="low" disruption="high" reboot="false" strategy="enable">
part /srv --mountoptions="nosuid"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_srv_nosuid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_srv_nosuid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev" severity="medium">
              <xccdf-1.2:title>Add nodev Option to /tmp</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nodev</html:code> mount option can be used to prevent device files from
being created in <html:code>/tmp</html:code>. Legitimate character and block devices
should not exist within temporary directories like <html:code>/tmp</html:code>.
Add the <html:code>nodev</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/tmp</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The only legitimate location for device files is the <html:code>/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_tmp_nodev" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

function perform_remediation {
    
        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/tmp")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/tmp' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /tmp in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /tmp)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if [ "$(grep -c "$mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nodev)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        echo " /tmp  defaults,${previous_mount_opts}nodev 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif [ "$(grep "$mount_point_match_regexp" /etc/fstab | grep -c "nodev")" -eq 0 ]; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nodev|" /etc/fstab
    fi


    if mkdir -p "/tmp"; then
        if mountpoint -q "/tmp"; then
            mount -o remount --target "/tmp"
        else
            mount --target "/tmp"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_tmp_nodev" complexity="low" disruption="high" reboot="false" strategy="configure">- name: 'Add nodev Option to /tmp: Check information associated to mountpoint'
  command: findmnt --fstab '/tmp'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nodev
    - no_reboot_needed

- name: 'Add nodev Option to /tmp: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nodev
    - no_reboot_needed

- name: 'Add nodev Option to /tmp: If /tmp not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /tmp
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nodev
    - no_reboot_needed

- name: 'Add nodev Option to /tmp: Make sure nodev option is part of the to /tmp options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nodev" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nodev
    - no_reboot_needed

- name: 'Add nodev Option to /tmp: Ensure /tmp is mounted with nodev option'
  mount:
    path: /tmp
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nodev
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_tmp_nodev" complexity="low" disruption="high" reboot="false" strategy="enable">
part /tmp --mountoptions="nodev"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_tmp_nodev:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_tmp_nodev_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec" severity="medium">
              <xccdf-1.2:title>Add noexec Option to /tmp</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>noexec</html:code> mount option can be used to prevent binaries
from being executed out of <html:code>/tmp</html:code>.
Add the <html:code>noexec</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/tmp</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Allowing users to execute binaries from world-writable directories
such as <html:code>/tmp</html:code> should never be necessary in normal operation and
can expose the system to potential compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_tmp_noexec" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

function perform_remediation {
    
        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/tmp")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/tmp' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /tmp in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /tmp)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if [ "$(grep -c "$mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|noexec)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        echo " /tmp  defaults,${previous_mount_opts}noexec 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif [ "$(grep "$mount_point_match_regexp" /etc/fstab | grep -c "noexec")" -eq 0 ]; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,noexec|" /etc/fstab
    fi


    if mkdir -p "/tmp"; then
        if mountpoint -q "/tmp"; then
            mount -o remount --target "/tmp"
        else
            mount --target "/tmp"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_tmp_noexec" complexity="low" disruption="high" reboot="false" strategy="configure">- name: 'Add noexec Option to /tmp: Check information associated to mountpoint'
  command: findmnt --fstab '/tmp'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /tmp: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /tmp: If /tmp not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /tmp
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /tmp: Make sure noexec option is part of the to /tmp
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "noexec" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /tmp: Ensure /tmp is mounted with noexec option'
  mount:
    path: /tmp
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_noexec
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_tmp_noexec" complexity="low" disruption="high" reboot="false" strategy="enable">
part /tmp --mountoptions="noexec"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_tmp_noexec:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_tmp_noexec_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid" severity="medium">
              <xccdf-1.2:title>Add nosuid Option to /tmp</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code>/tmp</html:code>. The SUID and SGID permissions
should not be required in these world-writable directories.
Add the <html:code>nosuid</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/tmp</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from temporary storage partitions.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_tmp_nosuid" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

function perform_remediation {
    
        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/tmp")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/tmp' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /tmp in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /tmp)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if [ "$(grep -c "$mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        echo " /tmp  defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif [ "$(grep "$mount_point_match_regexp" /etc/fstab | grep -c "nosuid")" -eq 0 ]; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/tmp"; then
        if mountpoint -q "/tmp"; then
            mount -o remount --target "/tmp"
        else
            mount --target "/tmp"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_tmp_nosuid" complexity="low" disruption="high" reboot="false" strategy="configure">- name: 'Add nosuid Option to /tmp: Check information associated to mountpoint'
  command: findmnt --fstab '/tmp'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /tmp: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /tmp: If /tmp not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /tmp
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /tmp: Make sure nosuid option is part of the to /tmp
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nosuid" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /tmp: Ensure /tmp is mounted with nosuid option'
  mount:
    path: /tmp
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nosuid
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_tmp_nosuid" complexity="low" disruption="high" reboot="false" strategy="enable">
part /tmp --mountoptions="nosuid"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_tmp_nosuid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_tmp_nosuid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev" severity="medium">
              <xccdf-1.2:title>Add nodev Option to /var/log/audit</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nodev</html:code> mount option can be used to prevent device files from
being created in <html:code>/var/log/audit</html:code>.
Legitimate character and block devices should exist only in
the <html:code>/dev</html:code> directory on the root partition or within chroot
jails built for system services.
Add the <html:code>nodev</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/var/log/audit</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The only legitimate location for device files is the <html:code>/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_var_log_audit_nodev" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

function perform_remediation {
    
        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/var/log/audit")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var/log/audit' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var/log/audit in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /var/log/audit)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if [ "$(grep -c "$mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nodev)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        echo " /var/log/audit  defaults,${previous_mount_opts}nodev 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif [ "$(grep "$mount_point_match_regexp" /etc/fstab | grep -c "nodev")" -eq 0 ]; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nodev|" /etc/fstab
    fi


    if mkdir -p "/var/log/audit"; then
        if mountpoint -q "/var/log/audit"; then
            mount -o remount --target "/var/log/audit"
        else
            mount --target "/var/log/audit"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_var_log_audit_nodev" complexity="low" disruption="high" reboot="false" strategy="configure">- name: 'Add nodev Option to /var/log/audit: Check information associated to mountpoint'
  command: findmnt --fstab '/var/log/audit'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nodev
    - no_reboot_needed

- name: 'Add nodev Option to /var/log/audit: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nodev
    - no_reboot_needed

- name: 'Add nodev Option to /var/log/audit: If /var/log/audit not mounted, craft
    mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /var/log/audit
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nodev
    - no_reboot_needed

- name: 'Add nodev Option to /var/log/audit: Make sure nodev option is part of the
    to /var/log/audit options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nodev" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nodev
    - no_reboot_needed

- name: 'Add nodev Option to /var/log/audit: Ensure /var/log/audit is mounted with
    nodev option'
  mount:
    path: /var/log/audit
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nodev
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_var_log_audit_nodev" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var/log/audit --mountoptions="nodev"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_var_log_audit_nodev:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_var_log_audit_nodev_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec" severity="medium">
              <xccdf-1.2:title>Add noexec Option to /var/log/audit</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>noexec</html:code> mount option can be used to prevent binaries
from being executed out of <html:code>/var/log/audit</html:code>.
Add the <html:code>noexec</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/var/log/audit</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Allowing users to execute binaries from directories containing audit log files
such as <html:code>/var/log/audit</html:code> should never be necessary in normal operation and
can expose the system to potential compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_var_log_audit_noexec" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

function perform_remediation {
    
        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/var/log/audit")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var/log/audit' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var/log/audit in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /var/log/audit)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if [ "$(grep -c "$mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|noexec)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        echo " /var/log/audit  defaults,${previous_mount_opts}noexec 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif [ "$(grep "$mount_point_match_regexp" /etc/fstab | grep -c "noexec")" -eq 0 ]; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,noexec|" /etc/fstab
    fi


    if mkdir -p "/var/log/audit"; then
        if mountpoint -q "/var/log/audit"; then
            mount -o remount --target "/var/log/audit"
        else
            mount --target "/var/log/audit"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_var_log_audit_noexec" complexity="low" disruption="high" reboot="false" strategy="configure">- name: 'Add noexec Option to /var/log/audit: Check information associated to mountpoint'
  command: findmnt --fstab '/var/log/audit'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /var/log/audit: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /var/log/audit: If /var/log/audit not mounted, craft
    mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /var/log/audit
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /var/log/audit: Make sure noexec option is part of the
    to /var/log/audit options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "noexec" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /var/log/audit: Ensure /var/log/audit is mounted with
    noexec option'
  mount:
    path: /var/log/audit
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_noexec
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_var_log_audit_noexec" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var/log/audit --mountoptions="noexec"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_var_log_audit_noexec:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_var_log_audit_noexec_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid" severity="medium">
              <xccdf-1.2:title>Add nosuid Option to /var/log/audit</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code>/var/log/audit</html:code>. The SUID and SGID permissions
should not be required in directories containing audit log files.
Add the <html:code>nosuid</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/var/log/audit</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from partitions
designated for audit log files.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_var_log_audit_nosuid" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

function perform_remediation {
    
        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/var/log/audit")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var/log/audit' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var/log/audit in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /var/log/audit)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if [ "$(grep -c "$mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        echo " /var/log/audit  defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif [ "$(grep "$mount_point_match_regexp" /etc/fstab | grep -c "nosuid")" -eq 0 ]; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/var/log/audit"; then
        if mountpoint -q "/var/log/audit"; then
            mount -o remount --target "/var/log/audit"
        else
            mount --target "/var/log/audit"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_var_log_audit_nosuid" complexity="low" disruption="high" reboot="false" strategy="configure">- name: 'Add nosuid Option to /var/log/audit: Check information associated to mountpoint'
  command: findmnt --fstab '/var/log/audit'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /var/log/audit: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /var/log/audit: If /var/log/audit not mounted, craft
    mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /var/log/audit
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /var/log/audit: Make sure nosuid option is part of the
    to /var/log/audit options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nosuid" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /var/log/audit: Ensure /var/log/audit is mounted with
    nosuid option'
  mount:
    path: /var/log/audit
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nosuid
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_var_log_audit_nosuid" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var/log/audit --mountoptions="nosuid"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_var_log_audit_nosuid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_var_log_audit_nosuid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev" severity="medium">
              <xccdf-1.2:title>Add nodev Option to /var/log</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nodev</html:code> mount option can be used to prevent device files from
being created in <html:code>/var/log</html:code>.
Legitimate character and block devices should exist only in
the <html:code>/dev</html:code> directory on the root partition or within chroot
jails built for system services.
Add the <html:code>nodev</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/var/log</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The only legitimate location for device files is the <html:code>/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_var_log_nodev" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

function perform_remediation {
    
        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/var/log")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var/log' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var/log in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /var/log)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if [ "$(grep -c "$mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nodev)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        echo " /var/log  defaults,${previous_mount_opts}nodev 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif [ "$(grep "$mount_point_match_regexp" /etc/fstab | grep -c "nodev")" -eq 0 ]; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nodev|" /etc/fstab
    fi


    if mkdir -p "/var/log"; then
        if mountpoint -q "/var/log"; then
            mount -o remount --target "/var/log"
        else
            mount --target "/var/log"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_var_log_nodev" complexity="low" disruption="high" reboot="false" strategy="configure">- name: 'Add nodev Option to /var/log: Check information associated to mountpoint'
  command: findmnt --fstab '/var/log'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nodev
    - no_reboot_needed

- name: 'Add nodev Option to /var/log: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nodev
    - no_reboot_needed

- name: 'Add nodev Option to /var/log: If /var/log not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /var/log
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nodev
    - no_reboot_needed

- name: 'Add nodev Option to /var/log: Make sure nodev option is part of the to /var/log
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nodev" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nodev
    - no_reboot_needed

- name: 'Add nodev Option to /var/log: Ensure /var/log is mounted with nodev option'
  mount:
    path: /var/log
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nodev
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_var_log_nodev" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var/log --mountoptions="nodev"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_var_log_nodev:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_var_log_nodev_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec" severity="medium">
              <xccdf-1.2:title>Add noexec Option to /var/log</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>noexec</html:code> mount option can be used to prevent binaries
from being executed out of <html:code>/var/log</html:code>.
Add the <html:code>noexec</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/var/log</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Allowing users to execute binaries from directories containing log files
such as <html:code>/var/log</html:code> should never be necessary in normal operation and
can expose the system to potential compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_var_log_noexec" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

function perform_remediation {
    
        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/var/log")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var/log' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var/log in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /var/log)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if [ "$(grep -c "$mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|noexec)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        echo " /var/log  defaults,${previous_mount_opts}noexec 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif [ "$(grep "$mount_point_match_regexp" /etc/fstab | grep -c "noexec")" -eq 0 ]; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,noexec|" /etc/fstab
    fi


    if mkdir -p "/var/log"; then
        if mountpoint -q "/var/log"; then
            mount -o remount --target "/var/log"
        else
            mount --target "/var/log"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_var_log_noexec" complexity="low" disruption="high" reboot="false" strategy="configure">- name: 'Add noexec Option to /var/log: Check information associated to mountpoint'
  command: findmnt --fstab '/var/log'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /var/log: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /var/log: If /var/log not mounted, craft mount_info
    manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /var/log
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /var/log: Make sure noexec option is part of the to
    /var/log options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "noexec" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /var/log: Ensure /var/log is mounted with noexec option'
  mount:
    path: /var/log
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_noexec
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_var_log_noexec" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var/log --mountoptions="noexec"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_var_log_noexec:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_var_log_noexec_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid" severity="medium">
              <xccdf-1.2:title>Add nosuid Option to /var/log</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code>/var/log</html:code>. The SUID and SGID permissions
should not be required in directories containing log files.
Add the <html:code>nosuid</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/var/log</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from partitions
designated for log files.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_var_log_nosuid" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

function perform_remediation {
    
        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/var/log")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var/log' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var/log in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /var/log)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if [ "$(grep -c "$mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        echo " /var/log  defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif [ "$(grep "$mount_point_match_regexp" /etc/fstab | grep -c "nosuid")" -eq 0 ]; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/var/log"; then
        if mountpoint -q "/var/log"; then
            mount -o remount --target "/var/log"
        else
            mount --target "/var/log"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_var_log_nosuid" complexity="low" disruption="high" reboot="false" strategy="configure">- name: 'Add nosuid Option to /var/log: Check information associated to mountpoint'
  command: findmnt --fstab '/var/log'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /var/log: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /var/log: If /var/log not mounted, craft mount_info
    manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /var/log
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /var/log: Make sure nosuid option is part of the to
    /var/log options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nosuid" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nosuid
    - no_reboot_needed

- name: 'Add nosuid Option to /var/log: Ensure /var/log is mounted with nosuid option'
  mount:
    path: /var/log
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nosuid
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_var_log_nosuid" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var/log --mountoptions="nosuid"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_var_log_nosuid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_var_log_nosuid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_var_nodev" severity="medium">
              <xccdf-1.2:title>Add nodev Option to /var</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nodev</html:code> mount option can be used to prevent device files from
being created in <html:code>/var</html:code>.
Legitimate character and block devices should exist only in
the <html:code>/dev</html:code> directory on the root partition or within chroot
jails built for system services.
Add the <html:code>nodev</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/var</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The only legitimate location for device files is the <html:code>/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_var_nodev" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

function perform_remediation {
    
        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/var")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /var)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if [ "$(grep -c "$mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nodev)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        echo " /var  defaults,${previous_mount_opts}nodev 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif [ "$(grep "$mount_point_match_regexp" /etc/fstab | grep -c "nodev")" -eq 0 ]; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nodev|" /etc/fstab
    fi


    if mkdir -p "/var"; then
        if mountpoint -q "/var"; then
            mount -o remount --target "/var"
        else
            mount --target "/var"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_var_nodev" complexity="low" disruption="high" reboot="false" strategy="configure">- name: 'Add nodev Option to /var: Check information associated to mountpoint'
  command: findmnt --fstab '/var'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_nodev
    - no_reboot_needed

- name: 'Add nodev Option to /var: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_nodev
    - no_reboot_needed

- name: 'Add nodev Option to /var: If /var not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /var
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_nodev
    - no_reboot_needed

- name: 'Add nodev Option to /var: Make sure nodev option is part of the to /var options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nodev" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_nodev
    - no_reboot_needed

- name: 'Add nodev Option to /var: Ensure /var is mounted with nodev option'
  mount:
    path: /var
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_nodev
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_var_nodev" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var --mountoptions="nodev"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_var_nodev:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_var_nodev_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_var_noexec" severity="medium">
              <xccdf-1.2:title>Add noexec Option to /var</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>noexec</html:code> mount option can be used to prevent binaries from being
executed out of <html:code>/var</html:code>. 
Add the <html:code>noexec</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/var</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>/var</html:code> directory contains variable system data such as logs,
mails and caches. No binaries should be executed from this directory.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_var_noexec" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

function perform_remediation {
    
        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/var")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /var)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if [ "$(grep -c "$mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|noexec)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        echo " /var  defaults,${previous_mount_opts}noexec 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif [ "$(grep "$mount_point_match_regexp" /etc/fstab | grep -c "noexec")" -eq 0 ]; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,noexec|" /etc/fstab
    fi


    if mkdir -p "/var"; then
        if mountpoint -q "/var"; then
            mount -o remount --target "/var"
        else
            mount --target "/var"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_var_noexec" complexity="low" disruption="high" reboot="false" strategy="configure">- name: 'Add noexec Option to /var: Check information associated to mountpoint'
  command: findmnt --fstab '/var'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /var: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /var: If /var not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /var
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /var: Make sure noexec option is part of the to /var
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "noexec" not in mount_info.options
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_noexec
    - no_reboot_needed

- name: 'Add noexec Option to /var: Ensure /var is mounted with noexec option'
  mount:
    path: /var
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_noexec
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_var_noexec" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var --mountoptions="noexec"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_var_noexec:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_var_noexec_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_var_nosuid" severity="unknown">
              <xccdf-1.2:title>Add nosuid Option to /var</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code>/var</html:code>. The SUID and SGID permissions
should not be required for this directory.
Add the <html:code>nosuid</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/var</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R12)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The presence of SUID and SGID executables should be tightly controlled.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_var_nosuid" reboot="false"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

function perform_remediation {
    
        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/var")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /var)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if [ "$(grep -c "$mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        echo " /var  defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif [ "$(grep "$mount_point_match_regexp" /etc/fstab | grep -c "nosuid")" -eq 0 ]; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/var"; then
        if mountpoint -q "/var"; then
            mount -o remount --target "/var"
        else
            mount --target "/var"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_var_nosuid" complexity="low" disruption="high" reboot="false" strategy="configure">- name: 'Add nosuid Option to /var: Check information associated to mountpoint'
  command: findmnt --fstab '/var'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - mount_option_var_nosuid
    - no_reboot_needed
    - unknown_severity

- name: 'Add nosuid Option to /var: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - mount_option_var_nosuid
    - no_reboot_needed
    - unknown_severity

- name: 'Add nosuid Option to /var: If /var not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /var
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - mount_option_var_nosuid
    - no_reboot_needed
    - unknown_severity

- name: 'Add nosuid Option to /var: Make sure nosuid option is part of the to /var
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "nosuid" not in mount_info.options
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - mount_option_var_nosuid
    - no_reboot_needed
    - unknown_severity

- name: 'Add nosuid Option to /var: Ensure /var is mounted with nosuid option'
  mount:
    path: /var
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - configure_strategy
    - high_disruption
    - low_complexity
    - mount_option_var_nosuid
    - no_reboot_needed
    - unknown_severity
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_var_nosuid" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var --mountoptions="nosuid"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_var_nosuid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-mount_option_var_nosuid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_bind" severity="unknown">
              <xccdf-1.2:title>Bind Mount /var/tmp To /tmp</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>/var/tmp</html:code> directory is a world-writable directory. Bind-mount
it to <html:code>/tmp</html:code> in order to consolidate temporary storage into one
location protected by the same techniques as <html:code>/tmp</html:code>. To do so, edit
<html:code>/etc/fstab</html:code> and add the following line:
<html:pre>/tmp     /var/tmp     none     rw,nodev,noexec,nosuid,bind     0 0</html:pre>
See the <html:code>mount(8)</html:code> man page for further explanation of bind mounting.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Having multiple locations for temporary storage is not required. Unless absolutely
necessary to meet requirements, the storage location <html:code>/var/tmp</html:code> should be bind mounted to
<html:code>/tmp</html:code> and thus share the same protections.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_var_tmp_bind"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Delete particular /etc/fstab's row if /var/tmp is already configured to
# represent a mount point (for some device or filesystem other than /tmp)
if grep -q -P '.*\/var\/tmp.*' /etc/fstab
then
  sed -i '/.*\/var\/tmp.*/d' /etc/fstab
fi
umount /var/tmp

# Bind-mount /var/tmp to /tmp via /etc/fstab (preserving the /etc/fstab form)
printf "%-24s%-24s%-8s%-32s%-3s\n" "/tmp" "/var/tmp" "none" "rw,nodev,noexec,nosuid,bind" "0 0" &gt;&gt; /etc/fstab

mkdir -p /var/tmp
mount -B /tmp /var/tmp

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_var_tmp_bind" complexity="low" disruption="high" reboot="false" strategy="configure">- name: 'Bind Mount /var/tmp To /tmp: Check information associated to mountpoint'
  command: findmnt --fstab '/var/tmp'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - mount_option_var_tmp_bind
    - no_reboot_needed
    - unknown_severity

- name: 'Bind Mount /var/tmp To /tmp: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - mount_option_var_tmp_bind
    - no_reboot_needed
    - unknown_severity

- name: 'Bind Mount /var/tmp To /tmp: If /var/tmp not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /var/tmp
      - ''
      - ''
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("--fstab" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - mount_option_var_tmp_bind
    - no_reboot_needed
    - unknown_severity

- name: 'Bind Mount /var/tmp To /tmp: Make sure bind option is part of the to /var/tmp
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',bind''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "bind" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - mount_option_var_tmp_bind
    - no_reboot_needed
    - unknown_severity

- name: 'Bind Mount /var/tmp To /tmp: Ensure /var/tmp is mounted with bind option'
  mount:
    path: /var/tmp
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - mount_option_var_tmp_bind
    - no_reboot_needed
    - unknown_severity
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_var_tmp_bind" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var/tmp --mountoptions="bind"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-mount_option_var_tmp_bind:def:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_permissions_local">
            <xccdf-1.2:title>Verify Permissions on Important Files and
Directories Are Configured in /etc/permissions.local</xccdf-1.2:title>
            <xccdf-1.2:description>Permissions for many files on a system must be set
restrictively to ensure sensitive information is properly protected.
This section discusses the <html:code>/etc/permissions.local</html:code> file, where
expected permissions can be configured to be checked and fixed through
usage of the <html:code>chkstat</html:code> command.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_restrictions">
            <xccdf-1.2:title>Restrict Programs from Dangerous Execution Patterns</xccdf-1.2:title>
            <xccdf-1.2:description>The recommendations in this section are designed to
ensure that the system's features to protect against potentially
dangerous program execution are activated.
These protections are applied at the system initialization or
kernel level, and defend against certain types of badly-configured
or compromised programs.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_core_pattern" severity="medium">
              <xccdf-1.2:title>Disable storing core dumps</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.core_pattern</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.core_pattern=|/bin/false</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.core_pattern = |/bin/false</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(10)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data and is generally useful
only for developers trying to debug problems.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_core_pattern" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of kernel.core_pattern from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*kernel.core_pattern.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "kernel.core_pattern" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for kernel.core_pattern
#
/sbin/sysctl -q -n -w kernel.core_pattern="|/bin/false"

#
# If kernel.core_pattern present in /etc/sysctl.conf, change value to "|/bin/false"
#	else, add "kernel.core_pattern = |/bin/false" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.core_pattern")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "|/bin/false"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.core_pattern\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^kernel.core_pattern\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_core_pattern" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*kernel.core_pattern.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_core_pattern

- name: Comment out any occurrences of kernel.core_pattern from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.core_pattern
    replace: '#kernel.core_pattern'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_core_pattern

- name: Ensure sysctl kernel.core_pattern is set to |/bin/false
  sysctl:
    name: kernel.core_pattern
    value: '|/bin/false'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_core_pattern
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_kernel_core_pattern">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,kernel.core_pattern%20%3D%20%7C/bin/false%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_kernel_core_pattern.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_kernel_core_pattern:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_kernel_core_pattern_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_dmesg_restrict" severity="low">
              <xccdf-1.2:title>Restrict Access to Kernel Message Buffer</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.dmesg_restrict</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.dmesg_restrict=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.dmesg_restrict = 1</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R23)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-11(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-11(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000132-GPOS-00067</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000138-GPOS-00069</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Unprivileged access to the kernel syslog can expose sensitive kernel
address information.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_dmesg_restrict" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of kernel.dmesg_restrict from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*kernel.dmesg_restrict.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "kernel.dmesg_restrict" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for kernel.dmesg_restrict
#
/sbin/sysctl -q -n -w kernel.dmesg_restrict="1"

#
# If kernel.dmesg_restrict present in /etc/sysctl.conf, change value to "1"
#	else, add "kernel.dmesg_restrict = 1" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.dmesg_restrict")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.dmesg_restrict\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^kernel.dmesg_restrict\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_dmesg_restrict" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*kernel.dmesg_restrict.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.5
    - NIST-800-53-SI-11(a)
    - NIST-800-53-SI-11(b)
    - disable_strategy
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
    - sysctl_kernel_dmesg_restrict

- name: Comment out any occurrences of kernel.dmesg_restrict from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.dmesg_restrict
    replace: '#kernel.dmesg_restrict'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.5
    - NIST-800-53-SI-11(a)
    - NIST-800-53-SI-11(b)
    - disable_strategy
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
    - sysctl_kernel_dmesg_restrict

- name: Ensure sysctl kernel.dmesg_restrict is set to 1
  sysctl:
    name: kernel.dmesg_restrict
    value: '1'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.5
    - NIST-800-53-SI-11(a)
    - NIST-800-53-SI-11(b)
    - disable_strategy
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
    - sysctl_kernel_dmesg_restrict
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_kernel_dmesg_restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,kernel.dmesg_restrict%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_kernel_dmesg_restrict.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_kernel_dmesg_restrict:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_kernel_dmesg_restrict_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_kexec_load_disabled" severity="medium">
              <xccdf-1.2:title>Disable Kernel Image Loading</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.kexec_load_disabled</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.kexec_load_disabled=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.kexec_load_disabled = 1</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001749</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000366-GPOS-00153</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Disabling kexec_load allows greater control of the kernel memory.
It makes it impossible to load another kernel image after it has been disabled.
</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_kexec_load_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of kernel.kexec_load_disabled from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*kernel.kexec_load_disabled.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "kernel.kexec_load_disabled" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for kernel.kexec_load_disabled
#
/sbin/sysctl -q -n -w kernel.kexec_load_disabled="1"

#
# If kernel.kexec_load_disabled present in /etc/sysctl.conf, change value to "1"
#	else, add "kernel.kexec_load_disabled = 1" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.kexec_load_disabled")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.kexec_load_disabled\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^kernel.kexec_load_disabled\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_kexec_load_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*kernel.kexec_load_disabled.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_kexec_load_disabled

- name: Comment out any occurrences of kernel.kexec_load_disabled from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.kexec_load_disabled
    replace: '#kernel.kexec_load_disabled'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_kexec_load_disabled

- name: Ensure sysctl kernel.kexec_load_disabled is set to 1
  sysctl:
    name: kernel.kexec_load_disabled
    value: '1'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_kexec_load_disabled
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_kernel_kexec_load_disabled">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,kernel.kexec_load_disabled%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_kernel_kexec_load_disabled.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_kernel_kexec_load_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_kernel_kexec_load_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_modules_disabled" severity="medium">
              <xccdf-1.2:title>Disable loading and unloading of kernel modules</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.modules_disabled</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.modules_disabled=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.modules_disabled = 1</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This rule doesn't come with Bash remediation. Remediating this rule during the installation process disrupts the install and boot process.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R24)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Malicious kernel modules can have a significant impact on system security and
availability. Disabling loading of kernel modules prevents this threat. Note
that once this option has been set, it cannot be reverted without doing a
system reboot. Make sure that all needed kernel modules are loaded before
setting this option.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_modules_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*kernel.modules_disabled.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_modules_disabled

- name: Comment out any occurrences of kernel.modules_disabled from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.modules_disabled
    replace: '#kernel.modules_disabled'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_modules_disabled

- name: Ensure sysctl kernel.modules_disabled is set to 1
  sysctl:
    name: kernel.modules_disabled
    value: '1'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_modules_disabled
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_kernel_modules_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_kernel_modules_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_panic_on_oops" severity="medium">
              <xccdf-1.2:title>Kernel panic on oops</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.panic_on_oops</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.panic_on_oops=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.panic_on_oops = 1</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="functionality">The system may start to panic when it normally wouldn't. A non-catastrophic error that
would have allowed the system to continue operating will now result in a panic.</xccdf-1.2:warning>
              <xccdf-1.2:rationale>An attacker trying to exploit the kernel may trigger kernel OOPSes,
panicking the system will impede them from continuing.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_panic_on_oops" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of kernel.panic_on_oops from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*kernel.panic_on_oops.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "kernel.panic_on_oops" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for kernel.panic_on_oops
#
/sbin/sysctl -q -n -w kernel.panic_on_oops="1"

#
# If kernel.panic_on_oops present in /etc/sysctl.conf, change value to "1"
#	else, add "kernel.panic_on_oops = 1" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.panic_on_oops")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.panic_on_oops\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^kernel.panic_on_oops\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_panic_on_oops" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*kernel.panic_on_oops.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_panic_on_oops

- name: Comment out any occurrences of kernel.panic_on_oops from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.panic_on_oops
    replace: '#kernel.panic_on_oops'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_panic_on_oops

- name: Ensure sysctl kernel.panic_on_oops is set to 1
  sysctl:
    name: kernel.panic_on_oops
    value: '1'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_panic_on_oops
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_kernel_panic_on_oops:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_kernel_panic_on_oops_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_cpu_time_max_percent" severity="medium">
              <xccdf-1.2:title>Limit CPU consumption of the Perf system</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.perf_cpu_time_max_percent</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.perf_cpu_time_max_percent=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.perf_cpu_time_max_percent = 1</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R23)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>kernel.perf_cpu_time_max_percent</html:code> configures a treshold of
maximum percentile of CPU that can be used by Perf system. Restricting usage
of <html:code>Perf</html:code> system decreases risk of potential availability problems.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_perf_cpu_time_max_percent" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of kernel.perf_cpu_time_max_percent from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*kernel.perf_cpu_time_max_percent.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "kernel.perf_cpu_time_max_percent" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for kernel.perf_cpu_time_max_percent
#
/sbin/sysctl -q -n -w kernel.perf_cpu_time_max_percent="1"

#
# If kernel.perf_cpu_time_max_percent present in /etc/sysctl.conf, change value to "1"
#	else, add "kernel.perf_cpu_time_max_percent = 1" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.perf_cpu_time_max_percent")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.perf_cpu_time_max_percent\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^kernel.perf_cpu_time_max_percent\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_perf_cpu_time_max_percent" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*kernel.perf_cpu_time_max_percent.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_perf_cpu_time_max_percent

- name: Comment out any occurrences of kernel.perf_cpu_time_max_percent from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.perf_cpu_time_max_percent
    replace: '#kernel.perf_cpu_time_max_percent'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_perf_cpu_time_max_percent

- name: Ensure sysctl kernel.perf_cpu_time_max_percent is set to 1
  sysctl:
    name: kernel.perf_cpu_time_max_percent
    value: '1'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_perf_cpu_time_max_percent
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_kernel_perf_cpu_time_max_percent:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_kernel_perf_cpu_time_max_percent_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_event_max_sample_rate" severity="medium">
              <xccdf-1.2:title>Limit sampling frequency of the Perf system</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.perf_event_max_sample_rate</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.perf_event_max_sample_rate=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.perf_event_max_sample_rate = 1</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R23)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>kernel.perf_event_max_sample_rate</html:code> parameter configures maximum
frequency of collecting of samples for the Perf system. It is expressed in
samples per second. Restricting usage of <html:code>Perf</html:code> system decreases risk
of potential availability problems.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_perf_event_max_sample_rate" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of kernel.perf_event_max_sample_rate from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*kernel.perf_event_max_sample_rate.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "kernel.perf_event_max_sample_rate" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for kernel.perf_event_max_sample_rate
#
/sbin/sysctl -q -n -w kernel.perf_event_max_sample_rate="1"

#
# If kernel.perf_event_max_sample_rate present in /etc/sysctl.conf, change value to "1"
#	else, add "kernel.perf_event_max_sample_rate = 1" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.perf_event_max_sample_rate")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.perf_event_max_sample_rate\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^kernel.perf_event_max_sample_rate\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_perf_event_max_sample_rate" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*kernel.perf_event_max_sample_rate.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_perf_event_max_sample_rate

- name: Comment out any occurrences of kernel.perf_event_max_sample_rate from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.perf_event_max_sample_rate
    replace: '#kernel.perf_event_max_sample_rate'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_perf_event_max_sample_rate

- name: Ensure sysctl kernel.perf_event_max_sample_rate is set to 1
  sysctl:
    name: kernel.perf_event_max_sample_rate
    value: '1'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_perf_event_max_sample_rate
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_kernel_perf_event_max_sample_rate:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_kernel_perf_event_max_sample_rate_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_event_paranoid" severity="low">
              <xccdf-1.2:title>Disallow kernel profiling by unprivileged users</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.perf_event_paranoid</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.perf_event_paranoid=2</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.perf_event_paranoid = 2</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R23)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000132-GPOS-00067</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000138-GPOS-00069</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Kernel profiling can reveal sensitive information about kernel behaviour.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_perf_event_paranoid" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of kernel.perf_event_paranoid from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*kernel.perf_event_paranoid.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "kernel.perf_event_paranoid" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for kernel.perf_event_paranoid
#
/sbin/sysctl -q -n -w kernel.perf_event_paranoid="2"

#
# If kernel.perf_event_paranoid present in /etc/sysctl.conf, change value to "2"
#	else, add "kernel.perf_event_paranoid = 2" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.perf_event_paranoid")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "2"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.perf_event_paranoid\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^kernel.perf_event_paranoid\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_perf_event_paranoid" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*kernel.perf_event_paranoid.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - disable_strategy
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
    - sysctl_kernel_perf_event_paranoid

- name: Comment out any occurrences of kernel.perf_event_paranoid from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.perf_event_paranoid
    replace: '#kernel.perf_event_paranoid'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - disable_strategy
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
    - sysctl_kernel_perf_event_paranoid

- name: Ensure sysctl kernel.perf_event_paranoid is set to 2
  sysctl:
    name: kernel.perf_event_paranoid
    value: '2'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - disable_strategy
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
    - sysctl_kernel_perf_event_paranoid
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_kernel_perf_event_paranoid">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,kernel.perf_event_paranoid%3D2%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_kernel_perf_event_paranoid.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_kernel_perf_event_paranoid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_kernel_perf_event_paranoid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_pid_max" severity="medium">
              <xccdf-1.2:title>Configure maximum number of process identifiers</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.pid_max</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.pid_max=65536</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.pid_max = 65536</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R23)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>kernel.pid_max</html:code> parameter configures upper limit on process
identifiers (PID). If this number is not high enough, it might happen that
forking of new processes is not possible, because all available PIDs are
exhausted. Increasing this number enhances availability.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_pid_max" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of kernel.pid_max from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*kernel.pid_max.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "kernel.pid_max" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for kernel.pid_max
#
/sbin/sysctl -q -n -w kernel.pid_max="65536"

#
# If kernel.pid_max present in /etc/sysctl.conf, change value to "65536"
#	else, add "kernel.pid_max = 65536" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.pid_max")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "65536"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.pid_max\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^kernel.pid_max\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_pid_max" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*kernel.pid_max.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_pid_max

- name: Comment out any occurrences of kernel.pid_max from /etc/sysctl.d/*.conf files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.pid_max
    replace: '#kernel.pid_max'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_pid_max

- name: Ensure sysctl kernel.pid_max is set to 65536
  sysctl:
    name: kernel.pid_max
    value: '65536'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_pid_max
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_kernel_pid_max:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_kernel_pid_max_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_sysrq" severity="medium">
              <xccdf-1.2:title>Disallow magic SysRq key</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.sysrq</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.sysrq=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.sysrq = 0</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R23)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The Magic SysRq key allows sending certain commands directly to the running
kernel. It can dump various system and process information, potentially
revealing sensitive information. It can also reboot or shutdown the machine,
disturbing its availability.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_sysrq" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of kernel.sysrq from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*kernel.sysrq.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "kernel.sysrq" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for kernel.sysrq
#
/sbin/sysctl -q -n -w kernel.sysrq="0"

#
# If kernel.sysrq present in /etc/sysctl.conf, change value to "0"
#	else, add "kernel.sysrq = 0" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.sysrq")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.sysrq\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^kernel.sysrq\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_sysrq" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*kernel.sysrq.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_sysrq

- name: Comment out any occurrences of kernel.sysrq from /etc/sysctl.d/*.conf files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.sysrq
    replace: '#kernel.sysrq'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_sysrq

- name: Ensure sysctl kernel.sysrq is set to 0
  sysctl:
    name: kernel.sysrq
    value: '0'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_sysrq
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_kernel_sysrq:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_kernel_sysrq_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_unprivileged_bpf_disabled" severity="medium">
              <xccdf-1.2:title>Disable Access to Network bpf() Syscall From Unprivileged Processes</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.unprivileged_bpf_disabled</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.unprivileged_bpf_disabled=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.unprivileged_bpf_disabled = 1</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(10)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000132-GPOS-00067</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Loading and accessing the packet filters programs and maps using the bpf()
syscall has the potential of revealing sensitive information about the kernel state.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_unprivileged_bpf_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of kernel.unprivileged_bpf_disabled from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*kernel.unprivileged_bpf_disabled.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "kernel.unprivileged_bpf_disabled" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for kernel.unprivileged_bpf_disabled
#
/sbin/sysctl -q -n -w kernel.unprivileged_bpf_disabled="1"

#
# If kernel.unprivileged_bpf_disabled present in /etc/sysctl.conf, change value to "1"
#	else, add "kernel.unprivileged_bpf_disabled = 1" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.unprivileged_bpf_disabled")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.unprivileged_bpf_disabled\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^kernel.unprivileged_bpf_disabled\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_unprivileged_bpf_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*kernel.unprivileged_bpf_disabled.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_unprivileged_bpf_disabled

- name: Comment out any occurrences of kernel.unprivileged_bpf_disabled from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.unprivileged_bpf_disabled
    replace: '#kernel.unprivileged_bpf_disabled'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_unprivileged_bpf_disabled

- name: Ensure sysctl kernel.unprivileged_bpf_disabled is set to 1
  sysctl:
    name: kernel.unprivileged_bpf_disabled
    value: '1'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_unprivileged_bpf_disabled
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_kernel_unprivileged_bpf_disabled">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,kernel.unprivileged_bpf_disabled%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_kernel_unprivileged_bpf_disabled.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_kernel_unprivileged_bpf_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope" severity="medium">
              <xccdf-1.2:title>Restrict usage of ptrace to descendant processes</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.yama.ptrace_scope</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.yama.ptrace_scope=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.yama.ptrace_scope = 1</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R25)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(10)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000132-GPOS-00067</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Unrestricted usage of ptrace allows compromised binaries to run ptrace
on another processes of the user. Like this, the attacker can steal
sensitive information from the target processes (e.g. SSH sessions, web browser, ...)
without any additional assistance from the user (i.e. without resorting to phishing).
</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_yama_ptrace_scope" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of kernel.yama.ptrace_scope from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*kernel.yama.ptrace_scope.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "kernel.yama.ptrace_scope" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for kernel.yama.ptrace_scope
#
/sbin/sysctl -q -n -w kernel.yama.ptrace_scope="1"

#
# If kernel.yama.ptrace_scope present in /etc/sysctl.conf, change value to "1"
#	else, add "kernel.yama.ptrace_scope = 1" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.yama.ptrace_scope")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.yama.ptrace_scope\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^kernel.yama.ptrace_scope\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_yama_ptrace_scope" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*kernel.yama.ptrace_scope.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_yama_ptrace_scope

- name: Comment out any occurrences of kernel.yama.ptrace_scope from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.yama.ptrace_scope
    replace: '#kernel.yama.ptrace_scope'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_yama_ptrace_scope

- name: Ensure sysctl kernel.yama.ptrace_scope is set to 1
  sysctl:
    name: kernel.yama.ptrace_scope
    value: '1'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_yama_ptrace_scope
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_kernel_yama_ptrace_scope">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,kernel.yama.ptrace_scope%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_kernel_yama_ptrace_scope.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_kernel_yama_ptrace_scope:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_kernel_yama_ptrace_scope_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_core_bpf_jit_harden" severity="medium">
              <xccdf-1.2:title>Harden the operation of the BPF just-in-time compiler</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>net.core.bpf_jit_harden</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.core.bpf_jit_harden=2</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.core.bpf_jit_harden = 2</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(10)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>When hardened, the extended Berkeley Packet Filter just-in-time compiler
will randomize any kernel addresses in the BPF programs and maps,
and will not expose the JIT addresses in <html:code>/proc/kallsyms</html:code>.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_core_bpf_jit_harden" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of net.core.bpf_jit_harden from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*net.core.bpf_jit_harden.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "net.core.bpf_jit_harden" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for net.core.bpf_jit_harden
#
/sbin/sysctl -q -n -w net.core.bpf_jit_harden="2"

#
# If net.core.bpf_jit_harden present in /etc/sysctl.conf, change value to "2"
#	else, add "net.core.bpf_jit_harden = 2" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.core.bpf_jit_harden")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "2"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.core.bpf_jit_harden\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.core.bpf_jit_harden\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_core_bpf_jit_harden" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*net.core.bpf_jit_harden.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_core_bpf_jit_harden

- name: Comment out any occurrences of net.core.bpf_jit_harden from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.core.bpf_jit_harden
    replace: '#net.core.bpf_jit_harden'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_core_bpf_jit_harden

- name: Ensure sysctl net.core.bpf_jit_harden is set to 2
  sysctl:
    name: net.core.bpf_jit_harden
    value: '2'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_core_bpf_jit_harden
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_net_core_bpf_jit_harden">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,net.core.bpf_jit_harden%3D2%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_net_core_bpf_jit_harden.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_net_core_bpf_jit_harden:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_net_core_bpf_jit_harden_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_user_max_user_namespaces" severity="medium">
              <xccdf-1.2:title>Disable the use of user namespaces</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>user.max_user_namespaces</html:code> kernel parameter,
run the following command:
<html:pre>$ sudo sysctl -w user.max_user_namespaces=0</html:pre>

To make sure that the setting is persistent,
add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>:
<html:pre>user.max_user_namespaces = 0</html:pre>
When containers are deployed on the machine, the value should be set
to large non-zero value.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This configuration baseline was created to deploy the base operating system for general purpose
workloads. When the operating system is configured for certain purposes, such as to host Linux Containers,
it is expected that <html:code>user.max_user_namespaces</html:code> will be enabled.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-39</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>User namespaces are used primarily for Linux containers. The value 0
disallows the use of user namespaces.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_user_max_user_namespaces" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of user.max_user_namespaces from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*user.max_user_namespaces.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "user.max_user_namespaces" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for user.max_user_namespaces
#
/sbin/sysctl -q -n -w user.max_user_namespaces="0"

#
# If user.max_user_namespaces present in /etc/sysctl.conf, change value to "0"
#	else, add "user.max_user_namespaces = 0" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^user.max_user_namespaces")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^user.max_user_namespaces\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^user.max_user_namespaces\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_user_max_user_namespaces" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*user.max_user_namespaces.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-39
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_user_max_user_namespaces

- name: Comment out any occurrences of user.max_user_namespaces from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*user.max_user_namespaces
    replace: '#user.max_user_namespaces'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-39
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_user_max_user_namespaces

- name: Ensure sysctl user.max_user_namespaces is set to 0
  sysctl:
    name: user.max_user_namespaces
    value: '0'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-39
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_user_max_user_namespaces
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_user_max_user_namespaces">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,user.max_user_namespaces%20%3D%200%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_user_max_user_namespaces.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_user_max_user_namespaces:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_user_max_user_namespaces_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_vm_mmap_min_addr" severity="medium">
              <xccdf-1.2:title>Prevent applications from mapping low portion of virtual memory</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>vm.mmap_min_addr</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w vm.mmap_min_addr=65536</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>vm.mmap_min_addr = 65536</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R23)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>vm.mmap_min_addr</html:code> parameter specifies the minimum virtual
address that a process is allowed to mmap. Allowing a process to mmap low
portion of virtual memory can have security implications such as such as
heightened risk of kernel null pointer dereference defects.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_vm_mmap_min_addr" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of vm.mmap_min_addr from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*vm.mmap_min_addr.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "vm.mmap_min_addr" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for vm.mmap_min_addr
#
/sbin/sysctl -q -n -w vm.mmap_min_addr="65536"

#
# If vm.mmap_min_addr present in /etc/sysctl.conf, change value to "65536"
#	else, add "vm.mmap_min_addr = 65536" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^vm.mmap_min_addr")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "65536"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^vm.mmap_min_addr\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^vm.mmap_min_addr\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_vm_mmap_min_addr" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*vm.mmap_min_addr.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_vm_mmap_min_addr

- name: Comment out any occurrences of vm.mmap_min_addr from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*vm.mmap_min_addr
    replace: '#vm.mmap_min_addr'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_vm_mmap_min_addr

- name: Ensure sysctl vm.mmap_min_addr is set to 65536
  sysctl:
    name: vm.mmap_min_addr
    value: '65536'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_vm_mmap_min_addr
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_vm_mmap_min_addr:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_vm_mmap_min_addr_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_coredumps">
              <xccdf-1.2:title>Disable Core Dumps</xccdf-1.2:title>
              <xccdf-1.2:description>A core dump file is the memory image of an executable
program when it was terminated by the operating system due to
errant behavior. In most cases, only software developers
legitimately need to access these files. The core dump files may
also contain sensitive information, or unnecessarily occupy large
amounts of disk space.
<html:br/><html:br/>
Once a hard limit is set in <html:code>/etc/security/limits.conf</html:code>, or
to a file within the <html:code>/etc/security/limits.d/</html:code> directory, a
user cannot increase that limit within his or her own session. If access
to core dumps is required, consider restricting them to only
certain users or groups. See the <html:code>limits.conf</html:code> man page for more
information.
<html:br/><html:br/>
The core dumps of setuid programs are further protected. The
<html:code>sysctl</html:code> variable <html:code>fs.suid_dumpable</html:code> controls whether
the kernel allows core dumps from these programs at all. The default
value of 0 is recommended.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_systemd-coredump_disabled" severity="medium">
                <xccdf-1.2:title>Disable acquiring, saving, and processing core dumps</xccdf-1.2:title>
                <xccdf-1.2:description>The <html:code>systemd-coredump.socket</html:code> unit is a socket activation of
the <html:code>systemd-coredump@.service</html:code> which processes core dumps.
By masking the unit, core dump processing is disabled.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(10)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data
and is generally useful only for developers trying to debug problems.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_systemd-coredump_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'systemd-coredump.service'
"$SYSTEMCTL_EXEC" disable 'systemd-coredump.service'
"$SYSTEMCTL_EXEC" mask 'systemd-coredump.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^systemd-coredump.socket'; then
    "$SYSTEMCTL_EXEC" stop 'systemd-coredump.socket'
    "$SYSTEMCTL_EXEC" mask 'systemd-coredump.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'systemd-coredump.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_systemd-coredump_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Disable service systemd-coredump
  block:

    - name: Disable service systemd-coredump
      systemd:
        name: systemd-coredump.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      ignore_errors: 'yes'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_systemd-coredump_disabled

- name: Unit Socket Exists - systemd-coredump.socket
  command: systemctl list-unit-files systemd-coredump.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_systemd-coredump_disabled

- name: Disable socket systemd-coredump
  systemd:
    name: systemd-coredump.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"systemd-coredump.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_systemd-coredump_disabled
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_systemd-coredump_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_systemd-coredump

class disable_systemd-coredump {
  service {'systemd-coredump':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="service_systemd-coredump_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: systemd-coredump.service
        enabled: false
        mask: true
      - name: systemd-coredump.socket
        enabled: false
        mask: true
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_systemd-coredump_disabled">
[customizations.services]
disabled = ["systemd-coredump"]
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_systemd-coredump_disabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-service_systemd-coredump_disabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_coredump_disable_backtraces" severity="medium">
                <xccdf-1.2:title>Disable core dump backtraces</xccdf-1.2:title>
                <xccdf-1.2:description>The <html:code>ProcessSizeMax</html:code> option in <html:code>[Coredump]</html:code> section
of <html:code>/etc/systemd/coredump.conf</html:code>
specifies the maximum size in bytes of a core which will be processed.
Core dumps exceeding this size may be stored, but the backtrace will not
be generated.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">If the <html:code>/etc/systemd/coredump.conf</html:code> file
does not already contain the <html:code>[Coredump]</html:code> section,
the value will not be configured correctly.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data
and is generally useful only for developers or system operators trying to
debug problems.

Enabling core dumps on production systems is not recommended,
however there may be overriding operational requirements to enable advanced
debuging. Permitting temporary enablement of core dumps during such situations
should be reviewed through local needs and policy.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="coredump_disable_backtraces" complexity="low" disruption="low" reboot="false" strategy="restrict">if [ -e "/etc/systemd/coredump.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*ProcessSizeMax\s*=\s*/Id" "/etc/systemd/coredump.conf"
else
    touch "/etc/systemd/coredump.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/systemd/coredump.conf"

cp "/etc/systemd/coredump.conf" "/etc/systemd/coredump.conf.bak"
# Insert at the end of the file
printf '%s\n' "ProcessSizeMax=0" &gt;&gt; "/etc/systemd/coredump.conf"
# Clean up after ourselves.
rm "/etc/systemd/coredump.conf.bak"
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="coredump_disable_backtraces" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Disable core dump backtraces
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/systemd/coredump.conf
        create: false
        regexp: ^\s*ProcessSizeMax\s*=\s*
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/systemd/coredump.conf
      lineinfile:
        path: /etc/systemd/coredump.conf
        create: false
        regexp: ^\s*ProcessSizeMax\s*=\s*
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/systemd/coredump.conf
      lineinfile:
        path: /etc/systemd/coredump.conf
        create: false
        regexp: ^\s*ProcessSizeMax\s*=\s*
        line: ProcessSizeMax=0
        state: present
  tags:
    - NIST-800-53-CM-6
    - coredump_disable_backtraces
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="coredump_disable_backtraces">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%20%20This%20file%20is%20part%20of%20systemd.%0A%23%0A%23%20%20systemd%20is%20free%20software%3B%20you%20can%20redistribute%20it%20and/or%20modify%20it%0A%23%20%20under%20the%20terms%20of%20the%20GNU%20Lesser%20General%20Public%20License%20as%20published%20by%0A%23%20%20the%20Free%20Software%20Foundation%3B%20either%20version%202.1%20of%20the%20License%2C%20or%0A%23%20%20%28at%20your%20option%29%20any%20later%20version.%0A%23%0A%23%20Entries%20in%20this%20file%20show%20the%20compile%20time%20defaults.%0A%23%20You%20can%20change%20settings%20by%20editing%20this%20file.%0A%23%20Defaults%20can%20be%20restored%20by%20simply%20deleting%20this%20file.%0A%23%0A%23%20See%20coredump.conf%285%29%20for%20details.%0A%0A%5BCoredump%5D%0A%23Storage%3Dexternal%0A%23Compress%3Dyes%0A%23ProcessSizeMax%3D2G%0A%23ExternalSizeMax%3D2G%0A%23JournalSizeMax%3D767M%0A%23MaxUse%3D%0A%23KeepFree%3D%0AStorage%3Dnone%0AProcessSizeMax%3D0%0A
        mode: 0644
        path: /etc/systemd/coredump.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-coredump_disable_backtraces:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-coredump_disable_backtraces_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_coredump_disable_storage" severity="medium">
                <xccdf-1.2:title>Disable storing core dump</xccdf-1.2:title>
                <xccdf-1.2:description>The <html:code>Storage</html:code> option in <html:code>[Coredump]</html:code> section
of <html:code>/etc/systemd/coredump.conf</html:code>
can be set to <html:code>none</html:code> to disable storing core dumps permanently.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">If the <html:code>/etc/systemd/coredump.conf</html:code> file
does not already contain the <html:code>[Coredump]</html:code> section,
the value will not be configured correctly.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data
and is generally useful only for developers or system operators trying to
debug problems. Enabling core dumps on production systems is not recommended,
however there may be overriding operational requirements to enable advanced
debuging. Permitting temporary enablement of core dumps during such situations
should be reviewed through local needs and policy.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="coredump_disable_storage" complexity="low" disruption="low" reboot="false" strategy="restrict">if [ -e "/etc/systemd/coredump.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*Storage\s*=\s*/Id" "/etc/systemd/coredump.conf"
else
    touch "/etc/systemd/coredump.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/systemd/coredump.conf"

cp "/etc/systemd/coredump.conf" "/etc/systemd/coredump.conf.bak"
# Insert at the end of the file
printf '%s\n' "Storage=none" &gt;&gt; "/etc/systemd/coredump.conf"
# Clean up after ourselves.
rm "/etc/systemd/coredump.conf.bak"
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="coredump_disable_storage" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Disable storing core dump
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/systemd/coredump.conf
        create: false
        regexp: ^\s*Storage\s*=\s*
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/systemd/coredump.conf
      lineinfile:
        path: /etc/systemd/coredump.conf
        create: false
        regexp: ^\s*Storage\s*=\s*
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/systemd/coredump.conf
      lineinfile:
        path: /etc/systemd/coredump.conf
        create: false
        regexp: ^\s*Storage\s*=\s*
        line: Storage=none
        state: present
  tags:
    - NIST-800-53-CM-6
    - coredump_disable_storage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="coredump_disable_storage">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%20%20This%20file%20is%20part%20of%20systemd.%0A%23%0A%23%20%20systemd%20is%20free%20software%3B%20you%20can%20redistribute%20it%20and/or%20modify%20it%0A%23%20%20under%20the%20terms%20of%20the%20GNU%20Lesser%20General%20Public%20License%20as%20published%20by%0A%23%20%20the%20Free%20Software%20Foundation%3B%20either%20version%202.1%20of%20the%20License%2C%20or%0A%23%20%20%28at%20your%20option%29%20any%20later%20version.%0A%23%0A%23%20Entries%20in%20this%20file%20show%20the%20compile%20time%20defaults.%0A%23%20You%20can%20change%20settings%20by%20editing%20this%20file.%0A%23%20Defaults%20can%20be%20restored%20by%20simply%20deleting%20this%20file.%0A%23%0A%23%20See%20coredump.conf%285%29%20for%20details.%0A%0A%5BCoredump%5D%0A%23Storage%3Dexternal%0A%23Compress%3Dyes%0A%23ProcessSizeMax%3D2G%0A%23ExternalSizeMax%3D2G%0A%23JournalSizeMax%3D767M%0A%23MaxUse%3D%0A%23KeepFree%3D%0AStorage%3Dnone%0AProcessSizeMax%3D0%0A
        mode: 0644
        path: /etc/systemd/coredump.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-coredump_disable_storage:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-coredump_disable_storage_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_disable_users_coredumps" severity="medium">
                <xccdf-1.2:title>Disable Core Dumps for All Users</xccdf-1.2:title>
                <xccdf-1.2:description>To disable core dumps for all users, add the following line to
<html:code>/etc/security/limits.conf</html:code>, or to a file within the
<html:code>/etc/security/limits.d/</html:code> directory:
<html:pre>*     hard   core    0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(10)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data and is generally useful
only for developers trying to debug problems.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="disable_users_coredumps" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6
    - NIST-800-53-SC-7(10)
    - disable_users_coredumps
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: disable core dumps with limits
  lineinfile:
    dest: /etc/security/limits.conf
    regexp: ^[^#].*core
    line: '*        hard       core      0'
    create: true
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6
    - NIST-800-53-SC-7(10)
    - disable_users_coredumps
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="disable_users_coredumps">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%2A%20%20%20%20%20hard%20%20%20core%20%20%20%200
        mode: 0644
        path: /etc/security/limits.d/75-disable_users_coredumps.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-disable_users_coredumps:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-disable_users_coredumps_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_fs_suid_dumpable" severity="medium">
                <xccdf-1.2:title>Disable Core Dumps for SUID programs</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>fs.suid_dumpable</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w fs.suid_dumpable=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>fs.suid_dumpable = 0</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R23)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-11(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-11(b)</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The core dump of a setuid program is more likely to contain
sensitive data, as the program itself runs with greater privileges than the
user who initiated execution of the program.  Disabling the ability for any
setuid program to write a core file decreases the risk of unauthorized access
of such data.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_fs_suid_dumpable" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of fs.suid_dumpable from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*fs.suid_dumpable.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "fs.suid_dumpable" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for fs.suid_dumpable
#
/sbin/sysctl -q -n -w fs.suid_dumpable="0"

#
# If fs.suid_dumpable present in /etc/sysctl.conf, change value to "0"
#	else, add "fs.suid_dumpable = 0" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^fs.suid_dumpable")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^fs.suid_dumpable\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^fs.suid_dumpable\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_fs_suid_dumpable" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*fs.suid_dumpable.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-SI-11(a)
    - NIST-800-53-SI-11(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_suid_dumpable

- name: Comment out any occurrences of fs.suid_dumpable from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*fs.suid_dumpable
    replace: '#fs.suid_dumpable'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-SI-11(a)
    - NIST-800-53-SI-11(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_suid_dumpable

- name: Ensure sysctl fs.suid_dumpable is set to 0
  sysctl:
    name: fs.suid_dumpable
    value: '0'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-SI-11(a)
    - NIST-800-53-SI-11(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_suid_dumpable
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_fs_suid_dumpable:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_fs_suid_dumpable_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_daemon_umask">
              <xccdf-1.2:title>Daemon Umask</xccdf-1.2:title>
              <xccdf-1.2:description>The umask is a per-process setting which limits
the default permissions for creation of new files and directories.
The system includes initialization scripts which set the default umask
for system daemons.</xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_umask_for_daemons" type="string">
                <xccdf-1.2:title>daemon umask</xccdf-1.2:title>
                <xccdf-1.2:description>Enter umask for daemons</xccdf-1.2:description>
                <xccdf-1.2:value selector="022">022</xccdf-1.2:value>
                <xccdf-1.2:value selector="027">027</xccdf-1.2:value>
                <xccdf-1.2:value>022</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_umask_for_daemons" severity="unknown">
                <xccdf-1.2:title>Set Daemon Umask</xccdf-1.2:title>
                <xccdf-1.2:description>The file <html:code>/etc/init.d/functions</html:code> includes initialization
parameters for most or all daemons started at boot time. Many daemons
on the system already individually restrict themselves to
a umask of <html:code>077</html:code> in their own init scripts. By default, the umask of
<html:code>022</html:code> is set which prevents creation of group- or world-writable files.
To set the umask for daemons expected by the profile, edit the following line:
<html:pre>umask <html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_umask_for_daemons" use="legacy"/></html:i></html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning category="functionality">Setting the umask to too restrictive a setting can cause serious errors at
runtime.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The umask influences the permissions assigned to files created by a
process at run time. An unnecessarily permissive umask could result in files
being created with insecure permissions.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_umask_for_daemons:var:1" value-id="xccdf_org.ssgproject.content_value_var_umask_for_daemons"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-umask_for_daemons:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-umask_for_daemons_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_enable_execshield_settings">
              <xccdf-1.2:title>Enable ExecShield</xccdf-1.2:title>
              <xccdf-1.2:description>ExecShield describes kernel features that provide
protection against exploitation of memory corruption errors such as buffer
overflows. These features include random placement of the stack and other
memory regions, prevention of execution in memory that should only hold data,
and special handling of text buffers. These protections are enabled by default
on 32-bit systems and controlled through <html:code>sysctl</html:code> variables 
<html:code>kernel.exec-shield</html:code> and <html:code>kernel.randomize_va_space</html:code>. On the latest
64-bit systems, <html:code>kernel.exec-shield</html:code> cannot be enabled or disabled with 
<html:code>sysctl</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_kernel_kptr_restrict_value" type="number">
                <xccdf-1.2:title>kernel.kptr_restrict</xccdf-1.2:title>
                <xccdf-1.2:description>Configure exposition of kernel pointer addresses </xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_exec_shield" severity="medium">
                <xccdf-1.2:title>Enable ExecShield via sysctl</xccdf-1.2:title>
                <xccdf-1.2:description>By default on Fedora 64-bit systems, ExecShield is
enabled and can only be disabled if the hardware does not support
ExecShield or is disabled in <html:code>/etc/default/grub</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002530</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-39</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000433-GPOS-00192</xccdf-1.2:reference>
                <xccdf-1.2:rationale>ExecShield uses the segmentation feature on all x86 systems to prevent
execution in memory higher than a certain address. It writes an address as
a limit in the code segment descriptor, to control where code can be
executed, on a per-process basis. When the kernel places a process's memory
regions such as the stack and heap higher than this address, the hardware
prevents execution in that address range. This is enabled by default on the
latest Red Hat and Fedora systems if supported by the hardware.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_exec_shield" complexity="low" disruption="low" reboot="true" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

grubby --update-kernel=ALL --remove-args=noexec

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_exec_shield" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --remove-args="noexec"
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-39
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
    - sysctl_kernel_exec_shield
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_kernel_exec_shield:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_kernel_exec_shield_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_kptr_restrict" severity="medium">
                <xccdf-1.2:title>Restrict Exposed Kernel Pointer Addresses Access</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.kptr_restrict</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.kptr_restrict=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_kernel_kptr_restrict_value" use="legacy"/></html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.kptr_restrict = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_kernel_kptr_restrict_value" use="legacy"/></html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R23)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002824</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-002-5 R1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-002-5 R1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-005-6 R1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-005-6 R1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-005-6 R1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R8.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-009-6 R.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-009-6 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-30</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-30(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-30(5)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000132-GPOS-00067</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000433-GPOS-00192</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Exposing kernel pointers (through procfs or <html:code>seq_printf()</html:code>) exposes kernel
writeable structures which may contain functions pointers. If a write vulnerability
occurs in the kernel, allowing write access to any of this structure, the kernel can
be compromised. This option disallow any program without the CAP_SYSLOG capability
to get the addresses of kernel pointers by replacing them with 0.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_kptr_restrict" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of kernel.kptr_restrict from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*kernel.kptr_restrict.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "kernel.kptr_restrict" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done
sysctl_kernel_kptr_restrict_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_kernel_kptr_restrict_value" use="legacy"/>'


#
# Set runtime for kernel.kptr_restrict
#
/sbin/sysctl -q -n -w kernel.kptr_restrict="$sysctl_kernel_kptr_restrict_value"

#
# If kernel.kptr_restrict present in /etc/sysctl.conf, change value to appropriate value
#	else, add "kernel.kptr_restrict = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.kptr_restrict")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_kernel_kptr_restrict_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.kptr_restrict\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^kernel.kptr_restrict\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_kptr_restrict" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*kernel.kptr_restrict.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-30
    - NIST-800-53-SC-30(2)
    - NIST-800-53-SC-30(5)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_kptr_restrict

- name: Comment out any occurrences of kernel.kptr_restrict from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.kptr_restrict
    replace: '#kernel.kptr_restrict'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-30
    - NIST-800-53-SC-30(2)
    - NIST-800-53-SC-30(5)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_kptr_restrict
- name: XCCDF Value sysctl_kernel_kptr_restrict_value # promote to variable
  set_fact:
    sysctl_kernel_kptr_restrict_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_kernel_kptr_restrict_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl kernel.kptr_restrict is set
  sysctl:
    name: kernel.kptr_restrict
    value: '{{ sysctl_kernel_kptr_restrict_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-30
    - NIST-800-53-SC-30(2)
    - NIST-800-53-SC-30(5)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_kptr_restrict
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_kernel_kptr_restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,kernel.kptr_restrict%3D1%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_kernel_kptr_restrict.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_kernel_kptr_restrict_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_kernel_kptr_restrict_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_kernel_kptr_restrict:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_kernel_kptr_restrict_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space" severity="medium">
                <xccdf-1.2:title>Enable Randomized Layout of Virtual Address Space</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.randomize_va_space</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.randomize_va_space=2</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.randomize_va_space = 2</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R23)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002824</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-002-5 R1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-002-5 R1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-005-6 R1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-005-6 R1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-005-6 R1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R8.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-009-6 R.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-009-6 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-30</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-30(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000433-GPOS-00193</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Address space layout randomization (ASLR) makes it more difficult for an
attacker to predict the location of attack code they have introduced into a
process's address space during an attempt at exploitation. Additionally,
ASLR makes it more difficult for an attacker to know the location of
existing code in order to re-purpose it using return oriented programming
(ROP) techniques.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_randomize_va_space" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Comment out any occurrences of kernel.randomize_va_space from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do
  matching_list=$(grep -P '^(?!#).*[\s]*kernel.randomize_va_space.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "kernel.randomize_va_space" matches to preserve user data
      sed -i "s/^${entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for kernel.randomize_va_space
#
/sbin/sysctl -q -n -w kernel.randomize_va_space="2"

#
# If kernel.randomize_va_space present in /etc/sysctl.conf, change value to "2"
#	else, add "kernel.randomize_va_space = 2" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.randomize_va_space")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "2"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.randomize_va_space\\&gt;" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^kernel.randomize_va_space\\&gt;.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_randomize_va_space" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
    contains: ^[\s]*kernel.randomize_va_space.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-30
    - NIST-800-53-SC-30(2)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_randomize_va_space

- name: Comment out any occurrences of kernel.randomize_va_space from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.randomize_va_space
    replace: '#kernel.randomize_va_space'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-30
    - NIST-800-53-SC-30(2)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_randomize_va_space

- name: Ensure sysctl kernel.randomize_va_space is set to 2
  sysctl:
    name: kernel.randomize_va_space
    value: '2'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-30
    - NIST-800-53-SC-30(2)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_randomize_va_space
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="sysctl_kernel_randomize_va_space">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,kernel.randomize_va_space%3D2%0A
        mode: 0644
        path: /etc/sysctl.d/75-sysctl_kernel_randomize_va_space.conf
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sysctl_kernel_randomize_va_space:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sysctl_kernel_randomize_va_space_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_enable_nx">
              <xccdf-1.2:title>Enable Execute Disable (XD) or No Execute (NX) Support on
x86 Systems</xccdf-1.2:title>
              <xccdf-1.2:description>Recent processors in the x86 family support the
ability to prevent code execution on a per memory page basis.
Generically and on AMD processors, this ability is called No
Execute (NX), while on Intel processors it is called Execute
Disable (XD). This ability can help prevent exploitation of buffer
overflow vulnerabilities and should be activated whenever possible.
Extra steps must be taken to ensure that this protection is
enabled, particularly on 32-bit x86 systems. Other processors, such
as Itanium and POWER, have included such support since inception
and the standard kernel for those platforms supports the
feature. This is enabled by default on the latest Red Hat and 
Fedora systems if supported by the hardware.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_bios_enable_execution_restrictions" severity="medium">
                <xccdf-1.2:title>Enable NX or XD Support in the BIOS</xccdf-1.2:title>
                <xccdf-1.2:description>Reboot the system and enter the BIOS or Setup configuration menu.
Navigate the BIOS configuration menu and make sure that the option is enabled. The setting may be located
under a Security section. Look for Execute Disable (XD) on Intel-based systems and No Execute (NX)
on AMD-based systems.</xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002824</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-39</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000433-GPOS-00192</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Computers with the ability to prevent this type of code execution frequently put an option in the BIOS that will
allow users to turn the feature on or off at will.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-bios_enable_execution_restrictions:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-bios_enable_execution_restrictions_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_install_PAE_kernel_on_x86-32" severity="unknown">
                <xccdf-1.2:title>Install PAE Kernel on Supported 32-bit x86 Systems</xccdf-1.2:title>
                <xccdf-1.2:description>Systems that are using the 64-bit x86 kernel package
do not need to install the kernel-PAE package because the 64-bit
x86 kernel already includes this support. However, if the system is
32-bit and also supports the PAE and NX features as
determined in the previous section, the kernel-PAE package should
be installed to enable XD or NX support.
The <html:code>kernel-PAE</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install kernel-PAE</html:pre>
The installation process should also have configured the
bootloader to load the new kernel at boot. Verify this after reboot
and modify <html:code>/etc/default/grub</html:code> if necessary.</xccdf-1.2:description>
                <xccdf-1.2:warning category="hardware">The kernel-PAE package should not be
installed on older systems that do not support the XD or NX bit, as
8this may prevent them from booting.8</xccdf-1.2:warning>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:rationale>On 32-bit systems that support the XD or NX bit, the vendor-supplied
PAE kernel is required to enable either Execute Disable (XD) or No Execute (NX) support.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-install_PAE_kernel_on_x86-32:def:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_poisoning">
              <xccdf-1.2:title>Memory Poisoning</xccdf-1.2:title>
              <xccdf-1.2:description>Memory Poisoning consists of writing a special value to uninitialized or freed memory.
Poisoning can be used as a mechanism to prevent leak of information and detection of
corrupted memory.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_slub_debug_options" type="string" interactive="true">
                <xccdf-1.2:title>slub_debug - debug options</xccdf-1.2:title>
                <xccdf-1.2:description>Defines the debug options to use in <html:code>slub_debug</html:code> kernel command line argument.</xccdf-1.2:description>
                <xccdf-1.2:value>P</xccdf-1.2:value>
                <xccdf-1.2:value selector="F">F</xccdf-1.2:value>
                <xccdf-1.2:value selector="Z">Z</xccdf-1.2:value>
                <xccdf-1.2:value selector="P">P</xccdf-1.2:value>
                <xccdf-1.2:value selector="FZ">FZ</xccdf-1.2:value>
                <xccdf-1.2:value selector="FZP">FZP</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_page_poison_argument" severity="medium">
                <xccdf-1.2:title>Enable page allocator poisoning</xccdf-1.2:title>
                <xccdf-1.2:description>To enable poisoning of free pages,
add the argument <html:code>page_poison=1</html:code> to the default
GRUB 2 command line for the Linux operating system.
Configure the default Grub2 kernel command line to contain page_poison=1 as follows:
<html:pre># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) page_poison=1"</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001084</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000134-GPOS-00068</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Poisoning writes an arbitrary value to freed pages, so any modification or
reference to that page after being freed or before being initialized will be
detected and prevented.
This prevents many types of use-after-free vulnerabilities at little performance cost.
Also prevents leak of data and detection of corrupted memory.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#grub2"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_page_poison_argument"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ] &amp;&amp; { rpm --quiet -q grub2-common; }; then

grubby --update-kernel=ALL --args=page_poison=1

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_page_poison_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - grub2_page_poison_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="page_poison=1"
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"grub2-common" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - grub2_page_poison_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_page_poison_argument">[customizations.kernel]
append = "page_poison=1"
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-grub2_page_poison_argument:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-grub2_page_poison_argument_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_slub_debug_argument" severity="medium">
                <xccdf-1.2:title>Enable SLUB/SLAB allocator poisoning</xccdf-1.2:title>
                <xccdf-1.2:description>To enable poisoning of SLUB/SLAB objects,
add the argument <html:code>slub_debug=P</html:code> to the default
GRUB 2 command line for the Linux operating system.
Configure the default Grub2 kernel command line to contain slub_debug=P as follows:
<html:pre># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) slub_debug=P"</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001084</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000433-GPOS-00192</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000134-GPOS-00068</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Poisoning writes an arbitrary value to freed objects, so any modification or
reference to that object after being freed or before being initialized will be
detected and prevented.
This prevents many types of use-after-free vulnerabilities at little performance cost.
Also prevents leak of data and detection of corrupted memory.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#grub2"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_slub_debug_argument"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ] &amp;&amp; { rpm --quiet -q grub2-common; }; then

var_slub_debug_options='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_slub_debug_options" use="legacy"/>'



grubby --update-kernel=ALL --args=slub_debug=$var_slub_debug_options

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_slub_debug_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - grub2_slub_debug_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy
- name: XCCDF Value var_slub_debug_options # promote to variable
  set_fact:
    var_slub_debug_options: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_slub_debug_options" use="legacy"/>
  tags:
    - always

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="slub_debug={{ var_slub_debug_options
    }}"
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"grub2-common" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - grub2_slub_debug_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_slub_debug_argument">[customizations.kernel]
append = "slub_debug=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_slub_debug_options" use="legacy"/>"
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_slub_debug_options:var:1" value-id="xccdf_org.ssgproject.content_value_var_slub_debug_options"/>
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-grub2_slub_debug_argument:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-grub2_slub_debug_argument_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_selinux">
          <xccdf-1.2:title>SELinux</xccdf-1.2:title>
          <xccdf-1.2:description>SELinux is a feature of the Linux kernel which can be
used to guard against misconfigured or compromised programs.
SELinux enforces the idea that programs should be limited in what
files they can access and what actions they can take.
<html:br/><html:br/>
The default SELinux policy, as configured on Fedora, has been
sufficiently developed and debugged that it should be usable on
almost any system with minimal configuration and a small
amount of system administrator training. This policy prevents
system services - including most of the common network-visible
services such as mail servers, FTP servers, and DNS servers - from
accessing files which those services have no valid reason to
access. This action alone prevents a huge amount of possible damage
from network attacks against services, from trojaned software, and
so forth.
<html:br/><html:br/>
This guide recommends that SELinux be enabled using the
default (targeted) policy on every Fedora system, unless that
system has unusual requirements which make a stronger policy
appropriate.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#machine"/>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinux_policy_name" type="string">
            <xccdf-1.2:title>SELinux policy</xccdf-1.2:title>
            <xccdf-1.2:description>Type of policy in use. Possible values are:
<html:br/>targeted - Only targeted network daemons are protected.
<html:br/>strict - Full SELinux protection.
<html:br/>mls - Multiple levels of security</xccdf-1.2:description>
            <xccdf-1.2:value>targeted</xccdf-1.2:value>
            <xccdf-1.2:value selector="mls">mls</xccdf-1.2:value>
            <xccdf-1.2:value selector="targeted">targeted</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinux_state" type="string">
            <xccdf-1.2:title>SELinux state</xccdf-1.2:title>
            <xccdf-1.2:description>enforcing - SELinux security policy is enforced.
<html:br/>permissive - SELinux prints warnings instead of enforcing.
<html:br/>disabled - SELinux is fully disabled.</xccdf-1.2:description>
            <xccdf-1.2:value>enforcing</xccdf-1.2:value>
            <xccdf-1.2:value selector="disabled">disabled</xccdf-1.2:value>
            <xccdf-1.2:value selector="enforcing">enforcing</xccdf-1.2:value>
            <xccdf-1.2:value selector="permissive">permissive</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_libselinux_installed" severity="high">
            <xccdf-1.2:title>Install libselinux Package</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>libselinux</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install libselinux</html:pre></xccdf-1.2:description>
            <xccdf-1.2:rationale>Security-enhanced Linux is a feature of the Linux kernel and a number of utilities
with enhanced security functionality designed to add mandatory access controls to Linux.

The <html:code>libselinux</html:code> package contains the core library of the Security-enhanced Linux system.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_libselinux_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "libselinux" ; then
    dnf install -y "libselinux"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_libselinux_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure libselinux is installed
  package:
    name: libselinux
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - enable_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - package_libselinux_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_libselinux_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_libselinux

class install_libselinux {
  package { 'libselinux':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_libselinux_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=libselinux
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_libselinux_installed">
[[packages]]
name = "libselinux"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_libselinux_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_libselinux_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_policycoreutils_installed" severity="low">
            <xccdf-1.2:title>Install policycoreutils Package</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>policycoreutils</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install policycoreutils</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001084</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000134-GPOS-00068</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Security-enhanced Linux is a feature of the Linux kernel and a number of utilities
with enhanced security functionality designed to add mandatory access controls to Linux.
The Security-enhanced Linux kernel contains new architectural components originally
developed to improve security of the Flask operating system. These architectural components
provide general support for the enforcement of many kinds of mandatory access control
policies, including those based on the concepts of Type Enforcement, Role-based Access
Control, and Multi-level Security.

<html:code>policycoreutils</html:code> contains the policy core utilities that are required for
basic operation of an SELinux-enabled system. These utilities include <html:code>load_policy</html:code>
to load SELinux policies, <html:code>setfiles</html:code> to label filesystems, <html:code>newrole</html:code> to
switch roles, and so on.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_policycoreutils_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "policycoreutils" ; then
    dnf install -y "policycoreutils"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_policycoreutils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure policycoreutils is installed
  package:
    name: policycoreutils
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_policycoreutils_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_policycoreutils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_policycoreutils

class install_policycoreutils {
  package { 'policycoreutils':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_policycoreutils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=policycoreutils
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_policycoreutils_installed">
[[packages]]
name = "policycoreutils"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_policycoreutils_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_policycoreutils_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_mcstrans_removed" severity="low">
            <xccdf-1.2:title>Uninstall mcstrans Package</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>mcstransd</html:code> daemon provides category label information
to client processes requesting information. The label translations are defined
in <html:code>/etc/selinux/targeted/setrans.conf</html:code>.
The <html:code>mcstrans</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase mcstrans</html:pre></xccdf-1.2:description>
            <xccdf-1.2:rationale>Since this service is not used very often, disable it to reduce the
amount of potentially vulnerable code running on the system.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_mcstrans_removed" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# CAUTION: This remediation script will remove mcstrans
#	   from the system, and may remove any packages
#	   that depend on mcstrans. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "mcstrans" ; then

    dnf remove -y "mcstrans"

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_mcstrans_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure mcstrans is removed
  package:
    name: mcstrans
    state: absent
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_mcstrans_removed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_mcstrans_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_mcstrans

class remove_mcstrans {
  package { 'mcstrans':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_mcstrans_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=mcstrans
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_mcstrans_removed:def:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_setroubleshoot-plugins_removed" severity="low">
            <xccdf-1.2:title>Uninstall setroubleshoot-plugins Package</xccdf-1.2:title>
            <xccdf-1.2:description>The SETroubleshoot plugins are used to analyze SELinux AVC data. The service provides information around configuration errors,
unauthorized intrusions, and other potential errors.
The <html:code>setroubleshoot-plugins</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase setroubleshoot-plugins</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R68)</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The SETroubleshoot service is an unnecessary daemon to
have running on a server.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_setroubleshoot-plugins_removed" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# CAUTION: This remediation script will remove setroubleshoot-plugins
#	   from the system, and may remove any packages
#	   that depend on setroubleshoot-plugins. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "setroubleshoot-plugins" ; then

    dnf remove -y "setroubleshoot-plugins"

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_setroubleshoot-plugins_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure setroubleshoot-plugins is removed
  package:
    name: setroubleshoot-plugins
    state: absent
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_setroubleshoot-plugins_removed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_setroubleshoot-plugins_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_setroubleshoot-plugins

class remove_setroubleshoot-plugins {
  package { 'setroubleshoot-plugins':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_setroubleshoot-plugins_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=setroubleshoot-plugins
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_setroubleshoot-plugins_removed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_setroubleshoot-plugins_removed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_setroubleshoot-server_removed" severity="low">
            <xccdf-1.2:title>Uninstall setroubleshoot-server Package</xccdf-1.2:title>
            <xccdf-1.2:description>The SETroubleshoot service notifies desktop users of SELinux
denials. The service provides information around configuration errors,
unauthorized intrusions, and other potential errors.
The <html:code>setroubleshoot-server</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase setroubleshoot-server</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R68)</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The SETroubleshoot service is an unnecessary daemon to have
running on a server.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_setroubleshoot-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# CAUTION: This remediation script will remove setroubleshoot-server
#	   from the system, and may remove any packages
#	   that depend on setroubleshoot-server. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "setroubleshoot-server" ; then

    dnf remove -y "setroubleshoot-server"

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_setroubleshoot-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure setroubleshoot-server is removed
  package:
    name: setroubleshoot-server
    state: absent
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_setroubleshoot-server_removed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_setroubleshoot-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_setroubleshoot-server

class remove_setroubleshoot-server {
  package { 'setroubleshoot-server':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_setroubleshoot-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=setroubleshoot-server
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_setroubleshoot-server_removed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_setroubleshoot-server_removed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_setroubleshoot_removed" severity="low">
            <xccdf-1.2:title>Uninstall setroubleshoot Package</xccdf-1.2:title>
            <xccdf-1.2:description>The SETroubleshoot service notifies desktop users of SELinux
denials. The service provides information around configuration errors,
unauthorized intrusions, and other potential errors.
The <html:code>setroubleshoot</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase setroubleshoot</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R68)</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The SETroubleshoot service is an unnecessary daemon to
have running on a server, especially if
X Windows is removed or disabled.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_setroubleshoot_removed" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# CAUTION: This remediation script will remove setroubleshoot
#	   from the system, and may remove any packages
#	   that depend on setroubleshoot. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "setroubleshoot" ; then

    dnf remove -y "setroubleshoot"

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_setroubleshoot_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure setroubleshoot is removed
  package:
    name: setroubleshoot
    state: absent
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_setroubleshoot_removed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_setroubleshoot_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_setroubleshoot

class remove_setroubleshoot {
  package { 'setroubleshoot':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_setroubleshoot_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=setroubleshoot
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_setroubleshoot_removed:def:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_coreos_enable_selinux_kernel_argument" severity="medium">
            <xccdf-1.2:title>Ensure SELinux Not Disabled in the kernel arguments</xccdf-1.2:title>
            <xccdf-1.2:description>SELinux can be disabled at boot time by disabling it via a kernel argument.
Remove any instances of <html:code>selinux=0</html:code> from the kernel arguments in that
file to prevent SELinux from being disabled at boot.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000022</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000032</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3(3)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">SRG-OS-000445-VMM-001780</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Disabling a major host protection feature, such as SELinux, at boot time prevents
it from confining system services at boot time.  Further, it increases
the chances that it will remain off during system operation.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-coreos_enable_selinux_kernel_argument:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-coreos_enable_selinux_kernel_argument_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_enable_selinux" severity="medium">
            <xccdf-1.2:title>Ensure SELinux Not Disabled in /etc/default/grub</xccdf-1.2:title>
            <xccdf-1.2:description>SELinux can be disabled at boot time by an argument in
<html:code>/etc/default/grub</html:code>.
Remove any instances of <html:code>selinux=0</html:code> from the kernel arguments in that
file to prevent SELinux from being disabled at boot.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000022</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000032</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3(3)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">SRG-OS-000445-VMM-001780</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Disabling a major host protection feature, such as SELinux, at boot time prevents
it from confining system services at boot time.  Further, it increases
the chances that it will remain off during system operation.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_enable_selinux"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

sed -i --follow-symlinks "s/selinux=0//gI" /etc/default/grub /etc/grub2.cfg /etc/grub.d/*
sed -i --follow-symlinks "s/enforcing=0//gI" /etc/default/grub /etc/grub2.cfg /etc/grub.d/*

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_enable_selinux" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Find /etc/grub.d/ files
  find:
    paths:
      - /etc/grub.d/
    follow: true
  register: grub
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-171-3.7.2
    - NIST-800-53-AC-3
    - NIST-800-53-AC-3(3)(a)
    - grub2_enable_selinux
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Ensure SELinux Not Disabled in grub files
  replace:
    dest: '{{ item.path }}'
    regexp: (selinux|enforcing)=0
  with_items:
    - '{{ grub.files }}'
    - path: /etc/grub2.cfg
    - path: /etc/default/grub
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-171-3.7.2
    - NIST-800-53-AC-3
    - NIST-800-53-AC-3(3)(a)
    - grub2_enable_selinux
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-grub2_enable_selinux:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-grub2_enable_selinux_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_selinux_all_devicefiles_labeled" severity="medium">
            <xccdf-1.2:title>Ensure No Device Files are Unlabeled by SELinux</xccdf-1.2:title>
            <xccdf-1.2:description>Device files, which are used for communication with important system
resources, should be labeled with proper SELinux types. If any device files
carry the SELinux type <html:code>device_t</html:code> or <html:code>unlabeled_t</html:code>, report the
bug so that policy can be corrected. Supply information about what the
device is and what programs use it.
<html:br/><html:br/>
To check for incorrectly labeled device files, run following commands:
<html:pre>$ sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n"</html:pre>
<html:pre>$ sudo find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n"</html:pre>
It should produce no output in a well-configured system.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">Automatic remediation of this control is not available. The remediation
can be achieved by amending SELinux policy.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000022</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000032</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000318</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000368</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001812</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001813</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001814</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3(3)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If a device file carries the SELinux type <html:code>device_t</html:code> or
<html:code>unlabeled_t</html:code>, then SELinux cannot properly restrict access to the
device file.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-selinux_all_devicefiles_labeled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-selinux_all_devicefiles_labeled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_selinux_confinement_of_daemons" severity="medium">
            <xccdf-1.2:title>Ensure No Daemons are Unconfined by SELinux</xccdf-1.2:title>
            <xccdf-1.2:description>Daemons for which the SELinux policy does not contain rules will inherit the
context of the parent process. Because daemons are launched during
startup and descend from the <html:code>init</html:code> process, they inherit the <html:code>unconfined_service_t</html:code> context.
<html:br/>
<html:br/>
To check for unconfined daemons, run the following command:
<html:pre>$ sudo ps -eZ | grep "unconfined_service_t"</html:pre>
It should produce no output in a well-configured system.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">Automatic remediation of this control is not available. Remediation
can be achieved by amending SELinux policy or stopping the unconfined
daemons as outlined above.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3(3)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Daemons which run with the <html:code>unconfined_service_t</html:code> context may cause AVC denials,
or allow privileges that the daemon does not require.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-selinux_confinement_of_daemons:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-selinux_confinement_of_daemons_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_selinux_policytype" severity="medium">
            <xccdf-1.2:title>Configure SELinux Policy</xccdf-1.2:title>
            <xccdf-1.2:description>The SELinux <html:code>targeted</html:code> policy is appropriate for
general-purpose desktops and servers, as well as systems in many other roles.
To configure the system to use this policy, add or correct the following line
in <html:code>/etc/selinux/config</html:code>:
<html:pre>SELINUXTYPE=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" use="legacy"/></html:pre>
Other policies, such as <html:code>mls</html:code>, provide additional security labeling
and greater confinement but are not compatible with many general-purpose
use cases.</xccdf-1.2:description>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R66)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002165</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002696</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3(3)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(21)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000445-GPOS-00199</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">SRG-OS-000445-VMM-001780</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Setting the SELinux policy to <html:code>targeted</html:code> or a more specialized policy
ensures the system will confine processes that are likely to be
targeted for exploitation, such as network or system services.
<html:br/><html:br/>
Note: During the development or debugging of SELinux modules, it is common to
temporarily place non-production systems in <html:code>permissive</html:code> mode. In such
temporary cases, SELinux policies should be developed, and once work
is completed, the system should be reconfigured to
<html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" use="legacy"/></html:code>.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="selinux_policytype" complexity="low" disruption="low" reboot="true" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

var_selinux_policy_name='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" use="legacy"/>'


if [ -e "/etc/selinux/config" ] ; then
    
    LC_ALL=C sed -i "/^SELINUXTYPE=/Id" "/etc/selinux/config"
else
    touch "/etc/selinux/config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/selinux/config"

cp "/etc/selinux/config" "/etc/selinux/config.bak"
# Insert at the end of the file
printf '%s\n' "SELINUXTYPE=$var_selinux_policy_name" &gt;&gt; "/etc/selinux/config"
# Clean up after ourselves.
rm "/etc/selinux/config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="selinux_policytype" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: XCCDF Value var_selinux_policy_name # promote to variable
  set_fact:
    var_selinux_policy_name: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" use="legacy"/>
  tags:
    - always

- name: Configure SELinux Policy
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/selinux/config
        create: false
        regexp: ^SELINUXTYPE=
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/selinux/config
      lineinfile:
        path: /etc/selinux/config
        create: false
        regexp: ^SELINUXTYPE=
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/selinux/config
      lineinfile:
        path: /etc/selinux/config
        create: true
        regexp: ^SELINUXTYPE=
        line: SELINUXTYPE={{ var_selinux_policy_name }}
        state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-171-3.7.2
    - NIST-800-53-AC-3
    - NIST-800-53-AC-3(3)(a)
    - NIST-800-53-AU-9
    - NIST-800-53-SC-7(21)
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
    - selinux_policytype
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_selinux_policy_name:var:1" value-id="xccdf_org.ssgproject.content_value_var_selinux_policy_name"/>
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-selinux_policytype:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-selinux_policytype_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_selinux_state" severity="medium">
            <xccdf-1.2:title>Ensure SELinux State is Enforcing</xccdf-1.2:title>
            <xccdf-1.2:description>The SELinux state should be set to <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_state" use="legacy"/></html:code> at
system boot time.  In the file <html:code>/etc/selinux/config</html:code>, add or correct the
following line to configure the system to boot into enforcing mode:
<html:pre>SELINUX=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_state" use="legacy"/></html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R66)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002165</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002696</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3(3)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(21)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000445-GPOS-00199</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000134-GPOS-00068</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">SRG-OS-000445-VMM-001780</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Setting the SELinux state to enforcing ensures SELinux is able to confine
potentially compromised processes to the security policy, which is designed to
prevent them from causing damage to the system or further elevating their
privileges.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="selinux_state" complexity="low" disruption="low" reboot="true" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

var_selinux_state='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_state" use="legacy"/>'


if [ -e "/etc/selinux/config" ] ; then
    
    LC_ALL=C sed -i "/^SELINUX=/Id" "/etc/selinux/config"
else
    touch "/etc/selinux/config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/selinux/config"

cp "/etc/selinux/config" "/etc/selinux/config.bak"
# Insert at the end of the file
printf '%s\n' "SELINUX=$var_selinux_state" &gt;&gt; "/etc/selinux/config"
# Clean up after ourselves.
rm "/etc/selinux/config.bak"

fixfiles onboot
fixfiles -f relabel

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="selinux_state" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: XCCDF Value var_selinux_state # promote to variable
  set_fact:
    var_selinux_state: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_state" use="legacy"/>
  tags:
    - always

- name: Ensure SELinux State is Enforcing
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/selinux/config
        create: false
        regexp: ^SELINUX=
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/selinux/config
      lineinfile:
        path: /etc/selinux/config
        create: false
        regexp: ^SELINUX=
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/selinux/config
      lineinfile:
        path: /etc/selinux/config
        create: true
        regexp: ^SELINUX=
        line: SELINUX={{ var_selinux_state }}
        state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.2
    - NIST-800-171-3.7.2
    - NIST-800-53-AC-3
    - NIST-800-53-AC-3(3)(a)
    - NIST-800-53-AU-9
    - NIST-800-53-SC-7(21)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - selinux_state
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_selinux_state:var:1" value-id="xccdf_org.ssgproject.content_value_var_selinux_state"/>
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-selinux_state:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-selinux_state_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_selinux-booleans">
            <xccdf-1.2:title>SELinux - Booleans</xccdf-1.2:title>
            <xccdf-1.2:description>Enable or Disable runtime customization of SELinux system policies
without having to reload or recompile the SELinux policy.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_abrt_anon_write" type="boolean">
              <xccdf-1.2:title>abrt_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_abrt_handle_event" type="boolean">
              <xccdf-1.2:title>abrt_handle_event SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_abrt_upload_watch_anon_write" type="boolean">
              <xccdf-1.2:title>abrt_upload_watch_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_antivirus_can_scan_system" type="boolean">
              <xccdf-1.2:title>antivirus_can_scan_system SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_antivirus_use_jit" type="boolean">
              <xccdf-1.2:title>antivirus_use_jit SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditadm_exec_content" type="boolean">
              <xccdf-1.2:title>auditadm_exec_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_authlogin_nsswitch_use_ldap" type="boolean">
              <xccdf-1.2:title>authlogin_nsswitch_use_ldap SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_authlogin_radius" type="boolean">
              <xccdf-1.2:title>authlogin_radius SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_authlogin_yubikey" type="boolean">
              <xccdf-1.2:title>authlogin_yubikey SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_awstats_purge_apache_log_files" type="boolean">
              <xccdf-1.2:title>awstats_purge_apache_log_files SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_boinc_execmem" type="boolean">
              <xccdf-1.2:title>boinc_execmem SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cdrecord_read_content" type="boolean">
              <xccdf-1.2:title>cdrecord_read_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cluster_can_network_connect" type="boolean">
              <xccdf-1.2:title>cluster_can_network_connect SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cluster_manage_all_files" type="boolean">
              <xccdf-1.2:title>cluster_manage_all_files SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cluster_use_execmem" type="boolean">
              <xccdf-1.2:title>cluster_use_execmem SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cobbler_anon_write" type="boolean">
              <xccdf-1.2:title>cobbler_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cobbler_can_network_connect" type="boolean">
              <xccdf-1.2:title>cobbler_can_network_connect SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cobbler_use_cifs" type="boolean">
              <xccdf-1.2:title>cobbler_use_cifs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cobbler_use_nfs" type="boolean">
              <xccdf-1.2:title>cobbler_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_collectd_tcp_network_connect" type="boolean">
              <xccdf-1.2:title>collectd_tcp_network_connect SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_condor_tcp_network_connect" type="boolean">
              <xccdf-1.2:title>condor_tcp_network_connect SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_conman_can_network" type="boolean">
              <xccdf-1.2:title>conman_can_network SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_container_connect_any" type="boolean">
              <xccdf-1.2:title>container_connect_any SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cron_can_relabel" type="boolean">
              <xccdf-1.2:title>cron_can_relabel SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cron_system_cronjob_use_shares" type="boolean">
              <xccdf-1.2:title>cron_system_cronjob_use_shares SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cron_userdomain_transition" type="boolean">
              <xccdf-1.2:title>cron_userdomain_transition SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cups_execmem" type="boolean">
              <xccdf-1.2:title>cups_execmem SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cvs_read_shadow" type="boolean">
              <xccdf-1.2:title>cvs_read_shadow SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_daemons_dump_core" type="boolean">
              <xccdf-1.2:title>daemons_dump_core SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_daemons_enable_cluster_mode" type="boolean">
              <xccdf-1.2:title>daemons_enable_cluster_mode SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_daemons_use_tcp_wrapper" type="boolean">
              <xccdf-1.2:title>daemons_use_tcp_wrapper SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_daemons_use_tty" type="boolean">
              <xccdf-1.2:title>daemons_use_tty SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_dbadm_exec_content" type="boolean">
              <xccdf-1.2:title>dbadm_exec_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_dbadm_manage_user_files" type="boolean">
              <xccdf-1.2:title>dbadm_manage_user_files SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_dbadm_read_user_files" type="boolean">
              <xccdf-1.2:title>dbadm_read_user_files SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_deny_execmem" type="boolean">
              <xccdf-1.2:title>deny_execmem SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_deny_ptrace" type="boolean">
              <xccdf-1.2:title>deny_ptrace SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_dhcpc_exec_iptables" type="boolean">
              <xccdf-1.2:title>dhcpc_exec_iptables SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_dhcpd_use_ldap" type="boolean">
              <xccdf-1.2:title>dhcpd_use_ldap SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_domain_fd_use" type="boolean">
              <xccdf-1.2:title>domain_fd_use SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_domain_kernel_load_modules" type="boolean">
              <xccdf-1.2:title>domain_kernel_load_modules SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_entropyd_use_audio" type="boolean">
              <xccdf-1.2:title>entropyd_use_audio SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_exim_can_connect_db" type="boolean">
              <xccdf-1.2:title>exim_can_connect_db SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_exim_manage_user_files" type="boolean">
              <xccdf-1.2:title>exim_manage_user_files SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_exim_read_user_files" type="boolean">
              <xccdf-1.2:title>exim_read_user_files SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_fcron_crond" type="boolean">
              <xccdf-1.2:title>fcron_crond SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_fenced_can_network_connect" type="boolean">
              <xccdf-1.2:title>fenced_can_network_connect SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_fenced_can_ssh" type="boolean">
              <xccdf-1.2:title>fenced_can_ssh SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_fips_mode" type="boolean">
              <xccdf-1.2:title>fips_mode SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ftpd_anon_write" type="boolean">
              <xccdf-1.2:title>ftpd_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ftpd_connect_all_unreserved" type="boolean">
              <xccdf-1.2:title>ftpd_connect_all_unreserved SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ftpd_connect_db" type="boolean">
              <xccdf-1.2:title>ftpd_connect_db SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ftpd_full_access" type="boolean">
              <xccdf-1.2:title>ftpd_full_access SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ftpd_use_cifs" type="boolean">
              <xccdf-1.2:title>ftpd_use_cifs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ftpd_use_fusefs" type="boolean">
              <xccdf-1.2:title>ftpd_use_fusefs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ftpd_use_nfs" type="boolean">
              <xccdf-1.2:title>ftpd_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ftpd_use_passive_mode" type="boolean">
              <xccdf-1.2:title>ftpd_use_passive_mode SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_git_cgi_enable_homedirs" type="boolean">
              <xccdf-1.2:title>git_cgi_enable_homedirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_git_cgi_use_cifs" type="boolean">
              <xccdf-1.2:title>git_cgi_use_cifs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_git_cgi_use_nfs" type="boolean">
              <xccdf-1.2:title>git_cgi_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_git_session_bind_all_unreserved_ports" type="boolean">
              <xccdf-1.2:title>git_session_bind_all_unreserved_ports SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_git_session_users" type="boolean">
              <xccdf-1.2:title>git_session_users SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_git_system_enable_homedirs" type="boolean">
              <xccdf-1.2:title>git_system_enable_homedirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_git_system_use_cifs" type="boolean">
              <xccdf-1.2:title>git_system_use_cifs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_git_system_use_nfs" type="boolean">
              <xccdf-1.2:title>git_system_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_gitosis_can_sendmail" type="boolean">
              <xccdf-1.2:title>gitosis_can_sendmail SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_glance_api_can_network" type="boolean">
              <xccdf-1.2:title>glance_api_can_network SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_glance_use_execmem" type="boolean">
              <xccdf-1.2:title>glance_use_execmem SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_glance_use_fusefs" type="boolean">
              <xccdf-1.2:title>glance_use_fusefs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_global_ssp" type="boolean">
              <xccdf-1.2:title>global_ssp SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_gluster_anon_write" type="boolean">
              <xccdf-1.2:title>gluster_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_gluster_export_all_ro" type="boolean">
              <xccdf-1.2:title>gluster_export_all_ro SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_gluster_export_all_rw" type="boolean">
              <xccdf-1.2:title>gluster_export_all_rw SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_gpg_web_anon_write" type="boolean">
              <xccdf-1.2:title>gpg_web_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_gssd_read_tmp" type="boolean">
              <xccdf-1.2:title>gssd_read_tmp SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_guest_exec_content" type="boolean">
              <xccdf-1.2:title>guest_exec_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_haproxy_connect_any" type="boolean">
              <xccdf-1.2:title>haproxy_connect_any SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_anon_write" type="boolean">
              <xccdf-1.2:title>httpd_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_builtin_scripting" type="boolean">
              <xccdf-1.2:title>httpd_builtin_scripting SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_can_check_spam" type="boolean">
              <xccdf-1.2:title>httpd_can_check_spam SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_can_connect_ftp" type="boolean">
              <xccdf-1.2:title>httpd_can_connect_ftp SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_can_connect_ldap" type="boolean">
              <xccdf-1.2:title>httpd_can_connect_ldap SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_can_connect_mythtv" type="boolean">
              <xccdf-1.2:title>httpd_can_connect_mythtv SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_can_connect_zabbix" type="boolean">
              <xccdf-1.2:title>httpd_can_connect_zabbix SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_can_network_connect" type="boolean">
              <xccdf-1.2:title>httpd_can_network_connect SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_can_network_connect_cobbler" type="boolean">
              <xccdf-1.2:title>httpd_can_network_connect_cobbler SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_can_network_connect_db" type="boolean">
              <xccdf-1.2:title>httpd_can_network_connect_db SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_can_network_memcache" type="boolean">
              <xccdf-1.2:title>httpd_can_network_memcache SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_can_network_relay" type="boolean">
              <xccdf-1.2:title>httpd_can_network_relay SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_can_sendmail" type="boolean">
              <xccdf-1.2:title>httpd_can_sendmail SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_dbus_avahi" type="boolean">
              <xccdf-1.2:title>httpd_dbus_avahi SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_dbus_sssd" type="boolean">
              <xccdf-1.2:title>httpd_dbus_sssd SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_dontaudit_search_dirs" type="boolean">
              <xccdf-1.2:title>httpd_dontaudit_search_dirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_enable_cgi" type="boolean">
              <xccdf-1.2:title>httpd_enable_cgi SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_enable_ftp_server" type="boolean">
              <xccdf-1.2:title>httpd_enable_ftp_server SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_enable_homedirs" type="boolean">
              <xccdf-1.2:title>httpd_enable_homedirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_execmem" type="boolean">
              <xccdf-1.2:title>httpd_execmem SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_graceful_shutdown" type="boolean">
              <xccdf-1.2:title>httpd_graceful_shutdown SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_manage_ipa" type="boolean">
              <xccdf-1.2:title>httpd_manage_ipa SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_mod_auth_ntlm_winbind" type="boolean">
              <xccdf-1.2:title>httpd_mod_auth_ntlm_winbind SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_mod_auth_pam" type="boolean">
              <xccdf-1.2:title>httpd_mod_auth_pam SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_read_user_content" type="boolean">
              <xccdf-1.2:title>httpd_read_user_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_run_ipa" type="boolean">
              <xccdf-1.2:title>httpd_run_ipa SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_run_preupgrade" type="boolean">
              <xccdf-1.2:title>httpd_run_preupgrade SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_run_stickshift" type="boolean">
              <xccdf-1.2:title>httpd_run_stickshift SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_serve_cobbler_files" type="boolean">
              <xccdf-1.2:title>httpd_serve_cobbler_files SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_setrlimit" type="boolean">
              <xccdf-1.2:title>httpd_setrlimit SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_ssi_exec" type="boolean">
              <xccdf-1.2:title>httpd_ssi_exec SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_sys_script_anon_write" type="boolean">
              <xccdf-1.2:title>httpd_sys_script_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_tmp_exec" type="boolean">
              <xccdf-1.2:title>httpd_tmp_exec SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_tty_comm" type="boolean">
              <xccdf-1.2:title>httpd_tty_comm SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_unified" type="boolean">
              <xccdf-1.2:title>httpd_unified SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_use_cifs" type="boolean">
              <xccdf-1.2:title>httpd_use_cifs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_use_fusefs" type="boolean">
              <xccdf-1.2:title>httpd_use_fusefs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_use_gpg" type="boolean">
              <xccdf-1.2:title>httpd_use_gpg SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_use_nfs" type="boolean">
              <xccdf-1.2:title>httpd_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_use_openstack" type="boolean">
              <xccdf-1.2:title>httpd_use_openstack SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_use_sasl" type="boolean">
              <xccdf-1.2:title>httpd_use_sasl SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_verify_dns" type="boolean">
              <xccdf-1.2:title>httpd_verify_dns SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_icecast_use_any_tcp_ports" type="boolean">
              <xccdf-1.2:title>icecast_use_any_tcp_ports SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_irc_use_any_tcp_ports" type="boolean">
              <xccdf-1.2:title>irc_use_any_tcp_ports SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_irssi_use_full_network" type="boolean">
              <xccdf-1.2:title>irssi_use_full_network SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_kdumpgui_run_bootloader" type="boolean">
              <xccdf-1.2:title>kdumpgui_run_bootloader SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_kerberos_enabled" type="boolean">
              <xccdf-1.2:title>kerberos_enabled SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ksmtuned_use_cifs" type="boolean">
              <xccdf-1.2:title>ksmtuned_use_cifs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ksmtuned_use_nfs" type="boolean">
              <xccdf-1.2:title>ksmtuned_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_logadm_exec_content" type="boolean">
              <xccdf-1.2:title>logadm_exec_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_logging_syslogd_can_sendmail" type="boolean">
              <xccdf-1.2:title>logging_syslogd_can_sendmail SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_logging_syslogd_run_nagios_plugins" type="boolean">
              <xccdf-1.2:title>logging_syslogd_run_nagios_plugins SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_logging_syslogd_use_tty" type="boolean">
              <xccdf-1.2:title>logging_syslogd_use_tty SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_login_console_enabled" type="boolean">
              <xccdf-1.2:title>login_console_enabled SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_logrotate_use_nfs" type="boolean">
              <xccdf-1.2:title>logrotate_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_logwatch_can_network_connect_mail" type="boolean">
              <xccdf-1.2:title>logwatch_can_network_connect_mail SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_lsmd_plugin_connect_any" type="boolean">
              <xccdf-1.2:title>lsmd_plugin_connect_any SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mailman_use_fusefs" type="boolean">
              <xccdf-1.2:title>mailman_use_fusefs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mcelog_client" type="boolean">
              <xccdf-1.2:title>mcelog_client SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mcelog_exec_scripts" type="boolean">
              <xccdf-1.2:title>mcelog_exec_scripts SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mcelog_foreground" type="boolean">
              <xccdf-1.2:title>mcelog_foreground SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mcelog_server" type="boolean">
              <xccdf-1.2:title>mcelog_server SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_minidlna_read_generic_user_content" type="boolean">
              <xccdf-1.2:title>minidlna_read_generic_user_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mmap_low_allowed" type="boolean">
              <xccdf-1.2:title>mmap_low_allowed SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mock_enable_homedirs" type="boolean">
              <xccdf-1.2:title>mock_enable_homedirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mount_anyfile" type="boolean">
              <xccdf-1.2:title>mount_anyfile SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mozilla_plugin_bind_unreserved_ports" type="boolean">
              <xccdf-1.2:title>mozilla_plugin_bind_unreserved_ports SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mozilla_plugin_can_network_connect" type="boolean">
              <xccdf-1.2:title>mozilla_plugin_can_network_connect SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mozilla_plugin_use_bluejeans" type="boolean">
              <xccdf-1.2:title>mozilla_plugin_use_bluejeans SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mozilla_plugin_use_gps" type="boolean">
              <xccdf-1.2:title>mozilla_plugin_use_gps SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mozilla_plugin_use_spice" type="boolean">
              <xccdf-1.2:title>mozilla_plugin_use_spice SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mozilla_read_content" type="boolean">
              <xccdf-1.2:title>mozilla_read_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mpd_enable_homedirs" type="boolean">
              <xccdf-1.2:title>mpd_enable_homedirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mpd_use_cifs" type="boolean">
              <xccdf-1.2:title>mpd_use_cifs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mpd_use_nfs" type="boolean">
              <xccdf-1.2:title>mpd_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mplayer_execstack" type="boolean">
              <xccdf-1.2:title>mplayer_execstack SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mysql_connect_any" type="boolean">
              <xccdf-1.2:title>mysql_connect_any SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_nagios_run_pnp4nagios" type="boolean">
              <xccdf-1.2:title>nagios_run_pnp4nagios SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_nagios_run_sudo" type="boolean">
              <xccdf-1.2:title>nagios_run_sudo SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_named_tcp_bind_http_port" type="boolean">
              <xccdf-1.2:title>named_tcp_bind_http_port SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_named_write_master_zones" type="boolean">
              <xccdf-1.2:title>named_write_master_zones SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_neutron_can_network" type="boolean">
              <xccdf-1.2:title>neutron_can_network SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_nfs_export_all_ro" type="boolean">
              <xccdf-1.2:title>nfs_export_all_ro SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_nfs_export_all_rw" type="boolean">
              <xccdf-1.2:title>nfs_export_all_rw SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_nfsd_anon_write" type="boolean">
              <xccdf-1.2:title>nfsd_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_nis_enabled" type="boolean">
              <xccdf-1.2:title>nis_enabled SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_nscd_use_shm" type="boolean">
              <xccdf-1.2:title>nscd_use_shm SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_openshift_use_nfs" type="boolean">
              <xccdf-1.2:title>openshift_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_openvpn_can_network_connect" type="boolean">
              <xccdf-1.2:title>openvpn_can_network_connect SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_openvpn_enable_homedirs" type="boolean">
              <xccdf-1.2:title>openvpn_enable_homedirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_openvpn_run_unconfined" type="boolean">
              <xccdf-1.2:title>openvpn_run_unconfined SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_pcp_bind_all_unreserved_ports" type="boolean">
              <xccdf-1.2:title>pcp_bind_all_unreserved_ports SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_pcp_read_generic_logs" type="boolean">
              <xccdf-1.2:title>pcp_read_generic_logs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_piranha_lvs_can_network_connect" type="boolean">
              <xccdf-1.2:title>piranha_lvs_can_network_connect SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_polipo_connect_all_unreserved" type="boolean">
              <xccdf-1.2:title>polipo_connect_all_unreserved SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_polipo_session_bind_all_unreserved_ports" type="boolean">
              <xccdf-1.2:title>polipo_session_bind_all_unreserved_ports SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_polipo_session_users" type="boolean">
              <xccdf-1.2:title>polipo_session_users SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_polipo_use_cifs" type="boolean">
              <xccdf-1.2:title>polipo_use_cifs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_polipo_use_nfs" type="boolean">
              <xccdf-1.2:title>polipo_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_polyinstantiation_enabled" type="boolean">
              <xccdf-1.2:title>polyinstantiation_enabled SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_postfix_local_write_mail_spool" type="boolean">
              <xccdf-1.2:title>postfix_local_write_mail_spool SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_postgresql_can_rsync" type="boolean">
              <xccdf-1.2:title>postgresql_can_rsync SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_postgresql_selinux_transmit_client_label" type="boolean">
              <xccdf-1.2:title>postgresql_selinux_transmit_client_label SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_postgresql_selinux_unconfined_dbadm" type="boolean">
              <xccdf-1.2:title>postgresql_selinux_unconfined_dbadm SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_postgresql_selinux_users_ddl" type="boolean">
              <xccdf-1.2:title>postgresql_selinux_users_ddl SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_pppd_can_insmod" type="boolean">
              <xccdf-1.2:title>pppd_can_insmod SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_pppd_for_user" type="boolean">
              <xccdf-1.2:title>pppd_for_user SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_privoxy_connect_any" type="boolean">
              <xccdf-1.2:title>privoxy_connect_any SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_prosody_bind_http_port" type="boolean">
              <xccdf-1.2:title>prosody_bind_http_port SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_puppetagent_manage_all_files" type="boolean">
              <xccdf-1.2:title>puppetagent_manage_all_files SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_puppetmaster_use_db" type="boolean">
              <xccdf-1.2:title>puppetmaster_use_db SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_racoon_read_shadow" type="boolean">
              <xccdf-1.2:title>racoon_read_shadow SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_rsync_anon_write" type="boolean">
              <xccdf-1.2:title>rsync_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_rsync_client" type="boolean">
              <xccdf-1.2:title>rsync_client SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_rsync_export_all_ro" type="boolean">
              <xccdf-1.2:title>rsync_export_all_ro SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_rsync_full_access" type="boolean">
              <xccdf-1.2:title>rsync_full_access SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_samba_create_home_dirs" type="boolean">
              <xccdf-1.2:title>samba_create_home_dirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_samba_domain_controller" type="boolean">
              <xccdf-1.2:title>samba_domain_controller SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_samba_enable_home_dirs" type="boolean">
              <xccdf-1.2:title>samba_enable_home_dirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_samba_export_all_ro" type="boolean">
              <xccdf-1.2:title>samba_export_all_ro SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_samba_export_all_rw" type="boolean">
              <xccdf-1.2:title>samba_export_all_rw SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_samba_load_libgfapi" type="boolean">
              <xccdf-1.2:title>samba_load_libgfapi SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_samba_portmapper" type="boolean">
              <xccdf-1.2:title>samba_portmapper SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_samba_run_unconfined" type="boolean">
              <xccdf-1.2:title>samba_run_unconfined SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_samba_share_fusefs" type="boolean">
              <xccdf-1.2:title>samba_share_fusefs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_samba_share_nfs" type="boolean">
              <xccdf-1.2:title>samba_share_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sanlock_use_fusefs" type="boolean">
              <xccdf-1.2:title>sanlock_use_fusefs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sanlock_use_nfs" type="boolean">
              <xccdf-1.2:title>sanlock_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sanlock_use_samba" type="boolean">
              <xccdf-1.2:title>sanlock_use_samba SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_saslauthd_read_shadow" type="boolean">
              <xccdf-1.2:title>saslauthd_read_shadow SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_secadm_exec_content" type="boolean">
              <xccdf-1.2:title>secadm_exec_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_secure_mode" type="boolean">
              <xccdf-1.2:title>secure_mode SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_secure_mode_insmod" type="boolean">
              <xccdf-1.2:title>secure_mode_insmod SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_secure_mode_policyload" type="boolean">
              <xccdf-1.2:title>secure_mode_policyload SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_direct_dri_enabled" type="boolean">
              <xccdf-1.2:title>selinuxuser_direct_dri_enabled SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_execheap" type="boolean">
              <xccdf-1.2:title>selinuxuser_execheap SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_execmod" type="boolean">
              <xccdf-1.2:title>selinuxuser_execmod SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_execstack" type="boolean">
              <xccdf-1.2:title>selinuxuser_execstack SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_mysql_connect_enabled" type="boolean">
              <xccdf-1.2:title>selinuxuser_mysql_connect_enabled SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_ping" type="boolean">
              <xccdf-1.2:title>selinuxuser_ping SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_postgresql_connect_enabled" type="boolean">
              <xccdf-1.2:title>selinuxuser_postgresql_connect_enabled SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_rw_noexattrfile" type="boolean">
              <xccdf-1.2:title>selinuxuser_rw_noexattrfile SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_share_music" type="boolean">
              <xccdf-1.2:title>selinuxuser_share_music SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_tcp_server" type="boolean">
              <xccdf-1.2:title>selinuxuser_tcp_server SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_udp_server" type="boolean">
              <xccdf-1.2:title>selinuxuser_udp_server SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_use_ssh_chroot" type="boolean">
              <xccdf-1.2:title>selinuxuser_use_ssh_chroot SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sge_domain_can_network_connect" type="boolean">
              <xccdf-1.2:title>sge_domain_can_network_connect SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sge_use_nfs" type="boolean">
              <xccdf-1.2:title>sge_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_smartmon_3ware" type="boolean">
              <xccdf-1.2:title>smartmon_3ware SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_smbd_anon_write" type="boolean">
              <xccdf-1.2:title>smbd_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_spamassassin_can_network" type="boolean">
              <xccdf-1.2:title>spamassassin_can_network SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_spamd_enable_home_dirs" type="boolean">
              <xccdf-1.2:title>spamd_enable_home_dirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_squid_connect_any" type="boolean">
              <xccdf-1.2:title>squid_connect_any SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_squid_use_tproxy" type="boolean">
              <xccdf-1.2:title>squid_use_tproxy SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ssh_chroot_rw_homedirs" type="boolean">
              <xccdf-1.2:title>ssh_chroot_rw_homedirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ssh_keysign" type="boolean">
              <xccdf-1.2:title>ssh_keysign SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ssh_sysadm_login" type="boolean">
              <xccdf-1.2:title>ssh_sysadm_login SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_staff_exec_content" type="boolean">
              <xccdf-1.2:title>staff_exec_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_staff_use_svirt" type="boolean">
              <xccdf-1.2:title>staff_use_svirt SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_swift_can_network" type="boolean">
              <xccdf-1.2:title>swift_can_network SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sysadm_exec_content" type="boolean">
              <xccdf-1.2:title>sysadm_exec_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_telepathy_connect_all_ports" type="boolean">
              <xccdf-1.2:title>telepathy_connect_all_ports SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_telepathy_tcp_connect_generic_network_ports" type="boolean">
              <xccdf-1.2:title>telepathy_tcp_connect_generic_network_ports SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_tftp_anon_write" type="boolean">
              <xccdf-1.2:title>tftp_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_tftp_home_dir" type="boolean">
              <xccdf-1.2:title>tftp_home_dir SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_tmpreaper_use_nfs" type="boolean">
              <xccdf-1.2:title>tmpreaper_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_tmpreaper_use_samba" type="boolean">
              <xccdf-1.2:title>tmpreaper_use_samba SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_tor_bind_all_unreserved_ports" type="boolean">
              <xccdf-1.2:title>tor_bind_all_unreserved_ports SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_tor_can_network_relay" type="boolean">
              <xccdf-1.2:title>tor_can_network_relay SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_unconfined_chrome_sandbox_transition" type="boolean">
              <xccdf-1.2:title>unconfined_chrome_sandbox_transition SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_unconfined_login" type="boolean">
              <xccdf-1.2:title>unconfined_login SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_unconfined_mozilla_plugin_transition" type="boolean">
              <xccdf-1.2:title>unconfined_mozilla_plugin_transition SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_unprivuser_use_svirt" type="boolean">
              <xccdf-1.2:title>unprivuser_use_svirt SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_use_ecryptfs_home_dirs" type="boolean">
              <xccdf-1.2:title>use_ecryptfs_home_dirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_use_fusefs_home_dirs" type="boolean">
              <xccdf-1.2:title>use_fusefs_home_dirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_use_lpd_server" type="boolean">
              <xccdf-1.2:title>use_lpd_server SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_use_nfs_home_dirs" type="boolean">
              <xccdf-1.2:title>use_nfs_home_dirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_use_samba_home_dirs" type="boolean">
              <xccdf-1.2:title>use_samba_home_dirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_user_exec_content" type="boolean">
              <xccdf-1.2:title>user_exec_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_varnishd_connect_any" type="boolean">
              <xccdf-1.2:title>varnishd_connect_any SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_read_qemu_ga_data" type="boolean">
              <xccdf-1.2:title>virt_read_qemu_ga_data SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_rw_qemu_ga_data" type="boolean">
              <xccdf-1.2:title>virt_rw_qemu_ga_data SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_all_caps" type="boolean">
              <xccdf-1.2:title>virt_sandbox_use_all_caps SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_audit" type="boolean">
              <xccdf-1.2:title>virt_sandbox_use_audit SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_mknod" type="boolean">
              <xccdf-1.2:title>virt_sandbox_use_mknod SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_netlink" type="boolean">
              <xccdf-1.2:title>virt_sandbox_use_netlink SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_sys_admin" type="boolean">
              <xccdf-1.2:title>virt_sandbox_use_sys_admin SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_transition_userdomain" type="boolean">
              <xccdf-1.2:title>virt_transition_userdomain SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_use_comm" type="boolean">
              <xccdf-1.2:title>virt_use_comm SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_use_execmem" type="boolean">
              <xccdf-1.2:title>virt_use_execmem SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_use_fusefs" type="boolean">
              <xccdf-1.2:title>virt_use_fusefs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_use_nfs" type="boolean">
              <xccdf-1.2:title>virt_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_use_rawip" type="boolean">
              <xccdf-1.2:title>virt_use_rawip SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_use_samba" type="boolean">
              <xccdf-1.2:title>virt_use_samba SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_use_sanlock" type="boolean">
              <xccdf-1.2:title>virt_use_sanlock SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_use_usb" type="boolean">
              <xccdf-1.2:title>virt_use_usb SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_use_xserver" type="boolean">
              <xccdf-1.2:title>virt_use_xserver SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_webadm_manage_user_files" type="boolean">
              <xccdf-1.2:title>webadm_manage_user_files SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_webadm_read_user_files" type="boolean">
              <xccdf-1.2:title>webadm_read_user_files SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_wine_mmap_zero_ignore" type="boolean">
              <xccdf-1.2:title>wine_mmap_zero_ignore SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xdm_bind_vnc_tcp_port" type="boolean">
              <xccdf-1.2:title>xdm_bind_vnc_tcp_port SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xdm_exec_bootloader" type="boolean">
              <xccdf-1.2:title>xdm_exec_bootloader SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xdm_sysadm_login" type="boolean">
              <xccdf-1.2:title>xdm_sysadm_login SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xdm_write_home" type="boolean">
              <xccdf-1.2:title>xdm_write_home SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xen_use_nfs" type="boolean">
              <xccdf-1.2:title>xen_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xend_run_blktap" type="boolean">
              <xccdf-1.2:title>xend_run_blktap SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xend_run_qemu" type="boolean">
              <xccdf-1.2:title>xend_run_qemu SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xguest_connect_network" type="boolean">
              <xccdf-1.2:title>xguest_connect_network SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xguest_exec_content" type="boolean">
              <xccdf-1.2:title>xguest_exec_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xguest_mount_media" type="boolean">
              <xccdf-1.2:title>xguest_mount_media SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xguest_use_bluetooth" type="boolean">
              <xccdf-1.2:title>xguest_use_bluetooth SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xserver_clients_write_xshm" type="boolean">
              <xccdf-1.2:title>xserver_clients_write_xshm SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xserver_execmem" type="boolean">
              <xccdf-1.2:title>xserver_execmem SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xserver_object_manager" type="boolean">
              <xccdf-1.2:title>xserver_object_manager SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_zabbix_can_network" type="boolean">
              <xccdf-1.2:title>zabbix_can_network SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_zarafa_setrlimit" type="boolean">
              <xccdf-1.2:title>zarafa_setrlimit SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_zebra_write_config" type="boolean">
              <xccdf-1.2:title>zebra_write_config SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_zoneminder_anon_write" type="boolean">
              <xccdf-1.2:title>zoneminder_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_zoneminder_run_sudo" type="boolean">
              <xccdf-1.2:title>zoneminder_run_sudo SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
      </xccdf-1.2:Group>
      <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_services">
        <xccdf-1.2:title>Services</xccdf-1.2:title>
        <xccdf-1.2:description>The best protection against vulnerable software is running less software. This section describes how to review
the software which Fedora installs on a system and disable software which is not needed. It
then enumerates the software packages installed on a default Fedora system and provides guidance about which
ones can be safely disabled.
<html:br/><html:br/>
Fedora provides a convenient minimal install option that essentially installs the bare necessities for a functional
system. When building Fedora systems, it is highly recommended to select the minimal packages and then build up
the system from there.</xccdf-1.2:description>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_apport">
          <xccdf-1.2:title>Apport Service</xccdf-1.2:title>
          <xccdf-1.2:description>The Apport service provides debugging and crash reporting
features on Ubuntu distributions.</xccdf-1.2:description>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_apt">
          <xccdf-1.2:title>APT service configuration</xccdf-1.2:title>
          <xccdf-1.2:description>The apt service manage the package management and update of the whole system. Its configuration need to be properly defined to ensure efficient security updates, packages and repository authentication and proper lifecycle management.</xccdf-1.2:description>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_avahi">
          <xccdf-1.2:title>Avahi Server</xccdf-1.2:title>
          <xccdf-1.2:description>The Avahi daemon implements the DNS Service Discovery
and Multicast DNS protocols, which provide service and host
discovery on a network. It allows a system to automatically
identify resources on the network, such as printers or web servers.
This capability is also known as mDNSresponder and is a major part
of Zeroconf networking.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_avahi_configuration">
            <xccdf-1.2:title>Configure Avahi if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description>If your system requires the Avahi daemon, its configuration can be restricted
to improve security. The Avahi daemon configuration file is
<html:code>/etc/avahi/avahi-daemon.conf</html:code>. The following security recommendations
should be applied to this file:
See the <html:code>avahi-daemon.conf(5)</html:code> man page, or documentation at

    <html:a href="http://www.avahi.org">http://www.avahi.org</html:a>, for more detailed information
about the configuration options.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_avahi_disable_publishing" severity="low">
              <xccdf-1.2:title>Disable Avahi Publishing</xccdf-1.2:title>
              <xccdf-1.2:description>To prevent Avahi from publishing its records, edit <html:code>/etc/avahi/avahi-daemon.conf</html:code>
and ensure the following line appears in the <html:code>[publish]</html:code> section:
<html:pre>disable-publishing=yes</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:rationale>This helps ensure that no record will be published by Avahi.</xccdf-1.2:rationale>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disable_avahi_group">
            <xccdf-1.2:title>Disable Avahi Server if Possible</xccdf-1.2:title>
            <xccdf-1.2:description>Because the Avahi daemon service keeps an open network
port, it is subject to network attacks.
Disabling it can reduce the system's vulnerability to such attacks.</xccdf-1.2:description>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_base">
          <xccdf-1.2:title>Base Services</xccdf-1.2:title>
          <xccdf-1.2:description>This section addresses the base services that are installed on a
Fedora default installation which are not covered in other
sections. Some of these services listen on the network and
should be treated with particular discretion. Other services are local
system utilities that may or may not be extraneous. In general, system services
should be disabled if not required.</xccdf-1.2:description>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_abrt_removed" severity="medium">
            <xccdf-1.2:title>Uninstall Automatic Bug Reporting Tool (abrt)</xccdf-1.2:title>
            <xccdf-1.2:description>The Automatic Bug Reporting Tool (<html:code>abrt</html:code>) collects
and reports crash data when an application crash is detected. Using a variety
of plugins, abrt can email crash reports to system administrators, log crash
reports to files, or forward crash reports to a centralized issue tracking
system such as RHTSupport.
The <html:code>abrt</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase abrt</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Mishandling crash data could expose sensitive information about
vulnerabilities in software executing on the system, as well as sensitive
information from within a process's address space or registers.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_abrt_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove abrt
#	   from the system, and may remove any packages
#	   that depend on abrt. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "abrt" ; then

    dnf remove -y "abrt"

fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_abrt_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure abrt is removed
  package:
    name: abrt
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_abrt_removed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_abrt_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_abrt

class remove_abrt {
  package { 'abrt':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_abrt_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=abrt
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_abrt_removed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_abrt_removed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_cron_and_at">
          <xccdf-1.2:title>Cron and At Daemons</xccdf-1.2:title>
          <xccdf-1.2:description>The cron and at services are used to allow commands to
be executed at a later time. The cron service is required by almost
all systems to perform necessary maintenance tasks, while at may or
may not be required on a given system. Both daemons should be
configured defensively.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#machine"/>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_cron_installed" severity="medium">
            <xccdf-1.2:title>Install the cron service</xccdf-1.2:title>
            <xccdf-1.2:description>The Cron service should be installed.</xccdf-1.2:description>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R50)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_cron_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "cron" ; then
    dnf install -y "cron"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_cron_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure cron is installed
  package:
    name: cron
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_cron_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_cron_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_cron

class install_cron {
  package { 'cron':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_cron_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=cron
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_cron_installed">
[[packages]]
name = "cron"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_cron_installed:def:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_cron_enabled" severity="medium">
            <xccdf-1.2:title>Enable cron Service</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>crond</html:code> service is used to execute commands at
preconfigured times. It is required by almost all systems to perform necessary
maintenance tasks, such as notifying root of system activity.

The <html:code>cron</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable cron.service</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Due to its usage for maintenance and security-supporting tasks,
enabling the cron daemon is essential.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_cron_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'cron.service'
"$SYSTEMCTL_EXEC" start 'cron.service'
"$SYSTEMCTL_EXEC" enable 'cron.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_cron_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Enable service cron
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service cron
      service:
        name: cron
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"cron" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_cron_enabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_cron_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_cron

class enable_cron {
  service {'cron':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_cron_enabled">
[customizations.services]
enabled = ["cron"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_cron_enabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-service_cron_enabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_crond_enabled" severity="medium">
            <xccdf-1.2:title>Enable cron Service</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>crond</html:code> service is used to execute commands at
preconfigured times. It is required by almost all systems to perform necessary
maintenance tasks, such as notifying root of system activity.

The <html:code>crond</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable crond.service</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Due to its usage for maintenance and security-supporting tasks,
enabling the cron daemon is essential.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_crond_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'crond.service'
"$SYSTEMCTL_EXEC" start 'crond.service'
"$SYSTEMCTL_EXEC" enable 'crond.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_crond_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Enable service crond
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service crond
      service:
        name: crond
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"cronie" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_crond_enabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_crond_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_crond

class enable_crond {
  service {'crond':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_crond_enabled">
[customizations.services]
enabled = ["crond"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_crond_enabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-service_crond_enabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_atd_disabled" severity="medium">
            <xccdf-1.2:title>Disable At Service (atd)</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>at</html:code> and <html:code>batch</html:code> commands can be used to
schedule tasks that are meant to be executed only once. This allows delayed
execution in a manner similar to cron, except that it is not
recurring. The daemon <html:code>atd</html:code> keeps track of tasks scheduled via
<html:code>at</html:code> and <html:code>batch</html:code>, and executes them at the specified time.

The <html:code>atd</html:code> service can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now atd.service</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The <html:code>atd</html:code> service could be used by an unsophisticated insider to carry
out activities outside of a normal login session, which could complicate
accountability. Furthermore, the need to schedule tasks with <html:code>at</html:code> or
<html:code>batch</html:code> is not common.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_atd_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'atd.service'
"$SYSTEMCTL_EXEC" disable 'atd.service'
"$SYSTEMCTL_EXEC" mask 'atd.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^atd.socket'; then
    "$SYSTEMCTL_EXEC" stop 'atd.socket'
    "$SYSTEMCTL_EXEC" mask 'atd.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'atd.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_atd_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Disable service atd
  block:

    - name: Disable service atd
      systemd:
        name: atd.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      ignore_errors: 'yes'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_atd_disabled

- name: Unit Socket Exists - atd.socket
  command: systemctl list-unit-files atd.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_atd_disabled

- name: Disable socket atd
  systemd:
    name: atd.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"atd.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_atd_disabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_atd_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_atd

class disable_atd {
  service {'atd':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="service_atd_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: atd.service
        enabled: false
        mask: true
      - name: atd.socket
        enabled: false
        mask: true
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_atd_disabled">
[customizations.services]
disabled = ["atd"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_atd_disabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-service_atd_disabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_disable_anacron" severity="unknown">
            <xccdf-1.2:title>Disable anacron Service</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>cronie-anacron</html:code> package, which provides <html:code>anacron</html:code>
functionality, is installed by default. 
The <html:code>cronie-anacron</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase cronie-anacron</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The <html:code>anacron</html:code> service provides <html:code>cron</html:code> functionality for systems
such as laptops and workstations that may be shut down during the normal times
that <html:code>cron</html:code> jobs are scheduled to run. On systems which do not require this
additional functionality, <html:code>anacron</html:code> could needlessly increase the possible
attack surface for an intruder.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-disable_anacron_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_restrict_at_cron_users">
            <xccdf-1.2:title>Restrict at and cron to Authorized Users if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>/etc/cron.allow</html:code> and <html:code>/etc/at.allow</html:code> files contain lists of
users who are allowed to use <html:code>cron</html:code> and at to delay execution of
processes. If these files exist and if the corresponding files
<html:code>/etc/cron.deny</html:code> and <html:code>/etc/at.deny</html:code> do not exist, then only users
listed in the relevant allow files can run the crontab and <html:code>at</html:code> commands
to submit jobs to be run at scheduled intervals. On many systems, only the
system administrator needs the ability to schedule jobs. Note that even if a
given user is not listed in <html:code>cron.allow</html:code>, cron jobs can still be run as
that user. The <html:code>cron.allow</html:code> file controls only administrative access
to the crontab command for scheduling and modifying cron jobs.
<html:br/>
<html:br/>
To restrict <html:code>at</html:code> and <html:code>cron</html:code> to only authorized users:
<html:ul><html:li>Remove the <html:code>cron.deny</html:code> file:<html:pre>$ sudo rm /etc/cron.deny</html:pre></html:li><html:li>Edit <html:code>/etc/cron.allow</html:code>, adding one line for each user allowed to use
the crontab command to create cron jobs.</html:li><html:li>Remove the <html:code>at.deny</html:code> file:<html:pre>$ sudo rm /etc/at.deny</html:pre></html:li><html:li>Edit <html:code>/etc/at.allow</html:code>, adding one line for each user allowed to use
the at command to create at jobs.</html:li></html:ul></xccdf-1.2:description>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_at_deny_not_exist" severity="medium">
              <xccdf-1.2:title>Ensure that /etc/at.deny does not exist</xccdf-1.2:title>
              <xccdf-1.2:description>The file <html:code>/etc/at.deny</html:code> should not exist.
Use <html:code>/etc/at.allow</html:code> instead.</xccdf-1.2:description>
              <xccdf-1.2:rationale>Access to <html:code>at</html:code> should be restricted.
It is easier to manage an allow list than a deny list.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_at_deny_not_exist" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

#!/bin/bash



    if [[ -f  /etc/at.deny ]]; then
        rm /etc/at.deny
    fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_at_deny_not_exist" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Remove /etc/at.deny
  file:
    path: /etc/at.deny
    state: absent
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - file_at_deny_not_exist
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_at_deny_not_exist:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_at_deny_not_exist_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_cron_deny_not_exist" severity="medium">
              <xccdf-1.2:title>Ensure that /etc/cron.deny does not exist</xccdf-1.2:title>
              <xccdf-1.2:description>The file <html:code>/etc/cron.deny</html:code> should not exist.
Use <html:code>/etc/cron.allow</html:code> instead.</xccdf-1.2:description>
              <xccdf-1.2:rationale>Access to <html:code>cron</html:code> should be restricted.
It is easier to manage an allow list than a deny list.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_cron_deny_not_exist" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

#!/bin/bash



    if [[ -f  /etc/cron.deny ]]; then
        rm /etc/cron.deny
    fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_cron_deny_not_exist" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Remove /etc/cron.deny
  file:
    path: /etc/cron.deny
    state: absent
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - file_cron_deny_not_exist
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_cron_deny_not_exist:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_cron_deny_not_exist_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_deprecated">
          <xccdf-1.2:title>Deprecated services</xccdf-1.2:title>
          <xccdf-1.2:description>Some deprecated software services impact the overall system security due to their behavior (leak of
confidentiality in network exchange, usage as uncontrolled communication channel, risk associated with the service due to its old age, etc.</xccdf-1.2:description>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed" severity="high">
            <xccdf-1.2:title>Uninstall the inet-based telnet server</xccdf-1.2:title>
            <xccdf-1.2:description>The inet-based telnet daemon should be uninstalled.</xccdf-1.2:description>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT007(R03)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:rationale><html:code>telnet</html:code> allows clear text communications, and does not protect any
data transmission between client and server. Any confidential data can be
listened and no integrity checking is made.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_inetutils-telnetd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove inetutils-telnetd
#	   from the system, and may remove any packages
#	   that depend on inetutils-telnetd. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "inetutils-telnetd" ; then

    dnf remove -y "inetutils-telnetd"

fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_inetutils-telnetd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure inetutils-telnetd is removed
  package:
    name: inetutils-telnetd
    state: absent
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - package_inetutils-telnetd_removed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_inetutils-telnetd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_inetutils-telnetd

class remove_inetutils-telnetd {
  package { 'inetutils-telnetd':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_inetutils-telnetd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=inetutils-telnetd
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_inetutils-telnetd_removed:def:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_nis_removed" severity="low">
            <xccdf-1.2:title>Uninstall the nis package</xccdf-1.2:title>
            <xccdf-1.2:description>The support for Yellowpages should not be installed unless it is required.</xccdf-1.2:description>
            <xccdf-1.2:rationale>NIS is the historical SUN service for central account management, more and more replaced by LDAP.
NIS does not support efficiently security constraints, ACL, etc. and should not be used.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_nis_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove nis
#	   from the system, and may remove any packages
#	   that depend on nis. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "nis" ; then

    dnf remove -y "nis"

fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_nis_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure nis is removed
  package:
    name: nis
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_nis_removed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_nis_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_nis

class remove_nis {
  package { 'nis':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_nis_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=nis
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_nis_removed:def:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_ntpdate_removed" severity="low">
            <xccdf-1.2:title>Uninstall the ntpdate package</xccdf-1.2:title>
            <xccdf-1.2:description>ntpdate is a historical ntp synchronization client for unixes. It sould be uninstalled.</xccdf-1.2:description>
            <xccdf-1.2:rationale>ntpdate is an old not security-compliant ntp client. It should be replaced by modern ntp clients such as ntpd, able to use cryptographic mechanisms integrated in NTP.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_ntpdate_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove ntpdate
#	   from the system, and may remove any packages
#	   that depend on ntpdate. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "ntpdate" ; then

    dnf remove -y "ntpdate"

fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_ntpdate_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure ntpdate is removed
  package:
    name: ntpdate
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_ntpdate_removed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_ntpdate_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_ntpdate

class remove_ntpdate {
  package { 'ntpdate':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_ntpdate_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=ntpdate
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_ntpdate_removed:def:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_telnetd-ssl_removed" severity="high">
            <xccdf-1.2:title>Uninstall the ssl compliant telnet server</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>telnet</html:code> daemon, even with ssl support, should be uninstalled.</xccdf-1.2:description>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT007(R02)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:rationale><html:code>telnet</html:code>, even with ssl support, should not be installed.
When remote shell is required, up-to-date ssh daemon can be used.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_telnetd-ssl_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove telnetd-ssl
#	   from the system, and may remove any packages
#	   that depend on telnetd-ssl. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "telnetd-ssl" ; then

    dnf remove -y "telnetd-ssl"

fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_telnetd-ssl_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure telnetd-ssl is removed
  package:
    name: telnetd-ssl
    state: absent
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - package_telnetd-ssl_removed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_telnetd-ssl_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_telnetd-ssl

class remove_telnetd-ssl {
  package { 'telnetd-ssl':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_telnetd-ssl_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=telnetd-ssl
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_telnetd-ssl_removed:def:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_telnetd_removed" severity="high">
            <xccdf-1.2:title>Uninstall the telnet server</xccdf-1.2:title>
            <xccdf-1.2:description>The telnet daemon should be uninstalled.</xccdf-1.2:description>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT007(R03)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:rationale><html:code>telnet</html:code> allows clear text communications, and does not protect
any data transmission between client and server. Any confidential data
can be listened and no integrity checking is made.'</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_telnetd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove telnetd
#	   from the system, and may remove any packages
#	   that depend on telnetd. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "telnetd" ; then

    dnf remove -y "telnetd"

fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_telnetd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure telnetd is removed
  package:
    name: telnetd
    state: absent
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - package_telnetd_removed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_telnetd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_telnetd

class remove_telnetd {
  package { 'telnetd':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_telnetd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=telnetd
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_telnetd_removed:def:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dhcp">
          <xccdf-1.2:title>DHCP</xccdf-1.2:title>
          <xccdf-1.2:description>The Dynamic Host Configuration Protocol (DHCP) allows
systems to request and obtain an IP address and other configuration
parameters from a server.
<html:br/><html:br/>
This guide recommends configuring networking on clients by manually editing
the appropriate files under <html:code>/etc/sysconfig</html:code>.  Use of DHCP can make client 
systems vulnerable to compromise by rogue DHCP servers, and should be avoided 
unless necessary.  If using DHCP is necessary, however, there are best practices 
that should be followed to minimize security risk.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dhcp_client_configuration">
            <xccdf-1.2:title>Configure DHCP Client if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description>If DHCP must be used, then certain configuration changes can
minimize the amount of information it receives and applies from the network,
and thus the amount of incorrect information a rogue DHCP server could
successfully distribute.  For more information on configuring dhclient, see the
<html:code>dhclient(8)</html:code> and <html:code>dhclient.conf(5)</html:code> man pages.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dhcp_client_restrict_options" severity="unknown">
              <xccdf-1.2:title>Minimize the DHCP-Configured Options</xccdf-1.2:title>
              <xccdf-1.2:description>Create the file <html:code>/etc/dhcp/dhclient.conf</html:code>, and add an
appropriate setting for each of the ten configuration settings which can be
obtained via DHCP. For each setting, do one of the following:
<html:br/>
If the setting should <html:i>not</html:i> be configured remotely by the DHCP server,
select an appropriate static value, and add the line:
<html:pre>supersede <html:code>setting value</html:code>;</html:pre>
If the setting should be configured remotely by the DHCP server, add the lines:
<html:pre>request <html:code>setting</html:code>;
require <html:code>setting</html:code>;</html:pre>
For example, suppose the DHCP server should provide only the IP address itself
and the subnet mask. Then the entire file should look like:
<html:pre>supersede domain-name "example.com";
supersede domain-name-servers 192.168.1.2;
supersede nis-domain "";
supersede nis-servers "";
supersede ntp-servers "ntp.example.com ";
supersede routers 192.168.1.1;
supersede time-offset -18000;
request subnet-mask;
require subnet-mask;</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">In this example, the options nis-servers and
nis-domain are set to empty strings, on the assumption that the deprecated NIS
protocol is not in use. It is necessary to supersede settings for unused
services so that they cannot be set by a hostile DHCP server. If an option is
set to an empty string, dhclient will typically not attempt to configure the
service.</xccdf-1.2:warning>
              <xccdf-1.2:rationale>By default, the DHCP client program, dhclient, requests and applies
ten configuration options (in addition to the IP address) from the DHCP server.
subnet-mask, broadcast-address, time-offset, routers, domain-name,
domain-name-servers, host-name, nis-domain, nis-servers, and ntp-servers.  Many
of the options requested and applied by dhclient may be the same for every
system on a network. It is recommended that almost all configuration options be
assigned statically, and only options which must vary on a host-by-host basis
be assigned via DHCP. This limits the damage which can be done by a rogue DHCP
server.  If appropriate for your site, it is also possible to supersede the
host-name directive in <html:code>/etc/dhcp/dhclient.conf</html:code>, establishing a static
hostname for the system. However, dhclient does not use the host name option
provided by the DHCP server (instead using the value provided by a reverse DNS
lookup).</xccdf-1.2:rationale>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dhcp_server_configuration">
            <xccdf-1.2:title>Configure DHCP Server</xccdf-1.2:title>
            <xccdf-1.2:description>If the system must act as a DHCP server, the configuration
information it serves should be minimized. Also, support for other protocols
and DNS-updating schemes should be explicitly disabled unless needed. The
configuration file for dhcpd is called <html:code>/etc/dhcp/dhcpd.conf</html:code>. The file
begins with a number of global configuration options. The remainder of the file
is divided into sections, one for each block of addresses offered by dhcpd,
each of which contains configuration options specific to that address
block.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dhcp_server_minimize_served_info" severity="unknown">
              <xccdf-1.2:title>Minimize Served Information</xccdf-1.2:title>
              <xccdf-1.2:description>Edit /etc/dhcp/dhcpd.conf. Examine each address range section within
the file, and ensure that the following options are not defined unless there is
an operational need to provide this information via DHCP:
<html:pre>option domain-name
option domain-name-servers
option nis-domain
option nis-servers
option ntp-servers
option routers
option time-offset</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">By default, the Red Hat Enterprise Linux client installation uses DHCP
to request much of the above information from the DHCP server. In particular,
domain-name, domain-name-servers, and routers are configured via DHCP.  These
settings are typically necessary for proper network functionality, but are also
usually static across systems at a given site.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Because the configuration information provided by the DHCP server
could be maliciously provided to clients by a rogue DHCP server, the amount of
information provided via DHCP should be minimized. Remove these definitions
from the DHCP server configuration to ensure that legitimate clients do not
unnecessarily rely on DHCP for this information.</xccdf-1.2:rationale>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_dhcp_client">
            <xccdf-1.2:title>Disable DHCP Client</xccdf-1.2:title>
            <xccdf-1.2:description>DHCP is the default network configuration method provided by the system
installer, and common on many networks. Nevertheless, manual management
of IP addresses for systems implies a greater degree of management and
accountability for network activity.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_dhcp_server">
            <xccdf-1.2:title>Disable DHCP Server</xccdf-1.2:title>
            <xccdf-1.2:description>The DHCP server <html:code>dhcpd</html:code> is not installed or activated by
default. If the software was installed and activated, but the
system does not need to act as a DHCP server, it should be disabled
and removed.</xccdf-1.2:description>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dns">
          <xccdf-1.2:title>DNS Server</xccdf-1.2:title>
          <xccdf-1.2:description>Most organizations have an operational need to run at
least one nameserver. However, there are many common attacks
involving DNS server software, and this server software should
be disabled on any system
on which it is not needed.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_dns_server">
            <xccdf-1.2:title>Disable DNS Server</xccdf-1.2:title>
            <xccdf-1.2:description>DNS software should be disabled on any systems which does not
need to be a nameserver. Note that the BIND DNS server software is
not installed on Fedora by default. The remainder of this section
discusses secure configuration of systems which must be
nameservers.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_bind_removed" severity="low">
              <xccdf-1.2:title>Uninstall bind Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>named</html:code> service is provided by the <html:code>bind</html:code> package.
The <html:code>bind</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase bind</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If there is no need to make DNS server software available,
removing it provides a safeguard against its activation.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_bind_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove bind
#	   from the system, and may remove any packages
#	   that depend on bind. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "bind" ; then

    dnf remove -y "bind"

fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_bind_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure bind is removed
  package:
    name: bind
    state: absent
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_bind_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_bind_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_bind

class remove_bind {
  package { 'bind':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_bind_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=bind
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_bind_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_bind_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dns_server_isolation">
            <xccdf-1.2:title>Isolate DNS from Other Services</xccdf-1.2:title>
            <xccdf-1.2:description>This section discusses mechanisms for preventing the DNS server
from interfering with other services. This is done both to protect the
remainder of the network should a nameserver be compromised, and to make direct
attacks on nameservers more difficult.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dns_server_chroot">
              <xccdf-1.2:title>Run DNS Software in a chroot Jail</xccdf-1.2:title>
              <xccdf-1.2:description>Install the <html:code>bind-chroot</html:code> package:
<html:pre>$ sudo yum install bind-chroot</html:pre>
Place a valid named.conf file inside the chroot jail:
<html:pre>$ sudo cp /etc/named.conf /var/named/chroot/etc/named.conf
$ sudo chown root:root /var/named/chroot/etc/named.conf
$ sudo chmod 644 /var/named/chroot/etc/named.conf</html:pre>
Create and populate an appropriate zone directory within the jail, based on the
options directive. If your <html:code>named.conf</html:code> includes:
<html:pre>options {
directory "/path/to/DIRNAME ";
...
}</html:pre>
then copy that directory and its contents from the original zone directory:
<html:pre>$ sudo cp -r /path/to/DIRNAME /var/named/chroot/DIRNAME</html:pre>
Add or correct the following line within <html:code>/etc/sysconfig/named</html:code>:
<html:pre>ROOTDIR=/var/named/chroot</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">If you are running BIND in a chroot jail, then you
should use the jailed <html:code>named.conf</html:code> as the primary nameserver
configuration file. That is, when this guide recommends editing
<html:code>/etc/named.conf</html:code>, you should instead edit
<html:code>/var/named/chroot/etc/named.conf</html:code>.</xccdf-1.2:warning>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dns_server_dedicated">
              <xccdf-1.2:title>Run DNS Software on Dedicated Servers</xccdf-1.2:title>
              <xccdf-1.2:description>Since DNS is
a high-risk service which must frequently be made available to the entire
Internet, it is strongly recommended that no other services be offered by
systems which act as organizational DNS servers.</xccdf-1.2:description>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dns_server_protection">
            <xccdf-1.2:title>Protect DNS Data from Tampering or Attack</xccdf-1.2:title>
            <xccdf-1.2:description>This section discusses DNS configuration options which make it
more difficult for attackers to gain access to private DNS data or to modify
DNS data.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dns_server_partition_with_views">
              <xccdf-1.2:title>Use Views to Partition External and Internal Information</xccdf-1.2:title>
              <xccdf-1.2:description>If it is not possible to run external and internal nameservers on
separate physical systems, run BIND9 and simulate this feature using views.
Edit <html:code>/etc/named.conf</html:code>. Add or correct the following directives (where
SUBNET is the numerical IP representation of your organization in the form
xxx.xxx.xxx.xxx/xx):
<html:pre>acl internal {
  SUBNET ;
  localhost;
};
view "internal-view" {
  match-clients { internal; };
  zone "." IN {
    type hint;
    file "db.cache";
  };
  zone "internal.example.com " IN {
    ...
  };
};

view "external-view" {
  match-clients { any; };
  recursion no;
  zone "example.com " IN {
    ...
  };
};</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">As shown in the example, database files which are
required for recursion, such as the root hints file, must be available to any
clients which are allowed to make recursive queries. Under typical
circumstances, this includes only the internal clients which are allowed to use
this server as a general-purpose nameserver.</xccdf-1.2:warning>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dns_server_separate_internal_external">
              <xccdf-1.2:title>Run Separate DNS Servers for External and Internal Queries</xccdf-1.2:title>
              <xccdf-1.2:description>Is it possible to run external and internal nameservers on
separate systems? If so, follow the configuration guidance in this section. On
the external nameserver, edit <html:code>/etc/named.conf</html:code> to add or correct the
following directives:
<html:pre>options {
  allow-query { any; };
  recursion no;
  ...
};
zone "example.com " IN {
  ...
};</html:pre>
On the internal nameserver, edit <html:code>/etc/named.conf</html:code>. Add or correct the
following directives, where SUBNET is the numerical IP representation of your
organization in the form xxx.xxx.xxx.xxx/xx:
<html:pre>acl internal {
  SUBNET ;
  localhost;
};
options {
  allow-query { internal; };
  ...
};
zone "internal.example.com " IN {
  ...
};</html:pre></xccdf-1.2:description>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_docker">
          <xccdf-1.2:title>Docker Service</xccdf-1.2:title>
          <xccdf-1.2:description>The docker service is necessary to create containers, which are
  self-sufficient and self-contained applications using the resource
  isolation features of the kernel.</xccdf-1.2:description>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_fapolicyd">
          <xccdf-1.2:title>Application Whitelisting Daemon</xccdf-1.2:title>
          <xccdf-1.2:description>Fapolicyd (File Access Policy Daemon) implements application whitelisting
to decide file access rights. Applications that are known via a reputation
source are allowed access while unknown applications are not. The daemon
makes use of the kernel's <html:code>fanotify</html:code> interface to determine file access rights.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#machine"/>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_fapolicyd_installed" severity="medium">
            <xccdf-1.2:title>Install fapolicyd Package</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>fapolicyd</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install fapolicyd</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-4(22)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000370-GPOS-00155</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
            <xccdf-1.2:rationale><html:code>fapolicyd</html:code> (File Access Policy Daemon)
implements application whitelisting to decide file access rights.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_fapolicyd_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "fapolicyd" ; then
    dnf install -y "fapolicyd"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_fapolicyd_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure fapolicyd is installed
  package:
    name: fapolicyd
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-4(22)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_fapolicyd_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_fapolicyd_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_fapolicyd

class install_fapolicyd {
  package { 'fapolicyd':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_fapolicyd_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=fapolicyd
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_fapolicyd_installed">
[[packages]]
name = "fapolicyd"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_fapolicyd_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_fapolicyd_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ftp">
          <xccdf-1.2:title>FTP Server</xccdf-1.2:title>
          <xccdf-1.2:description>FTP is a common method for allowing remote access to
files. Like telnet, the FTP protocol is unencrypted, which means
that passwords and other data transmitted during the session can be
captured and that the session is vulnerable to hijacking.
Therefore, running the FTP server software is not recommended.
<html:br/><html:br/>
However, there are some FTP server configurations which may
be appropriate for some environments, particularly those which
allow only read-only anonymous access as a means of downloading
data available to the public.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_vsftpd">
            <xccdf-1.2:title>Disable vsftpd if Possible</xccdf-1.2:title>
            <xccdf-1.2:description>To minimize attack surface, disable vsftpd if at all
possible.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_vsftpd_removed" severity="high">
              <xccdf-1.2:title>Uninstall vsftpd Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>vsftpd</html:code> package can be removed with the following command: <html:pre> $ sudo dnf erase vsftpd</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000197</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1).1(v)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7.1(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000074-GPOS-00042</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Removing the <html:code>vsftpd</html:code> package decreases the risk of its
accidental activation.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_vsftpd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove vsftpd
#	   from the system, and may remove any packages
#	   that depend on vsftpd. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "vsftpd" ; then

    dnf remove -y "vsftpd"

fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_vsftpd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure vsftpd is removed
  package:
    name: vsftpd
    state: absent
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-CM-7.1(ii)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-5(1).1(v)
    - disable_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - package_vsftpd_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_vsftpd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_vsftpd

class remove_vsftpd {
  package { 'vsftpd':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_vsftpd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=vsftpd
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_vsftpd_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_vsftpd_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ftp_configure_vsftpd">
            <xccdf-1.2:title>Configure vsftpd to Provide FTP Service if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description>The primary vsftpd configuration file is
<html:code>/etc/vsftpd.conf</html:code>, if that file exists, or
<html:code>/etc/vsftpd/vsftpd.conf</html:code> if it does not.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ftp_configure_firewall" severity="unknown">
              <xccdf-1.2:title>Configure Firewalls to Protect the FTP Server</xccdf-1.2:title>
              <xccdf-1.2:description>
By default, <html:code>iptables</html:code>
blocks access to the ports used by the web server.

To configure <html:code>iptables</html:code> to allow port 21 traffic, one must edit
<html:code>/etc/sysconfig/iptables</html:code> and
<html:code>/etc/sysconfig/ip6tables</html:code> (if IPv6 is in use).
Add the following line, ensuring that it appears before the final LOG and DROP lines for the INPUT chain:
<html:pre>-A INPUT -m state --state NEW -p tcp --dport 21 -j ACCEPT</html:pre>
Edit the file <html:code>/etc/sysconfig/iptables-config</html:code>. Ensure that the space-separated list of modules contains
the FTP connection tracking module:
<html:pre>IPTABLES_MODULES="ip_conntrack_ftp"</html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale>These settings configure the firewall to allow connections to an FTP server.


The first line allows initial connections to the FTP server port.
FTP is an older protocol which is not very compatible with firewalls. During the initial FTP dialogue, the client
and server negotiate an arbitrary port to be used for data transfer. The <html:code>ip_conntrack_ftp</html:code>  module is used by
iptables to listen to that dialogue and allow connections to the data ports which FTP negotiates. This allows an
FTP server to operate on a system which is running a firewall.</xccdf-1.2:rationale>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ftp_disable_uploads" severity="unknown">
              <xccdf-1.2:title>Disable FTP Uploads if Possible</xccdf-1.2:title>
              <xccdf-1.2:description>Is there a mission-critical reason for users to upload files via FTP? If not,
edit the vsftpd configuration file to add or correct the following configuration options:
<html:pre>write_enable=NO</html:pre>
If FTP uploads are necessary, follow the guidance in the remainder of this section to secure these transactions
as much as possible.</xccdf-1.2:description>
              <xccdf-1.2:rationale>Anonymous FTP can be a convenient way to make files available for universal download. However, it is less
common to have a need to allow unauthenticated users to place files on the FTP server. If this must be done, it
is necessary to ensure that files cannot be uploaded and downloaded from the same directory.</xccdf-1.2:rationale>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ftp_home_partition" severity="unknown">
              <xccdf-1.2:title>Place the FTP Home Directory on its Own Partition</xccdf-1.2:title>
              <xccdf-1.2:description>By default, the anonymous FTP root is the home directory of the FTP user account. The df command can
be used to verify that this directory is on its own partition.</xccdf-1.2:description>
              <xccdf-1.2:rationale>If there is a mission-critical reason for anonymous users to upload files, precautions must be taken to prevent
these users from filling a disk used by other services.</xccdf-1.2:rationale>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ftp_log_transactions" severity="unknown">
              <xccdf-1.2:title>Enable Logging of All FTP Transactions</xccdf-1.2:title>
              <xccdf-1.2:description>Add or correct the following configuration options within the <html:code>vsftpd</html:code>
configuration file, located at <html:code>/etc/vsftpd/vsftpd.conf</html:code>:
<html:pre>xferlog_enable=YES
xferlog_std_format=NO
log_ftp_protocol=YES</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">If verbose logging to <html:code>vsftpd.log</html:code> is done, sparse logging of
downloads to <html:code>/var/log/xferlog</html:code> will not also occur. However,
the information about what files were downloaded is included in the
information logged to <html:code>vsftpd.log</html:code>.</xccdf-1.2:warning>
              <xccdf-1.2:rationale>To trace malicious activity facilitated by the FTP service, it must be configured to ensure that all commands sent to
the FTP server are logged using the verbose vsftpd log
format. The default vsftpd log file is <html:code>/var/log/vsftpd.log</html:code>.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-ftp_log_transactions:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-ftp_log_transactions_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ftp_present_banner" severity="medium">
              <xccdf-1.2:title>Create Warning Banners for All FTP Users</xccdf-1.2:title>
              <xccdf-1.2:description>
Edit the vsftpd configuration file, which resides at <html:code>/etc/vsftpd/vsftpd.conf</html:code>

by default. Add or correct the following configuration options:
<html:pre>banner_file=/etc/issue</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000048</xccdf-1.2:reference>
              <xccdf-1.2:rationale>This setting will cause the system greeting banner to be used for FTP connections as well.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-ftp_present_banner:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-ftp_present_banner_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ftp_restrict_users">
              <xccdf-1.2:title>Restrict the Set of Users Allowed to Access FTP</xccdf-1.2:title>
              <xccdf-1.2:description>This section describes how to disable non-anonymous (password-based) FTP logins, or, if it is not possible to
do this entirely due to legacy applications, how to restrict insecure FTP login to only those users who have an
identified need for this access.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ftp_limit_users" severity="unknown">
                <xccdf-1.2:title>Limit Users Allowed FTP Access if Necessary</xccdf-1.2:title>
                <xccdf-1.2:description>If there is a mission-critical reason for users to access their accounts via the insecure FTP protocol, limit the set of users who are allowed this access. Edit the vsftpd configuration file. Add or correct the following configuration options:
<html:pre>userlist_enable=YES
userlist_file=/etc/vsftp.ftpusers
userlist_deny=NO</html:pre>
Edit the file <html:code>/etc/vsftp.ftpusers</html:code>. For each user USERNAME who should be allowed to access the system via FTP, add a line containing that user's name:
<html:pre>USERNAME</html:pre>
If anonymous access is also required, add the anonymous usernames to <html:code>/etc/vsftp.ftpusers</html:code> as well.
<html:pre>anonymous
ftp</html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale>Historically, the file <html:code>/etc/ftpusers</html:code> contained a list of users who were not allowed to access the system via FTP. It was used to prevent system users such as the root user from logging in via the insecure FTP protocol. However, when the configuration option <html:code>userlist deny=NO</html:code> is set, vsftpd interprets ftpusers as the set of users who are allowed to login via FTP. Since it should be possible for most users to access their accounts via secure protocols, it is recommended that this setting be used, so that non-anonymous FTP access can be limited to legacy users who have been explicitly identified.</xccdf-1.2:rationale>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ftp_restrict_to_anon" severity="medium">
                <xccdf-1.2:title>Restrict Access to Anonymous Users if Possible</xccdf-1.2:title>
                <xccdf-1.2:description>Is there a mission-critical reason for users to transfer files to/from their own accounts
using FTP, rather than using a secure protocol like SCP/SFTP? If not, edit the vsftpd
configuration file. Add or correct the following configuration option:

<html:pre>local_enable=NO</html:pre>

If non-anonymous FTP logins are necessary, follow the guidance in the remainder of
this section to secure these logins as much as possible.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The use of non-anonymous FTP logins is strongly discouraged. Since SSH clients 
and servers are widely available, and since SSH provides support for a transfer
mode which resembles FTP in user interface, there is no good reason to allow
password-based FTP access.'</xccdf-1.2:rationale>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ftp_use_vsftpd">
            <xccdf-1.2:title>Use vsftpd to Provide FTP Service if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description>If your use-case requires FTP service, install and
set-up vsftpd to provide it.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_vsftpd_installed" severity="low">
              <xccdf-1.2:title>Install vsftpd Package</xccdf-1.2:title>
              <xccdf-1.2:description>If this system must operate as an FTP server, install the <html:code>vsftpd</html:code> package via the standard channels.
The <html:code>vsftpd</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install vsftpd</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:rationale>After Red Hat Enterprise Linux 2.1, Red Hat switched from distributing <html:code>wu-ftpd</html:code> with
Red Hat Enterprise Linux to distributing <html:code>vsftpd</html:code>. For security
and for consistency with future Red Hat releases, the use of <html:code>vsftpd</html:code> is recommended.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_vsftpd_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
if ! rpm -q --quiet "vsftpd" ; then
    dnf install -y "vsftpd"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_vsftpd_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure vsftpd is installed
  package:
    name: vsftpd
    state: present
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_vsftpd_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_vsftpd_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_vsftpd

class install_vsftpd {
  package { 'vsftpd':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_vsftpd_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=vsftpd
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_vsftpd_installed">
[[packages]]
name = "vsftpd"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_vsftpd_installed:def:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_http">
          <xccdf-1.2:title>Web Server</xccdf-1.2:title>
          <xccdf-1.2:description>The web server is responsible for providing access to
content via the HTTP protocol. Web servers represent a significant
security risk because:
<html:br/><html:br/>
<html:ul><html:li>The HTTP port is commonly probed by malicious sources</html:li><html:li>Web server software is very complex, and includes a long
history of vulnerabilities</html:li><html:li>The HTTP protocol is unencrypted and vulnerable to passive
monitoring</html:li></html:ul>
<html:br/><html:br/>
The system's default web server software is Apache 2 and is
provided in the RPM package <html:code>httpd</html:code>.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_httpd">
            <xccdf-1.2:title>Disable Apache if Possible</xccdf-1.2:title>
            <xccdf-1.2:description>If Apache was installed and activated, but the system
does not need to act as a web server, then it should be disabled
and removed from the system.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_installing_httpd">
            <xccdf-1.2:title>Install Apache if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description>If <html:code>httpd</html:code> was not installed and activated, but the system
needs to act as a web server, then it should be installed on the system. Follow these
guidelines to install it defensively. The <html:code>httpd</html:code> package can be installed with
the following command:
<html:pre>$ sudo yum install httpd</html:pre>
This method of installation is recommended over installing the "Web Server"
package group during the system installation process. The Web Server package
group includes many packages which are likely extraneous, while the
command-line method installs only the required <html:code>httpd</html:code> package itself.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_minimal_modules_installed">
              <xccdf-1.2:title>Confirm Minimal Built-in Modules Installed</xccdf-1.2:title>
              <xccdf-1.2:description>The default <html:code>httpd</html:code> installation minimizes the number of
modules that are compiled directly into the binary (<html:code>core prefork http_core
mod_so</html:code>). This minimizes risk by limiting the capabilities allowed by the
web server.

Query the set of compiled-in modules using the following command:
<html:pre>$ httpd -l</html:pre>
If the number of compiled-in modules is significantly larger than the
aforementioned set, this guide recommends re-installing <html:code>httpd</html:code> with a
reduced configuration. Minimizing the number of modules that are compiled into
the <html:code>httpd</html:code> binary, reduces risk by limiting the capabilities allowed by
the webserver.</xccdf-1.2:description>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_securing_httpd">
            <xccdf-1.2:title>Secure Apache Configuration</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>httpd</html:code> configuration file is
<html:code>/etc/httpd/conf/httpd.conf</html:code>. Apply the recommendations in the remainder
of this section to this file.</xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_loglevel" type="string">
              <xccdf-1.2:title>HTTPD Log Level</xccdf-1.2:title>
              <xccdf-1.2:description>The setting for LogLevel in /etc/httpd/conf/httpd.conf</xccdf-1.2:description>
              <xccdf-1.2:value selector="alert">alert</xccdf-1.2:value>
              <xccdf-1.2:value selector="crit">crit</xccdf-1.2:value>
              <xccdf-1.2:value>warn</xccdf-1.2:value>
              <xccdf-1.2:value selector="emerg">emerg</xccdf-1.2:value>
              <xccdf-1.2:value selector="error">error</xccdf-1.2:value>
              <xccdf-1.2:value selector="warn">warn</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_max_keepalive_requests" type="number">
              <xccdf-1.2:title>Maximum KeepAlive Requests for HTTPD</xccdf-1.2:title>
              <xccdf-1.2:description>The setting for MaxKeepAliveRequests in httpd.conf</xccdf-1.2:description>
              <xccdf-1.2:value selector="100">100</xccdf-1.2:value>
              <xccdf-1.2:value selector="1000">1000</xccdf-1.2:value>
              <xccdf-1.2:value selector="10000">10000</xccdf-1.2:value>
              <xccdf-1.2:value selector="100000">100000</xccdf-1.2:value>
              <xccdf-1.2:value selector="500">500</xccdf-1.2:value>
              <xccdf-1.2:value>100</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_configure_os_protect_web_server">
              <xccdf-1.2:title>Configure Operating System to Protect Web Server</xccdf-1.2:title>
              <xccdf-1.2:description>The following configuration steps should be taken on the system which hosts the
web server, in order to provide as safe an environment as possible for the web server.</xccdf-1.2:description>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_chroot">
                <xccdf-1.2:title>Run httpd in a chroot Jail if Practical</xccdf-1.2:title>
                <xccdf-1.2:description>Running <html:code>httpd</html:code> inside a <html:code>chroot</html:code> jail is designed to isolate the
web server process to a small section of the filesystem, limiting the damage if
it is compromised. Versions of Apache greater than 2.2.10 (such as the one
included with Fedora) provide the <html:code>ChrootDir</html:code> directive. To run Apache
inside a chroot jail in <html:code>/chroot/apache</html:code>, add the following line to
<html:code>/etc/httpd/conf/httpd.conf</html:code>: <html:pre>ChrootDir /chroot/apache</html:pre> This
necessitates placing all files required by <html:code>httpd</html:code> inside
<html:code>/chroot/apache</html:code> , including <html:code>httpd</html:code>'s binaries, modules,
configuration files, and served web pages. The details of this configuration
are beyond the scope of this guide. This may also require additional SELinux
configuration.</xccdf-1.2:description>
              </xccdf-1.2:Group>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_restrict_file_dir_access">
                <xccdf-1.2:title>Restrict File and Directory Access</xccdf-1.2:title>
                <xccdf-1.2:description>Minimize access to critical <html:code>httpd</html:code> files and directories.</xccdf-1.2:description>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_configure_perl_securely">
              <xccdf-1.2:title>Configure PERL Securely</xccdf-1.2:title>
              <xccdf-1.2:description>PERL (Practical Extraction and Report Language) is an interpreted language
optimized for scanning arbitrary text files, extracting information from those
text files, and printing reports based on that information. The language is
often used in shell scripting and is intended to be practical, easy to use, and
efficient means of generating interactive web pages for the user.</xccdf-1.2:description>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_configure_php_securely">
              <xccdf-1.2:title>Configure PHP Securely</xccdf-1.2:title>
              <xccdf-1.2:description>PHP is a widely-used and often misconfigured server-side scripting language. It should
be used with caution, but configured appropriately when needed.
<html:br/><html:br/>
Review <html:code>/etc/php.ini</html:code> and make the following changes if possible:
<html:pre># Do not expose PHP error messages to external users
display_errors = Off

# Enable safe mode
safe_mode = On

# Only allow access to executables in isolated directory
safe_mode_exec_dir = php-required-executables-path

# Limit external access to PHP environment
safe_mode_allowed_env_vars = PHP_

# Restrict PHP information leakage
expose_php = Off

# Log all errors
log_errors = On

# Do not register globals for input data
register_globals = Off

# Minimize allowable PHP post size
post_max_size = 1K

# Ensure PHP redirects appropriately
cgi.force_redirect = 0

# Disallow uploading unless necessary
file_uploads = Off

# Disallow treatment of file requests as fopen calls
allow_url_fopen = Off

# Enable SQL safe mode
sql.safe_mode = On
</html:pre></xccdf-1.2:description>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_directory_restrictions">
              <xccdf-1.2:title>Directory Restrictions</xccdf-1.2:title>
              <xccdf-1.2:description>The Directory tags in the web server configuration file allow finer grained access
control for a specified directory. All web directories should be configured on a
case-by-case basis, allowing access only where needed.</xccdf-1.2:description>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_minimize_loadable_modules">
              <xccdf-1.2:title>Minimize Web Server Loadable Modules</xccdf-1.2:title>
              <xccdf-1.2:description>A default installation of <html:code>httpd</html:code> includes a plethora of dynamically shared objects (DSO)
that are loaded at run-time. Unlike the aforementioned compiled-in modules, a DSO can be
disabled in the configuration file by removing the corresponding LoadModule directive.
<html:br/><html:br/>
Note: A DSO only provides additional functionality if associated directives are included
in the <html:code>httpd</html:code> configuration file. It should also be noted that removing a DSO will produce
errors on <html:code>httpd</html:code> startup if the configuration file contains directives that apply to that
module. Refer to <html:code><html:a href="http://httpd.apache.org/docs/">http://httpd.apache.org/docs/</html:a></html:code> for details on which directives
are associated with each DSO.
<html:br/><html:br/>
Following each DSO removal, the configuration can be tested with the following command
to check if everything still works:
<html:pre>$ sudo service httpd configtest</html:pre>
The purpose of each of the modules loaded by default will now be addressed one at a time.
If none of a module's directives are being used, remove it.</xccdf-1.2:description>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_core_modules">
                <xccdf-1.2:title>httpd Core Modules</xccdf-1.2:title>
                <xccdf-1.2:description>These modules comprise a basic subset of modules that are likely needed for base <html:code>httpd</html:code>
functionality; ensure they are not commented out in <html:code>/etc/httpd/conf/httpd.conf</html:code>:
<html:pre>LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule authn_default_module modules/mod_authn_default.so
LoadModule authz_host_module modules/mod_authz_host.so
LoadModule authz_user_module modules/mod_authz_user.so
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
LoadModule authz_default_module modules/mod_authz_default.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule logio_module modules/mod_logio.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule mime_module modules/mod_mome.so
LoadModule autoindex_module modules/mod_autoindex.so
LoadModule negotiation_module modules/mod_negotiation.so
LoadModule dir_module modules/mod_dir.so
LoadModule alias_module modules/mod_alias.so</html:pre>
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.</xccdf-1.2:description>
                <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_basic_authentication">
                  <xccdf-1.2:title>Minimize Modules for HTTP Basic Authentication</xccdf-1.2:title>
                  <xccdf-1.2:description>The following modules are necessary if this web server will provide content that will
be restricted by a password.
<html:br/><html:br/>
Authentication can be performed using local plain text password files (<html:code>authn_file</html:code>),
local DBM password files (<html:code>authn_dbm</html:code>) or an LDAP directory. The only module required by
the web server depends on your choice of authentication. Comment out the modules you don't
need from the following:
<html:pre>LoadModule authn_file_module modules/mod_authn_file.so
LoadModule authn_dbm_module modules/mod_authn_dbm.so</html:pre>
<html:code>authn_alias</html:code> allows for authentication based on aliases. <html:code>authn_anon</html:code>
allows anonymous authentication similar to that of anonymous ftp sites. <html:code>authz_owner</html:code>
allows authorization based on file ownership. <html:code>authz_dbm</html:code> allows for authorization
based on group membership if the web server is using DBM authentication.
<html:br/><html:br/>
If the above functionality is unnecessary, comment out the related module:
<html:pre>#LoadModule authn_alias_module modules/mod_authn_alias.so
#LoadModule authn_anon_module modules/mod_authn_anon.so
#LoadModule authz_owner_module modules/mod_authz_owner.so
#LoadModule authz_dbm_module modules/mod_authz_dbm.so</html:pre></xccdf-1.2:description>
                </xccdf-1.2:Group>
                <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_minimize_config_files_included">
                  <xccdf-1.2:title>Minimize Configuration Files Included</xccdf-1.2:title>
                  <xccdf-1.2:description>The <html:code>Include</html:code> directive directs <html:code>httpd</html:code> to load supplementary configuration files
from a provided path. The default configuration loads all files that end in <html:code>.conf</html:code>
from the <html:code>/etc/httpd/conf.d</html:code> directory.
<html:br/><html:br/>
To restrict excess configuration, the following line should be commented out and
replaced with <html:code>Include</html:code> directives that only reference required configuration files:
<html:pre>#Include conf.d/*.conf</html:pre>
If the above change was made, ensure that the SSL encryption remains loaded by
explicitly including the corresponding configuration file:
<html:pre>Include conf.d/ssl.conf</html:pre>
If PHP is necessary, a similar alteration must be made:
<html:pre>Include conf.d/php.conf</html:pre>

Explicitly listing the configuration files to be loaded during web server start-up avoids
the possibility of unwanted or malicious configuration files to be automatically included as
part of the server's running configuration.</xccdf-1.2:description>
                </xccdf-1.2:Group>
                <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_optional_components">
                  <xccdf-1.2:title>Minimize Various Optional Components</xccdf-1.2:title>
                  <xccdf-1.2:description>The following modules perform very specific tasks, sometimes providing access to
just a few additional directives. If such functionality is not required (or if you
are not using these directives), comment out the associated module:
<html:ul><html:li>External filtering (response passed through external program prior to client delivery)
<html:pre>#LoadModule ext_filter_module modules/mod_ext_filter.so</html:pre></html:li><html:li>User-specified Cache Control and Expiration
<html:pre>#LoadModule expires_module modules/mod_expires.so</html:pre></html:li><html:li>Compression Output Filter (provides content compression prior to client delivery)
<html:pre>#LoadModule deflate_module modules/mod_deflate.so</html:pre></html:li><html:li>HTTP Response/Request Header Customization
<html:pre>#LoadModule headers_module modules/mod_headers.so</html:pre></html:li><html:li>User activity monitoring via cookies
<html:pre>#LoadModule usertrack_module modules/mod_usertrack.so</html:pre></html:li><html:li>Dynamically configured mass virtual hosting
<html:pre>#LoadModule vhost_alias_module modules/mod_vhost_alias.so</html:pre></html:li></html:ul>
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.</xccdf-1.2:description>
                </xccdf-1.2:Group>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_modules_improve_security">
              <xccdf-1.2:title>Use Appropriate Modules to Improve httpd's Security</xccdf-1.2:title>
              <xccdf-1.2:description>Among the modules available for <html:code>httpd</html:code> are several whose use may improve the
security of the web server installation. This section recommends and discusses
the deployment of security-relevant modules.</xccdf-1.2:description>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_deploy_mod_security">
                <xccdf-1.2:title>Deploy mod_security</xccdf-1.2:title>
                <xccdf-1.2:description>The <html:code>security</html:code> module provides an application level firewall for <html:code>httpd</html:code>.
Following its installation with the base ruleset, specific configuration advice can be found at

    <html:a href="http://www.modsecurity.org/">http://www.modsecurity.org/</html:a> to design a policy that best matches the security needs of
the web applications. Usage of <html:code>mod_security</html:code> is highly recommended for some environments,
but it should be noted this module does not ship with Red Hat Enterprise Linux itself,
and instead is provided via Extra Packages for Enterprise Linux (EPEL).
For more information on EPEL please refer to 
    <html:a href="http://fedoraproject.org/wiki/EPEL">http://fedoraproject.org/wiki/EPEL</html:a>.</xccdf-1.2:description>
              </xccdf-1.2:Group>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_deploy_mod_ssl">
                <xccdf-1.2:title>Deploy mod_ssl</xccdf-1.2:title>
                <xccdf-1.2:description>Because HTTP is a plain text protocol, all traffic is susceptible to passive
monitoring. If there is a need for confidentiality, SSL should be configured
and enabled to encrypt content.
<html:br/><html:br/>
Note: <html:code>mod_nss</html:code> is a FIPS 140-2 certified alternative to <html:code>mod_ssl</html:code>.
The modules share a considerable amount of code and should be nearly identical
in functionality. If FIPS 140-2 validation is required, then <html:code>mod_nss</html:code> should
be used. If it provides some feature or its greater compatibility is required,
then <html:code>mod_ssl</html:code> should be used.</xccdf-1.2:description>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_restrict_info_leakage">
              <xccdf-1.2:title>Restrict Web Server Information Leakage</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>ServerTokens</html:code> and <html:code>ServerSignature</html:code> directives determine how
much information the web server discloses about the configuration of the
system.</xccdf-1.2:description>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_secure_content">
              <xccdf-1.2:title>Configure HTTPD-Served Web Content Securely</xccdf-1.2:title>
              <xccdf-1.2:description>Running <html:code>httpd</html:code> inside a <html:code>chroot</html:code> jail is designed to isolate the
web server process to a small section of the filesystem, limiting the damage if
it is compromised. Versions of Apache greater than 2.2.10 (such as the one
included with Red Hat Enterprise Linux 7) provide the <html:code>ChrootDir</html:code> directive. To run Apache
inside a chroot jail in <html:code>/chroot/apache</html:code>, add the following line to
<html:code>/etc/httpd/conf/httpd.conf</html:code>: <html:pre>ChrootDir /chroot/apache</html:pre> This
necessitates placing all files required by <html:code>httpd</html:code> inside
<html:code>/chroot/apache</html:code> , including <html:code>httpd</html:code>'s binaries, modules,
configuration files, and served web pages. The details of this configuration
are beyond the scope of this guide. This may also require additional SELinux
configuration.</xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_web_login_banner_text" type="string">
                <xccdf-1.2:title>Web Login Banner Verbiage</xccdf-1.2:title>
                <xccdf-1.2:description>Enter an appropriate login banner for your organization. Please note that new lines must
be expressed by the '\n' character and special characters like parentheses and quotation marks must be escaped with '\\'.</xccdf-1.2:description>
                <xccdf-1.2:value selector="dod_banners">^(You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\)\,[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including\,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to\,[\s\n]+penetration[\s\n]+testing\,[\s\n]+COMSEC[\s\n]+monitoring\,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense\,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\)\,[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\)\,[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time\,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using\,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on\,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private\,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring\,[\s\n]+interception\,[\s\n]+and[\s\n]+search\,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.\,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above\,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM\,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications\,[\s\n]+or[\s\n]+work[\s\n]+product\,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys\,[\s\n]+psychotherapists\,[\s\n]+or[\s\n]+clergy\,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.|I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.)$</xccdf-1.2:value>
                <xccdf-1.2:value selector="dod_default">^You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\)\,[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including\,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to\,[\s\n]+penetration[\s\n]+testing\,[\s\n]+COMSEC[\s\n]+monitoring\,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense\,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\)\,[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\)\,[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time\,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using\,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on\,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private\,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring\,[\s\n]+interception\,[\s\n]+and[\s\n]+search\,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.\,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above\,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM\,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications\,[\s\n]+or[\s\n]+work[\s\n]+product\,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys\,[\s\n]+psychotherapists\,[\s\n]+or[\s\n]+clergy\,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.$</xccdf-1.2:value>
                <xccdf-1.2:value selector="dod_short">^I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.$</xccdf-1.2:value>
                <xccdf-1.2:value selector="dss_odaa_default">^Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.[\s\n]+This[\s\n]+is[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+and[\s\n]+related[\s\n]+equipment[\s\n]+are[\s\n]+intended[\s\n]+for[\s\n]+the[\s\n]+communication\,[\s\n]+transmission\,[\s\n]+processing\,[\s\n]+and[\s\n]+storage[\s\n]+of[\s\n]+official[\s\n]+U\.S\.[\s\n]+Government[\s\n]+or[\s\n]+other[\s\n]+authorized[\s\n]+information[\s\n]+only\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times[\s\n]+to[\s\n]+ensure[\s\n]+proper[\s\n]+functioning[\s\n]+of[\s\n]+equipment[\s\n]+and[\s\n]+systems[\s\n]+including[\s\n]+security[\s\n]+devices[\s\n]+and[\s\n]+systems\,[\s\n]+to[\s\n]+prevent[\s\n]+unauthorized[\s\n]+use[\s\n]+and[\s\n]+violations[\s\n]+of[\s\n]+statutes[\s\n]+and[\s\n]+security[\s\n]+regulations\,[\s\n]+to[\s\n]+deter[\s\n]+criminal[\s\n]+activity\,[\s\n]+and[\s\n]+for[\s\n]+other[\s\n]+similar[\s\n]+purposes\.[\s\n]+Any[\s\n]+user[\s\n]+of[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+should[\s\n]+be[\s\n]+aware[\s\n]+that[\s\n]+any[\s\n]+information[\s\n]+placed[\s\n]+in[\s\n]+the[\s\n]+system[\s\n]+is[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+not[\s\n]+subject[\s\n]+to[\s\n]+any[\s\n]+expectation[\s\n]+of[\s\n]+privacy\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+violation[\s\n]+of[\s\n]+criminal[\s\n]+statutes\,[\s\n]+this[\s\n]+evidence[\s\n]+and[\s\n]+any[\s\n]+other[\s\n]+related[\s\n]+information\,[\s\n]+including[\s\n]+identification[\s\n]+information[\s\n]+about[\s\n]+the[\s\n]+user\,[\s\n]+may[\s\n]+be[\s\n]+provided[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+reveals[\s\n]+violations[\s\n]+of[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+unauthorized[\s\n]+use\,[\s\n]+employees[\s\n]+who[\s\n]+violate[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+make[\s\n]+unauthorized[\s\n]+use[\s\n]+of[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+appropriate[\s\n]+disciplinary[\s\n]+action\.[\s\n]+Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.$</xccdf-1.2:value>
                <xccdf-1.2:value selector="usgcb_default">^\-\-[\s\n]+WARNING[\s\n]+\-\-[\s\n]+This[\s\n]+system[\s\n]+is[\s\n]+for[\s\n]+the[\s\n]+use[\s\n]+of[\s\n]+authorized[\s\n]+users[\s\n]+only\.[\s\n]+Individuals[\s\n]+using[\s\n]+this[\s\n]+computer[\s\n]+system[\s\n]+without[\s\n]+authority[\s\n]+or[\s\n]+in[\s\n]+excess[\s\n]+of[\s\n]+their[\s\n]+authority[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+having[\s\n]+all[\s\n]+their[\s\n]+activities[\s\n]+on[\s\n]+this[\s\n]+system[\s\n]+monitored[\s\n]+and[\s\n]+recorded[\s\n]+by[\s\n]+system[\s\n]+personnel\.[\s\n]+Anyone[\s\n]+using[\s\n]+this[\s\n]+system[\s\n]+expressly[\s\n]+consents[\s\n]+to[\s\n]+such[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+advised[\s\n]+that[\s\n]+if[\s\n]+such[\s\n]+monitoring[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+criminal[\s\n]+activity[\s\n]+system[\s\n]+personal[\s\n]+may[\s\n]+provide[\s\n]+the[\s\n]+evidence[\s\n]+of[\s\n]+such[\s\n]+monitoring[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.$</xccdf-1.2:value>
              </xccdf-1.2:Value>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_use_dos_protection_modules">
              <xccdf-1.2:title>Use Denial-of-Service Protection Modules</xccdf-1.2:title>
              <xccdf-1.2:description>Denial-of-service attacks are difficult to detect and prevent while maintaining
acceptable access to authorized users. However, some traffic-shaping
modules can be used to address the problem. Well-known DoS protection modules include:
<html:pre>mod_cband mod_bwshare mod_limitipconn mod_evasive</html:pre>
Denial-of-service prevention should be implemented for a web server if such a threat exists.
However, specific configuration details are very dependent on the environment and often best left
at the discretion of the administrator.</xccdf-1.2:description>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_imap">
          <xccdf-1.2:title>IMAP and POP3 Server</xccdf-1.2:title>
          <xccdf-1.2:description>Dovecot provides IMAP and POP3 services. It is not
installed by default. The project page at 
    <html:a href="http://www.dovecot.org">http://www.dovecot.org</html:a>
contains more detailed information about Dovecot
configuration.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_configure_dovecot">
            <xccdf-1.2:title>Configure Dovecot if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description>If the system will operate as an IMAP or
POP3 server, the dovecot software should be configured securely by following
the recommendations below.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dovecot_allow_imap_access">
              <xccdf-1.2:title>Allow IMAP Clients to Access the Server</xccdf-1.2:title>
              <xccdf-1.2:description>
The default iptables configuration does not allow inbound access to any services.
This modification will allow remote hosts to initiate connections to the IMAP daemon,
while keeping all other ports on the server in their default protected state.
To configure <html:code>iptables</html:code> to allow port 143 traffic, one must edit
<html:code>/etc/sysconfig/iptables</html:code> and
<html:code>/etc/sysconfig/ip6tables</html:code> (if IPv6 is in use).
Add the following line, ensuring that it appears before the final LOG and DROP lines for the INPUT chain:
<html:pre>-A INPUT -m state --state NEW -p tcp --dport 143 -j ACCEPT</html:pre></xccdf-1.2:description>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dovecot_enabling_ssl">
              <xccdf-1.2:title>Enable SSL Support</xccdf-1.2:title>
              <xccdf-1.2:description>SSL should be used to encrypt network traffic between the 
Dovecot server and its clients. Users must authenticate to the Dovecot 
server in order to read their mail, and passwords should never be 
transmitted in clear text. In addition, protecting mail as it is 
downloaded is a privacy measure, and clients may use SSL certificates 
to authenticate the server, preventing another system from impersonating 
the server.</xccdf-1.2:description>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dovecot_support_necessary_protocols">
              <xccdf-1.2:title>Support Only the Necessary Protocols</xccdf-1.2:title>
              <xccdf-1.2:description>Dovecot supports the IMAP and POP3 protocols, as well as 
SSL-protected versions of those protocols. Configure the Dovecot server 
to support only the protocols needed by your site. Edit <html:code>/etc/dovecot/dovecot.conf</html:code>. 
Add or correct the following lines, replacing <html:code>PROTOCOL</html:code> with 
only the subset of protocols (<html:code>imap</html:code>, <html:code>imaps</html:code>, 
<html:code>pop3</html:code>, <html:code>pop3s</html:code>) required:
<html:pre>protocols = PROTOCOL</html:pre>
If possible, require SSL protection for all transactions. The SSL 
protocol variants listen on alternate ports (995 instead of 110 for 
pop3s, and 993 instead of 143 for imaps), and require SSL-aware clients. 
An alternate approach is to listen on the standard port and require the 
client to use the STARTTLS command before authenticating.</xccdf-1.2:description>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_dovecot">
            <xccdf-1.2:title>Disable Dovecot</xccdf-1.2:title>
            <xccdf-1.2:description>If the system does not need to operate as an IMAP or
POP3 server, the dovecot software should be disabled and removed.</xccdf-1.2:description>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_kerberos">
          <xccdf-1.2:title>Kerberos</xccdf-1.2:title>
          <xccdf-1.2:description>The Kerberos protocol is used for authentication across
non-secure network. Authentication can happen between
various types of principals -- users, service, or hosts.
Their identity and encryption keys can be stored in keytab
files.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#machine"/>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kerberos_disable_no_keytab" severity="medium">
            <xccdf-1.2:title>Disable Kerberos by removing host keytab</xccdf-1.2:title>
            <xccdf-1.2:description>Kerberos is not an approved key distribution method for
Common Criteria. To prevent using Kerberos by system daemons,
remove the Kerberos keytab files, especially
<html:code>/etc/krb5.keytab</html:code>.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000803</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">0418</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1055</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1402</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FTP_ITC_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The key derivation function (KDF) in Kerberos is not FIPS compatible.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kerberos_disable_no_keytab"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

rm -f /etc/*.keytab

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kerberos_disable_no_keytab" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Find keytab files
  find:
    paths: /etc/
    patterns: '*.keytab'
  register: keytab_files
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - kerberos_disable_no_keytab
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Remove keytab files
  file:
    path: '{{ item.path }}'
    state: absent
  with_items: '{{ keytab_files.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - kerberos_disable_no_keytab
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-kerberos_disable_no_keytab:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-kerberos_disable_no_keytab_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ldap">
          <xccdf-1.2:title>LDAP</xccdf-1.2:title>
          <xccdf-1.2:description>LDAP is a popular directory service, that is, a
standardized way of looking up information from a central database.
Fedora includes software that enables a system to act as both
an LDAP client and server.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_openldap_client">
            <xccdf-1.2:title>Configure OpenLDAP Clients</xccdf-1.2:title>
            <xccdf-1.2:description>This section provides information on which security settings are
important to configure in OpenLDAP clients by manually editing the appropriate
configuration files.  Fedora provides an automated configuration tool called
authconfig and a graphical wrapper for authconfig called
<html:code>system-config-authentication</html:code>. However, these tools do not provide as
much control over configuration as manual editing of configuration files. The
authconfig tools do not allow you to specify locations of SSL certificate
files, which is useful when trying to use SSL cleanly across several protocols.
Installation and configuration of OpenLDAP on Fedora is available at</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">Before configuring any system to be an
LDAP client, ensure that a working LDAP server is present on the
network.</xccdf-1.2:warning>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_openldap-clients_removed" severity="low">
              <xccdf-1.2:title>Ensure LDAP client is not installed</xccdf-1.2:title>
              <xccdf-1.2:description>The Lightweight Directory Access Protocol (LDAP) is a service that provides
a method for looking up information from a central database.
The <html:code>openldap-clients</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase openldap-clients</html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale>If the system does not need to act as an LDAP client, it is recommended that the software is removed to reduce the potential attack surface.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_openldap-clients_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove openldap-clients
#	   from the system, and may remove any packages
#	   that depend on openldap-clients. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "openldap-clients" ; then

    dnf remove -y "openldap-clients"

fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_openldap-clients_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure openldap-clients is removed
  package:
    name: openldap-clients
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_openldap-clients_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_openldap-clients_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_openldap-clients

class remove_openldap-clients {
  package { 'openldap-clients':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_openldap-clients_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=openldap-clients
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_openldap-clients_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_openldap-clients_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_openldap_server">
            <xccdf-1.2:title>Configure OpenLDAP Server</xccdf-1.2:title>
            <xccdf-1.2:description>This section details some security-relevant settings
for an OpenLDAP server.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ldap_server_config_certificate_files">
              <xccdf-1.2:title>Install and Protect LDAP Certificate Files</xccdf-1.2:title>
              <xccdf-1.2:description>Create the PKI directory for LDAP certificates if it does not already exist:
<html:pre>$ sudo mkdir /etc/pki/tls/ldap
$ sudo chown root:root /etc/pki/tls/ldap
$ sudo chmod 755 /etc/pki/tls/ldap</html:pre>
Using removable media or some other secure transmission format, install the certificate files
onto the LDAP server:
<html:ul><html:li><html:code>/etc/pki/tls/ldap/serverkey.pem</html:code>: the private key <html:code>ldapserverkey.pem</html:code></html:li><html:li><html:code>/etc/pki/tls/ldap/servercert.pem</html:code>: the certificate file <html:code>ldapservercert.pem</html:code></html:li></html:ul>
Verify the ownership and permissions of these files:
<html:pre>$ sudo chown root:ldap /etc/pki/tls/ldap/serverkey.pem
$ sudo chown root:ldap /etc/pki/tls/ldap/servercert.pem
$ sudo chmod 640 /etc/pki/tls/ldap/serverkey.pem
$ sudo chmod 640 /etc/pki/tls/ldap/servercert.pem</html:pre>
Verify that the CA's public certificate file has been installed as
<html:code>/etc/pki/tls/CA/cacert.pem</html:code>, and has the correct permissions:
<html:pre>$ sudo mkdir /etc/pki/tls/CA
$ sudo chown root:root /etc/pki/tls/CA/cacert.pem
$ sudo chmod 644 /etc/pki/tls/CA/cacert.pem</html:pre>

As a result of these steps, the LDAP server will have access to its own private
certificate and the key with which that certificate is encrypted, and to the
public certificate file belonging to the CA. Note that it would be possible for
the key to be protected further, so that processes running as ldap could not
read it. If this were done, the LDAP server process would need to be restarted
manually whenever the server rebooted.</xccdf-1.2:description>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_mail">
          <xccdf-1.2:title>Mail Server Software</xccdf-1.2:title>
          <xccdf-1.2:description>Mail servers are used to send and receive email over the network.
Mail is a very common service, and Mail Transfer Agents (MTAs) are obvious
targets of network attack.
Ensure that systems are not running MTAs unnecessarily,
and configure needed MTAs as defensively as possible.
<html:br/><html:br/>
Very few systems at any site should be configured to directly receive email over the
network. Users should instead use mail client programs to retrieve email
from a central server that supports protocols such as IMAP or POP3.
However, it is normal for most systems to be independently capable of sending email,
for instance so that cron jobs can report output to an administrator.
Most MTAs, including Postfix, support a submission-only mode in which mail can be sent from
the local system to a central site MTA (or directly delivered to a local account),
but the system still cannot receive mail directly over a network.
<html:br/><html:br/>
The <html:code>alternatives</html:code> program in Fedora permits selection of other mail server software
(such as Sendmail), but Postfix is the default and is preferred.
Postfix was coded with security in mind and can also be more effectively contained by
SELinux as its modular design has resulted in separate processes performing specific actions.
More information is available on its website, 
    <html:a href="http://www.postfix.org">http://www.postfix.org</html:a>.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#machine"/>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_sendmail_removed" severity="medium">
            <xccdf-1.2:title>Uninstall Sendmail Package</xccdf-1.2:title>
            <xccdf-1.2:description>Sendmail is not the default mail transfer agent and is
not installed by default.
The <html:code>sendmail</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase sendmail</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The sendmail software was not developed with security in mind and
its design prevents it from being effectively contained by SELinux.  Postfix
should be used instead.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_sendmail_removed" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# CAUTION: This remediation script will remove sendmail
#	   from the system, and may remove any packages
#	   that depend on sendmail. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "sendmail" ; then

    dnf remove -y "sendmail"

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_sendmail_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure sendmail is removed
  package:
    name: sendmail
    state: absent
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_sendmail_removed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_sendmail_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_sendmail

class remove_sendmail {
  package { 'sendmail':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_sendmail_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=sendmail
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_sendmail_removed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_sendmail_removed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_client">
            <xccdf-1.2:title>Configure SMTP For Mail Clients</xccdf-1.2:title>
            <xccdf-1.2:description>This section discusses settings for Postfix in a submission-only
e-mail configuration.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_postfix_inet_interfaces" type="string">
              <xccdf-1.2:title>Postfix Network Interfaces</xccdf-1.2:title>
              <xccdf-1.2:description>The setting for inet_interfaces in /etc/postfix/main.cf</xccdf-1.2:description>
              <xccdf-1.2:value selector="loopback-only">loopback-only</xccdf-1.2:value>
              <xccdf-1.2:value>loopback-only</xccdf-1.2:value>
              <xccdf-1.2:value selector="localhost">localhost</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_postfix_relayhost" type="string">
              <xccdf-1.2:title>Postfix relayhost</xccdf-1.2:title>
              <xccdf-1.2:description>Specify the host all outbound email should be routed into.</xccdf-1.2:description>
              <xccdf-1.2:value>smtp.$mydomain</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_postfix_root_mail_alias" type="string" interactive="true">
              <xccdf-1.2:title>Postfix Root Mail Alias</xccdf-1.2:title>
              <xccdf-1.2:description>Specify an email address (string) for a root mail alias.</xccdf-1.2:description>
              <xccdf-1.2:value>system.administrator@mail.mil</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_postfix_client_configure_mail_alias" severity="medium">
              <xccdf-1.2:title>Configure System to Forward All Mail For The Root Account</xccdf-1.2:title>
              <xccdf-1.2:description>Make sure that mails delivered to root user are forwarded to a monitored
email address. Make sure that the address
<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_postfix_root_mail_alias" use="legacy"/> is a valid email address
reachable from the system in question. Use the following command to
configure the alias:
<html:pre>$ sudo echo "root: <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_postfix_root_mail_alias" use="legacy"/>" &gt;&gt; /etc/aliases
$ sudo newaliases</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R49)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000139</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000046-GPOS-00022</xccdf-1.2:reference>
              <xccdf-1.2:rationale>A number of system services utilize email messages sent to the root user to
notify system administrators of active or impending issues.  These messages must
be forwarded to at least one monitored email address.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="postfix_client_configure_mail_alias"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

var_postfix_root_mail_alias='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_postfix_root_mail_alias" use="legacy"/>'


# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/aliases"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^root")

# shellcheck disable=SC2059
printf -v formatted_output "%s: %s" "$stripped_key" "$var_postfix_root_mail_alias"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^root\\&gt;" "/etc/aliases"; then
    "${sed_command[@]}" "s/^root\\&gt;.*/$formatted_output/gi" "/etc/aliases"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/aliases"
fi

newaliases

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="postfix_client_configure_mail_alias" complexity="low" disruption="low" reboot="false" strategy="configure">- name: XCCDF Value var_postfix_root_mail_alias # promote to variable
  set_fact:
    var_postfix_root_mail_alias: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_postfix_root_mail_alias" use="legacy"/>
  tags:
    - always

- name: Make sure that that "/etc/aliases" has a defined value for root
  lineinfile:
    path: /etc/aliases
    line: 'root: {{ var_postfix_root_mail_alias }}'
    regexp: ^(?:[rR][oO][oO][tT]|"[rR][oO][oO][tT]")\s*:\s*(.+)$
    create: true
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - postfix_client_configure_mail_alias
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_postfix_root_mail_alias:var:1" value-id="xccdf_org.ssgproject.content_value_var_postfix_root_mail_alias"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-postfix_client_configure_mail_alias:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-postfix_client_configure_mail_alias_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_postfix_client_configure_relayhost" severity="medium">
              <xccdf-1.2:title>Configure System to Forward All Mail through a specific host</xccdf-1.2:title>
              <xccdf-1.2:description>Set up a relay host that will act as a gateway for all outbound email.
Edit the file <html:code>/etc/postfix/main.cf</html:code> to ensure that only the following
<html:code>relayhost</html:code> line appears:
<html:pre>relayhost = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_postfix_relayhost" use="legacy"/></html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale>A central outbound email location ensures messages sent from any network host
can be audited for potential unexpected content.  Tooling on the central server
may help prevent spam or viruses from being delivered.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#postfix"/>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-postfix_client_configure_relayhost_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_harden_os">
            <xccdf-1.2:title>Configure Operating System to Protect Mail Server</xccdf-1.2:title>
            <xccdf-1.2:description>The guidance in this section is appropriate for any host which is
operating as a site MTA, whether the mail server runs using Sendmail, Postfix,
or some other software.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#postfix"/>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_configure_ssl_certs">
              <xccdf-1.2:title>Configure SSL Certificates for Use with SMTP AUTH</xccdf-1.2:title>
              <xccdf-1.2:description>If SMTP AUTH is to be used, the use of SSL to protect credentials in transit is strongly recommended.
There are also configurations for which it may be desirable to encrypt all mail in transit from one MTA to another,
though such configurations are beyond the scope of this guide. In either event, the steps for creating and installing
an SSL certificate are independent of the MTA in use, and are described here.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#postfix"/>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_install_ssl_cert">
                <xccdf-1.2:title>Ensure Security of Postfix SSL Certificate</xccdf-1.2:title>
                <xccdf-1.2:description>Create the PKI directory for mail certificates, if it does not already exist:
<html:pre>$ sudo mkdir /etc/pki/tls/mail
$ sudo chown root:root /etc/pki/tls/mail
$ sudo chmod 755 /etc/pki/tls/mail</html:pre>
Using removable media or some other secure transmission format, install the files generated in the previous
step onto the mail server:
<html:pre>/etc/pki/tls/mail/serverkey.pem: the private key mailserverkey.pem
/etc/pki/tls/mail/servercert.pem: the certificate file mailservercert.pem</html:pre>
Verify the ownership and permissions of these files:
<html:pre>$ sudo chown root:root /etc/pki/tls/mail/serverkey.pem
$ sudo chown root:root /etc/pki/tls/mail/servercert.pem
$ sudo chmod 600 /etc/pki/tls/mail/serverkey.pem
$ sudo chmod 644 /etc/pki/tls/mail/servercert.pem</html:pre>
Verify that the CA's public certificate file has been installed as <html:code>/etc/pki/tls/CA/cacert.pem</html:code>, and has the
correct permissions:
<html:pre>$ sudo chown root:root /etc/pki/tls/CA/cacert.pem
$ sudo chmod 644 /etc/pki/tls/CA/cacert.pem</html:pre></xccdf-1.2:description>
                <xccdf-1.2:platform idref="#postfix"/>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_server_cfg">
              <xccdf-1.2:title>Configure Postfix if Necessary</xccdf-1.2:title>
              <xccdf-1.2:description>Postfix stores its configuration files in the directory
/etc/postfix by default. The primary configuration file is
<html:code>/etc/postfix/main.cf</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#postfix"/>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_server_dos">
                <xccdf-1.2:title>Configure Postfix Resource Usage to Limit Denial of Service Attacks</xccdf-1.2:title>
                <xccdf-1.2:description>Edit <html:code>/etc/postfix/main.cf</html:code>. Edit the following lines to
configure the amount of system resources Postfix can consume:
<html:pre>default_process_limit = 100
smtpd_client_connection_count_limit = 10
smtpd_client_connection_rate_limit = 30
queue_minfree = 20971520
header_size_limit = 51200
message_size_limit = 10485760
smtpd_recipient_limit = 100</html:pre>
The values here are examples.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note: The values given here are examples, and may
need to be modified for any particular site. By default, the Postfix anvil
process gathers mail receipt statistics. To get information about about what
connection rates are typical at your site, look in <html:code>/var/log/maillog</html:code>
for lines with the daemon name postfix/anvil.</xccdf-1.2:warning>
                <xccdf-1.2:platform idref="#postfix"/>
              </xccdf-1.2:Group>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_server_relay">
                <xccdf-1.2:title>Control Mail Relaying</xccdf-1.2:title>
                <xccdf-1.2:description>Postfix's mail relay controls are implemented with the help of the
smtpd recipient restrictions option, which controls the restrictions placed on
the SMTP dialogue once the sender and recipient envelope addresses are known.
The guidance in the following sections should be applied to all systems. If
there are systems which must be allowed to relay mail, but which cannot be
trusted to relay unconditionally, configure SMTP AUTH with SSL support.</xccdf-1.2:description>
                <xccdf-1.2:platform idref="#postfix"/>
                <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_recipient_restrictions">
                  <xccdf-1.2:title>Enact SMTP Recipient Restrictions</xccdf-1.2:title>
                  <xccdf-1.2:description>To configure Postfix to restrict addresses to which it
will send mail, see:

    <html:a href="http://www.postfix.org/SMTPD_ACCESS_README.html#danger">http://www.postfix.org/SMTPD_ACCESS_README.html#danger</html:a>
<html:br/>
The full contents of <html:code>smtpd_recipient_restrictions</html:code> will
vary by site, since this is a common place to put spam restrictions and other
site-specific options. The <html:code>permit_mynetworks</html:code> option allows all mail to
be relayed from the systems in <html:code>mynetworks</html:code>. Then, the
<html:code>reject_unauth_destination</html:code> option denies all mail whose destination
address is not local, preventing any other systems from relaying. These two
options should always appear in this order, and should usually follow one
another immediately unless SMTP AUTH is used.</xccdf-1.2:description>
                  <xccdf-1.2:platform idref="#postfix"/>
                </xccdf-1.2:Group>
                <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_relay_restrictions">
                  <xccdf-1.2:title>Enact SMTP Relay Restrictions</xccdf-1.2:title>
                  <xccdf-1.2:description>To configure Postfix to restrict addresses to which it
will send mail, see:

    <html:a href="http://www.postfix.org/SMTPD_ACCESS_README.html#danger">http://www.postfix.org/SMTPD_ACCESS_README.html#danger</html:a>
<html:br/>
The full contents of <html:code>smtpd_recipient_restrictions</html:code> will
vary by site, since this is a common place to put spam restrictions and other
site-specific options. The <html:code>permit_mynetworks</html:code> option allows all mail to
be relayed from the systems in <html:code>mynetworks</html:code>. Then, the
<html:code>reject_unauth_destination</html:code> option denies all mail whose destination
address is not local, preventing any other systems from relaying. These two
options should always appear in this order, and should usually follow one
another immediately unless SMTP AUTH is used.</xccdf-1.2:description>
                  <xccdf-1.2:platform idref="#postfix"/>
                </xccdf-1.2:Group>
                <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_server_relay_require_tls">
                  <xccdf-1.2:title>Use TLS for SMTP AUTH</xccdf-1.2:title>
                  <xccdf-1.2:description>Postfix provides options to use TLS for certificate-based
authentication and encrypted sessions. An encrypted session protects the
information that is transmitted with SMTP mail or with SASL authentication.
To configure Postfix to protect all SMTP AUTH transactions
using TLS, see 
    <html:a href="http://www.postfix.org/TLS_README.html">http://www.postfix.org/TLS_README.html</html:a>.</xccdf-1.2:description>
                  <xccdf-1.2:platform idref="#postfix"/>
                </xccdf-1.2:Group>
                <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_server_relay_set_trusted">
                  <xccdf-1.2:title>Configure Trusted Networks and Hosts</xccdf-1.2:title>
                  <xccdf-1.2:description>Edit <html:code>/etc/postfix/main.cf</html:code>, and configure the contents of
the <html:code>mynetworks</html:code> variable in one of the following ways:
<html:ul><html:li>If any system in the subnet containing the MTA may be trusted to relay
messages, add or correct the following line:
<html:pre>mynetworks_style = subnet</html:pre>
This is also the default setting, and is in effect if all
<html:code>my_networks_style</html:code> directives are commented.</html:li><html:li>If only the MTA host itself is trusted to relay messages, add or correct
the following line:
<html:pre>mynetworks_style = host</html:pre></html:li><html:li>If the set of systems which can relay is more complicated, manually
specify an entry for each netblock or IP address which is trusted to relay by
setting the <html:code>mynetworks</html:code> variable directly:
<html:pre>mynetworks = 10.0.0.0/16, 192.168.1.0/24, 127.0.0.1</html:pre></html:li></html:ul></xccdf-1.2:description>
                  <xccdf-1.2:platform idref="#postfix"/>
                </xccdf-1.2:Group>
                <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_server_relay_smtp_auth_for_untrusted">
                  <xccdf-1.2:title>Require SMTP AUTH Before Relaying from Untrusted Clients</xccdf-1.2:title>
                  <xccdf-1.2:description>SMTP authentication allows remote clients to relay mail safely by
requiring them to authenticate before submitting mail. Postfix's SMTP AUTH uses
an authentication library called SASL, which is not part of Postfix itself.  To
enable the use of SASL authentication, see

    <html:a href="http://www.postfix.org/SASL_README.html">http://www.postfix.org/SASL_README.html</html:a></xccdf-1.2:description>
                  <xccdf-1.2:platform idref="#postfix"/>
                </xccdf-1.2:Group>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_nfs_and_rpc">
          <xccdf-1.2:title>NFS and RPC</xccdf-1.2:title>
          <xccdf-1.2:description>The Network File System is a popular distributed filesystem for
the Unix environment, and is very widely deployed.  This section discusses the
circumstances under which it is possible to disable NFS and its dependencies,
and then details steps which should be taken to secure
NFS's configuration. This section is relevant to systems operating as NFS
clients, as well as to those operating as NFS servers.</xccdf-1.2:description>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_nfs-utils_removed" severity="low">
            <xccdf-1.2:title>Uninstall nfs-utils Package</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>nfs-utils</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase nfs-utils</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
            <xccdf-1.2:rationale><html:code>nfs-utils</html:code> provides a daemon for the kernel NFS server and related tools. This
package also contains the <html:code>showmount</html:code> program. <html:code>showmount</html:code> queries the mount
daemon on a remote host for information about the Network File System (NFS) server on the
remote host. For example, <html:code>showmount</html:code> can display the clients which are mounted on
that host.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_nfs-utils_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove nfs-utils
#	   from the system, and may remove any packages
#	   that depend on nfs-utils. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "nfs-utils" ; then

    dnf remove -y "nfs-utils"

fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_nfs-utils_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure nfs-utils is removed
  package:
    name: nfs-utils
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_nfs-utils_removed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_nfs-utils_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_nfs-utils

class remove_nfs-utils {
  package { 'nfs-utils':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_nfs-utils_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=nfs-utils
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_nfs-utils_removed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_nfs-utils_removed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_nfs">
            <xccdf-1.2:title>Disable All NFS Services if Possible</xccdf-1.2:title>
            <xccdf-1.2:description>If there is not a reason for the system to operate as either an
NFS client or an NFS server, follow all instructions in this section to disable
subsystems required by NFS.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">The steps in this section will prevent a system
from operating as either an NFS client or an NFS server. Only perform these
steps on systems which do not need NFS at all.</xccdf-1.2:warning>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_netfs">
              <xccdf-1.2:title>Disable netfs if Possible</xccdf-1.2:title>
              <xccdf-1.2:description>To determine if any network filesystems handled by netfs are
currently mounted on the system execute the following command:
<html:pre>$ mount -t nfs,nfs4,smbfs,cifs,ncpfs</html:pre>
If the command did not return any output then disable netfs.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_netfs_disabled" severity="unknown">
                <xccdf-1.2:title>Disable Network File Systems (netfs)</xccdf-1.2:title>
                <xccdf-1.2:description>The netfs script manages the boot-time mounting of several types
of networked filesystems, of which NFS and Samba are the most common. If these
filesystem types are not in use, the script can be disabled, protecting the
system somewhat against accidental or malicious changes to <html:code>/etc/fstab</html:code>
and against flaws in the netfs script itself.

The <html:code>netfs</html:code> service can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now netfs.service</html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale/>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_netfs_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'netfs.service'
"$SYSTEMCTL_EXEC" disable 'netfs.service'
"$SYSTEMCTL_EXEC" mask 'netfs.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^netfs.socket'; then
    "$SYSTEMCTL_EXEC" stop 'netfs.socket'
    "$SYSTEMCTL_EXEC" mask 'netfs.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'netfs.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_netfs_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Disable service netfs
  block:

    - name: Disable service netfs
      systemd:
        name: netfs.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      ignore_errors: 'yes'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_netfs_disabled
    - unknown_severity

- name: Unit Socket Exists - netfs.socket
  command: systemctl list-unit-files netfs.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_netfs_disabled
    - unknown_severity

- name: Disable socket netfs
  systemd:
    name: netfs.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"netfs.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_netfs_disabled
    - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_netfs_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_netfs

class disable_netfs {
  service {'netfs':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="service_netfs_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: netfs.service
        enabled: false
        mask: true
      - name: netfs.socket
        enabled: false
        mask: true
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_netfs_disabled">
[customizations.services]
disabled = ["netfs"]
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_netfs_disabled:def:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_nfs_services">
              <xccdf-1.2:title>Disable Services Used Only by NFS</xccdf-1.2:title>
              <xccdf-1.2:description>If NFS is not needed, disable the NFS client daemons nfslock, rpcgssd, and rpcidmapd.
<html:br/><html:br/>
All of these daemons run with elevated privileges, and many listen for network
connections. If they are not needed, they should be disabled to improve system
security posture.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_nfslock_disabled" severity="unknown">
                <xccdf-1.2:title>Disable Network File System Lock Service (nfslock)</xccdf-1.2:title>
                <xccdf-1.2:description>The Network File System Lock (nfslock) service starts the required
remote procedure call (RPC) processes which allow clients to lock files on the
server. If the local system is not configured to mount NFS filesystems then
this service should be disabled.

The <html:code>nfslock</html:code> service can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now nfslock.service</html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale/>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_nfslock_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'nfslock.service'
"$SYSTEMCTL_EXEC" disable 'nfslock.service'
"$SYSTEMCTL_EXEC" mask 'nfslock.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^nfslock.socket'; then
    "$SYSTEMCTL_EXEC" stop 'nfslock.socket'
    "$SYSTEMCTL_EXEC" mask 'nfslock.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'nfslock.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_nfslock_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Disable service nfslock
  block:

    - name: Disable service nfslock
      systemd:
        name: nfslock.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      ignore_errors: 'yes'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_nfslock_disabled
    - unknown_severity

- name: Unit Socket Exists - nfslock.socket
  command: systemctl list-unit-files nfslock.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_nfslock_disabled
    - unknown_severity

- name: Disable socket nfslock
  systemd:
    name: nfslock.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"nfslock.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_nfslock_disabled
    - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_nfslock_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_nfslock

class disable_nfslock {
  service {'nfslock':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="service_nfslock_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: nfslock.service
        enabled: false
        mask: true
      - name: nfslock.socket
        enabled: false
        mask: true
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_nfslock_disabled">
[customizations.services]
disabled = ["nfslock"]
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_nfslock_disabled:def:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_rpcgssd_disabled" severity="unknown">
                <xccdf-1.2:title>Disable Secure RPC Client Service (rpcgssd)</xccdf-1.2:title>
                <xccdf-1.2:description>The rpcgssd service manages RPCSEC GSS contexts required to secure protocols
that use RPC (most often Kerberos and NFS). The rpcgssd service is the
client-side of RPCSEC GSS. If the system does not require secure RPC then this
service should be disabled.

The <html:code>rpcgssd</html:code> service can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now rpcgssd.service</html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale/>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_rpcgssd_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'rpcgssd.service'
"$SYSTEMCTL_EXEC" disable 'rpcgssd.service'
"$SYSTEMCTL_EXEC" mask 'rpcgssd.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^rpcgssd.socket'; then
    "$SYSTEMCTL_EXEC" stop 'rpcgssd.socket'
    "$SYSTEMCTL_EXEC" mask 'rpcgssd.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'rpcgssd.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_rpcgssd_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Disable service rpcgssd
  block:

    - name: Disable service rpcgssd
      systemd:
        name: rpcgssd.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      ignore_errors: 'yes'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_rpcgssd_disabled
    - unknown_severity

- name: Unit Socket Exists - rpcgssd.socket
  command: systemctl list-unit-files rpcgssd.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_rpcgssd_disabled
    - unknown_severity

- name: Disable socket rpcgssd
  systemd:
    name: rpcgssd.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"rpcgssd.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_rpcgssd_disabled
    - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_rpcgssd_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_rpcgssd

class disable_rpcgssd {
  service {'rpcgssd':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="service_rpcgssd_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: rpcgssd.service
        enabled: false
        mask: true
      - name: rpcgssd.socket
        enabled: false
        mask: true
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_rpcgssd_disabled">
[customizations.services]
disabled = ["rpcgssd"]
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_rpcgssd_disabled:def:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_rpcidmapd_disabled" severity="unknown">
                <xccdf-1.2:title>Disable RPC ID Mapping Service (rpcidmapd)</xccdf-1.2:title>
                <xccdf-1.2:description>The rpcidmapd service is used to map user names and groups to UID
and GID numbers on NFSv4 mounts. If NFS is not in use on the local system then
this service should be disabled.

The <html:code>rpcidmapd</html:code> service can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now rpcidmapd.service</html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale/>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_rpcidmapd_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'rpcidmapd.service'
"$SYSTEMCTL_EXEC" disable 'rpcidmapd.service'
"$SYSTEMCTL_EXEC" mask 'rpcidmapd.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^rpcidmapd.socket'; then
    "$SYSTEMCTL_EXEC" stop 'rpcidmapd.socket'
    "$SYSTEMCTL_EXEC" mask 'rpcidmapd.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'rpcidmapd.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_rpcidmapd_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Disable service rpcidmapd
  block:

    - name: Disable service rpcidmapd
      systemd:
        name: rpcidmapd.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      ignore_errors: 'yes'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_rpcidmapd_disabled
    - unknown_severity

- name: Unit Socket Exists - rpcidmapd.socket
  command: systemctl list-unit-files rpcidmapd.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_rpcidmapd_disabled
    - unknown_severity

- name: Disable socket rpcidmapd
  systemd:
    name: rpcidmapd.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"rpcidmapd.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_rpcidmapd_disabled
    - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_rpcidmapd_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_rpcidmapd

class disable_rpcidmapd {
  service {'rpcidmapd':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="service_rpcidmapd_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: rpcidmapd.service
        enabled: false
        mask: true
      - name: rpcidmapd.socket
        enabled: false
        mask: true
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_rpcidmapd_disabled">
[customizations.services]
disabled = ["rpcidmapd"]
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_rpcidmapd_disabled:def:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_nfs_configuring_all_machines">
            <xccdf-1.2:title>Configure All Systems which Use NFS</xccdf-1.2:title>
            <xccdf-1.2:description>The steps in this section are appropriate for all systems which
run NFS, whether they operate as clients or as servers.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_nfs_client_or_server_not_both">
              <xccdf-1.2:title>Make Each System a Client or a Server, not Both</xccdf-1.2:title>
              <xccdf-1.2:description>If NFS must be used, it should be deployed in the simplest
configuration possible to avoid maintainability problems which may lead to
unnecessary security exposure. Due to the reliability and security problems
caused by NFS (specially NFSv3 and NFSv2), it is not a good idea for systems
which act as NFS servers to also mount filesystems via NFS. At the least,
crossed mounts (the situation in which each of two servers mounts a filesystem
from the other) should never be used.</xccdf-1.2:description>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_nfs_configure_fixed_ports">
              <xccdf-1.2:title>Configure NFS Services to Use Fixed Ports (NFSv3 and NFSv2)</xccdf-1.2:title>
              <xccdf-1.2:description>Firewalling should be done at each host and at the border
firewalls to protect the NFS daemons from remote access, since NFS servers
should never be accessible from outside the organization. However, by default
for NFSv3 and NFSv2, the RPC Bind service assigns each NFS service to a port
dynamically at service startup time. Dynamic ports cannot be protected by port

filtering firewalls such as <html:code>iptables</html:code>.

<html:br/><html:br/>
Therefore, restrict each service to always use a given port, so that
firewalling can be done effectively. Note that, because of the way RPC is
implemented, it is not possible to disable the RPC Bind service even if ports
are assigned statically to all RPC services.
<html:br/><html:br/>
In NFSv4, the mounting and locking protocols have been incorporated into the
protocol, and the server listens on the the well-known TCP port 2049. As such,
NFSv4 does not need to interact with the <html:code>rpcbind, lockd, and rpc.statd</html:code>
daemons, which can and should be disabled in a pure NFSv4 environment. The
<html:code>rpc.mountd</html:code> daemon is still required on the NFS server to setup
exports, but is not involved in any over-the-wire operations.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_nfs_fixed_lockd_tcp_port" severity="unknown">
                <xccdf-1.2:title>Configure lockd to use static TCP port</xccdf-1.2:title>
                <xccdf-1.2:description>Configure the <html:code>lockd</html:code> daemon to use a static TCP port as
opposed to letting the RPC Bind service dynamically assign a port. Edit the
file <html:code>/etc/sysconfig/nfs</html:code>. Add or correct the following line:
<html:pre>LOCKD_TCPPORT=lockd-port</html:pre>
Where <html:code>lockd-port</html:code> is a port which is not used by any other service on
your network.</xccdf-1.2:description>
                <xccdf-1.2:rationale>Restrict service to always use a given port, so that firewalling can be done
effectively.</xccdf-1.2:rationale>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_nfs_fixed_lockd_udp_port" severity="unknown">
                <xccdf-1.2:title>Configure lockd to use static UDP port</xccdf-1.2:title>
                <xccdf-1.2:description>Configure the <html:code>lockd</html:code> daemon to use a static UDP port as
opposed to letting the RPC Bind service dynamically assign a port. Edit the
file <html:code>/etc/sysconfig/nfs</html:code>. Add or correct the following line:
<html:pre>LOCKD_UDPPORT=lockd-port</html:pre>
Where <html:code>lockd-port</html:code> is a port which is not used by any other service on
your network.</xccdf-1.2:description>
                <xccdf-1.2:rationale>Restricting services to always use a given port enables firewalling
to be done more effectively.</xccdf-1.2:rationale>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_nfs_fixed_mountd_port" severity="unknown">
                <xccdf-1.2:title>Configure mountd to use static port</xccdf-1.2:title>
                <xccdf-1.2:description>Configure the <html:code>mountd</html:code> daemon to use a static port as
opposed to letting the RPC Bind service dynamically assign a port. Edit the
file <html:code>/etc/sysconfig/nfs</html:code>. Add or correct the following line:
<html:pre>MOUNTD_PORT=statd-port</html:pre>
Where <html:code>mountd-port</html:code> is a port which is not used by any other service on your network.</xccdf-1.2:description>
                <xccdf-1.2:rationale>Restricting services to always use a given port enables firewalling
to be done more effectively.</xccdf-1.2:rationale>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_nfs_fixed_statd_port" severity="unknown">
                <xccdf-1.2:title>Configure statd to use static port</xccdf-1.2:title>
                <xccdf-1.2:description>Configure the <html:code>statd</html:code> daemon to use a static port as
opposed to letting the RPC Bind service dynamically assign a port. Edit the
file <html:code>/etc/sysconfig/nfs</html:code>. Add or correct the following line:
<html:pre>STATD_PORT=statd-port</html:pre>
Where <html:code>statd-port</html:code> is a port which is not used by any other service on your network.</xccdf-1.2:description>
                <xccdf-1.2:rationale>Restricting services to always use a given port enables firewalling
to be done more effectively.</xccdf-1.2:rationale>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_nfs_configuring_clients">
            <xccdf-1.2:title>Configure NFS Clients</xccdf-1.2:title>
            <xccdf-1.2:description>The steps in this section are appropriate for systems which operate as NFS clients.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_nfsd">
              <xccdf-1.2:title>Disable NFS Server Daemons</xccdf-1.2:title>
              <xccdf-1.2:description>There is no need to run the NFS server daemons <html:code>nfs</html:code> and
<html:code>rpcsvcgssd</html:code> except on a small number of properly secured systems
designated as NFS servers. Ensure that these daemons are turned off on
clients.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_nfs_disabled" severity="unknown">
                <xccdf-1.2:title>Disable Network File System (nfs)</xccdf-1.2:title>
                <xccdf-1.2:description>The Network File System (NFS) service allows remote hosts to mount
and interact with shared filesystems on the local system. If the local system
is not designated as a NFS server then this service should be disabled.

The <html:code>nfs-server</html:code> service can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now nfs-server.service</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unnecessary services should be disabled to decrease the attack surface of the system.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_nfs_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'nfs-server.service'
"$SYSTEMCTL_EXEC" disable 'nfs-server.service'
"$SYSTEMCTL_EXEC" mask 'nfs-server.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^nfs-server.socket'; then
    "$SYSTEMCTL_EXEC" stop 'nfs-server.socket'
    "$SYSTEMCTL_EXEC" mask 'nfs-server.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'nfs-server.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_nfs_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Disable service nfs-server
  block:

    - name: Disable service nfs-server
      systemd:
        name: nfs-server.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      ignore_errors: 'yes'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_nfs_disabled
    - unknown_severity

- name: Unit Socket Exists - nfs-server.socket
  command: systemctl list-unit-files nfs-server.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_nfs_disabled
    - unknown_severity

- name: Disable socket nfs-server
  systemd:
    name: nfs-server.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"nfs-server.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_nfs_disabled
    - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_nfs_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_nfs-server

class disable_nfs-server {
  service {'nfs-server':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="service_nfs_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: nfs-server.service
        enabled: false
        mask: true
      - name: nfs-server.socket
        enabled: false
        mask: true
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_nfs_disabled">
[customizations.services]
disabled = ["nfs-server"]
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_nfs_disabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-service_nfs_disabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_rpcsvcgssd_disabled" severity="unknown">
                <xccdf-1.2:title>Disable Secure RPC Server Service (rpcsvcgssd)</xccdf-1.2:title>
                <xccdf-1.2:description>The rpcsvcgssd service manages RPCSEC GSS contexts required to
secure protocols that use RPC (most often Kerberos and NFS). The rpcsvcgssd
service is the server-side of RPCSEC GSS. If the system does not require secure
RPC then this service should be disabled.

The <html:code>rpcsvcgssd</html:code> service can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now rpcsvcgssd.service</html:pre></xccdf-1.2:description>
                <xccdf-1.2:rationale>Unnecessary services should be disabled to decrease the attack surface of the system.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_rpcsvcgssd_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'rpcsvcgssd.service'
"$SYSTEMCTL_EXEC" disable 'rpcsvcgssd.service'
"$SYSTEMCTL_EXEC" mask 'rpcsvcgssd.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^rpcsvcgssd.socket'; then
    "$SYSTEMCTL_EXEC" stop 'rpcsvcgssd.socket'
    "$SYSTEMCTL_EXEC" mask 'rpcsvcgssd.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'rpcsvcgssd.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_rpcsvcgssd_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Disable service rpcsvcgssd
  block:

    - name: Disable service rpcsvcgssd
      systemd:
        name: rpcsvcgssd.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      ignore_errors: 'yes'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_rpcsvcgssd_disabled
    - unknown_severity

- name: Unit Socket Exists - rpcsvcgssd.socket
  command: systemctl list-unit-files rpcsvcgssd.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_rpcsvcgssd_disabled
    - unknown_severity

- name: Disable socket rpcsvcgssd
  systemd:
    name: rpcsvcgssd.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"rpcsvcgssd.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_rpcsvcgssd_disabled
    - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_rpcsvcgssd_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_rpcsvcgssd

class disable_rpcsvcgssd {
  service {'rpcsvcgssd':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="service_rpcsvcgssd_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: rpcsvcgssd.service
        enabled: false
        mask: true
      - name: rpcsvcgssd.socket
        enabled: false
        mask: true
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_rpcsvcgssd_disabled">
[customizations.services]
disabled = ["rpcsvcgssd"]
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_rpcsvcgssd_disabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-service_rpcsvcgssd_disabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_nfs_no_anonymous" severity="unknown">
                <xccdf-1.2:title>Specify UID and GID for Anonymous NFS Connections</xccdf-1.2:title>
                <xccdf-1.2:description>To specify the UID and GID for remote root users, edit the <html:code>/etc/exports</html:code> file and add the following for each export:
<html:pre>
anonuid=<html:code>value greater than UID_MAX from /etc/login.defs</html:code>
anongid=<html:code>value greater than GID_MAX from /etc/login.defs</html:code>
</html:pre>
Note that a value of "-1" is technically acceptable as this will randomize the <html:code>anonuid</html:code> and
<html:code>anongid</html:code> values on a Red Hat Enterprise Linux based NFS server. While acceptable from a security perspective,
a value of <html:code>-1</html:code>  may cause interoperability issues, particularly with Red Hat Enterprise Linux 7 client systems.
Alternatively, functionally equivalent values of 60001, 65534, 65535 may be used.</xccdf-1.2:description>
                <xccdf-1.2:rationale>Specifying the anonymous UID and GID ensures that the remote root user is mapped
to a local account which has no permissions on the system.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-nfs_no_anonymous_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_mounting_remote_filesystems">
              <xccdf-1.2:title>Mount Remote Filesystems with Restrictive Options</xccdf-1.2:title>
              <xccdf-1.2:description>Edit the file <html:code>/etc/fstab</html:code>. For each filesystem whose type
(column 3) is <html:code>nfs</html:code> or <html:code>nfs4</html:code>, add the text
<html:code>,nodev,nosuid</html:code> to the list of mount options in column 4. If
appropriate, also add <html:code>,noexec</html:code>.
<html:br/><html:br/>
See the section titled "Restrict Partition Mount Options" for a description of
the effects of these options. In general, execution of files mounted via NFS
should be considered risky because of the possibility that an adversary could
intercept the request and substitute a malicious file. Allowing setuid files to
be executed from remote servers is particularly risky, both for this reason and
because it requires the clients to extend root-level trust to the NFS
server.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#machine"/>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_nfs_configuring_servers">
            <xccdf-1.2:title>Configure NFS Servers</xccdf-1.2:title>
            <xccdf-1.2:description>The steps in this section are appropriate for systems which operate as NFS servers.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_all_squash_exports" severity="low">
              <xccdf-1.2:title>Ensure All-Squashing Disabled On All Exports</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>all_squash</html:code> maps all uids and gids to an anonymous user.
This should be disabled by removing any instances of the
<html:code>all_squash</html:code> option from the file <html:code>/etc/exports</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:rationale>The all_squash option maps all client requests to a single anonymous
uid/gid on the NFS server, negating the ability to track file access
by user ID.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-no_all_squash_exports_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_insecure_locks_exports" severity="medium">
              <xccdf-1.2:title>Ensure Insecure File Locking is Not Allowed</xccdf-1.2:title>
              <xccdf-1.2:description>By default the NFS server requires secure file-lock requests, which require
credentials from the client in order to lock a file. Most NFS clients send
credentials with file lock requests, however, there are a few clients that
do not send credentials when requesting a file-lock, allowing the client to
only be able to lock world-readable files. To get around this, the
<html:code>insecure_locks</html:code> option can be used so these clients can access the
desired export. This poses a security risk by potentially allowing the
client access to data for which it does not have authorization. Remove any
instances of the <html:code>insecure_locks</html:code> option from the file
<html:code>/etc/exports</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000764</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Allowing insecure file locking could allow for sensitive data to be
viewed or edited by an unauthorized user.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-no_insecure_locks_exports:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-no_insecure_locks_exports_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_restrict_nfs_clients_to_privileged_ports" severity="unknown">
              <xccdf-1.2:title>Restrict NFS Clients to Privileged Ports</xccdf-1.2:title>
              <xccdf-1.2:description>By default, the server NFS implementation requires that all client requests be made
from ports less than 1024. If your organization has control over systems connected to its
network, and if NFS requests are prohibited at the border firewall, this offers some protection
against malicious requests from unprivileged users. Therefore, the default should not be changed.
<html:br/><html:br/>
To ensure that the default has not been changed, ensure no line in
<html:code>/etc/exports</html:code> contains the option <html:code>insecure</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Allowing client requests to be made from ports higher than 1024 could allow a unprivileged
user to initiate an NFS connection. If the unprivileged user account has been compromised, an
attacker could gain access to data on the NFS server.</xccdf-1.2:rationale>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_use_root_squashing_all_exports" severity="unknown">
              <xccdf-1.2:title>Use Root-Squashing on All Exports</xccdf-1.2:title>
              <xccdf-1.2:description>If a filesystem is exported using root squashing, requests from root on the client
are considered to be unprivileged (mapped to a user such as nobody). This provides some mild
protection against remote abuse of an NFS server. Root squashing is enabled by default, and
should not be disabled.
<html:br/><html:br/>
Ensure that no line in <html:code>/etc/exports</html:code> contains the option <html:code>no_root_squash</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:rationale>If the NFS server allows root access to local file systems from remote hosts, this
access could be used to compromise the system.</xccdf-1.2:rationale>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_configure_exports_restrictively">
              <xccdf-1.2:title>Configure the Exports File Restrictively</xccdf-1.2:title>
              <xccdf-1.2:description>Linux's NFS implementation uses the file <html:code>/etc/exports</html:code> to control what filesystems
and directories may be accessed via NFS. (See the <html:code>exports(5)</html:code> manpage for more information about the
format of this file.)
<html:br/><html:br/>
The syntax of the <html:code>exports</html:code> file is not necessarily checked fully on reload, and syntax errors
can leave your NFS configuration more open than intended. Therefore, exercise caution when modifying
the file.
<html:br/><html:br/>
The syntax of each line in <html:code>/etc/exports</html:code> is:
<html:pre>/DIR	host1(opt1,opt2) host2(opt3)</html:pre>
where <html:code>/DIR</html:code> is a directory or filesystem to export, <html:code>hostN</html:code> is an IP address, netblock,
hostname, domain, or netgroup to which to export, and <html:code>optN</html:code> is an option.</xccdf-1.2:description>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_export_filesystems_read_only">
              <xccdf-1.2:title>Export Filesystems Read-Only if Possible</xccdf-1.2:title>
              <xccdf-1.2:description>If a filesystem is being exported so that users can view the files in a convenient
fashion, but there is no need for users to edit those files, exporting the filesystem read-only
removes an attack vector against the server. The default filesystem export mode is <html:code>ro</html:code>,
so do not specify <html:code>rw</html:code> without a good reason.</xccdf-1.2:description>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_use_acl_enforce_auth_restrictions">
              <xccdf-1.2:title>Use Access Lists to Enforce Authorization Restrictions</xccdf-1.2:title>
              <xccdf-1.2:description>When configuring NFS exports, ensure that each export line in <html:code>/etc/exports</html:code> contains
a list of hosts which are allowed to access that export. If no hosts are specified on an export line,
then that export is available to any remote host which requests it. All lines of the exports file should
specify the hosts (or subnets, if needed) which are allowed to access the exported directory, so that
unknown or remote hosts will be denied.
<html:br/><html:br/>
Authorized hosts can be specified in several different formats:
<html:ul><html:li>Name or alias that is recognized by the resolver</html:li><html:li>Fully qualified domain name</html:li><html:li>IP address</html:li><html:li>IP subnets in the format <html:code>address/netmask</html:code> or <html:code>address/CIDR</html:code></html:li></html:ul></xccdf-1.2:description>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ntp">
          <xccdf-1.2:title>Network Time Protocol</xccdf-1.2:title>
          <xccdf-1.2:description>The Network Time Protocol is used to manage the system
clock over a network. Computer clocks are not very accurate, so
time will drift unpredictably on unmanaged systems. Central time
protocols can be used both to ensure that time is consistent among
a network of systems, and that their time is consistent with the
outside world.
<html:br/><html:br/>
If every system on a network reliably reports the same time, then it is much
easier to correlate log messages in case of an attack. In addition, a number of
cryptographic protocols (such as Kerberos) use timestamps to prevent certain
types of attacks. If your network does not have synchronized time, these
protocols may be unreliable or even unusable.
<html:br/><html:br/>
Depending on the specifics of the network, global time accuracy may be just as
important as local synchronization, or not very important at all. If your
network is connected to the Internet, using a public timeserver (or one
provided by your enterprise) provides globally accurate timestamps which may be
essential in investigating or responding to an attack which originated outside
of your network.
<html:br/><html:br/>
A typical network setup involves a small number of internal systems operating
as NTP servers, and the remainder obtaining time information from those
internal servers.
<html:br/><html:br/>
There is a choice between the daemons <html:code>ntpd</html:code> and <html:code>chronyd</html:code>, which
are available from the repositories in the <html:code>ntp</html:code> and <html:code>chrony</html:code>
packages respectively.
<html:br/><html:br/>
The default <html:code>chronyd</html:code> daemon can work well when external time references
are only intermittently accesible, can perform well even when the network is
congested for longer periods of time, can usually synchronize the clock faster
and with better time accuracy, and quickly adapts to sudden changes in the rate
of the clock, for example, due to changes in the temperature of the crystal
oscillator. <html:code>Chronyd</html:code> should be considered for all systems which are
frequently suspended or otherwise intermittently disconnected and reconnected
to a network. Mobile and virtual systems for example.
<html:br/><html:br/>
The <html:code>ntpd</html:code> NTP daemon fully supports NTP protocol version 4 (RFC 5905),
including broadcast, multicast, manycast clients and servers, and the orphan
mode. It also supports extra authentication schemes based on public-key
cryptography (RFC 5906). The NTP daemon (<html:code>ntpd</html:code>) should be considered
for systems which are normally kept permanently on. Systems which are required
to use broadcast or multicast IP, or to perform authentication of packets with
the <html:code>Autokey</html:code> protocol, should consider using <html:code>ntpd</html:code>.
<html:br/><html:br/>
Refer to

    
    <html:a href="https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/servers/Configuring_NTP_Using_the_chrony_Suite/">https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/servers/Configuring_NTP_Using_the_chrony_Suite/</html:a>

for more detailed comparison of features of <html:code>chronyd</html:code>
and <html:code>ntpd</html:code> daemon features respectively, and for further guidance how to
choose between the two NTP daemons.
<html:br/><html:br/>
The upstream manual pages at 
    <html:a href="http://chrony.tuxfamily.org/manual.html">http://chrony.tuxfamily.org/manual.html</html:a> for
<html:code>chronyd</html:code> and 
    <html:a href="http://www.ntp.org">http://www.ntp.org</html:a> for <html:code>ntpd</html:code> provide additional
information on the capabilities and configuration of each of the NTP daemons.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#machine"/>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_multiple_time_servers" type="string" interactive="true">
            <xccdf-1.2:title>Vendor Approved Time Servers</xccdf-1.2:title>
            <xccdf-1.2:description>The list of vendor-approved time servers</xccdf-1.2:description>
            <xccdf-1.2:value>0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org</xccdf-1.2:value>
            <xccdf-1.2:value selector="fedora">0.fedora.pool.ntp.org,1.fedora.pool.ntp.org,2.fedora.pool.ntp.org,3.fedora.pool.ntp.org</xccdf-1.2:value>
            <xccdf-1.2:value selector="rhel">0.rhel.pool.ntp.org,1.rhel.pool.ntp.org,2.rhel.pool.ntp.org,3.rhel.pool.ntp.org</xccdf-1.2:value>
            <xccdf-1.2:value selector="ol">0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org</xccdf-1.2:value>
            <xccdf-1.2:value selector="suse">0.suse.pool.ntp.org,1.suse.pool.ntp.org,2.suse.pool.ntp.org,3.suse.pool.ntp.org</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_time_service_set_maxpoll" type="number">
            <xccdf-1.2:title>Maximum NTP or Chrony Poll</xccdf-1.2:title>
            <xccdf-1.2:description>The maximum NTP or Chrony poll interval number in seconds specified as a power of two.</xccdf-1.2:description>
            <xccdf-1.2:value selector="36_hours">17</xccdf-1.2:value>
            <xccdf-1.2:value selector="18_hours">16</xccdf-1.2:value>
            <xccdf-1.2:value>10</xccdf-1.2:value>
            <xccdf-1.2:value selector="system_default">10</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_chrony_installed" severity="medium">
            <xccdf-1.2:title>The Chrony package is installed</xccdf-1.2:title>
            <xccdf-1.2:description>System time should be synchronized between all systems in an environment. This is
typically done by establishing an authoritative time server or set of servers and having all
systems synchronize their clocks to them.
The <html:code>chrony</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install chrony</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R43)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">0988</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1405</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000355-GPOS-00143</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Time synchronization is important to support time sensitive security mechanisms like
Kerberos and also ensures log files have consistent time records across the enterprise,
which aids in forensic investigations.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_chrony_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "chrony" ; then
    dnf install -y "chrony"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_chrony_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure chrony is installed
  package:
    name: chrony
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_chrony_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_chrony_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_chrony

class install_chrony {
  package { 'chrony':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_chrony_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=chrony
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_chrony_installed">
[[packages]]
name = "chrony"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_chrony_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_chrony_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_ntp_installed" severity="high">
            <xccdf-1.2:title>Install the ntp service</xccdf-1.2:title>
            <xccdf-1.2:description>The ntpd service should be installed.</xccdf-1.2:description>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT012(R03)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000160</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Time synchronization (using NTP) is required by almost all network and administrative tasks (syslog, cryptographic based services (authentication, etc.), etc.). Ntpd is regulary maintained and updated, supporting security features such as RFC 5906.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_ntp_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "ntp" ; then
    dnf install -y "ntp"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_ntp_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure ntp is installed
  package:
    name: ntp
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4
    - enable_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - package_ntp_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_ntp_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_ntp

class install_ntp {
  package { 'ntp':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_ntp_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=ntp
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_ntp_installed">
[[packages]]
name = "ntp"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_ntp_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_ntp_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_chronyd_enabled" severity="medium">
            <xccdf-1.2:title>The Chronyd service is enabled</xccdf-1.2:title>
            <xccdf-1.2:description>chrony is a daemon which implements the Network Time Protocol (NTP) is designed to
synchronize system clocks across a variety of systems and use a source that is highly
accurate. More information on chrony can be found at

    <html:a href="http://chrony.tuxfamily.org/">http://chrony.tuxfamily.org/</html:a>.
Chrony can be configured to be a client and/or a server.
To enable Chronyd service, you can run:
<html:code># systemctl enable chronyd.service</html:code>
This recommendation only applies if chrony is in use on the system.</xccdf-1.2:description>
            <xccdf-1.2:reference href="">0988</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1405</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If chrony is in use on the system proper configuration is vital to ensuring time
synchronization is working properly.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_chronyd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'chronyd.service'
"$SYSTEMCTL_EXEC" start 'chronyd.service'
"$SYSTEMCTL_EXEC" enable 'chronyd.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_chronyd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Enable service chronyd
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service chronyd
      service:
        name: chronyd
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"chrony" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_chronyd_enabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_chronyd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_chronyd

class enable_chronyd {
  service {'chronyd':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_chronyd_enabled">
[customizations.services]
enabled = ["chronyd"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_chronyd_enabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-service_chronyd_enabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_chronyd_or_ntpd_enabled" severity="medium">
            <xccdf-1.2:title>Enable the NTP Daemon</xccdf-1.2:title>
            <xccdf-1.2:description>

Run the following command to determine the current status of the
<html:code>chronyd</html:code> service:
<html:pre>$ sudo systemctl is-active chronyd</html:pre>
If the service is running, it should return the following: <html:pre>active</html:pre>
Note: The <html:code>chronyd</html:code> daemon is enabled by default.
<html:br/><html:br/>


Run the following command to determine the current status of the
<html:code>ntpd</html:code> service:
<html:pre>$ sudo systemctl is-active ntpd</html:pre>
If the service is running, it should return the following: <html:pre>active</html:pre>
Note: The <html:code>ntpd</html:code> daemon is not enabled by default. Though as mentioned
in the previous sections in certain environments the <html:code>ntpd</html:code> daemon might
be preferred to be used rather than the <html:code>chronyd</html:code> one. Refer to:

    
    <html:a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite">https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite</html:a>

for guidance which NTP daemon to choose depending on the environment used.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000160</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">0988</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1405</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">SRG-OS-000356-VMM-001340</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Enabling some of <html:code>chronyd</html:code> or <html:code>ntpd</html:code> services ensures
that the NTP daemon will be running and that the system will synchronize its
time to any servers specified. This is important whether the system is
configured to be a client (and synchronize only its own clock) or it is also
acting as an NTP server to other systems.  Synchronizing time is essential for
authentication services such as Kerberos, but it is also important for
maintaining accurate logs and auditing possible security breaches.
<html:br/><html:br/>
The <html:code>chronyd</html:code> and <html:code>ntpd</html:code> NTP daemons offer all of the
functionality of <html:code>ntpdate</html:code>, which is now deprecated.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_chronyd_or_ntpd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if rpm --quiet -q "chrony" ; then
    if ! /usr/sbin/pidof ntpd ; then
        /usr/bin/systemctl enable "chronyd"
        /usr/bin/systemctl start "chronyd"
        # The service may not be running because it has been started and failed,
        # so let's reset the state so OVAL checks pass.
        # Service should be 'inactive', not 'failed' after reboot though.
        /usr/bin/systemctl reset-failed "chronyd"
    fi
elif rpm --quiet -q "ntp" ; then
    /usr/bin/systemctl enable "ntpd"
    /usr/bin/systemctl start "ntpd"
    # The service may not be running because it has been started and failed,
    # so let's reset the state so OVAL checks pass.
    # Service should be 'inactive', not 'failed' after reboot though.
    /usr/bin/systemctl reset-failed "ntpd"
else
    if ! rpm -q --quiet "chrony" ; then
        dnf install -y "chrony"
    fi
    /usr/bin/systemctl enable "chronyd"
    /usr/bin/systemctl start "chronyd"
    # The service may not be running because it has been started and failed,
    # so let's reset the state so OVAL checks pass.
    # Service should be 'inactive', not 'failed' after reboot though.
    /usr/bin/systemctl reset-failed "chronyd"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_chronyd_or_ntpd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.3.7
    - NIST-800-53-AU-12(1)
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.1
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_chronyd_or_ntpd_enabled

- name: Gather the package facts
  ansible.builtin.package_facts:
    manager: auto
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.3.7
    - NIST-800-53-AU-12(1)
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.1
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_chronyd_or_ntpd_enabled

- name: Start ntpd service if ntp installed
  service:
    name: ntpd
    enabled: 'yes'
    state: started
    masked: 'no'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '''ntp'' in ansible_facts.packages'
  ignore_errors: true
  tags:
    - NIST-800-171-3.3.7
    - NIST-800-53-AU-12(1)
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.1
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_chronyd_or_ntpd_enabled

- name: Start chronyd service if chrony or chronyd installed
  service:
    name: chronyd
    enabled: 'yes'
    state: started
    masked: 'no'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ('chrony' in ansible_facts.packages) or ('chronyd' in ansible_facts.packages)
  ignore_errors: true
  tags:
    - NIST-800-171-3.3.7
    - NIST-800-53-AU-12(1)
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.1
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_chronyd_or_ntpd_enabled
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_chronyd_or_ntpd_enabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-service_chronyd_or_ntpd_enabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_ntp_enabled" severity="high">
            <xccdf-1.2:title>Enable the NTP Daemon</xccdf-1.2:title>
            <xccdf-1.2:description>
The <html:code>ntpd</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable ntpd.service</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT012(R03)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000160</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Enabling the <html:code>ntpd</html:code> service ensures that the <html:code>ntpd</html:code>
service will be running and that the system will synchronize its time to
any servers specified. This is important whether the system is configured to be
a client (and synchronize only its own clock) or it is also acting as an NTP
server to other systems.  Synchronizing time is essential for authentication
services such as Kerberos, but it is also important for maintaining accurate
logs and auditing possible security breaches.
<html:br/><html:br/>
The NTP daemon offers all of the functionality of <html:code>ntpdate</html:code>, which is now
deprecated.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_ntp_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'ntp.service'
"$SYSTEMCTL_EXEC" start 'ntp.service'
"$SYSTEMCTL_EXEC" enable 'ntp.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_ntp_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Enable service ntp
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service ntp
      service:
        name: ntp
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"ntp" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4
    - enable_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_ntp_enabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_ntp_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_ntp

class enable_ntp {
  service {'ntp':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_ntp_enabled">
[customizations.services]
enabled = ["ntp"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_ntp_enabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-service_ntp_enabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_ntpd_enabled" severity="medium">
            <xccdf-1.2:title>Enable the NTP Daemon</xccdf-1.2:title>
            <xccdf-1.2:description>
The <html:code>ntpd</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable ntpd.service</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Enabling the <html:code>ntpd</html:code> service ensures that the <html:code>ntpd</html:code>
service will be running and that the system will synchronize its time to
any servers specified. This is important whether the system is configured to be
a client (and synchronize only its own clock) or it is also acting as an NTP
server to other systems.  Synchronizing time is essential for authentication
services such as Kerberos, but it is also important for maintaining accurate
logs and auditing possible security breaches.
<html:br/><html:br/>
The NTP daemon offers all of the functionality of <html:code>ntpdate</html:code>, which is now
deprecated.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#ntp"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_ntpd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ] &amp;&amp; { rpm --quiet -q ntp; }; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'ntpd.service'
"$SYSTEMCTL_EXEC" start 'ntpd.service'
"$SYSTEMCTL_EXEC" enable 'ntpd.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_ntpd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_ntpd_enabled

- name: Enable service ntpd
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service ntpd
      service:
        name: ntpd
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"ntp" in ansible_facts.packages'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"ntp" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_ntpd_enabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_ntpd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_ntpd

class enable_ntpd {
  service {'ntpd':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_ntpd_enabled">
[customizations.services]
enabled = ["ntpd"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_ntpd_enabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-service_ntpd_enabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_chronyd_client_only" severity="low">
            <xccdf-1.2:title>Disable chrony daemon from acting as server</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>port</html:code> option in <html:code>/etc/chrony.conf</html:code> can be set to
<html:code>0</html:code> to make chrony daemon to never open any listening port
for server operation and to operate strictly in a client-only mode.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000096-GPOS-00050</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Minimizing the exposure of the server functionality of the chrony
daemon diminishes the attack surface.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="chronyd_client_only"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/chrony.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^port")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^port\\&gt;" "/etc/chrony.conf"; then
    "${sed_command[@]}" "s/^port\\&gt;.*/$formatted_output/gi" "/etc/chrony.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/chrony.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="chronyd_client_only" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Disable chrony daemon from acting as server
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/chrony.conf
        create: false
        regexp: ^\s*port\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/chrony.conf
      lineinfile:
        path: /etc/chrony.conf
        create: false
        regexp: ^\s*port\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/chrony.conf
      lineinfile:
        path: /etc/chrony.conf
        create: true
        regexp: ^\s*port\s+
        line: port 0
        state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(1)
    - NIST-800-53-AU-8(1)
    - chronyd_client_only
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="chronyd_client_only" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ %23%20Allow%20for%20extra%20configuration%20files.%20This%20is%20useful%0A%23%20for%20admins%20specifying%20their%20own%20NTP%20servers%0Ainclude%20/etc/chrony.d/%2A.conf%0A%0A%23%20Set%20chronyd%20as%20client-only.%0Aport%200%0A%0A%23%20Disable%20chronyc%20from%20the%20network%0Acmdport%200%0A%0A%23%20Record%20the%20rate%20at%20which%20the%20system%20clock%20gains/losses%20time.%0Adriftfile%20/var/lib/chrony/drift%0A%0A%23%20Allow%20the%20system%20clock%20to%20be%20stepped%20in%20the%20first%20three%20updates%0A%23%20if%20its%20offset%20is%20larger%20than%201%20second.%0Amakestep%201.0%203%0A%0A%23%20Enable%20kernel%20synchronization%20of%20the%20real-time%20clock%20%28RTC%29.%0Artcsync%0A%0A%23%20Enable%20hardware%20timestamping%20on%20all%20interfaces%20that%20support%20it.%0A%23hwtimestamp%20%2A%0A%0A%23%20Increase%20the%20minimum%20number%20of%20selectable%20sources%20required%20to%20adjust%0A%23%20the%20system%20clock.%0A%23minsources%202%0A%0A%23%20Allow%20NTP%20client%20access%20from%20local%20network.%0A%23allow%20192.168.0.0/16%0A%0A%23%20Serve%20time%20even%20if%20not%20synchronized%20to%20a%20time%20source.%0A%23local%20stratum%2010%0A%0A%23%20Require%20authentication%20%28nts%20or%20key%20option%29%20for%20all%20NTP%20sources.%0A%23authselectmode%20require%0A%0A%23%20Specify%20file%20containing%20keys%20for%20NTP%20authentication.%0Akeyfile%20/etc/chrony.keys%0A%0A%23%20Insert/delete%20leap%20seconds%20by%20slewing%20instead%20of%20stepping.%0A%23leapsecmode%20slew%0A%0A%23%20Get%20TAI-UTC%20offset%20and%20leap%20seconds%20from%20the%20system%20tz%20database.%0Aleapsectz%20right/UTC%0A%0A%23%20Specify%20directory%20for%20log%20files.%0Alogdir%20/var/log/chrony%0A%0A%23%20Select%20which%20information%20is%20logged.%0A%23log%20measurements%20statistics%20tracking }}
        mode: 420
        overwrite: true
        path: /etc/chrony.conf
      - contents:
          source: data:,
        mode: 420
        overwrite: true
        path: /etc/chrony.d/.mco-keep
      - contents:
          source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20ntp%20server%0A%23%20%7B%7B.var_multiple_time_servers%7D%7D%20we%20have%20to%20put%20variable%20array%20name%20here%20for%20mutilines%20remediation%20%0A%7B%7B%24var_time_service_set_maxpoll%3A%3D.var_time_service_set_maxpoll%7D%7D%0A%7B%7Brange%20%24element%3A%3D.var_multiple_time_servers%7CtoArrayByComma%7D%7Dserver%20%7B%7B%24element%7D%7D%20minpoll%204%20maxpoll%20%7B%7B%24var_time_service_set_maxpoll%7D%7D%0A%7B%7Bend%7D%7D }}
        mode: 420
        overwrite: true
        path: /etc/chrony.d/ntp-server.conf
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-chronyd_client_only:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-chronyd_client_only_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network" severity="low">
            <xccdf-1.2:title>Disable network management of chrony daemon</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>cmdport</html:code> option in <html:code>/etc/chrony.conf</html:code> can be set to
<html:code>0</html:code> to stop chrony daemon from listening on the UDP port 323
for management connections made by chronyc.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000096-GPOS-00050</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Not exposing the management interface of the chrony daemon on
the network diminishes the attack space.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="chronyd_no_chronyc_network"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/chrony.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^cmdport")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^cmdport\\&gt;" "/etc/chrony.conf"; then
    "${sed_command[@]}" "s/^cmdport\\&gt;.*/$formatted_output/gi" "/etc/chrony.conf"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/chrony.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="chronyd_no_chronyc_network" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Disable network management of chrony daemon
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/chrony.conf
        create: false
        regexp: ^\s*cmdport\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/chrony.conf
      lineinfile:
        path: /etc/chrony.conf
        create: false
        regexp: ^\s*cmdport\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/chrony.conf
      lineinfile:
        path: /etc/chrony.conf
        create: true
        regexp: ^\s*cmdport\s+
        line: cmdport 0
        state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-7(1)
    - chronyd_no_chronyc_network
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="chronyd_no_chronyc_network" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ %23%20Allow%20for%20extra%20configuration%20files.%20This%20is%20useful%0A%23%20for%20admins%20specifying%20their%20own%20NTP%20servers%0Ainclude%20/etc/chrony.d/%2A.conf%0A%0A%23%20Set%20chronyd%20as%20client-only.%0Aport%200%0A%0A%23%20Disable%20chronyc%20from%20the%20network%0Acmdport%200%0A%0A%23%20Record%20the%20rate%20at%20which%20the%20system%20clock%20gains/losses%20time.%0Adriftfile%20/var/lib/chrony/drift%0A%0A%23%20Allow%20the%20system%20clock%20to%20be%20stepped%20in%20the%20first%20three%20updates%0A%23%20if%20its%20offset%20is%20larger%20than%201%20second.%0Amakestep%201.0%203%0A%0A%23%20Enable%20kernel%20synchronization%20of%20the%20real-time%20clock%20%28RTC%29.%0Artcsync%0A%0A%23%20Enable%20hardware%20timestamping%20on%20all%20interfaces%20that%20support%20it.%0A%23hwtimestamp%20%2A%0A%0A%23%20Increase%20the%20minimum%20number%20of%20selectable%20sources%20required%20to%20adjust%0A%23%20the%20system%20clock.%0A%23minsources%202%0A%0A%23%20Allow%20NTP%20client%20access%20from%20local%20network.%0A%23allow%20192.168.0.0/16%0A%0A%23%20Serve%20time%20even%20if%20not%20synchronized%20to%20a%20time%20source.%0A%23local%20stratum%2010%0A%0A%23%20Require%20authentication%20%28nts%20or%20key%20option%29%20for%20all%20NTP%20sources.%0A%23authselectmode%20require%0A%0A%23%20Specify%20file%20containing%20keys%20for%20NTP%20authentication.%0Akeyfile%20/etc/chrony.keys%0A%0A%23%20Insert/delete%20leap%20seconds%20by%20slewing%20instead%20of%20stepping.%0A%23leapsecmode%20slew%0A%0A%23%20Get%20TAI-UTC%20offset%20and%20leap%20seconds%20from%20the%20system%20tz%20database.%0Aleapsectz%20right/UTC%0A%0A%23%20Specify%20directory%20for%20log%20files.%0Alogdir%20/var/log/chrony%0A%0A%23%20Select%20which%20information%20is%20logged.%0A%23log%20measurements%20statistics%20tracking }}
        mode: 420
        overwrite: true
        path: /etc/chrony.conf
      - contents:
          source: data:,
        mode: 420
        overwrite: true
        path: /etc/chrony.d/.mco-keep
      - contents:
          source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20ntp%20server%0A%23%20%7B%7B.var_multiple_time_servers%7D%7D%20we%20have%20to%20put%20variable%20array%20name%20here%20for%20mutilines%20remediation%20%0A%7B%7B%24var_time_service_set_maxpoll%3A%3D.var_time_service_set_maxpoll%7D%7D%0A%7B%7Brange%20%24element%3A%3D.var_multiple_time_servers%7CtoArrayByComma%7D%7Dserver%20%7B%7B%24element%7D%7D%20minpoll%204%20maxpoll%20%7B%7B%24var_time_service_set_maxpoll%7D%7D%0A%7B%7Bend%7D%7D }}
        mode: 420
        overwrite: true
        path: /etc/chrony.d/ntp-server.conf
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-chronyd_no_chronyc_network:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-chronyd_no_chronyc_network_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_set_maxpoll" severity="medium">
            <xccdf-1.2:title>Configure Time Service Maxpoll Interval</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>maxpoll</html:code> should be configured to
<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_time_service_set_maxpoll" use="legacy"/> in <html:code>/etc/ntp.conf</html:code> or
<html:code>/etc/chrony.conf</html:code> to continuously poll time servers. To configure
<html:code>maxpoll</html:code> in <html:code>/etc/ntp.conf</html:code> or <html:code>/etc/chrony.conf</html:code>
add the following after each `server`, `pool` or `peer` entry:
<html:pre>maxpoll <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_time_service_set_maxpoll" use="legacy"/></html:pre>
to <html:pre>server</html:pre> directives. If using chrony any <html:pre>pool</html:pre> directives
should be configured too.
If no <html:code>server</html:code> or <html:code>pool</html:code> directives are configured, the rule evaluates
to pass.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001891</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002046</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000355-GPOS-00143</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000356-GPOS-00144</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000359-GPOS-00146</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Inaccurate time stamps make it more difficult to correlate
events and can lead to an inaccurate analysis. Determining the correct
time a particular event occurred on a system is critical when conducting
forensic analysis and investigating system events. Sources outside the
configured acceptable allowance (drift) may be inaccurate.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#chrony_or_ntp"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="chronyd_or_ntpd_set_maxpoll" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ %23%20Allow%20for%20extra%20configuration%20files.%20This%20is%20useful%0A%23%20for%20admins%20specifying%20their%20own%20NTP%20servers%0Ainclude%20/etc/chrony.d/%2A.conf%0A%0A%23%20Set%20chronyd%20as%20client-only.%0Aport%200%0A%0A%23%20Disable%20chronyc%20from%20the%20network%0Acmdport%200%0A%0A%23%20Record%20the%20rate%20at%20which%20the%20system%20clock%20gains/losses%20time.%0Adriftfile%20/var/lib/chrony/drift%0A%0A%23%20Allow%20the%20system%20clock%20to%20be%20stepped%20in%20the%20first%20three%20updates%0A%23%20if%20its%20offset%20is%20larger%20than%201%20second.%0Amakestep%201.0%203%0A%0A%23%20Enable%20kernel%20synchronization%20of%20the%20real-time%20clock%20%28RTC%29.%0Artcsync%0A%0A%23%20Enable%20hardware%20timestamping%20on%20all%20interfaces%20that%20support%20it.%0A%23hwtimestamp%20%2A%0A%0A%23%20Increase%20the%20minimum%20number%20of%20selectable%20sources%20required%20to%20adjust%0A%23%20the%20system%20clock.%0A%23minsources%202%0A%0A%23%20Allow%20NTP%20client%20access%20from%20local%20network.%0A%23allow%20192.168.0.0/16%0A%0A%23%20Serve%20time%20even%20if%20not%20synchronized%20to%20a%20time%20source.%0A%23local%20stratum%2010%0A%0A%23%20Require%20authentication%20%28nts%20or%20key%20option%29%20for%20all%20NTP%20sources.%0A%23authselectmode%20require%0A%0A%23%20Specify%20file%20containing%20keys%20for%20NTP%20authentication.%0Akeyfile%20/etc/chrony.keys%0A%0A%23%20Insert/delete%20leap%20seconds%20by%20slewing%20instead%20of%20stepping.%0A%23leapsecmode%20slew%0A%0A%23%20Get%20TAI-UTC%20offset%20and%20leap%20seconds%20from%20the%20system%20tz%20database.%0Aleapsectz%20right/UTC%0A%0A%23%20Specify%20directory%20for%20log%20files.%0Alogdir%20/var/log/chrony%0A%0A%23%20Select%20which%20information%20is%20logged.%0A%23log%20measurements%20statistics%20tracking }}
        mode: 420
        overwrite: true
        path: /etc/chrony.conf
      - contents:
          source: data:,
        mode: 420
        overwrite: true
        path: /etc/chrony.d/.mco-keep
      - contents:
          source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20ntp%20server%0A%23%20%7B%7B.var_multiple_time_servers%7D%7D%20we%20have%20to%20put%20variable%20array%20name%20here%20for%20mutilines%20remediation%20%0A%7B%7B%24var_time_service_set_maxpoll%3A%3D.var_time_service_set_maxpoll%7D%7D%0A%7B%7Brange%20%24element%3A%3D.var_multiple_time_servers%7CtoArrayByComma%7D%7Dserver%20%7B%7B%24element%7D%7D%20minpoll%204%20maxpoll%20%7B%7B%24var_time_service_set_maxpoll%7D%7D%0A%7B%7Bend%7D%7D }}
        mode: 420
        overwrite: true
        path: /etc/chrony.d/ntp-server.conf
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_time_service_set_maxpoll:var:1" value-id="xccdf_org.ssgproject.content_value_var_time_service_set_maxpoll"/>
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-chronyd_or_ntpd_set_maxpoll:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-chronyd_or_ntpd_set_maxpoll_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_multiple_servers" severity="medium">
            <xccdf-1.2:title>Specify Additional Remote NTP Servers</xccdf-1.2:title>
            <xccdf-1.2:description>Depending on specific functional requirements of a concrete
production environment, the Fedora system can be
configured to utilize the services of the <html:code>chronyd</html:code> NTP daemon (the
default), or services of the <html:code>ntpd</html:code> NTP daemon. Refer to

    
    <html:a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite">https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite</html:a>

for more detailed comparison of the features of both of the choices, and for
further guidance how to choose between the two NTP daemons.
<html:br/>
Additional NTP servers can be specified for time synchronization. To do so,
perform the following:
<html:ul><html:li> if the system is configured to use the <html:code>chronyd</html:code> as the NTP daemon
(the default), edit the file <html:code>/etc/chrony.conf</html:code> as follows,</html:li><html:li> if the system is configured to use the <html:code>ntpd</html:code> as the NTP daemon,
edit the file <html:code>/etc/ntp.conf</html:code> as documented below.</html:li></html:ul>
Add additional lines of the following form, substituting the IP address or
hostname of a remote NTP server for <html:em>ntpserver</html:em>:
<html:pre>server <html:i>ntpserver</html:i></html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">0988</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1405</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(2)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.3</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Specifying additional NTP servers increases the availability of
accurate time data, in the event that one of the specified servers becomes
unavailable. This is typical for a system acting as an NTP server for
other systems.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="chronyd_or_ntpd_specify_multiple_servers"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

var_multiple_time_servers='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" use="legacy"/>'


config_file="/etc/ntp.conf"
/usr/sbin/pidof ntpd || config_file="/etc/chrony.conf"

if ! [ "$(grep -c '^server' "$config_file")" -gt 1 ] ; then
  if ! grep -q '#[[:space:]]*server' "$config_file" ; then
    for server in $(echo "$var_multiple_time_servers" | tr ',' '\n') ; do
      printf '\nserver %s' "$server" &gt;&gt; "$config_file"
    done
  else
    sed -i 's/#[ \t]*server/server/g' "$config_file"
  fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="chronyd_or_ntpd_specify_multiple_servers" complexity="low" disruption="low" reboot="false" strategy="configure">- name: XCCDF Value var_multiple_time_servers # promote to variable
  set_fact:
    var_multiple_time_servers: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" use="legacy"/>
  tags:
    - always

- name: Detect if chrony configuration file is present
  find:
    path: /etc
    patterns: chrony.conf
  register: chrony_server_config
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(1)
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-AU-8(2)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.3
    - chronyd_or_ntpd_specify_multiple_servers
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Configure multiple time servers in chrony config
  lineinfile:
    path: /etc/chrony.conf
    line: server {{ item }}
    state: present
    create: true
  loop: '{{ var_multiple_time_servers.split(",") }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - chrony_server_config.matched == 1
  tags:
    - NIST-800-53-AU-12(1)
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-AU-8(2)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.3
    - chronyd_or_ntpd_specify_multiple_servers
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Detect if NTP configuration file is present
  find:
    path: /etc
    patterns: ntp.conf
  register: ntp_server_config
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(1)
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-AU-8(2)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.3
    - chronyd_or_ntpd_specify_multiple_servers
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Configure multiple time servers in NTP config
  lineinfile:
    path: /etc/chrony.conf
    line: pool {{ item }}
    state: present
    create: true
  loop: '{{ var_multiple_time_servers.split(",") }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ntp_server_config.matched == 1
  tags:
    - NIST-800-53-AU-12(1)
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-AU-8(2)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.3
    - chronyd_or_ntpd_specify_multiple_servers
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="chronyd_or_ntpd_specify_multiple_servers" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ %23%20Allow%20for%20extra%20configuration%20files.%20This%20is%20useful%0A%23%20for%20admins%20specifying%20their%20own%20NTP%20servers%0Ainclude%20/etc/chrony.d/%2A.conf%0A%0A%23%20Set%20chronyd%20as%20client-only.%0Aport%200%0A%0A%23%20Disable%20chronyc%20from%20the%20network%0Acmdport%200%0A%0A%23%20Record%20the%20rate%20at%20which%20the%20system%20clock%20gains/losses%20time.%0Adriftfile%20/var/lib/chrony/drift%0A%0A%23%20Allow%20the%20system%20clock%20to%20be%20stepped%20in%20the%20first%20three%20updates%0A%23%20if%20its%20offset%20is%20larger%20than%201%20second.%0Amakestep%201.0%203%0A%0A%23%20Enable%20kernel%20synchronization%20of%20the%20real-time%20clock%20%28RTC%29.%0Artcsync%0A%0A%23%20Enable%20hardware%20timestamping%20on%20all%20interfaces%20that%20support%20it.%0A%23hwtimestamp%20%2A%0A%0A%23%20Increase%20the%20minimum%20number%20of%20selectable%20sources%20required%20to%20adjust%0A%23%20the%20system%20clock.%0A%23minsources%202%0A%0A%23%20Allow%20NTP%20client%20access%20from%20local%20network.%0A%23allow%20192.168.0.0/16%0A%0A%23%20Serve%20time%20even%20if%20not%20synchronized%20to%20a%20time%20source.%0A%23local%20stratum%2010%0A%0A%23%20Require%20authentication%20%28nts%20or%20key%20option%29%20for%20all%20NTP%20sources.%0A%23authselectmode%20require%0A%0A%23%20Specify%20file%20containing%20keys%20for%20NTP%20authentication.%0Akeyfile%20/etc/chrony.keys%0A%0A%23%20Insert/delete%20leap%20seconds%20by%20slewing%20instead%20of%20stepping.%0A%23leapsecmode%20slew%0A%0A%23%20Get%20TAI-UTC%20offset%20and%20leap%20seconds%20from%20the%20system%20tz%20database.%0Aleapsectz%20right/UTC%0A%0A%23%20Specify%20directory%20for%20log%20files.%0Alogdir%20/var/log/chrony%0A%0A%23%20Select%20which%20information%20is%20logged.%0A%23log%20measurements%20statistics%20tracking }}
        mode: 420
        overwrite: true
        path: /etc/chrony.conf
      - contents:
          source: data:,
        mode: 420
        overwrite: true
        path: /etc/chrony.d/.mco-keep
      - contents:
          source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20ntp%20server%0A%23%20%7B%7B.var_multiple_time_servers%7D%7D%20we%20have%20to%20put%20variable%20array%20name%20here%20for%20mutilines%20remediation%20%0A%7B%7B%24var_time_service_set_maxpoll%3A%3D.var_time_service_set_maxpoll%7D%7D%0A%7B%7Brange%20%24element%3A%3D.var_multiple_time_servers%7CtoArrayByComma%7D%7Dserver%20%7B%7B%24element%7D%7D%20minpoll%204%20maxpoll%20%7B%7B%24var_time_service_set_maxpoll%7D%7D%0A%7B%7Bend%7D%7D }}
        mode: 420
        overwrite: true
        path: /etc/chrony.d/ntp-server.conf
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-chronyd_or_ntpd_specify_multiple_servers:def:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_remote_server" severity="medium">
            <xccdf-1.2:title>Specify a Remote NTP Server</xccdf-1.2:title>
            <xccdf-1.2:description>Depending on specific functional requirements of a concrete
production environment, the Fedora system can be
configured to utilize the services of the <html:code>chronyd</html:code> NTP daemon (the
default), or services of the <html:code>ntpd</html:code> NTP daemon. Refer to

    
    <html:a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite">https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite</html:a>

for more detailed comparison of the features of both of the choices, and for
further guidance how to choose between the two NTP daemons.
<html:br/>
To specify a remote NTP server for time synchronization, perform the following:
<html:ul><html:li> if the system is configured to use the <html:code>chronyd</html:code> as the NTP daemon (the
default), edit the file <html:code>/etc/chrony.conf</html:code> as follows,</html:li><html:li> if the system is configured to use the <html:code>ntpd</html:code> as the NTP daemon,
edit the file <html:code>/etc/ntp.conf</html:code> as documented below.</html:li></html:ul>
Add or correct the following lines, substituting the IP or hostname of a remote
NTP server for <html:em>ntpserver</html:em>:
<html:pre>server <html:i>ntpserver</html:i></html:pre>
This instructs the NTP software to contact that remote server to obtain time
data.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000160</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001891</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(2)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">SRG-OS-000355-VMM-001330</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Synchronizing with an NTP server makes it possible to collate system
logs from multiple sources or correlate computer events with real time events.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine_and_chrony_or_ntp"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="chronyd_or_ntpd_specify_remote_server"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ] &amp;&amp; { ( [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ] &amp;&amp; ( rpm --quiet -q chrony || rpm --quiet -q ntp ) ); }; then

var_multiple_time_servers='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" use="legacy"/>'


config_file="/etc/ntp.conf"
/usr/sbin/pidof ntpd || config_file="/etc/chrony.conf"

if ! grep -q ^server "$config_file" ; then
  if ! grep -q '#[[:space:]]*server' "$config_file" ; then
    for server in $(echo "$var_multiple_time_servers" | tr ',' '\n') ; do
      printf '\nserver %s' "$server" &gt;&gt; "$config_file"
    done
  else
    sed -i 's/#[ \t]*server/server/g' "$config_file"
  fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="chronyd_or_ntpd_specify_remote_server" complexity="low" disruption="low" reboot="true" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ %23%20Allow%20for%20extra%20configuration%20files.%20This%20is%20useful%0A%23%20for%20admins%20specifying%20their%20own%20NTP%20servers%0Ainclude%20/etc/chrony.d/%2A.conf%0A%0A%23%20Set%20chronyd%20as%20client-only.%0Aport%200%0A%0A%23%20Disable%20chronyc%20from%20the%20network%0Acmdport%200%0A%0A%23%20Record%20the%20rate%20at%20which%20the%20system%20clock%20gains/losses%20time.%0Adriftfile%20/var/lib/chrony/drift%0A%0A%23%20Allow%20the%20system%20clock%20to%20be%20stepped%20in%20the%20first%20three%20updates%0A%23%20if%20its%20offset%20is%20larger%20than%201%20second.%0Amakestep%201.0%203%0A%0A%23%20Enable%20kernel%20synchronization%20of%20the%20real-time%20clock%20%28RTC%29.%0Artcsync%0A%0A%23%20Enable%20hardware%20timestamping%20on%20all%20interfaces%20that%20support%20it.%0A%23hwtimestamp%20%2A%0A%0A%23%20Increase%20the%20minimum%20number%20of%20selectable%20sources%20required%20to%20adjust%0A%23%20the%20system%20clock.%0A%23minsources%202%0A%0A%23%20Allow%20NTP%20client%20access%20from%20local%20network.%0A%23allow%20192.168.0.0/16%0A%0A%23%20Serve%20time%20even%20if%20not%20synchronized%20to%20a%20time%20source.%0A%23local%20stratum%2010%0A%0A%23%20Require%20authentication%20%28nts%20or%20key%20option%29%20for%20all%20NTP%20sources.%0A%23authselectmode%20require%0A%0A%23%20Specify%20file%20containing%20keys%20for%20NTP%20authentication.%0Akeyfile%20/etc/chrony.keys%0A%0A%23%20Insert/delete%20leap%20seconds%20by%20slewing%20instead%20of%20stepping.%0A%23leapsecmode%20slew%0A%0A%23%20Get%20TAI-UTC%20offset%20and%20leap%20seconds%20from%20the%20system%20tz%20database.%0Aleapsectz%20right/UTC%0A%0A%23%20Specify%20directory%20for%20log%20files.%0Alogdir%20/var/log/chrony%0A%0A%23%20Select%20which%20information%20is%20logged.%0A%23log%20measurements%20statistics%20tracking }}
        mode: 420
        overwrite: true
        path: /etc/chrony.conf
      - contents:
          source: data:,
        mode: 420
        overwrite: true
        path: /etc/chrony.d/.mco-keep
      - contents:
          source: data:,{{ %23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20ntp%20server%0A%23%20%7B%7B.var_multiple_time_servers%7D%7D%20we%20have%20to%20put%20variable%20array%20name%20here%20for%20mutilines%20remediation%20%0A%7B%7B%24var_time_service_set_maxpoll%3A%3D.var_time_service_set_maxpoll%7D%7D%0A%7B%7Brange%20%24element%3A%3D.var_multiple_time_servers%7CtoArrayByComma%7D%7Dserver%20%7B%7B%24element%7D%7D%20minpoll%204%20maxpoll%20%7B%7B%24var_time_service_set_maxpoll%7D%7D%0A%7B%7Bend%7D%7D }}
        mode: 420
        overwrite: true
        path: /etc/chrony.d/ntp-server.conf
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-chronyd_or_ntpd_specify_remote_server:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-chronyd_or_ntpd_specify_remote_server_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_chronyd_run_as_chrony_user" severity="medium">
            <xccdf-1.2:title>Ensure that chronyd is running under chrony user account</xccdf-1.2:title>
            <xccdf-1.2:description>chrony is a daemon which implements the Network Time Protocol (NTP). It is designed to
synchronize system clocks across a variety of systems and use a source that is highly
accurate. More information on chrony can be found at

    <html:a href="http://chrony.tuxfamily.org/">http://chrony.tuxfamily.org/</html:a>.
Chrony can be configured to be a client and/or a server.
To ensure that chronyd is running under chrony user account, Add or edit the
<html:code>OPTIONS</html:code> variable in <html:code>/etc/sysconfig/chronyd</html:code> to include <html:code>-u chrony</html:code>:
<html:pre>OPTIONS="-u chrony"</html:pre>
This recommendation only applies if chrony is in use on the system.</xccdf-1.2:description>
            <xccdf-1.2:rationale>If chrony is in use on the system proper configuration is vital to ensuring time synchronization
is working properly.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#chrony"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="chronyd_run_as_chrony_user"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ] &amp;&amp; { rpm --quiet -q chrony; }; then

if grep -q 'OPTIONS=.*' /etc/sysconfig/chronyd; then
	# trying to solve cases where the parameter after OPTIONS
	#may or may not be enclosed in quotes
	sed -i -E -e 's/\s*-u\s+\w+\s*/ /' -e 's/^([\s]*OPTIONS=["]?[^"]*)("?)/\1 -u chrony\2/' /etc/sysconfig/chronyd
else
	echo 'OPTIONS="-u chrony"' &gt;&gt; /etc/sysconfig/chronyd
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="chronyd_run_as_chrony_user" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - chronyd_run_as_chrony_user
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Detect if file /etc/sysconfig/chronyd is not empty or missing
  find:
    path: /etc/sysconfig/
    patterns: chronyd
    contains: ^([\s]*OPTIONS=["]?[^"]*)("?)
  register: chronyd_file
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"chrony" in ansible_facts.packages'
  tags:
    - chronyd_run_as_chrony_user
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Remove any previous configuration of user used to run chronyd process
  replace:
    path: /etc/sysconfig/chronyd
    regexp: \s*-u\s+\w+\s*
    replace: ' '
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"chrony" in ansible_facts.packages'
    - chronyd_file is defined and chronyd_file.matched &gt; 0
  tags:
    - chronyd_run_as_chrony_user
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Correct existing line in /etc/sysconfig/chronyd to run chronyd as chrony user
  lineinfile:
    path: /etc/sysconfig/chronyd
    regexp: ^([\s]*OPTIONS=["]?[^"]*)("?)
    line: \1 -u chrony\2
    state: present
    backrefs: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"chrony" in ansible_facts.packages'
    - chronyd_file is defined and chronyd_file.matched &gt; 0
  tags:
    - chronyd_run_as_chrony_user
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Insert correct line into /etc/sysconfig/chronyd ensuring chronyd runs as chrony
    user
  lineinfile:
    path: /etc/sysconfig/chronyd
    line: OPTIONS="-u chrony"
    state: present
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"chrony" in ansible_facts.packages'
    - chronyd_file is defined and chronyd_file.matched == 0
  tags:
    - chronyd_run_as_chrony_user
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-chronyd_run_as_chrony_user:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-chronyd_run_as_chrony_user_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_chronyd_server_directive" severity="medium">
            <xccdf-1.2:title>Ensure Chrony is only configured with the server directive</xccdf-1.2:title>
            <xccdf-1.2:description>Check that Chrony only has time sources configured with the <html:code>server</html:code> directive.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">This rule doesn't come with a remediation, the time source needs to be added by the adminstrator.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001891</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000355-GPOS-00143</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000356-GPOS-00144</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000359-GPOS-00146</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Depending on the infrastruture being used the <html:code>pool</html:code> directive may not be supported.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#chrony"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-chronyd_server_directive:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-chronyd_server_directive_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_chronyd_specify_remote_server" severity="medium">
            <xccdf-1.2:title>A remote time server for Chrony is configured</xccdf-1.2:title>
            <xccdf-1.2:description><html:code>Chrony</html:code> is a daemon which implements the Network Time Protocol (NTP). It is designed to
synchronize system clocks across a variety of systems and use a source that is highly
accurate. More information on <html:code>chrony</html:code> can be found at

    <html:a href="http://chrony.tuxfamily.org/">http://chrony.tuxfamily.org/</html:a>.
<html:code>Chrony</html:code> can be configured to be a client and/or a server.
Add or edit server or pool lines to <html:code>/etc/chrony.conf</html:code> as appropriate:
<html:pre>server &lt;remote-server&gt;</html:pre>
Multiple servers may be configured.</xccdf-1.2:description>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R43)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000160</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001891</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">0988</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1405</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.3</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If <html:code>chrony</html:code> is in use on the system proper configuration is vital to ensuring time
synchronization is working properly.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#chrony"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="chronyd_specify_remote_server"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ] &amp;&amp; { rpm --quiet -q chrony; }; then

var_multiple_time_servers='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" use="legacy"/>'


config_file="/etc/chrony.conf"

if ! grep -q '^[\s]*(?:server|pool)[\s]+[\w]+' "$config_file" ; then
  if ! grep -q '#[[:space:]]*server' "$config_file" ; then
    for server in $(echo "$var_multiple_time_servers" | tr ',' '\n') ; do
      printf '\nserver %s' "$server" &gt;&gt; "$config_file"
    done
  else
    sed -i 's/#[ \t]*server/server/g' "$config_file"
  fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="chronyd_specify_remote_server" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.3
    - chronyd_specify_remote_server
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
- name: XCCDF Value var_multiple_time_servers # promote to variable
  set_fact:
    var_multiple_time_servers: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" use="legacy"/>
  tags:
    - always

- name: Detect if chrony is already configured with pools or servers
  find:
    path: /etc
    patterns: chrony.conf
    contains: ^[\s]*(?:server|pool)[\s]+[\w]+
  register: chrony_servers
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"chrony" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.3
    - chronyd_specify_remote_server
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Configure remote time servers
  lineinfile:
    path: /etc/chrony.conf
    line: server {{ item }}
    state: present
    create: true
  loop: '{{ var_multiple_time_servers.split(",") }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"chrony" in ansible_facts.packages'
    - chrony_servers.matched == 0
  tags:
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.3
    - chronyd_specify_remote_server
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-chronyd_specify_remote_server:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-chronyd_specify_remote_server_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ntpd_configure_restrictions" severity="medium">
            <xccdf-1.2:title>Configure server restrictions for ntpd</xccdf-1.2:title>
            <xccdf-1.2:description>ntpd is a daemon which implements the Network Time Protocol (NTP). It is designed to
synchronize system clocks across a variety of systems and use a source that is highly
accurate. More information on NTP can be found at

    <html:a href="http://www.ntp.org">http://www.ntp.org</html:a>.
ntp can be configured to be a client and/or a server.
To ensure that ntpd implements correct server restrictions, make sure that the following lines exist in the file <html:code>/etc/ntpd.conf</html:code>:
<html:pre>restrict -4 default kod nomodify notrap nopeer noquery</html:pre>
<html:pre>restrict -6 default kod nomodify notrap nopeer noquery</html:pre>
This recommendation only applies if ntp is in use on the system.</xccdf-1.2:description>
            <xccdf-1.2:rationale>If ntp is in use on the system proper configuration is vital to ensuring time synchronization
is working properly.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#ntp"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="ntpd_configure_restrictions"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ] &amp;&amp; { rpm --quiet -q ntp; }; then

if [ -e "/etc/ntp.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*restrict \-4\s\+/Id" "/etc/ntp.conf"
else
    touch "/etc/ntp.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ntp.conf"

cp "/etc/ntp.conf" "/etc/ntp.conf.bak"
# Insert at the end of the file
printf '%s\n' "restrict -4 default kod nomodify notrap nopeer noquery" &gt;&gt; "/etc/ntp.conf"
# Clean up after ourselves.
rm "/etc/ntp.conf.bak"
if [ -e "/etc/ntp.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*restrict \-6\s\+/Id" "/etc/ntp.conf"
else
    touch "/etc/ntp.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ntp.conf"

cp "/etc/ntp.conf" "/etc/ntp.conf.bak"
# Insert at the end of the file
printf '%s\n' "restrict -6 default kod nomodify notrap nopeer noquery" &gt;&gt; "/etc/ntp.conf"
# Clean up after ourselves.
rm "/etc/ntp.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="ntpd_configure_restrictions" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - ntpd_configure_restrictions

- name: configure ipv4 restrictions for ntpd
  lineinfile:
    path: /etc/ntp.conf
    create: true
    line: restrict -4 default kod nomodify notrap nopeer noquery
    state: present
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"ntp" in ansible_facts.packages'
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - ntpd_configure_restrictions

- name: configure ipv6 restrictions for ntpd
  lineinfile:
    path: /etc/ntp.conf
    create: true
    line: restrict -6 default kod nomodify notrap nopeer noquery
    state: present
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"ntp" in ansible_facts.packages'
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - ntpd_configure_restrictions
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-ntpd_configure_restrictions:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-ntpd_configure_restrictions_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ntpd_run_as_ntp_user" severity="medium">
            <xccdf-1.2:title>Configure ntpd To Run As ntp User</xccdf-1.2:title>
            <xccdf-1.2:description>ntp is a daemon which implements the Network Time Protocol (NTP). It is designed to
synchronize system clocks across a variety of systems and use a source that is highly
accurate. More information on NTP can be found at

    <html:a href="http://www.ntp.org">http://www.ntp.org</html:a>.
ntp can be configured to be a client and/or a server.
To ensure that ntpd is running as ntp user, Add or edit the
<html:code>OPTIONS</html:code> variable in <html:code>/etc/sysconfig/ntpd</html:code> to include ' -u ntp:ntp ':
<html:pre>OPTIONS="-u ntp:ntp"</html:pre>
This recommendation only applies if ntp is in use on the system.</xccdf-1.2:description>
            <xccdf-1.2:rationale>If ntp is in use on the system proper configuration is vital to ensuring time synchronization
is working properly. Running ntpd under dedicated user accounts limits the attack surface for
potential attacker exploiting security flaws in the daemon or the protocol.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#ntp"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="ntpd_run_as_ntp_user"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ] &amp;&amp; { rpm --quiet -q ntp; }; then

if grep -q 'OPTIONS=.*' /etc/sysconfig/ntpd; then
	# trying to solve cases where the parameter after OPTIONS
	#may or may not be enclosed in quotes
	sed -i -E 's/^([\s]*OPTIONS=["]?[^"]*)("?)/\1 -u ntp:ntp\2/' /etc/sysconfig/ntpd
else
	echo 'OPTIONS="-u ntp:ntp"' &gt;&gt; /etc/sysconfig/ntpd
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="ntpd_run_as_ntp_user" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - ntpd_run_as_ntp_user

- name: detect if file is not empty or missing
  find:
    path: /etc/sysconfig/
    patterns: ntpd
    contains: ^([\s]*OPTIONS=["]?[^"]*)("?)
  register: ntpd_file
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"ntp" in ansible_facts.packages'
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - ntpd_run_as_ntp_user

- name: replace existing setting or create a new file, rest is handled by different
    task
  lineinfile:
    path: /etc/sysconfig/ntpd
    regexp: ^([\s]*OPTIONS=["]?[^"]*)("?)
    line: \1 -u ntp:ntp\2
    state: present
    create: true
    backrefs: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"ntp" in ansible_facts.packages'
    - ntpd_file.matched &gt; 0
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - ntpd_run_as_ntp_user

- name: put line into file, assume file was empty
  lineinfile:
    path: /etc/sysconfig/ntpd
    line: OPTIONS="-u ntp:ntp"
    state: present
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"ntp" in ansible_facts.packages'
    - ntpd_file.matched == 0
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - ntpd_run_as_ntp_user
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-ntpd_run_as_ntp_user:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-ntpd_run_as_ntp_user_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ntpd_specify_multiple_servers" severity="unknown">
            <xccdf-1.2:title>Specify Additional Remote NTP Servers</xccdf-1.2:title>
            <xccdf-1.2:description>Additional NTP servers can be specified for time synchronization
in the file <html:code>/etc/ntp.conf</html:code>.  To do so, add additional lines of the
following form, substituting the IP address or hostname of a remote NTP server for
<html:em>ntpserver</html:em>:
<html:pre>server <html:i>ntpserver</html:i></html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(2)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.3</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Specifying additional NTP servers increases the availability of
accurate time data, in the event that one of the specified servers becomes
unavailable. This is typical for a system acting as an NTP server for
other systems.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-ntpd_specify_multiple_servers:def:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ntpd_specify_remote_server" severity="medium">
            <xccdf-1.2:title>Specify a Remote NTP Server</xccdf-1.2:title>
            <xccdf-1.2:description>To specify a remote NTP server for time synchronization, edit
the file <html:code>/etc/ntp.conf</html:code>. Add or correct the following lines,
substituting the IP or hostname of a remote NTP server for <html:em>ntpserver</html:em>:
<html:pre>server <html:i>ntpserver</html:i></html:pre>
This instructs the NTP software to contact that remote server to obtain time
data.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.3</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Synchronizing with an NTP server makes it possible
to collate system logs from multiple sources or correlate computer events with
real time events.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#ntp"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="ntpd_specify_remote_server"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ] &amp;&amp; { rpm --quiet -q ntp; }; then

var_multiple_time_servers='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" use="legacy"/>'


config_file="/etc/ntp.conf"

if ! grep -q '^[\s]*(?:server|pool)[\s]+[\w]+' "$config_file" ; then
          if ! grep -q '#[[:space:]]*server' "$config_file" ; then
    for server in $(echo "$var_multiple_time_servers" | tr ',' '\n') ; do
      printf '\nserver %s' "$server" &gt;&gt; "$config_file"
    done
  else
    sed -i 's/#[ \t]*server/server/g' "$config_file"
  fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="ntpd_specify_remote_server" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.1
    - PCI-DSS-Req-10.4.3
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - ntpd_specify_remote_server
- name: XCCDF Value var_multiple_time_servers # promote to variable
  set_fact:
    var_multiple_time_servers: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" use="legacy"/>
  tags:
    - always

- name: Detect if ntp is already configured with pools or servers
  find:
    path: /etc
    patterns: ntp.conf
    contains: ^[\s]*(?:server|pool)[\s]+[\w]+
  register: ntp_servers
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"ntp" in ansible_facts.packages'
  tags:
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.1
    - PCI-DSS-Req-10.4.3
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - ntpd_specify_remote_server

- name: Configure remote time servers
  lineinfile:
    path: /etc/ntp.conf
    line: server {{ item }}
    state: present
    create: true
  loop: '{{ var_multiple_time_servers.split(",") }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"ntp" in ansible_facts.packages'
    - ntp_servers.matched == 0
  tags:
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.1
    - PCI-DSS-Req-10.4.3
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - ntpd_specify_remote_server
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-ntpd_specify_remote_server:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-ntpd_specify_remote_server_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_obsolete">
          <xccdf-1.2:title>Obsolete Services</xccdf-1.2:title>
          <xccdf-1.2:description>This section discusses a number of network-visible
services which have historically caused problems for system
security, and for which disabling or severely limiting the service
has been the best available guidance for some time. As a result of
this, many of these services are not installed as part of Fedora
by default.
<html:br/><html:br/>
Organizations which are running these services should
switch to more secure equivalents as soon as possible.
If it remains absolutely necessary to run one of
these services for legacy reasons, care should be taken to restrict
the service as much as possible, for instance by configuring host

firewall software such as <html:code>iptables</html:code> to restrict access to the

vulnerable service to only those remote hosts which have a known
need to use it.</xccdf-1.2:description>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_rsyncd_disabled" severity="medium">
            <xccdf-1.2:title>Ensure rsyncd service is diabled</xccdf-1.2:title>
            <xccdf-1.2:description>
The <html:code>rsyncd</html:code> service can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now rsyncd.service</html:pre></xccdf-1.2:description>
            <xccdf-1.2:rationale>The rsyncd service presents a security risk as it uses unencrypted protocols for
communication.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_rsyncd_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'rsyncd.service'
"$SYSTEMCTL_EXEC" disable 'rsyncd.service'
"$SYSTEMCTL_EXEC" mask 'rsyncd.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^rsyncd.socket'; then
    "$SYSTEMCTL_EXEC" stop 'rsyncd.socket'
    "$SYSTEMCTL_EXEC" mask 'rsyncd.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'rsyncd.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_rsyncd_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Disable service rsyncd
  block:

    - name: Disable service rsyncd
      systemd:
        name: rsyncd.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      ignore_errors: 'yes'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_rsyncd_disabled

- name: Unit Socket Exists - rsyncd.socket
  command: systemctl list-unit-files rsyncd.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_rsyncd_disabled

- name: Disable socket rsyncd
  systemd:
    name: rsyncd.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"rsyncd.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_rsyncd_disabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_rsyncd_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_rsyncd

class disable_rsyncd {
  service {'rsyncd':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="service_rsyncd_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: rsyncd.service
        enabled: false
        mask: true
      - name: rsyncd.socket
        enabled: false
        mask: true
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_rsyncd_disabled">
[customizations.services]
disabled = ["rsyncd"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_rsyncd_disabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-service_rsyncd_disabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_inetd_and_xinetd">
            <xccdf-1.2:title>Xinetd</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>xinetd</html:code> service acts as a dedicated listener for some
network services (mostly, obsolete ones) and can be used to provide access
controls and perform some logging. It has been largely obsoleted by other
features, and it is not installed by default. The older Inetd service
is not even available as part of Fedora.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#machine"/>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_nis">
            <xccdf-1.2:title>NIS</xccdf-1.2:title>
            <xccdf-1.2:description>The Network Information Service (NIS), also known as 'Yellow
Pages' (YP), and its successor NIS+ have been made obsolete by
Kerberos, LDAP, and other modern centralized authentication
services. NIS should not be used because it suffers from security
problems inherent in its design, such as inadequate protection of
important authentication information.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_r_services">
            <xccdf-1.2:title>Rlogin, Rsh, and Rexec</xccdf-1.2:title>
            <xccdf-1.2:description>The Berkeley r-commands are legacy services which
allow cleartext remote access and have an insecure trust
model.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_rsh_trust_files" severity="high">
              <xccdf-1.2:title>Remove Rsh Trust Files</xccdf-1.2:title>
              <xccdf-1.2:description>The files <html:code>/etc/hosts.equiv</html:code> and <html:code>~/.rhosts</html:code> (in
each user's home directory) list remote hosts and users that are trusted by the
local system when using the rshd daemon.
To remove these files, run the following command to delete them from any
location:
<html:pre>$ sudo rm /etc/hosts.equiv</html:pre>
<html:pre>$ rm ~/.rhosts</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001436</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:rationale>This action is only meaningful if <html:code>.rhosts</html:code> support is permitted
through PAM. Trust files are convenient, but when used in conjunction with
the R-services, they can allow unauthenticated access to a system.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="no_rsh_trust_files" complexity="low" disruption="low" reboot="false" strategy="restrict">- block:

    - name: Detect .rhosts files in users home directories
      find:
        paths:
          - /root
          - /home
        recurse: true
        patterns: .rhosts
        hidden: true
        file_type: file
      check_mode: false
      register: rhosts_locations

    - name: Remove .rhosts files
      file:
        path: '{{ item }}'
        state: absent
      with_items: '{{ rhosts_locations.files | map(attribute=''path'') | list }}'
      when: rhosts_locations is success

    - name: Remove /etc/hosts.equiv file
      file:
        path: /etc/hosts.equiv
        state: absent
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - no_rsh_trust_files
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-no_rsh_trust_files:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-no_rsh_trust_files_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_talk">
            <xccdf-1.2:title>Chat/Messaging Services</xccdf-1.2:title>
            <xccdf-1.2:description>The talk software makes it possible for users to send and receive messages
across systems through a terminal session.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_telnet">
            <xccdf-1.2:title>Telnet</xccdf-1.2:title>
            <xccdf-1.2:description>The telnet protocol does not provide confidentiality or integrity
for information transmitted on the network. This includes authentication
information such as passwords. Organizations which use telnet should be
actively working to migrate to a more secure protocol.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_tftp">
            <xccdf-1.2:title>TFTP Server</xccdf-1.2:title>
            <xccdf-1.2:description>TFTP is a lightweight version of the FTP protocol which has
traditionally been used to configure networking equipment. However,
TFTP provides little security, and modern versions of networking
operating systems frequently support configuration via SSH or other
more secure protocols. A TFTP server should be run only if no more
secure method of supporting existing equipment can be
found.</xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_tftpd_secure_directory" type="string" interactive="true">
              <xccdf-1.2:title>TFTP server secure directory</xccdf-1.2:title>
              <xccdf-1.2:description>Specify the directory which is used by TFTP server as a root directory when running in secure mode.</xccdf-1.2:description>
              <xccdf-1.2:value>/var/lib/tftpboot</xccdf-1.2:value>
            </xccdf-1.2:Value>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_printing">
          <xccdf-1.2:title>Print Support</xccdf-1.2:title>
          <xccdf-1.2:description>The Common Unix Printing System (CUPS) service provides both local
and network printing support. A system running the CUPS service can accept
print jobs from other systems, process them, and send them to the appropriate
printer. It also provides an interface for remote administration through a web
browser. The CUPS service is installed and activated by default. The project
homepage and more detailed documentation are available at

    <html:a href="http://www.cups.org">http://www.cups.org</html:a>.
<html:br/><html:br/></xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_configure_printing">
            <xccdf-1.2:title>Configure the CUPS Service if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description>CUPS provides the ability to easily share local printers with
other systems over the network. It does this by allowing systems to share
lists of available printers. Additionally, each system that runs the CUPS
service can potentially act as a print server. Whenever possible, the printer
sharing and print server capabilities of CUPS should be limited or disabled.
The following recommendations should demonstrate how to do just that.</xccdf-1.2:description>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_proxy">
          <xccdf-1.2:title>Proxy Server</xccdf-1.2:title>
          <xccdf-1.2:description>A proxy server is a very desirable target for a
potential adversary because much (or all) sensitive data for a
given infrastructure may flow through it. Therefore, if one is
required, the system acting as a proxy server should be dedicated
to that purpose alone and be stored in a physically secure
location. The system's default proxy server software is Squid, and
provided in an RPM package of the same name.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_squid">
            <xccdf-1.2:title>Disable Squid if Possible</xccdf-1.2:title>
            <xccdf-1.2:description>If Squid was installed and activated, but the system
does not need to act as a proxy server, then it should be disabled
and removed.</xccdf-1.2:description>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_radius">
          <xccdf-1.2:title>Remote Authentication Dial-In User Service (RADIUS)</xccdf-1.2:title>
          <xccdf-1.2:description>Remote Authentication Dial-In User Service (RADIUS) is a networking
protocol, operating on port 1812 that provides centralized
Authentication, Authorization, and Accounting (AAA or Triple A)
management for users who connect and use a network service. </xccdf-1.2:description>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_rng">
          <xccdf-1.2:title>Hardware RNG Entropy Gatherer Daemon</xccdf-1.2:title>
          <xccdf-1.2:description>The rngd feeds random data from hardware device to kernel random device.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#machine"/>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_rngd_enabled" severity="low">
            <xccdf-1.2:title>Enable the Hardware RNG Entropy Gatherer Service</xccdf-1.2:title>
            <xccdf-1.2:description>The Hardware RNG Entropy Gatherer service should be enabled.

The <html:code>rngd</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable rngd.service</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_RBG_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The <html:code>rngd</html:code> service
feeds random data from hardware device to kernel random device.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_rngd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'rngd.service'
"$SYSTEMCTL_EXEC" start 'rngd.service'
"$SYSTEMCTL_EXEC" enable 'rngd.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_rngd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Enable service rngd
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service rngd
      service:
        name: rngd
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"rng-tools" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - service_rngd_enabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_rngd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_rngd

class enable_rngd {
  service {'rngd':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_rngd_enabled">
[customizations.services]
enabled = ["rngd"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_rngd_enabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-service_rngd_enabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_routing">
          <xccdf-1.2:title>Network Routing</xccdf-1.2:title>
          <xccdf-1.2:description>A router is a very desirable target for a
potential adversary because they fulfill a variety of 
infrastructure networking roles such as access to network segments,
gateways to other networks, filtering, etc. Therefore, if one is
required, the system acting as a router should be dedicated
to that purpose alone and be stored in a physically secure
location. The system's default routing software is Quagga, and
provided in an RPM package of the same name.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_quagga">
            <xccdf-1.2:title>Disable Quagga if Possible</xccdf-1.2:title>
            <xccdf-1.2:description>If Quagga was installed and activated, but the system
does not need to act as a router, then it should be disabled
and removed.</xccdf-1.2:description>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_smb">
          <xccdf-1.2:title>Samba(SMB) Microsoft Windows File Sharing Server</xccdf-1.2:title>
          <xccdf-1.2:description>When properly configured, the Samba service allows
Linux systems to provide file and print sharing to Microsoft
Windows systems. There are two software packages that provide
Samba support. The first, <html:code>samba-client</html:code>, provides a series of
command line tools that enable a client system to access Samba
shares. The second, simply labeled <html:code>samba</html:code>, provides the Samba
service. It is this second package that allows a Linux system to
act as an Active Directory server, a domain controller, or as a
domain member. Only the <html:code>samba-client</html:code> package is installed by
default.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_configuring_samba">
            <xccdf-1.2:title>Configure Samba if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description>All settings for the Samba daemon can be found in
<html:code>/etc/samba/smb.conf</html:code>. Settings are divided between a
<html:code>[global]</html:code> configuration section and a series of user
created share definition sections meant to describe file or print
shares on the system. By default, Samba will operate in user mode
and allow client systems to access local home directories and
printers. It is recommended that these settings be changed or that
additional limitations be set in place.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_smb_disable_printing">
              <xccdf-1.2:title>Restrict Printer Sharing</xccdf-1.2:title>
              <xccdf-1.2:description>By default, Samba utilizes the CUPS printing service to enable
printer sharing with Microsoft Windows workstations. If there are no printers
on the local system, or if printer sharing with Microsoft Windows is not
required, disable the printer sharing capability by commenting out the
following lines, found in <html:code>/etc/samba/smb.conf</html:code>:
<html:pre>[global]
  load printers = yes
  cups options = raw
[printers]
  comment = All Printers
  path = /usr/spool/samba
  browseable = no
  guest ok = no
  writable = no
  printable = yes</html:pre>
There may be other options present, but these are the only options enabled and
uncommented by default. Removing the <html:code>[printers]</html:code> share should be enough
for most users.  If the Samba printer sharing capability is needed, consider
disabling the Samba network browsing capability or restricting access to a
particular set of users or network addresses. Set the <html:code>valid users</html:code>
parameter to a small subset of users or restrict it to a particular group of
users with the shorthand <html:code>@</html:code>. Separate each user or group of users with
a space. For example, under the <html:code>[printers]</html:code> share:
<html:pre>[printers]
  valid users = user @printerusers</html:pre></xccdf-1.2:description>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_smb_restrict_file_sharing">
              <xccdf-1.2:title>Restrict SMB File Sharing to Configured Networks</xccdf-1.2:title>
              <xccdf-1.2:description>Only users with local user accounts will be able to log in to
Samba shares by default. Shares can be limited to particular users or network
addresses. Use the <html:code>hosts allow</html:code> and <html:code>hosts deny</html:code> directives
accordingly, and consider setting the valid users directive to a limited subset
of users or to a group of users. Separate each address, user, or user group
with a space as follows for a particular <html:i>share</html:i> or global:
<html:pre>[<html:i>share</html:i>]
  hosts allow = 192.168.1. 127.0.0.1
  valid users = userone usertwo @usergroup</html:pre>
It is also possible to limit read and write access to particular users with the
read list and write list options, though the permissions set by the system
itself will override these settings. Set the read only attribute for each share
to ensure that global settings will not accidentally override the individual
share settings. Then, as with the valid users directive, separate each user or
group of users with a space:
<html:pre>[<html:i>share</html:i>]
  read only = yes
  write list = userone usertwo @usergroup</html:pre></xccdf-1.2:description>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_samba">
            <xccdf-1.2:title>Disable Samba if Possible</xccdf-1.2:title>
            <xccdf-1.2:description>Even after the Samba server package has been installed, it
will remain disabled. Do not enable this service unless it is
absolutely necessary to provide Microsoft Windows file and print
sharing functionality.</xccdf-1.2:description>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_snmp">
          <xccdf-1.2:title>SNMP Server</xccdf-1.2:title>
          <xccdf-1.2:description>The Simple Network Management Protocol allows
administrators to monitor the state of network devices, including
computers. Older versions of SNMP were well-known for weak
security, such as plaintext transmission of the community string
(used for authentication) and usage of easily-guessable
choices for the community string.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_snmp_service">
            <xccdf-1.2:title>Disable SNMP Server if Possible</xccdf-1.2:title>
            <xccdf-1.2:description>The system includes an SNMP daemon that allows for its remote
monitoring, though it not installed by default. If it was installed and
activated but is not needed, the software should be disabled and removed.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_net-snmp_removed" severity="unknown">
              <xccdf-1.2:title>Uninstall net-snmp Package</xccdf-1.2:title>
              <xccdf-1.2:description>
The <html:code>net-snmp</html:code> package provides the snmpd service.
The <html:code>net-snmp</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase net-snmp</html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale>If there is no need to run SNMP server software,
removing the package provides a safeguard against its
activation.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_net-snmp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove net-snmp
#	   from the system, and may remove any packages
#	   that depend on net-snmp. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "net-snmp" ; then

    dnf remove -y "net-snmp"

fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_net-snmp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure net-snmp is removed
  package:
    name: net-snmp
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - package_net-snmp_removed
    - unknown_severity
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_net-snmp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_net-snmp

class remove_net-snmp {
  package { 'net-snmp':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_net-snmp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=net-snmp
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_net-snmp_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_net-snmp_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_snmp_configure_server">
            <xccdf-1.2:title>Configure SNMP Server if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description>If it is necessary to run the snmpd agent on the system, some best
practices should be followed to minimize the security risk from the
installation. The multiple security models implemented by SNMP cannot be fully
covered here so only the following general configuration advice can be offered:
<html:ul><html:li>use only SNMP version 3 security models and enable the use of authentication and encryption</html:li><html:li>write access to the MIB (Management Information Base) should be allowed only if necessary</html:li><html:li>all access to the MIB should be restricted following a principle of least privilege</html:li><html:li>network access should be limited to the maximum extent possible including restricting to expected network
addresses both in the configuration files and in the system firewall rules</html:li><html:li>ensure SNMP agents send traps only to, and accept SNMP queries only from, authorized management
stations</html:li><html:li>ensure that permissions on the <html:code>snmpd.conf</html:code> configuration file (by default, in <html:code>/etc/snmp</html:code>) are 640 or more restrictive</html:li><html:li>ensure that any MIB files' permissions are also 640 or more restrictive</html:li></html:ul></xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_snmpd_ro_string" type="string" interactive="true">
              <xccdf-1.2:title>SNMP read-only community string</xccdf-1.2:title>
              <xccdf-1.2:description>Specify the SNMP community string used for read-only access.</xccdf-1.2:description>
              <xccdf-1.2:value>changemero</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_snmpd_rw_string" type="string" interactive="true">
              <xccdf-1.2:title>SNMP read-write community string</xccdf-1.2:title>
              <xccdf-1.2:description>Specify the SNMP community string used for read-write access.</xccdf-1.2:description>
              <xccdf-1.2:value>changemerw</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_snmpd_no_rwusers" severity="medium">
              <xccdf-1.2:title>Ensure SNMP Read Write is disabled</xccdf-1.2:title>
              <xccdf-1.2:description>Edit <html:code>/etc/snmp/snmpd.conf</html:code>, remove any <html:code>rwuser</html:code> entries.
Once the read write users have been removed, restart the SNMP service:
<html:pre>$ sudo service snmpd restart</html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale>Certain SNMP settings can permit users to execute system behaviors from user
writes to the community strings.
This may permit a compromised account to execute commands on a remote system.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#net-snmp"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="snmpd_no_rwusers"># Remediation is applicable only in certain platforms
if rpm --quiet -q net-snmp; then

if grep -s "rwuser" /etc/snmp/snmpd.conf | grep -qv "^#"; then
	sed -i "/^\s*#/b;/rwuser/ s/^/#/" /etc/snmp/snmpd.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-snmpd_no_rwusers_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_snmpd_not_default_password" severity="high">
              <xccdf-1.2:title>Ensure Default SNMP Password Is Not Used</xccdf-1.2:title>
              <xccdf-1.2:description>Edit <html:code>/etc/snmp/snmpd.conf</html:code>, remove or change the default community strings of
<html:code>public</html:code> and <html:code>private</html:code>.
This profile configures new read-only community string to <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_snmpd_ro_string" use="legacy"/></html:code> and read-write community string to <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_snmpd_rw_string" use="legacy"/></html:code>.
Once the default community strings have been changed, restart the SNMP service:
<html:pre>$ sudo service snmpd restart</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Whether active or not, default simple network management protocol (SNMP) community
strings must be changed to maintain security. If the service is running with the
default authenticators, then anyone can gather data about the system and the network
and use the information to potentially compromise the integrity of the system and
network(s).</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#net-snmp"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="snmpd_not_default_password"># Remediation is applicable only in certain platforms
if rpm --quiet -q net-snmp; then

var_snmpd_ro_string='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_snmpd_ro_string" use="legacy"/>'
var_snmpd_rw_string='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_snmpd_rw_string" use="legacy"/>'


# remediate read-only community string
if grep -q 'public' /etc/snmp/snmpd.conf; then
    sed -i "s/public/$var_snmpd_ro_string/" /etc/snmp/snmpd.conf
fi

# remediate read-write community string
if grep -q 'private' /etc/snmp/snmpd.conf; then
    sed -i "s/private/$var_snmpd_rw_string/" /etc/snmp/snmpd.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="snmpd_not_default_password" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-IA-5(e)
    - configure_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - snmpd_not_default_password
- name: XCCDF Value var_snmpd_ro_string # promote to variable
  set_fact:
    var_snmpd_ro_string: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_snmpd_ro_string" use="legacy"/>
  tags:
    - always
- name: XCCDF Value var_snmpd_rw_string # promote to variable
  set_fact:
    var_snmpd_rw_string: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_snmpd_rw_string" use="legacy"/>
  tags:
    - always

- name: Check if file /etc/snmp/snmpd.conf exists
  stat:
    path: /etc/snmp/snmpd.conf
  register: snmpd
  when: '"net-snmp" in ansible_facts.packages'
  tags:
    - NIST-800-53-IA-5(e)
    - configure_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - snmpd_not_default_password

- name: Replace all instances of SNMP RO strings
  replace:
    path: /etc/snmp/snmpd.conf
    regexp: public
    replace: '{{ var_snmpd_ro_string }}'
  when:
    - '"net-snmp" in ansible_facts.packages'
    - (snmpd.stat.exists is defined and snmpd.stat.exists)
  tags:
    - NIST-800-53-IA-5(e)
    - configure_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - snmpd_not_default_password

- name: Replace all instances of SNMP RW strings
  replace:
    path: /etc/snmp/snmpd.conf
    regexp: private
    replace: '{{ var_snmpd_rw_string }}'
  when:
    - '"net-snmp" in ansible_facts.packages'
    - (snmpd.stat.exists is defined and snmpd.stat.exists)
  tags:
    - NIST-800-53-IA-5(e)
    - configure_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - snmpd_not_default_password
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-snmpd_not_default_password:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-snmpd_not_default_password_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_snmpd_use_newer_protocol" severity="medium">
              <xccdf-1.2:title>Configure SNMP Service to Use Only SNMPv3 or Newer</xccdf-1.2:title>
              <xccdf-1.2:description>Edit <html:code>/etc/snmp/snmpd.conf</html:code>, removing any references to <html:code>rocommunity</html:code>, <html:code>rwcommunity</html:code>, or <html:code>com2sec</html:code>.
Upon doing that, restart the SNMP service:
<html:pre>$ sudo service snmpd restart</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="">1311</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Earlier versions of SNMP are considered insecure, as they potentially allow
unauthorized access to detailed system management information.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#net-snmp"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-snmpd_use_newer_protocol:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-snmpd_use_newer_protocol_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ssh">
          <xccdf-1.2:title>SSH Server</xccdf-1.2:title>
          <xccdf-1.2:description>The SSH protocol is recommended for remote login and
remote file transfer. SSH provides confidentiality and integrity
for data exchanged between two systems, as well as server
authentication, through the use of public key cryptography. The
implementation included with the system is called OpenSSH, and more
detailed documentation is available from its website,

    <html:a href="https://www.openssh.com">https://www.openssh.com</html:a>.
Its server program is called <html:code>sshd</html:code> and provided by the RPM package
<html:code>openssh-server</html:code>.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#machine"/>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_firewalld_sshd_zone" type="string">
            <xccdf-1.2:title>SSH enabled firewalld zone</xccdf-1.2:title>
            <xccdf-1.2:description>Specify firewalld zone to enable SSH service. This value is used only for remediation purposes.</xccdf-1.2:description>
            <xccdf-1.2:value selector="block">block</xccdf-1.2:value>
            <xccdf-1.2:value>public</xccdf-1.2:value>
            <xccdf-1.2:value selector="dmz">dmz</xccdf-1.2:value>
            <xccdf-1.2:value selector="drop">drop</xccdf-1.2:value>
            <xccdf-1.2:value selector="external">external</xccdf-1.2:value>
            <xccdf-1.2:value selector="home">home</xccdf-1.2:value>
            <xccdf-1.2:value selector="internal">internal</xccdf-1.2:value>
            <xccdf-1.2:value selector="public">public</xccdf-1.2:value>
            <xccdf-1.2:value selector="trusted">trusted</xccdf-1.2:value>
            <xccdf-1.2:value selector="work">work</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sshd_approved_ciphers" type="string">
            <xccdf-1.2:title>SSH Approved ciphers by FIPS</xccdf-1.2:title>
            <xccdf-1.2:description>Specify the FIPS approved ciphers that are used for data integrity protection by the SSH server.</xccdf-1.2:description>
            <xccdf-1.2:value selector="stig">aes256-ctr,aes192-ctr,aes128-ctr</xccdf-1.2:value>
            <xccdf-1.2:value>aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_rhel7">chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_sle12">chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_sle15">chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sshd_approved_macs" type="string">
            <xccdf-1.2:title>SSH Approved MACs by FIPS</xccdf-1.2:title>
            <xccdf-1.2:description>Specify the FIPS approved MACs (message authentication code) algorithms
	that are used for data integrity protection by the SSH server.</xccdf-1.2:description>
            <xccdf-1.2:value selector="stig">hmac-sha2-512,hmac-sha2-256</xccdf-1.2:value>
            <xccdf-1.2:value>hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_rhel7">umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-etm@openssh.com</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_sle12">umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-etm@openssh.com</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_sle15">umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-etm@openssh.com</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" type="number">
            <xccdf-1.2:title>SSH session Idle time</xccdf-1.2:title>
            <xccdf-1.2:description>Specify duration of allowed idle time.</xccdf-1.2:description>
            <xccdf-1.2:value selector="10_minutes">600</xccdf-1.2:value>
            <xccdf-1.2:value selector="120_minutes">7200</xccdf-1.2:value>
            <xccdf-1.2:value selector="14_minutes">840</xccdf-1.2:value>
            <xccdf-1.2:value selector="15_minutes">900</xccdf-1.2:value>
            <xccdf-1.2:value selector="30_minutes">1800</xccdf-1.2:value>
            <xccdf-1.2:value selector="5_minutes">300</xccdf-1.2:value>
            <xccdf-1.2:value selector="60_minutes">3600</xccdf-1.2:value>
            <xccdf-1.2:value>300</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sshd_listening_port" type="number">
            <xccdf-1.2:title>SSH Server Listening Port</xccdf-1.2:title>
            <xccdf-1.2:description>Specify port the SSH server is listening.</xccdf-1.2:description>
            <xccdf-1.2:value>22</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value" type="number">
            <xccdf-1.2:title>SSH Max authentication attempts</xccdf-1.2:title>
            <xccdf-1.2:description>Specify the maximum number of authentication attempts per connection.</xccdf-1.2:description>
            <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
            <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
            <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
            <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
            <xccdf-1.2:value>4</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sshd_required" type="number">
            <xccdf-1.2:title>SSH is required to be installed</xccdf-1.2:title>
            <xccdf-1.2:description>Specify if the Policy requires SSH to be installed. Used by SSH Rules
to determine if SSH should be uninstalled or configured.<html:br/>
A value of 0 means that the policy doesn't care if OpenSSH server is installed or not. If it is installed, scanner will check for it's configuration, if it's not installed, the check will pass.<html:br/>
A value of 1 indicates that OpenSSH server package is not required by the policy;<html:br/>
A value of 2 indicates that OpenSSH server package is required by the policy.<html:br/></xccdf-1.2:description>
            <xccdf-1.2:value>0</xccdf-1.2:value>
            <xccdf-1.2:value selector="no">1</xccdf-1.2:value>
            <xccdf-1.2:value selector="yes">2</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sshd_max_sessions" type="number">
            <xccdf-1.2:title>SSH Max Sessions Count</xccdf-1.2:title>
            <xccdf-1.2:description>Specify the maximum number of open sessions permitted.</xccdf-1.2:description>
            <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
            <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
            <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
            <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
            <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
            <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
            <xccdf-1.2:value>10</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive" type="number">
            <xccdf-1.2:title>SSH Max Keep Alive Count</xccdf-1.2:title>
            <xccdf-1.2:description>Specify the maximum number of idle message counts before session is terminated.</xccdf-1.2:description>
            <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
            <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
            <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
            <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
            <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
            <xccdf-1.2:value>0</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_openssh-server_installed" severity="medium">
            <xccdf-1.2:title>Install the OpenSSH Server Package</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>openssh-server</html:code> package should be installed.
The <html:code>openssh-server</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install openssh-server</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002418</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002420</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002421</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002422</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FTP_ITC_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000423-GPOS-00187</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000424-GPOS-00188</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000425-GPOS-00189</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000426-GPOS-00190</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Without protection of the transmitted information, confidentiality, and
integrity may be compromised because unprotected communications can be
intercepted and either read or altered.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_openssh-server_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "openssh-server" ; then
    dnf install -y "openssh-server"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_openssh-server_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure openssh-server is installed
  package:
    name: openssh-server
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_openssh-server_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_openssh-server_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_openssh-server

class install_openssh-server {
  package { 'openssh-server':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_openssh-server_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=openssh-server
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_openssh-server_installed">
[[packages]]
name = "openssh-server"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_openssh-server_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_openssh-server_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_openssh-server_removed" severity="medium">
            <xccdf-1.2:title>Remove the OpenSSH Server Package</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>openssh-server</html:code> package should be removed.
The <html:code>openssh-server</html:code> package can be removed with the following command:
<html:pre>
$ sudo dnf erase openssh-server</html:pre></xccdf-1.2:description>
            <xccdf-1.2:rationale>Without protection of the transmitted information, confidentiality, and
integrity may be compromised because unprotected communications can be
intercepted and either read or altered.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_openssh-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# CAUTION: This remediation script will remove openssh-server
#	   from the system, and may remove any packages
#	   that depend on openssh-server. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "openssh-server" ; then

    dnf remove -y "openssh-server"

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_openssh-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure openssh-server is removed
  package:
    name: openssh-server
    state: absent
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_openssh-server_removed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_openssh-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_openssh-server

class remove_openssh-server {
  package { 'openssh-server':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_openssh-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=openssh-server
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_openssh-server_removed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_openssh-server_removed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_sshd_disabled" severity="unknown">
            <xccdf-1.2:title>Disable SSH Server If Possible (Unusual)</xccdf-1.2:title>
            <xccdf-1.2:description>The SSH server service, sshd, is commonly needed.
However, if it can be disabled, do so.


The <html:code>sshd</html:code> service can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now sshd.service</html:pre>

This is unusual, as SSH is a common method for encrypted and authenticated
remote access.</xccdf-1.2:description>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-3(6)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(4)</xccdf-1.2:reference>
            <xccdf-1.2:rationale/>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_sshd_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'sshd.service'
"$SYSTEMCTL_EXEC" disable 'sshd.service'
"$SYSTEMCTL_EXEC" mask 'sshd.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^sshd.socket'; then
    "$SYSTEMCTL_EXEC" stop 'sshd.socket'
    "$SYSTEMCTL_EXEC" mask 'sshd.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'sshd.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_sshd_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Disable service sshd
  block:

    - name: Disable service sshd
      systemd:
        name: sshd.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      ignore_errors: 'yes'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-3(6)
    - NIST-800-53-IA-2(4)
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_sshd_disabled
    - unknown_severity

- name: Unit Socket Exists - sshd.socket
  command: systemctl list-unit-files sshd.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-3(6)
    - NIST-800-53-IA-2(4)
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_sshd_disabled
    - unknown_severity

- name: Disable socket sshd
  systemd:
    name: sshd.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"sshd.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - NIST-800-53-CM-3(6)
    - NIST-800-53-IA-2(4)
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_sshd_disabled
    - unknown_severity
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_sshd_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_sshd

class disable_sshd {
  service {'sshd':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="service_sshd_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: sshd.service
        enabled: false
        mask: true
      - name: sshd.socket
        enabled: false
        mask: true
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_sshd_disabled">
[customizations.services]
disabled = ["sshd"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_sshd_disabled:def:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key" severity="medium">
            <xccdf-1.2:title>Verify Permissions on SSH Server Private *_key Key Files</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/ssh/*_key</html:code>, run the command:
<html:pre>$ sudo chmod 0600 /etc/ssh/*_key</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R36)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If an unauthorized user obtains the private SSH host key file, the host could be
impersonated.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_sshd_private_key" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

find -H /etc/ssh/ -maxdepth 1 -perm /u+xs,g+xwrs,o+xwrt -type f -regex '^.*_key$' -exec chmod u-xs,g-xwrs,o-xwrt {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_sshd_private_key" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Find /etc/ssh/ file(s)
  command: find -H /etc/ssh/ -maxdepth 1 -perm /u+xs,g+xwrs,o+xwrt -type f -regex
    "^.*_key$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.13
    - NIST-800-171-3.13.10
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_sshd_private_key
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Set permissions for /etc/ssh/ file(s)
  file:
    path: '{{ item }}'
    mode: u-xs,g-xwrs,o-xwrt
    state: file
  with_items:
    - '{{ files_found.stdout_lines }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.13
    - NIST-800-171-3.13.10
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_sshd_private_key
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="file_permissions_sshd_private_key">include ssh_private_key_perms

class ssh_private_key_perms {
  exec { 'sshd_priv_key':
    command =&gt; "chmod 0640 /etc/ssh/*_key",
    path    =&gt; '/bin:/usr/bin'
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_sshd_private_key:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_sshd_private_key_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key" severity="medium">
            <xccdf-1.2:title>Verify Permissions on SSH Server Public *.pub Key Files</xccdf-1.2:title>
            <xccdf-1.2:description> To properly set the permissions of <html:code>/etc/ssh/*.pub</html:code>, run the command: <html:pre>$ sudo chmod 0644 /etc/ssh/*.pub</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If a public host key file is modified by an unauthorized user, the SSH service
may be compromised.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_sshd_pub_key" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

find -H /etc/ssh/ -maxdepth 1 -perm /u+xs,g+xws,o+xwt -type f -regex '^.*.pub$' -exec chmod u-xs,g-xws,o-xwt {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_sshd_pub_key" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Find /etc/ssh/ file(s)
  command: find -H /etc/ssh/ -maxdepth 1 -perm /u+xs,g+xws,o+xwt -type f -regex "^.*.pub$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.13
    - NIST-800-171-3.13.10
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_sshd_pub_key
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Set permissions for /etc/ssh/ file(s)
  file:
    path: '{{ item }}'
    mode: u-xs,g-xws,o-xwt
    state: file
  with_items:
    - '{{ files_found.stdout_lines }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.13
    - NIST-800-171-3.13.10
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_sshd_pub_key
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="file_permissions_sshd_pub_key">include ssh_public_key_perms

class ssh_public_key_perms {
  exec { 'sshd_pub_key':
    command =&gt; "chmod 0644 /etc/ssh/*.pub",
    path    =&gt; '/bin:/usr/bin'
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-file_permissions_sshd_pub_key:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-file_permissions_sshd_pub_key_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_iptables_sshd_disabled" severity="unknown">
            <xccdf-1.2:title>Remove SSH Server iptables Firewall exception (Unusual)</xccdf-1.2:title>
            <xccdf-1.2:description>By default, inbound connections to SSH's port are allowed. If the SSH
server is not being used, this exception should be removed from the
firewall configuration.
<html:br/><html:br/>
Edit the files <html:code>/etc/sysconfig/iptables</html:code> and
<html:code>/etc/sysconfig/ip6tables</html:code> (if IPv6 is in use). In each file, locate
and delete the line:
<html:pre>-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT</html:pre>
This is unusual, as SSH is a common method for encrypted and authenticated
remote access.</xccdf-1.2:description>
            <xccdf-1.2:rationale>If inbound SSH connections are not expected, disallowing access to the SSH
port will avoid possible exploitation of the port by an attacker.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ssh_client">
            <xccdf-1.2:title>Configure OpenSSH Client if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description>The following configuration changes apply to the SSH client. They can
improve security parameters relwevant to the client user, e.g. increasing
entropy while generating initialization vectors. Note that these changes
influence only the default SSH client configuration. Changes in this group
can be overridden by the client user by modifying files within the
<html:pre>~/.ssh</html:pre> directory or by supplying parameters on the command line.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#machine"/>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ssh_server">
            <xccdf-1.2:title>Configure OpenSSH Server if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description>If the system needs to act as an SSH server, then
certain changes should be made to the OpenSSH daemon configuration
file <html:code>/etc/ssh/sshd_config</html:code>. The following recommendations can be
applied to this file. See the <html:code>sshd_config(5)</html:code> man page for more
detailed information.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_rekey_limit_size" type="string">
              <xccdf-1.2:title>SSH RekeyLimit - size</xccdf-1.2:title>
              <xccdf-1.2:description>Specify the size component of the rekey limit.</xccdf-1.2:description>
              <xccdf-1.2:value selector="sshd_default">default</xccdf-1.2:value>
              <xccdf-1.2:value>512M</xccdf-1.2:value>
              <xccdf-1.2:value selector="512M">512M</xccdf-1.2:value>
              <xccdf-1.2:value selector="1G">1G</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_rekey_limit_time" type="string">
              <xccdf-1.2:title>SSH RekeyLimit - size</xccdf-1.2:title>
              <xccdf-1.2:description>Specify the size component of the rekey limit.</xccdf-1.2:description>
              <xccdf-1.2:value selector="sshd_default">none</xccdf-1.2:value>
              <xccdf-1.2:value>1h</xccdf-1.2:value>
              <xccdf-1.2:value selector="1hour">1h</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sshd_disable_compression" type="string">
              <xccdf-1.2:title>SSH Compression Setting</xccdf-1.2:title>
              <xccdf-1.2:description>Specify the compression setting for SSH connections.</xccdf-1.2:description>
              <xccdf-1.2:value selector="no">no</xccdf-1.2:value>
              <xccdf-1.2:value selector="delayed">delayed</xccdf-1.2:value>
              <xccdf-1.2:value>no</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sshd_priv_separation" type="string">
              <xccdf-1.2:title>SSH Privilege Separation Setting</xccdf-1.2:title>
              <xccdf-1.2:description>Specify whether and how sshd separates privileges when handling incoming network connections.</xccdf-1.2:description>
              <xccdf-1.2:value selector="no">no</xccdf-1.2:value>
              <xccdf-1.2:value selector="yes">yes</xccdf-1.2:value>
              <xccdf-1.2:value selector="sandbox">sandbox</xccdf-1.2:value>
              <xccdf-1.2:value>sandbox</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sshd_set_login_grace_time" type="number" interactive="true">
              <xccdf-1.2:title>SSH LoginGraceTime setting</xccdf-1.2:title>
              <xccdf-1.2:description>Configure parameters for how long the servers stays connected before the user has successfully logged in</xccdf-1.2:description>
              <xccdf-1.2:value>60</xccdf-1.2:value>
              <xccdf-1.2:value selector="60">60</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sshd_set_maxstartups" type="string" interactive="true">
              <xccdf-1.2:title>SSH MaxStartups setting</xccdf-1.2:title>
              <xccdf-1.2:description>Configure parameters for maximum concurrent unauthenticated connections to the SSH daemon.</xccdf-1.2:description>
              <xccdf-1.2:value>10:30:100</xccdf-1.2:value>
              <xccdf-1.2:value selector="10:30:60">10:30:60</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_set_keepalive_0" severity="medium">
              <xccdf-1.2:title>Set SSH Client Alive Count Max to zero</xccdf-1.2:title>
              <xccdf-1.2:description>The SSH server sends at most <html:code>ClientAliveCountMax</html:code> messages
during a SSH session and waits for a response from the SSH client.
The option <html:code>ClientAliveInterval</html:code> configures timeout after
each <html:code>ClientAliveCountMax</html:code> message. If the SSH server does not
receive a response from the client, then the connection is considered idle
and terminated.

To ensure the SSH idle timeout occurs precisely when the
<html:code>ClientAliveInterval</html:code> is set, set the <html:code>ClientAliveCountMax</html:code> to
value of <html:code>0</html:code> in


<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000879</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002361</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000163-GPOS-00072</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000279-GPOS-00109</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000480-VMM-002000</xccdf-1.2:reference>
              <xccdf-1.2:rationale>This ensures a user login will be terminated as soon as the <html:code>ClientAliveInterval</html:code>
is reached.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:requires idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_set_keepalive_0" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*ClientAliveCountMax\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*ClientAliveCountMax\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*ClientAliveCountMax\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "ClientAliveCountMax 0" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    printf '%s\n' "ClientAliveCountMax 0" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_set_keepalive_0" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Set SSH Client Alive Count Max to zero
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "ClientAliveCountMax"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter ClientAliveCountMax is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "ClientAliveCountMax"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "ClientAliveCountMax"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
        create: true
        regexp: ^\s*{{ "ClientAliveCountMax"| regex_escape }}\s+
        line: ClientAliveCountMax 0
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - PCI-DSS-Req-8.1.8
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_keepalive_0
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_set_keepalive_0:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_set_keepalive_0_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" severity="medium">
              <xccdf-1.2:title>Set SSH Client Alive Count Max</xccdf-1.2:title>
              <xccdf-1.2:description>The SSH server sends at most <html:code>ClientAliveCountMax</html:code> messages
during a SSH session and waits for a response from the SSH client.
The option <html:code>ClientAliveInterval</html:code> configures timeout after
each <html:code>ClientAliveCountMax</html:code> message. If the SSH server does not
receive a response from the client, then the connection is considered idle
and terminated.
For SSH earlier than v8.2, a <html:code>ClientAliveCountMax</html:code> value of <html:code>0</html:code>
causes an idle timeout precisely when the <html:code>ClientAliveInterval</html:code> is set.
Starting with v8.2, a value of <html:code>0</html:code> disables the timeout functionality
completely. If the option is set to a number greater than <html:code>0</html:code>, then
the idle session will be disconnected after
<html:code>ClientAliveInterval * ClientAliveCountMax</html:code> seconds.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R29)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000879</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002361</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000163-GPOS-00072</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000279-GPOS-00109</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000480-VMM-002000</xccdf-1.2:reference>
              <xccdf-1.2:rationale>This ensures a user login will be terminated as soon as the <html:code>ClientAliveInterval</html:code>
is reached.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:requires idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_set_keepalive"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

var_sshd_set_keepalive='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive" use="legacy"/>'


if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*ClientAliveCountMax\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "ClientAliveCountMax $var_sshd_set_keepalive" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "ClientAliveCountMax $var_sshd_set_keepalive" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_set_keepalive" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: XCCDF Value var_sshd_set_keepalive # promote to variable
  set_fact:
    var_sshd_set_keepalive: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive" use="legacy"/>
  tags:
    - always

- name: Set SSH Client Alive Count Max
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*ClientAliveCountMax\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*ClientAliveCountMax\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*ClientAliveCountMax\s+
        line: ClientAliveCountMax {{ var_sshd_set_keepalive }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - PCI-DSS-Req-8.1.8
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_keepalive
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_sshd_set_keepalive:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive"/>
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_set_keepalive:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_set_keepalive_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" severity="medium">
              <xccdf-1.2:title>Set SSH Idle Timeout Interval</xccdf-1.2:title>
              <xccdf-1.2:description>SSH allows administrators to set an idle timeout interval. After this interval
has passed, the idle user will be automatically logged out.
<html:br/><html:br/>
To set an idle timeout interval, edit the following line in <html:code>/etc/ssh/sshd_config</html:code> as
follows:
<html:pre>ClientAliveInterval <html:b><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" use="legacy"/></html:b></html:pre>
<html:br/><html:br/>
The timeout <html:b>interval</html:b> is given in seconds. For example, have a timeout
of 10 minutes, set <html:b>interval</html:b> to 600.
<html:br/><html:br/>
If a shorter timeout has already been set for the login shell, that value will
preempt any SSH setting made in <html:code>/etc/ssh/sshd_config</html:code>. Keep in mind that
some processes may stop SSH  from correctly detecting that the user is idle.</xccdf-1.2:description>
              <xccdf-1.2:warning category="dependency">SSH disconnecting idle clients will not have desired effect without also
configuring ClientAliveCountMax in the SSH service configuration.</xccdf-1.2:warning>
              <xccdf-1.2:warning category="general">Following conditions may prevent the SSH session to time out:
<html:ul><html:li>Remote processes on the remote machine generates output. As the output has to be transferred over the network to the client, the timeout is reset every time such transfer happens.</html:li><html:li>Any <html:code>scp</html:code> or <html:code>sftp</html:code> activity by the same user to the host resets the timeout.</html:li></html:ul></xccdf-1.2:warning>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R29)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000879</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002361</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000126-GPOS-00066</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000163-GPOS-00072</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000279-GPOS-00109</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000395-GPOS-00175</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000480-VMM-002000</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Terminating an idle ssh session within a short time period reduces the window of
opportunity for unauthorized personnel to take control of a management session
enabled on the console or console port that has been let unattended.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:requires idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive_0"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_set_idle_timeout"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

sshd_idle_timeout_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" use="legacy"/>'


if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*ClientAliveInterval\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "ClientAliveInterval $sshd_idle_timeout_value" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "ClientAliveInterval $sshd_idle_timeout_value" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_set_idle_timeout" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: XCCDF Value sshd_idle_timeout_value # promote to variable
  set_fact:
    sshd_idle_timeout_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" use="legacy"/>
  tags:
    - always

- name: Set SSH Idle Timeout Interval
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*ClientAliveInterval\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*ClientAliveInterval\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*ClientAliveInterval\s+
        line: ClientAliveInterval {{ sshd_idle_timeout_value }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - PCI-DSS-Req-8.1.8
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_idle_timeout
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_sshd_set_keepalive:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive"/>
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_idle_timeout_value:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_set_idle_timeout:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_set_idle_timeout_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_disable_host_auth" severity="medium">
              <xccdf-1.2:title>Disable Host-Based Authentication</xccdf-1.2:title>
              <xccdf-1.2:description>SSH's cryptographic host-based authentication is
more secure than <html:code>.rhosts</html:code> authentication. However, it is
not recommended that hosts unilaterally trust one another, even
within an organization.
<html:br/>
The default SSH configuration disables host-based authentication. The appropriate
configuration is used if no value is set for <html:code>HostbasedAuthentication</html:code>.
<html:br/>
To explicitly disable host-based authentication, add or correct the
following line in


<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre>HostbasedAuthentication no</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0421</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0422</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0431</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0974</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1173</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1401</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1504</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1505</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1546</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1557</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1558</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1559</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1560</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1561</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00229</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000480-VMM-002000</xccdf-1.2:reference>
              <xccdf-1.2:rationale>SSH trust relationships mean a compromise on one host
can allow an attacker to move trivially to other hosts.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="disable_host_auth" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

LC_ALL=C sed -i "/^\s*HostbasedAuthentication\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*HostbasedAuthentication\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*HostbasedAuthentication\s\+/Id" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    touch "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"

cp "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "HostbasedAuthentication no" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
    printf '%s\n' "HostbasedAuthentication no" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="disable_host_auth" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Disable Host-Based Authentication
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "HostbasedAuthentication"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter HostbasedAuthentication is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "HostbasedAuthentication"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "HostbasedAuthentication"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
        create: true
        regexp: ^\s*{{ "HostbasedAuthentication"| regex_escape }}\s+
        line: HostbasedAuthentication no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_host_auth
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="disable_host_auth">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%09%24OpenBSD%3A%20sshd_config%2Cv%201.103%202018%2F04%2F09%2020%3A41%3A22%20tj%20Exp%20%24%0A%0A%23%20This%20is%20the%20sshd%20server%20system-wide%20configuration%20file.%20%20See%0A%23%20sshd_config%285%29%20for%20more%20information.%0A%0A%23%20This%20sshd%20was%20compiled%20with%20PATH%3D%2Fusr%2Flocal%2Fbin%3A%2Fusr%2Fbin%3A%2Fusr%2Flocal%2Fsbin%3A%2Fusr%2Fsbin%0A%0A%23%20The%20strategy%20used%20for%20options%20in%20the%20default%20sshd_config%20shipped%20with%0A%23%20OpenSSH%20is%20to%20specify%20options%20with%20their%20default%20value%20where%0A%23%20possible%2C%20but%20leave%20them%20commented.%20%20Uncommented%20options%20override%20the%0A%23%20default%20value.%0A%0A%23%20If%20you%20want%20to%20change%20the%20port%20on%20a%20SELinux%20system%2C%20you%20have%20to%20tell%0A%23%20SELinux%20about%20this%20change.%0A%23%20semanage%20port%20-a%20-t%20ssh_port_t%20-p%20tcp%20%23PORTNUMBER%0A%23%0A%23Port%2022%0A%23AddressFamily%20any%0A%23ListenAddress%200.0.0.0%0A%23ListenAddress%20%3A%3A%0A%0AHostKey%20%2Fetc%2Fssh%2Fssh_host_rsa_key%0AHostKey%20%2Fetc%2Fssh%2Fssh_host_ecdsa_key%0AHostKey%20%2Fetc%2Fssh%2Fssh_host_ed25519_key%0A%0A%23%20Ciphers%20and%20keying%0ARekeyLimit%20512M%201h%0A%0A%23%20System-wide%20Crypto%20policy%3A%0A%23%20This%20system%20is%20following%20system-wide%20crypto%20policy.%20The%20changes%20to%0A%23%20Ciphers%2C%20MACs%2C%20KexAlgoritms%20and%20GSSAPIKexAlgorithsm%20will%20not%20have%20any%0A%23%20effect%20here.%20They%20will%20be%20overridden%20by%20command-line%20options%20passed%20on%0A%23%20the%20server%20start%20up.%0A%23%20To%20opt%20out%2C%20uncomment%20a%20line%20with%20redefinition%20of%20%20CRYPTO_POLICY%3D%0A%23%20variable%20in%20%20%2Fetc%2Fsysconfig%2Fsshd%20%20to%20overwrite%20the%20policy.%0A%23%20For%20more%20information%2C%20see%20manual%20page%20for%20update-crypto-policies%288%29.%0A%0A%23%20Logging%0A%23SyslogFacility%20AUTH%0ASyslogFacility%20AUTHPRIV%0A%23LogLevel%20INFO%0A%0A%23%20Authentication%3A%0A%0A%23LoginGraceTime%202m%0APermitRootLogin%20no%0AStrictModes%20yes%0A%23MaxAuthTries%206%0A%23MaxSessions%2010%0A%0APubkeyAuthentication%20yes%0A%0A%23%20The%20default%20is%20to%20check%20both%20.ssh%2Fauthorized_keys%20and%20.ssh%2Fauthorized_keys2%0A%23%20but%20this%20is%20overridden%20so%20installations%20will%20only%20check%20.ssh%2Fauthorized_keys%0AAuthorizedKeysFile%09.ssh%2Fauthorized_keys%0A%0A%23AuthorizedPrincipalsFile%20none%0A%0A%23AuthorizedKeysCommand%20none%0A%23AuthorizedKeysCommandUser%20nobody%0A%0A%23%20For%20this%20to%20work%20you%20will%20also%20need%20host%20keys%20in%20%2Fetc%2Fssh%2Fssh_known_hosts%0AHostbasedAuthentication%20no%0A%23%20Change%20to%20yes%20if%20you%20don%27t%20trust%20~%2F.ssh%2Fknown_hosts%20for%0A%23%20HostbasedAuthentication%0AIgnoreUserKnownHosts%20yes%0A%23%20Don%27t%20read%20the%20user%27s%20~%2F.rhosts%20and%20~%2F.shosts%20files%0AIgnoreRhosts%20yes%0A%0A%23%20To%20disable%20tunneled%20clear%20text%20passwords%2C%20change%20to%20no%20here%21%0A%23PasswordAuthentication%20yes%0APermitEmptyPasswords%20no%0APasswordAuthentication%20no%0A%0A%23%20Change%20to%20no%20to%20disable%20s%2Fkey%20passwords%0A%23ChallengeResponseAuthentication%20yes%0AChallengeResponseAuthentication%20no%0A%0A%23%20Kerberos%20options%0AKerberosAuthentication%20no%0A%23KerberosOrLocalPasswd%20yes%0A%23KerberosTicketCleanup%20yes%0A%23KerberosGetAFSToken%20no%0A%23KerberosUseKuserok%20yes%0A%0A%23%20GSSAPI%20options%0AGSSAPIAuthentication%20no%0AGSSAPICleanupCredentials%20no%0A%23GSSAPIStrictAcceptorCheck%20yes%0A%23GSSAPIKeyExchange%20no%0A%23GSSAPIEnablek5users%20no%0A%0A%23%20Set%20this%20to%20%27yes%27%20to%20enable%20PAM%20authentication%2C%20account%20processing%2C%0A%23%20and%20session%20processing.%20If%20this%20is%20enabled%2C%20PAM%20authentication%20will%0A%23%20be%20allowed%20through%20the%20ChallengeResponseAuthentication%20and%0A%23%20PasswordAuthentication.%20%20Depending%20on%20your%20PAM%20configuration%2C%0A%23%20PAM%20authentication%20via%20ChallengeResponseAuthentication%20may%20bypass%0A%23%20the%20setting%20of%20%22PermitRootLogin%20without-password%22.%0A%23%20If%20you%20just%20want%20the%20PAM%20account%20and%20session%20checks%20to%20run%20without%0A%23%20PAM%20authentication%2C%20then%20enable%20this%20but%20set%20PasswordAuthentication%0A%23%20and%20ChallengeResponseAuthentication%20to%20%27no%27.%0A%23%20WARNING%3A%20%27UsePAM%20no%27%20is%20not%20supported%20in%20Fedora%20and%20may%20cause%20several%0A%23%20problems.%0AUsePAM%20yes%0A%0A%23AllowAgentForwarding%20yes%0A%23AllowTcpForwarding%20yes%0A%23GatewayPorts%20no%0AX11Forwarding%20yes%0A%23X11DisplayOffset%2010%0A%23X11UseLocalhost%20yes%0A%23PermitTTY%20yes%0A%0A%23%20It%20is%20recommended%20to%20use%20pam_motd%20in%20%2Fetc%2Fpam.d%2Fsshd%20instead%20of%20PrintMotd%2C%0A%23%20as%20it%20is%20more%20configurable%20and%20versatile%20than%20the%20built-in%20version.%0APrintMotd%20no%0A%0APrintLastLog%20yes%0A%23TCPKeepAlive%20yes%0APermitUserEnvironment%20no%0ACompression%20no%0AClientAliveInterval%20600%0AClientAliveCountMax%200%0A%23UseDNS%20no%0A%23PidFile%20%2Fvar%2Frun%2Fsshd.pid%0A%23MaxStartups%2010%3A30%3A100%0A%23PermitTunnel%20no%0A%23ChrootDirectory%20none%0A%23VersionAddendum%20none%0A%0A%23%20no%20default%20banner%20path%0ABanner%20%2Fetc%2Fissue%0A%0A%23%20Accept%20locale-related%20environment%20variables%0AAcceptEnv%20LANG%20LC_CTYPE%20LC_NUMERIC%20LC_TIME%20LC_COLLATE%20LC_MONETARY%20LC_MESSAGES%0AAcceptEnv%20LC_PAPER%20LC_NAME%20LC_ADDRESS%20LC_TELEPHONE%20LC_MEASUREMENT%0AAcceptEnv%20LC_IDENTIFICATION%20LC_ALL%20LANGUAGE%0AAcceptEnv%20XMODIFIERS%0A%0A%23%20override%20default%20of%20no%20subsystems%0ASubsystem%09sftp%09%2Fusr%2Flibexec%2Fopenssh%2Fsftp-server%0A%0A%23%20Example%20of%20overriding%20settings%20on%20a%20per-user%20basis%0A%23Match%20User%20anoncvs%0A%23%09X11Forwarding%20no%0A%23%09AllowTcpForwarding%20no%0A%23%09PermitTTY%20no%0A%23%09ForceCommand%20cvs%20server%0A%0AUsePrivilegeSeparation%20sandbox
        mode: 0600
        path: /etc/ssh/sshd_config
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-disable_host_auth:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-disable_host_auth_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_allow_only_protocol2" severity="high">
              <xccdf-1.2:title>Allow Only SSH Protocol 2</xccdf-1.2:title>
              <xccdf-1.2:description>Only SSH protocol version 2 connections should be
permitted. The default setting in
<html:code>/etc/ssh/sshd_config</html:code> is correct, and can be
verified by ensuring that the following
line appears:
<html:pre>Protocol 2</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">As of <html:code>openssh-server</html:code> version <html:code>7.4</html:code> and above, the only protocol
supported is version 2, and line <html:pre>Protocol 2</html:pre> in
<html:code>/etc/ssh/sshd_config</html:code> is not necessary.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT007(R1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000197</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0487</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1449</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1506</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000074-GPOS-00042</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000033-VMM-000140</xccdf-1.2:reference>
              <xccdf-1.2:rationale>SSH protocol version 1 is an insecure implementation of the SSH protocol and
has many well-known vulnerability exploits. Exploits of the SSH daemon could provide
immediate root access to the system.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_allow_only_protocol2" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Allow Only SSH Protocol 2
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*Protocol\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*Protocol\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*Protocol\s+
        line: Protocol 2
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.13
    - NIST-800-171-3.5.4
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-13
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
    - sshd_allow_only_protocol2
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_allow_only_protocol2:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_allow_only_protocol2_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_disable_compression" severity="medium">
              <xccdf-1.2:title>Disable Compression Or Set Compression to delayed</xccdf-1.2:title>
              <xccdf-1.2:description>Compression is useful for slow network connections over long
distances but can cause performance issues on local LANs. If use of compression
is required, it should be enabled only after a user has authenticated; otherwise,
it should be disabled. To disable compression or delay compression until after
a user has successfully authenticated, add or correct the following line in the
<html:code>/etc/ssh/sshd_config</html:code> file:
<html:pre>Compression <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_disable_compression" use="legacy"/></html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000480-VMM-002000</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If compression is allowed in an SSH connection prior to authentication,
vulnerabilities in the compression software could result in compromise of the
system from an unauthenticated connection, potentially with root privileges.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_disable_compression" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: XCCDF Value var_sshd_disable_compression # promote to variable
  set_fact:
    var_sshd_disable_compression: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_disable_compression" use="legacy"/>
  tags:
    - always

- name: Disable Compression Or Set Compression to delayed
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*Compression\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*Compression\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*Compression\s+
        line: Compression {{ var_sshd_disable_compression }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_compression
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-export export-name="oval:ssg-var_sshd_disable_compression:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_disable_compression"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_disable_compression:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_disable_compression_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" severity="high">
              <xccdf-1.2:title>Disable SSH Access via Empty Passwords</xccdf-1.2:title>
              <xccdf-1.2:description>Disallow SSH login with empty passwords.
The default SSH configuration disables logins with empty passwords. The appropriate
configuration is used if no value is set for <html:code>PermitEmptyPasswords</html:code>.
<html:br/>
To explicitly disallow SSH login from accounts with empty passwords,
add or correct the following line in


<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:br/>
<html:pre>PermitEmptyPasswords no</html:pre>
Any accounts with empty passwords should be disabled immediately, and PAM configuration
should prevent users from being able to assign themselves empty passwords.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT007(R17)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000766</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000106-GPOS-00053</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00229</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000480-VMM-002000</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Configuring this setting for the SSH daemon provides additional assurance
that remote login via SSH will require a password, even in the event of
misconfiguration elsewhere.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_disable_empty_passwords" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

LC_ALL=C sed -i "/^\s*PermitEmptyPasswords\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*PermitEmptyPasswords\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*PermitEmptyPasswords\s\+/Id" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    touch "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"

cp "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "PermitEmptyPasswords no" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
    printf '%s\n' "PermitEmptyPasswords no" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_disable_empty_passwords" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Disable SSH Access via Empty Passwords
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "PermitEmptyPasswords"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter PermitEmptyPasswords is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "PermitEmptyPasswords"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "PermitEmptyPasswords"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
        create: true
        regexp: ^\s*{{ "PermitEmptyPasswords"| regex_escape }}\s+
        line: PermitEmptyPasswords no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_empty_passwords
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_disable_empty_passwords:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_disable_empty_passwords_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_disable_gssapi_auth" severity="medium">
              <xccdf-1.2:title>Disable GSSAPI Authentication</xccdf-1.2:title>
              <xccdf-1.2:description>Unless needed, SSH should not permit extraneous or unnecessary
authentication mechanisms like GSSAPI.
<html:br/>
The default SSH configuration disallows authentications based on GSSAPI. The appropriate
configuration is used if no value is set for <html:code>GSSAPIAuthentication</html:code>.
<html:br/>
To explicitly disable GSSAPI authentication, add or correct the following line in


<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre>GSSAPIAuthentication no</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000318</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000368</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001812</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001813</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001814</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0418</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1055</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1402</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FTP_ITC_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000364-GPOS-00151</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000480-VMM-002000</xccdf-1.2:reference>
              <xccdf-1.2:rationale>GSSAPI authentication is used to provide additional authentication mechanisms to
applications. Allowing GSSAPI authentication through SSH exposes the system's
GSSAPI to remote hosts, increasing the attack surface of the system.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_disable_gssapi_auth" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

LC_ALL=C sed -i "/^\s*GSSAPIAuthentication\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*GSSAPIAuthentication\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*GSSAPIAuthentication\s\+/Id" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    touch "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"

cp "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "GSSAPIAuthentication no" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
    printf '%s\n' "GSSAPIAuthentication no" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_disable_gssapi_auth" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Disable GSSAPI Authentication
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "GSSAPIAuthentication"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter GSSAPIAuthentication is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "GSSAPIAuthentication"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "GSSAPIAuthentication"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
        create: true
        regexp: ^\s*{{ "GSSAPIAuthentication"| regex_escape }}\s+
        line: GSSAPIAuthentication no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_gssapi_auth
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_disable_gssapi_auth:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_disable_gssapi_auth_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_disable_kerb_auth" severity="medium">
              <xccdf-1.2:title>Disable Kerberos Authentication</xccdf-1.2:title>
              <xccdf-1.2:description>Unless needed, SSH should not permit extraneous or unnecessary
authentication mechanisms like Kerberos.
<html:br/>
The default SSH configuration disallows authentication validation through Kerberos.
The appropriate configuration is used if no value is set for <html:code>KerberosAuthentication</html:code>.
<html:br/>
To explicitly disable Kerberos authentication, add or correct the following line in


<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre>KerberosAuthentication no</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000318</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000368</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001812</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001813</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001814</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0421</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0422</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0431</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0974</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1173</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1401</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1504</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1505</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1546</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1557</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1558</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1559</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1560</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1561</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FTP_ITC_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000364-GPOS-00151</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000480-VMM-002000</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Kerberos authentication for SSH is often implemented using GSSAPI. If Kerberos
is enabled through SSH, the SSH daemon provides a means of access to the
system's Kerberos implementation. Vulnerabilities in the system's Kerberos
implementations may be subject to exploitation.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_disable_kerb_auth" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

LC_ALL=C sed -i "/^\s*KerberosAuthentication\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*KerberosAuthentication\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*KerberosAuthentication\s\+/Id" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    touch "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"

cp "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "KerberosAuthentication no" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
    printf '%s\n' "KerberosAuthentication no" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_disable_kerb_auth" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Disable Kerberos Authentication
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "KerberosAuthentication"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter KerberosAuthentication is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "KerberosAuthentication"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "KerberosAuthentication"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
        create: true
        regexp: ^\s*{{ "KerberosAuthentication"| regex_escape }}\s+
        line: KerberosAuthentication no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_kerb_auth
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_disable_kerb_auth:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_disable_kerb_auth_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_disable_pubkey_auth" severity="medium">
              <xccdf-1.2:title>Disable PubkeyAuthentication Authentication</xccdf-1.2:title>
              <xccdf-1.2:description>Unless needed, SSH should not permit extraneous or unnecessary
authentication mechanisms. To disable PubkeyAuthentication authentication, add or
correct the following line in


<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre>PubkeyAuthentication no</html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale>PubkeyAuthentication authentication is used to provide additional authentication mechanisms to
applications. Allowing PubkeyAuthentication authentication through SSH allows users to
generate their own authentication tokens, increasing the attack surface of the system.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_disable_pubkey_auth" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*PubkeyAuthentication\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*PubkeyAuthentication\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*PubkeyAuthentication\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "PubkeyAuthentication no" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    printf '%s\n' "PubkeyAuthentication no" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_disable_pubkey_auth" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Disable PubkeyAuthentication Authentication
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "PubkeyAuthentication"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter PubkeyAuthentication is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "PubkeyAuthentication"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "PubkeyAuthentication"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
        create: true
        regexp: ^\s*{{ "PubkeyAuthentication"| regex_escape }}\s+
        line: PubkeyAuthentication no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_pubkey_auth
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_disable_pubkey_auth:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_disable_pubkey_auth_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_disable_rhosts" severity="medium">
              <xccdf-1.2:title>Disable SSH Support for .rhosts Files</xccdf-1.2:title>
              <xccdf-1.2:description>SSH can emulate the behavior of the obsolete rsh
command in allowing users to enable insecure access to their
accounts via <html:code>.rhosts</html:code> files.
<html:br/>
The default SSH configuration disables support for <html:code>.rhosts</html:code>. The appropriate
configuration is used if no value is set for <html:code>IgnoreRhosts</html:code>.
<html:br/>
To explicitly disable support for .rhosts files, add or correct the following line in


<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre>IgnoreRhosts yes</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000107-VMM-000530</xccdf-1.2:reference>
              <xccdf-1.2:rationale>SSH trust relationships mean a compromise on one host
can allow an attacker to move trivially to other hosts.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_disable_rhosts" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

LC_ALL=C sed -i "/^\s*IgnoreRhosts\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*IgnoreRhosts\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*IgnoreRhosts\s\+/Id" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    touch "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"

cp "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "IgnoreRhosts yes" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
    printf '%s\n' "IgnoreRhosts yes" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_disable_rhosts" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Disable SSH Support for .rhosts Files
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "IgnoreRhosts"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter IgnoreRhosts is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "IgnoreRhosts"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "IgnoreRhosts"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
        create: true
        regexp: ^\s*{{ "IgnoreRhosts"| regex_escape }}\s+
        line: IgnoreRhosts yes
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_rhosts
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_disable_rhosts:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_disable_rhosts_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_disable_rhosts_rsa" severity="medium">
              <xccdf-1.2:title>Disable SSH Support for Rhosts RSA Authentication</xccdf-1.2:title>
              <xccdf-1.2:description>SSH can allow authentication through the obsolete rsh
command through the use of the authenticating user's SSH keys. This should be disabled.
<html:br/><html:br/>
To ensure this behavior is disabled, add or correct the
following line in <html:code>/etc/ssh/sshd_config</html:code>:
<html:pre>RhostsRSAAuthentication no</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">As of <html:code>openssh-server</html:code> version <html:code>7.4</html:code> and above,
the <html:code>RhostsRSAAuthentication</html:code> option has been deprecated, and the line
<html:pre>RhostsRSAAuthentication no</html:pre> in <html:code>/etc/ssh/sshd_config</html:code> is not
necessary.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Configuring this setting for the SSH daemon provides additional
assurance that remote login via SSH will require a password, even
in the event of misconfiguration elsewhere.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_disable_rhosts_rsa"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/ssh/sshd_config"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^RhostsRSAAuthentication")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "no"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^RhostsRSAAuthentication\\&gt;" "/etc/ssh/sshd_config"; then
    "${sed_command[@]}" "s/^RhostsRSAAuthentication\\&gt;.*/$formatted_output/gi" "/etc/ssh/sshd_config"
else
    # \n is precaution for case where file ends without trailing newline
    
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/ssh/sshd_config"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_disable_rhosts_rsa" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Disable SSH Support for Rhosts RSA Authentication
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*RhostsRSAAuthentication\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*RhostsRSAAuthentication\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*RhostsRSAAuthentication\s+
        line: RhostsRSAAuthentication no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_rhosts_rsa
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_disable_rhosts_rsa:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_disable_rhosts_rsa_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" severity="medium">
              <xccdf-1.2:title>Disable SSH Root Login</xccdf-1.2:title>
              <xccdf-1.2:description>The root user should never be allowed to login to a
system directly over a network.
To disable root login via SSH, add or correct the following line in


<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre>PermitRootLogin no</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R19)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT007(R21)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000770</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000109-GPOS-00056</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000480-VMM-002000</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Even though the communications channel may be encrypted, an additional layer of
security is gained by extending the policy of not logging directly on as root.
In addition, logging in with a user-specific account provides individual
accountability of actions performed on the system and also helps to minimize
direct attack attempts on root's password.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_disable_root_login" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*PermitRootLogin\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*PermitRootLogin\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*PermitRootLogin\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "PermitRootLogin no" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    printf '%s\n' "PermitRootLogin no" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_disable_root_login" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Disable SSH Root Login
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "PermitRootLogin"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter PermitRootLogin is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "PermitRootLogin"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "PermitRootLogin"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
        create: true
        regexp: ^\s*{{ "PermitRootLogin"| regex_escape }}\s+
        line: PermitRootLogin no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6(2)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-IA-2
    - NIST-800-53-IA-2(5)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_root_login
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_disable_root_login:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_disable_root_login_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_disable_root_password_login" severity="medium">
              <xccdf-1.2:title>Disable SSH root Login with a Password (Insecure)</xccdf-1.2:title>
              <xccdf-1.2:description>To disable password-based root logins over SSH, add or correct the following line in


<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre>PermitRootLogin prohibit-password</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="general">While this disables password-based root logins, direct root logins
through other means such as through SSH keys or GSSAPI will still be
permitted. Permitting any sort of root login remotely opens up the
root account to attack.
To fully disable direct root logins over SSH (which is considered a
best practice) and prevent remote attacks against the root account,
see CCE-27100-7, CCE-27445-6, CCE-80901-2, and similar.</xccdf-1.2:warning>
              <xccdf-1.2:rationale>Even though the communications channel may be encrypted, an additional
layer of security is gained by preventing use of a password.
This also helps to minimize direct attack attempts on root's password.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_disable_root_password_login" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*PermitRootLogin\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*PermitRootLogin\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*PermitRootLogin\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "PermitRootLogin prohibit-password" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    printf '%s\n' "PermitRootLogin prohibit-password" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_disable_root_password_login" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Disable SSH root Login with a Password (Insecure)
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "PermitRootLogin"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter PermitRootLogin is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "PermitRootLogin"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "PermitRootLogin"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
        create: true
        regexp: ^\s*{{ "PermitRootLogin"| regex_escape }}\s+
        line: PermitRootLogin prohibit-password
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_root_password_login
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_disable_root_password_login:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_disable_root_password_login_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_disable_tcp_forwarding" severity="medium">
              <xccdf-1.2:title>Disable SSH TCP Forwarding</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>AllowTcpForwarding</html:code> parameter specifies whether TCP forwarding is permitted.
To disable TCP forwarding, add or correct the following line in


<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre>AllowTcpForwarding no</html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale>Leaving port forwarding enabled can expose the organization to security risks and back-doors.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_disable_tcp_forwarding" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*AllowTcpForwarding\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*AllowTcpForwarding\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*AllowTcpForwarding\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "AllowTcpForwarding no" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    printf '%s\n' "AllowTcpForwarding no" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_disable_tcp_forwarding" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Disable SSH TCP Forwarding
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "AllowTcpForwarding"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter AllowTcpForwarding is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "AllowTcpForwarding"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "AllowTcpForwarding"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
        create: true
        regexp: ^\s*{{ "AllowTcpForwarding"| regex_escape }}\s+
        line: AllowTcpForwarding no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_tcp_forwarding
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_disable_tcp_forwarding:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_disable_tcp_forwarding_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_disable_user_known_hosts" severity="medium">
              <xccdf-1.2:title>Disable SSH Support for User Known Hosts</xccdf-1.2:title>
              <xccdf-1.2:description>SSH can allow system users to connect to systems if a cache of the remote
systems public keys is available.  This should be disabled.
<html:br/><html:br/>
To ensure this behavior is disabled, add or correct the following line in


<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre>IgnoreUserKnownHosts yes</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Configuring this setting for the SSH daemon provides additional
assurance that remote login via SSH will require a password, even
in the event of misconfiguration elsewhere.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_disable_user_known_hosts" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*IgnoreUserKnownHosts\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*IgnoreUserKnownHosts\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*IgnoreUserKnownHosts\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "IgnoreUserKnownHosts yes" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    printf '%s\n' "IgnoreUserKnownHosts yes" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_disable_user_known_hosts" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Disable SSH Support for User Known Hosts
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "IgnoreUserKnownHosts"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter IgnoreUserKnownHosts is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "IgnoreUserKnownHosts"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "IgnoreUserKnownHosts"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
        create: true
        regexp: ^\s*{{ "IgnoreUserKnownHosts"| regex_escape }}\s+
        line: IgnoreUserKnownHosts yes
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_user_known_hosts
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_disable_user_known_hosts:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_disable_user_known_hosts_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_disable_x11_forwarding" severity="medium">
              <xccdf-1.2:title>Disable X11 Forwarding</xccdf-1.2:title>
              <xccdf-1.2:description>The X11Forwarding parameter provides the ability to tunnel X11 traffic
through the connection to enable remote graphic connections.
SSH has the capability to encrypt remote X11 connections when SSH's
<html:code>X11Forwarding</html:code> option is enabled.
<html:br/>
The default SSH configuration disables X11Forwarding. The appropriate
configuration is used if no value is set for <html:code>X11Forwarding</html:code>.
<html:br/>
To explicitly disable X11 Forwarding, add or correct the following line in


<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre>X11Forwarding no</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Disable X11 forwarding unless there is an operational requirement to use X11
applications directly. There is a small risk that the remote X11 servers of
users who are logged in via SSH with X11 forwarding could be compromised by
other users on the X11 server. Note that even if X11 forwarding is disabled,
users can always install their own forwarders.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_disable_x11_forwarding" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

LC_ALL=C sed -i "/^\s*X11Forwarding\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*X11Forwarding\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*X11Forwarding\s\+/Id" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    touch "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"

cp "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "X11Forwarding no" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
    printf '%s\n' "X11Forwarding no" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_disable_x11_forwarding" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Disable X11 Forwarding
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "X11Forwarding"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter X11Forwarding is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "X11Forwarding"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "X11Forwarding"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
        create: true
        regexp: ^\s*{{ "X11Forwarding"| regex_escape }}\s+
        line: X11Forwarding no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_x11_forwarding
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_disable_x11_forwarding:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_disable_x11_forwarding_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_do_not_permit_user_env" severity="medium">
              <xccdf-1.2:title>Do Not Allow SSH Environment Options</xccdf-1.2:title>
              <xccdf-1.2:description>Ensure that users are not able to override environment variables of the SSH daemon.
<html:br/>
The default SSH configuration disables environment processing. The appropriate
configuration is used if no value is set for <html:code>PermitUserEnvironment</html:code>.
<html:br/>
To explicitly disable Environment options, add or correct the following


<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre>PermitUserEnvironment no</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00229</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000480-VMM-002000</xccdf-1.2:reference>
              <xccdf-1.2:rationale>SSH environment options potentially allow users to bypass
access restriction in some configurations.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_do_not_permit_user_env" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

LC_ALL=C sed -i "/^\s*PermitUserEnvironment\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*PermitUserEnvironment\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*PermitUserEnvironment\s\+/Id" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    touch "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"

cp "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "PermitUserEnvironment no" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
    printf '%s\n' "PermitUserEnvironment no" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_do_not_permit_user_env" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Do Not Allow SSH Environment Options
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "PermitUserEnvironment"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter PermitUserEnvironment is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "PermitUserEnvironment"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "PermitUserEnvironment"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
        create: true
        regexp: ^\s*{{ "PermitUserEnvironment"| regex_escape }}\s+
        line: PermitUserEnvironment no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_do_not_permit_user_env
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_do_not_permit_user_env:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_do_not_permit_user_env_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_enable_gssapi_auth" severity="medium">
              <xccdf-1.2:title>Enable GSSAPI Authentication</xccdf-1.2:title>
              <xccdf-1.2:description>Sites setup to use Kerberos or other GSSAPI Authenticaion require setting
sshd to accept this authentication.
To enable GSSAPI authentication, add or correct the following line in


<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre>GSSAPIAuthentication yes</html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale>Kerberos authentication for SSH is often implemented using GSSAPI. If
Kerberos is enabled through SSH, the SSH daemon provides a means of access
to the system's Kerberos implementation. Vulnerabilities in the system's
Kerberos implementations may be subject to exploitation.

For enterprises, Kerberos is often enabled and used with GSSAPI for 
centralized user account management which may necessitate enabling of
GSSAPI functionality in SSH. </xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_enable_gssapi_auth" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*GSSAPIAuthentication\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*GSSAPIAuthentication\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*GSSAPIAuthentication\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "GSSAPIAuthentication yes" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    printf '%s\n' "GSSAPIAuthentication yes" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_enable_gssapi_auth" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Enable GSSAPI Authentication
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "GSSAPIAuthentication"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter GSSAPIAuthentication is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "GSSAPIAuthentication"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "GSSAPIAuthentication"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
        create: true
        regexp: ^\s*{{ "GSSAPIAuthentication"| regex_escape }}\s+
        line: GSSAPIAuthentication yes
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_enable_gssapi_auth
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_enable_gssapi_auth:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_enable_gssapi_auth_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_enable_pam" severity="medium">
              <xccdf-1.2:title>Enable PAM</xccdf-1.2:title>
              <xccdf-1.2:description>UsePAM Enables the Pluggable Authentication Module interface. If set to “yes” this will
enable PAM authentication using ChallengeResponseAuthentication and
PasswordAuthentication in addition to PAM account and session module processing for all
authentication types.

To enable PAM authentication, add or correct the following line in


<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre>UsePAM yes</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000877</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000125-GPOS-00065</xccdf-1.2:reference>
              <xccdf-1.2:rationale>When UsePAM is set to yes, PAM runs through account and session types properly. This is
important if you want to restrict access to services based off of IP, time or other factors of
the account. Additionally, you can make sure users inherit certain environment variables
on login or disallow access to the server.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_enable_pam" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*UsePAM\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*UsePAM\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*UsePAM\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "UsePAM yes" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    printf '%s\n' "UsePAM yes" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_enable_pam" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Enable PAM
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "UsePAM"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter UsePAM is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "UsePAM"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "UsePAM"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
        create: true
        regexp: ^\s*{{ "UsePAM"| regex_escape }}\s+
        line: UsePAM yes
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_enable_pam
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_enable_pam:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_enable_pam_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_enable_pubkey_auth" severity="medium">
              <xccdf-1.2:title>Enable Public Key Authentication</xccdf-1.2:title>
              <xccdf-1.2:description>Enable SSH login with public keys.
<html:br/>
The default SSH configuration enables authentication based on public keys. The appropriate
configuration is used if no value is set for <html:code>PubkeyAuthentication</html:code>.
<html:br/>
To explicitly enable Public Key Authentication, add or correct the following


<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre>PubkeyAuthentication yes</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000765</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000766</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000767</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000768</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000105-GPOS-00052</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000106-GPOS-00053</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000107-GPOS-00054</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00055</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Without the use of multifactor authentication, the ease of access to
privileged functions is greatly increased. Multifactor authentication
requires using two or more factors to achieve authentication.
A privileged account is defined as an information system account with
authorizations of a privileged user. 
The DoD CAC with DoD-approved PKI is an example of multifactor
authentication.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_enable_pubkey_auth" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*PubkeyAuthentication\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*PubkeyAuthentication\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*PubkeyAuthentication\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "PubkeyAuthentication yes" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    printf '%s\n' "PubkeyAuthentication yes" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_enable_pubkey_auth" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Enable Public Key Authentication
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "PubkeyAuthentication"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter PubkeyAuthentication is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "PubkeyAuthentication"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "PubkeyAuthentication"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
        create: true
        regexp: ^\s*{{ "PubkeyAuthentication"| regex_escape }}\s+
        line: PubkeyAuthentication yes
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_enable_pubkey_auth
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_enable_pubkey_auth:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_enable_pubkey_auth_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_enable_strictmodes" severity="medium">
              <xccdf-1.2:title>Enable Use of Strict Mode Checking</xccdf-1.2:title>
              <xccdf-1.2:description>SSHs <html:code>StrictModes</html:code> option checks file and ownership permissions in
the user's home directory <html:code>.ssh</html:code> folder before accepting login. If world-
writable permissions are found, logon is rejected.
<html:br/>
The default SSH configuration has <html:code>StrictModes</html:code> enabled. The appropriate
configuration is used if no value is set for <html:code>StrictModes</html:code>.
<html:br/>
To explicitly enable <html:code>StrictModes</html:code> in SSH, add or correct the following line in


<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre>StrictModes yes</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000480-VMM-002000</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If other users have access to modify user-specific SSH configuration files, they
may be able to log into the system as another user.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_enable_strictmodes" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

LC_ALL=C sed -i "/^\s*StrictModes\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*StrictModes\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*StrictModes\s\+/Id" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    touch "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"

cp "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "StrictModes yes" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
    printf '%s\n' "StrictModes yes" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_enable_strictmodes" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Enable Use of Strict Mode Checking
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "StrictModes"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter StrictModes is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "StrictModes"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "StrictModes"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
        create: true
        regexp: ^\s*{{ "StrictModes"| regex_escape }}\s+
        line: StrictModes yes
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_enable_strictmodes
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_enable_strictmodes:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_enable_strictmodes_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner" severity="medium">
              <xccdf-1.2:title>Enable SSH Warning Banner</xccdf-1.2:title>
              <xccdf-1.2:description>To enable the warning banner and ensure it is consistent
across the system, add or correct the following line in


<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre>Banner /etc/issue</html:pre>
Another section contains information on how to create an
appropriate system-wide warning banner.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000048</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000050</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001384</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001385</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001386</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001387</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001388</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FTA_TAB.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000023-GPOS-00006</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000228-GPOS-00088</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000023-VMM-000060</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000024-VMM-000070</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The warning message reinforces policy awareness during the logon process and
facilitates possible legal action against attackers. Alternatively, systems
whose ownership should not be obvious should ensure usage of a banner that does
not provide easy attribution.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_enable_warning_banner" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*Banner\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*Banner\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*Banner\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "Banner /etc/issue" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    printf '%s\n' "Banner /etc/issue" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_enable_warning_banner" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Enable SSH Warning Banner
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "Banner"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter Banner is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "Banner"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "Banner"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
        create: true
        regexp: ^\s*{{ "Banner"| regex_escape }}\s+
        line: Banner /etc/issue
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_enable_warning_banner
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_enable_warning_banner:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_enable_warning_banner_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner_net" severity="medium">
              <xccdf-1.2:title>Enable SSH Warning Banner</xccdf-1.2:title>
              <xccdf-1.2:description>To enable the warning banner and ensure it is consistent
across the system, add or correct the following line in

<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre>Banner /etc/issue.net</html:pre>
Another section contains information on how to create an
appropriate system-wide warning banner.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000048</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000050</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001384</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001385</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001386</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001387</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001388</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FTA_TAB.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000023-GPOS-00006</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000228-GPOS-00088</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000023-VMM-000060</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000024-VMM-000070</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The warning message reinforces policy awareness during the logon process and
facilitates possible legal action against attackers. Alternatively, systems
whose ownership should not be obvious should ensure usage of a banner that does
not provide easy attribution.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_enable_warning_banner_net" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*Banner\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*Banner\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*Banner\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "Banner /etc/issue.net" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    printf '%s\n' "Banner /etc/issue.net" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_enable_warning_banner_net" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Enable SSH Warning Banner
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "Banner"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter Banner is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "Banner"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "Banner"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
        create: true
        regexp: ^\s*{{ "Banner"| regex_escape }}\s+
        line: Banner /etc/issue.net
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_enable_warning_banner_net
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_enable_warning_banner_net:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_enable_warning_banner_net_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_enable_x11_forwarding" severity="high">
              <xccdf-1.2:title>Enable Encrypted X11 Forwarding</xccdf-1.2:title>
              <xccdf-1.2:description>By default, remote X11 connections are not encrypted when initiated
by users. SSH has the capability to encrypt remote X11 connections when SSH's
<html:code>X11Forwarding</html:code> option is enabled.
<html:br/><html:br/>
To enable X11 Forwarding, add or correct the following line in


<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre>X11Forwarding yes</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">20</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.08</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI07.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Non-encrypted X displays allow an attacker to capture keystrokes and to execute commands
remotely.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_enable_x11_forwarding" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*X11Forwarding\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*X11Forwarding\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*X11Forwarding\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "X11Forwarding yes" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    printf '%s\n' "X11Forwarding yes" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_enable_x11_forwarding" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Enable Encrypted X11 Forwarding
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "X11Forwarding"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter X11Forwarding is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "X11Forwarding"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "X11Forwarding"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
        create: true
        regexp: ^\s*{{ "X11Forwarding"| regex_escape }}\s+
        line: X11Forwarding yes
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.13
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
    - sshd_enable_x11_forwarding
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_enable_x11_forwarding:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_enable_x11_forwarding_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_limit_user_access" severity="unknown">
              <xccdf-1.2:title>Limit Users' SSH Access</xccdf-1.2:title>
              <xccdf-1.2:description>By default, the SSH configuration allows any user with an account
to access the system. In order to specify the users that are allowed to login
via SSH and deny all other users, add or correct the following line in the
<html:code>/etc/ssh/sshd_config</html:code> file:
<html:pre>AllowUsers USER1 USER2</html:pre>
Where <html:code>USER1</html:code> and <html:code>USER2</html:code> are valid user names.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Specifying which accounts are allowed SSH access into the system reduces the
possibility of unauthorized access to the system.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_limit_user_access_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_print_last_log" severity="medium">
              <xccdf-1.2:title>Enable SSH Print Last Log</xccdf-1.2:title>
              <xccdf-1.2:description>Ensure that SSH will display the date and time of the last successful account logon.
<html:br/>
The default SSH configuration enables print of the date and time of the last login.
The appropriate configuration is used if no value is set for <html:code>PrintLastLog</html:code>.
<html:br/>
To explicitly enable LastLog in SSH, add or correct the following line in


<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre>PrintLastLog yes</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Providing users feedback on when account accesses last occurred facilitates user
recognition and reporting of unauthorized account use.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_print_last_log" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

LC_ALL=C sed -i "/^\s*PrintLastLog\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*PrintLastLog\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*PrintLastLog\s\+/Id" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    touch "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"

cp "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "PrintLastLog yes" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
    printf '%s\n' "PrintLastLog yes" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_print_last_log" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Enable SSH Print Last Log
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "PrintLastLog"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter PrintLastLog is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "PrintLastLog"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "PrintLastLog"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
        create: true
        regexp: ^\s*{{ "PrintLastLog"| regex_escape }}\s+
        line: PrintLastLog yes
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-9
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_print_last_log
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_print_last_log:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_print_last_log_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_rekey_limit" severity="medium">
              <xccdf-1.2:title>Force frequent session key renegotiation</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>RekeyLimit</html:code> parameter specifies how often
the session key of the is renegotiated, both in terms of
amount of data that may be transmitted and the time
elapsed.<html:br/>
To decrease the default limits, add or correct the following line in


<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre>RekeyLimit <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rekey_limit_size" use="legacy"/> <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rekey_limit_time" use="legacy"/></html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000068</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_SSHS_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000033-GPOS-00014</xccdf-1.2:reference>
              <xccdf-1.2:rationale>By decreasing the limit based on the amount of data and enabling
time-based limit, effects of potential attacks against
encryption keys are limited.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_rekey_limit"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

var_rekey_limit_size='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rekey_limit_size" use="legacy"/>'
var_rekey_limit_time='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rekey_limit_time" use="legacy"/>'



mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*RekeyLimit\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*RekeyLimit\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*RekeyLimit\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "RekeyLimit $var_rekey_limit_size $var_rekey_limit_time" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    printf '%s\n' "RekeyLimit $var_rekey_limit_size $var_rekey_limit_time" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_rekey_limit" complexity="low" disruption="low" reboot="false" strategy="configure">- name: XCCDF Value var_rekey_limit_size # promote to variable
  set_fact:
    var_rekey_limit_size: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rekey_limit_size" use="legacy"/>
  tags:
    - always
- name: XCCDF Value var_rekey_limit_time # promote to variable
  set_fact:
    var_rekey_limit_time: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rekey_limit_time" use="legacy"/>
  tags:
    - always

- name: Force frequent session key renegotiation
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "RekeyLimit"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter RekeyLimit is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "RekeyLimit"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "RekeyLimit"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
        create: true
        regexp: ^\s*{{ "RekeyLimit"| regex_escape }}\s+
        line: RekeyLimit {{ var_rekey_limit_size }} {{ var_rekey_limit_time }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - sshd_rekey_limit
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_rekey_limit_time:var:1" value-id="xccdf_org.ssgproject.content_value_var_rekey_limit_time"/>
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-export export-name="oval:ssg-var_rekey_limit_size:var:1" value-id="xccdf_org.ssgproject.content_value_var_rekey_limit_size"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_rekey_limit:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_rekey_limit_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_set_login_grace_time" severity="medium">
              <xccdf-1.2:title>Ensure SSH LoginGraceTime is configured</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>LoginGraceTime</html:code> parameter to the SSH server specifies the time allowed for successful authentication to
the SSH server. The longer the Grace period is the more open unauthenticated connections
can exist. Like other session controls in this session the Grace Period should be limited to
appropriate limits to ensure the service is available for needed access.</xccdf-1.2:description>
              <xccdf-1.2:rationale>Setting the <html:code>LoginGraceTime</html:code> parameter to a low number will minimize the risk of successful
brute force attacks to the SSH server. It will also limit the number of concurrent
unauthenticated connections.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_set_login_grace_time" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

var_sshd_set_login_grace_time='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_set_login_grace_time" use="legacy"/>'


if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*LoginGraceTime\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "LoginGraceTime $var_sshd_set_login_grace_time" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "LoginGraceTime $var_sshd_set_login_grace_time" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_set_login_grace_time" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: XCCDF Value var_sshd_set_login_grace_time # promote to variable
  set_fact:
    var_sshd_set_login_grace_time: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_set_login_grace_time" use="legacy"/>
  tags:
    - always

- name: Ensure SSH LoginGraceTime is configured
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*LoginGraceTime\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*LoginGraceTime\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*LoginGraceTime\s+
        line: LoginGraceTime {{ var_sshd_set_login_grace_time }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_login_grace_time
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_sshd_set_login_grace_time:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_set_login_grace_time"/>
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_set_login_grace_time:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_set_login_grace_time_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_set_loglevel_info" severity="low">
              <xccdf-1.2:title>Set LogLevel to INFO</xccdf-1.2:title>
              <xccdf-1.2:description>The INFO parameter specifices that record login and logout activity will be logged.
<html:br/>
The default SSH configuration sets the log level to INFO. The appropriate
configuration is used if no value is set for <html:code>LogLevel</html:code>.
<html:br/>
To explicitly specify the log level in SSH, add or correct the following line in


<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre>LogLevel INFO</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>SSH provides several logging levels with varying amounts of verbosity. <html:code>DEBUG</html:code> is specifically
not recommended other than strictly for debugging SSH communications since it provides
so much data that it is difficult to identify important security information. <html:code>INFO</html:code> level is the
basic level that only records login activity of SSH users. In many situations, such as Incident
Response, it is important to determine when a particular user was active on a system. The
logout record can eliminate those users who disconnected, which helps narrow the field.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_set_loglevel_info" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

LC_ALL=C sed -i "/^\s*LogLevel\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*LogLevel\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*LogLevel\s\+/Id" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    touch "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"

cp "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "LogLevel INFO" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
    printf '%s\n' "LogLevel INFO" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_set_loglevel_info" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Set LogLevel to INFO
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "LogLevel"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter LogLevel is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "LogLevel"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "LogLevel"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
        create: true
        regexp: ^\s*{{ "LogLevel"| regex_escape }}\s+
        line: LogLevel INFO
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_loglevel_info
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_set_loglevel_info:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_set_loglevel_info_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_set_loglevel_verbose" severity="medium">
              <xccdf-1.2:title>Set SSH Daemon LogLevel to VERBOSE</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>VERBOSE</html:code> parameter configures the SSH daemon to record login and logout activity.
To specify the log level in
SSH, add or correct the following line in


<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre>LogLevel VERBOSE</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000067</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000032-GPOS-00013</xccdf-1.2:reference>
              <xccdf-1.2:rationale>SSH provides several logging levels with varying amounts of verbosity. <html:code>DEBUG</html:code> is specifically
not recommended other than strictly for debugging SSH communications since it provides
so much data that it is difficult to identify important security information. <html:code>INFO</html:code> or
<html:code>VERBOSE</html:code> level is the basic level that only records login activity of SSH users. In many
situations, such as Incident Response, it is important to determine when a particular user was active
on a system. The logout record can eliminate those users who disconnected, which helps narrow the
field.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_set_loglevel_verbose" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*LogLevel\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*LogLevel\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*LogLevel\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "LogLevel VERBOSE" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    printf '%s\n' "LogLevel VERBOSE" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_set_loglevel_verbose" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Set SSH Daemon LogLevel to VERBOSE
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "LogLevel"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter LogLevel is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "LogLevel"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "LogLevel"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
        create: true
        regexp: ^\s*{{ "LogLevel"| regex_escape }}\s+
        line: LogLevel VERBOSE
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-17(1)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_loglevel_verbose
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_set_loglevel_verbose:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_set_loglevel_verbose_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_set_max_auth_tries" severity="medium">
              <xccdf-1.2:title>Set SSH authentication attempt limit</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>MaxAuthTries</html:code> parameter specifies the maximum number of authentication attempts
permitted per connection. Once the number of failures reaches half this value, additional failures are logged.
to set MaxAUthTries edit <html:code>/etc/ssh/sshd_config</html:code> as follows:
<html:pre>MaxAuthTries <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value" use="legacy"/></html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="">0421</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0422</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0431</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0974</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1173</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1401</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1504</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1505</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1546</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1557</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1558</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1559</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1560</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1561</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Setting the MaxAuthTries parameter to a low number will minimize the risk of successful
brute force attacks to the SSH server.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_set_max_auth_tries"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

sshd_max_auth_tries_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value" use="legacy"/>'


if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*MaxAuthTries\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "MaxAuthTries $sshd_max_auth_tries_value" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "MaxAuthTries $sshd_max_auth_tries_value" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_set_max_auth_tries" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: XCCDF Value sshd_max_auth_tries_value # promote to variable
  set_fact:
    sshd_max_auth_tries_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value" use="legacy"/>
  tags:
    - always

- name: Set SSH authentication attempt limit
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*MaxAuthTries\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*MaxAuthTries\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*MaxAuthTries\s+
        line: MaxAuthTries {{ sshd_max_auth_tries_value }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_max_auth_tries
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_max_auth_tries_value:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_set_max_auth_tries:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_set_max_auth_tries_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_set_max_sessions" severity="medium">
              <xccdf-1.2:title>Set SSH MaxSessions limit</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>MaxSessions</html:code> parameter specifies the maximum number of open sessions permitted
from a given connection. To set MaxSessions edit
<html:code>/etc/ssh/sshd_config</html:code> as follows: <html:pre>MaxSessions <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_max_sessions" use="legacy"/></html:pre></xccdf-1.2:description>
              <xccdf-1.2:rationale>To protect a system from denial of service due to a large number of concurrent
sessions, use the rate limiting function of MaxSessions to protect availability
of sshd logins and prevent overwhelming the daemon.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_set_max_sessions" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

var_sshd_max_sessions='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_max_sessions" use="legacy"/>'


if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*MaxSessions\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "MaxSessions $var_sshd_max_sessions" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "MaxSessions $var_sshd_max_sessions" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_set_max_sessions" complexity="low" disruption="low" reboot="false" strategy="configure">- name: XCCDF Value var_sshd_max_sessions # promote to variable
  set_fact:
    var_sshd_max_sessions: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_max_sessions" use="legacy"/>
  tags:
    - always

- name: Set SSH MaxSessions limit
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*MaxSessions\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*MaxSessions\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*MaxSessions\s+
        line: MaxSessions {{ var_sshd_max_sessions }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - sshd_set_max_sessions
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-export export-name="oval:ssg-var_sshd_max_sessions:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_max_sessions"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_set_max_sessions:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_set_max_sessions_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_set_maxstartups" severity="medium">
              <xccdf-1.2:title>Ensure SSH MaxStartups is configured</xccdf-1.2:title>
              <xccdf-1.2:description>The MaxStartups parameter specifies the maximum number of concurrent
unauthenticated connections to the SSH daemon. Additional connections will be
dropped until authentication succeeds or the LoginGraceTime expires for a
connection. To confgure MaxStartups, you should add or correct the following
line in the
<html:code>/etc/ssh/sshd_config</html:code> file:
<html:pre>MaxStartups <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_set_maxstartups" use="legacy"/></html:pre>
CIS recommends a MaxStartups value of '10:30:60', or more restrictive where
dictated by site policy.</xccdf-1.2:description>
              <xccdf-1.2:rationale>To protect a system from denial of service due to a large number of pending
authentication connection attempts, use the rate limiting function of MaxStartups
to protect availability of sshd logins and prevent overwhelming the daemon.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_set_maxstartups" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

var_sshd_set_maxstartups='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_set_maxstartups" use="legacy"/>'


if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*MaxStartups\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "MaxStartups $var_sshd_set_maxstartups" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "MaxStartups $var_sshd_set_maxstartups" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_set_maxstartups" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: XCCDF Value var_sshd_set_maxstartups # promote to variable
  set_fact:
    var_sshd_set_maxstartups: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_set_maxstartups" use="legacy"/>
  tags:
    - always

- name: Ensure SSH MaxStartups is configured
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*MaxStartups\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*MaxStartups\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*MaxStartups\s+
        line: MaxStartups {{ var_sshd_set_maxstartups }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_maxstartups
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_set_maxstartups:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_set_maxstartups_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_use_directory_configuration" severity="medium">
              <xccdf-1.2:title>Distribute the SSH Server configuration to multiple files in a config directory.</xccdf-1.2:title>
              <xccdf-1.2:description>Make sure to have the <html:code>Include /etc/ssh/sshd_config.d/*.conf</html:code> line in the <html:code>/etc/ssh/sshd_config</html:code> file.
Ideally, don't have any active configuration directives in that file, and distribute the service configuration
to several files in the <html:code>/etc/ssh/sshd_config.d</html:code> directory.</xccdf-1.2:description>
              <xccdf-1.2:rationale>This form of distributed configuration is considered as a good practice, and as other sshd rules assume that directives in files in the <html:code>/etc/ssh/sshd_config.d</html:code> config directory are effective, there has to be a rule that ensures this.
Aside from that, having multiple configuration files makes the SSH Server configuration changes easier to partition according to the reason that they were introduced, and therefore it should help to perform merges of hardening updates.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_use_directory_configuration"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if test -f /etc/ssh/sshd_config.d/sshd_config_original.conf; then
	printf '%s\n' "Remediation probably already happened, '/etc/ssh/sshd_config.d/sshd_config_original.conf' already exists, not doing anything." &gt;&amp;2
false 1
elif grep -Eq '^\s*Include\s+/etc/ssh/sshd_config\.d/\*\.conf' /etc/ssh/sshd_config &amp;&amp; ! grep -Eq '^\s*Match\s' /etc/ssh/sshd_config; then
	printf '%s\n' "Remediation probably already happened, '/etc/ssh/sshd_config' already contains the include directive." &gt;&amp;2
false 1
else
	mkdir -p /etc/ssh/sshd_config.d
	mv /etc/ssh/sshd_config /etc/ssh/sshd_config.d/sshd_config_original.conf
cat &gt; /etc/ssh/sshd_config &lt;&lt; EOF
# To modify the system-wide sshd configuration, create a  *.conf  file under
#  /etc/ssh/sshd_config.d/  which will be automatically included below

Include /etc/ssh/sshd_config.d/*.conf
EOF
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_use_directory_configuration:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_use_directory_configuration_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_use_priv_separation" severity="medium">
              <xccdf-1.2:title>Enable Use of Privilege Separation</xccdf-1.2:title>
              <xccdf-1.2:description>When enabled, SSH will create an unprivileged child process that
has the privilege of the authenticated user. To enable privilege separation in
SSH, add or correct the following line in the <html:code>/etc/ssh/sshd_config</html:code> file:
<html:pre>UsePrivilegeSeparation <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_priv_separation" use="legacy"/></html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>SSH daemon privilege separation causes the SSH process to drop root privileges
when not needed which would decrease the impact of software vulnerabilities in
the unprivileged section.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_use_priv_separation" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

var_sshd_priv_separation='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_priv_separation" use="legacy"/>'


if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*UsePrivilegeSeparation\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "UsePrivilegeSeparation $var_sshd_priv_separation" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "UsePrivilegeSeparation $var_sshd_priv_separation" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_use_priv_separation" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: XCCDF Value var_sshd_priv_separation # promote to variable
  set_fact:
    var_sshd_priv_separation: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_priv_separation" use="legacy"/>
  tags:
    - always

- name: Enable Use of Privilege Separation
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*UsePrivilegeSeparation\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*UsePrivilegeSeparation\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*UsePrivilegeSeparation\s+
        line: UsePrivilegeSeparation {{ var_sshd_priv_separation }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_use_priv_separation
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-export export-name="oval:ssg-var_sshd_priv_separation:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_priv_separation"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_use_priv_separation:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_use_priv_separation_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_x11_use_localhost" severity="medium">
              <xccdf-1.2:title>Prevent remote hosts from connecting to the proxy display</xccdf-1.2:title>
              <xccdf-1.2:description>The SSH daemon should prevent remote hosts from connecting to the proxy
display.
<html:br/>
The default SSH configuration for <html:code>X11UseLocalhost</html:code> is <html:code>yes</html:code>,
which prevents remote hosts from connecting to the proxy display.
<html:br/>
To explicitly prevent remote connections to the proxy display, add or correct
the following line in


<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:code>X11UseLocalhost yes</html:code></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>When X11 forwarding is enabled, there may be additional exposure to the
server and client displays if the sshd proxy display is configured to listen
on the wildcard address. By default, sshd binds the forwarding server to the
loopback address and sets the hostname part of the <html:code>DISPLAY</html:code>
environment variable to localhost. This prevents remote hosts from
connecting to the proxy display.  </xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_x11_use_localhost" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

LC_ALL=C sed -i "/^\s*X11UseLocalhost\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*X11UseLocalhost\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*X11UseLocalhost\s\+/Id" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    touch "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"

cp "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "X11UseLocalhost yes" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
    printf '%s\n' "X11UseLocalhost yes" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_x11_use_localhost" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Prevent remote hosts from connecting to the proxy display
  block:

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: ^\s*{{ "X11UseLocalhost"| regex_escape }}\s+
        state: absent

    - name: Check if /etc/ssh/sshd_config.d exists
      stat:
        path: /etc/ssh/sshd_config.d
      register: _etc_ssh_sshd_config_d_exists

    - name: Check if the parameter X11UseLocalhost is present in /etc/ssh/sshd_config.d
      find:
        paths: /etc/ssh/sshd_config.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ "X11UseLocalhost"| regex_escape }}\s+
      register: _etc_ssh_sshd_config_d_has_parameter
      when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/ssh/sshd_config.d
      lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: ^\s*{{ "X11UseLocalhost"| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
      when: _etc_ssh_sshd_config_d_has_parameter.matched

    - name: Insert correct line to /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
      lineinfile:
        path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
        create: true
        regexp: ^\s*{{ "X11UseLocalhost"| regex_escape }}\s+
        line: X11UseLocalhost yes
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_x11_use_localhost
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sshd_x11_use_localhost:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sshd_x11_use_localhost_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_sshd_strengthen_firewall">
              <xccdf-1.2:title>Strengthen Firewall Configuration if Possible</xccdf-1.2:title>
              <xccdf-1.2:description>If the SSH server is expected to only receive connections from
the local network, then strengthen the default firewall rule for the SSH service
to only accept connections from the appropriate network segment(s).
<html:br/><html:br/>
Determine an appropriate network block, <html:code>netwk</html:code>, network mask, <html:code>mask</html:code>, and
network protocol, <html:code>ip_protocol</html:code>, representing the systems on your network which will
be allowed to access this SSH server.
<html:br/><html:br/>
Run the following command:
<html:pre>firewall-cmd --permanent --add-rich-rule='rule family="ip_protocol" source address="netwk/mask" service name="ssh" accept'</html:pre></xccdf-1.2:description>
              <xccdf-1.2:platform idref="#machine"/>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_sssd">
          <xccdf-1.2:title>System Security Services Daemon</xccdf-1.2:title>
          <xccdf-1.2:description>The System Security Services Daemon (SSSD) is a system daemon that provides access
to different identity and authentication providers such as Red Hat's IdM, Microsoft's AD,
openLDAP, MIT Kerberos, etc. It uses a common framework that can provide caching and offline
support to systems utilizing SSSD. SSSD using caching to reduce load on authentication
servers permit offline authentication as well as store extended user data.
<html:br/><html:br/>
For more information, see</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#sssd"/>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sssd_certificate_verification_digest_function" type="string" interactive="true">
            <xccdf-1.2:title>SSSD certificate_verification option</xccdf-1.2:title>
            <xccdf-1.2:description>Value of the certificate_verification option in
the SSSD config.</xccdf-1.2:description>
            <xccdf-1.2:value selector="sha1">sha1</xccdf-1.2:value>
            <xccdf-1.2:value selector="sha256">sha256</xccdf-1.2:value>
            <xccdf-1.2:value selector="sha384">sha384</xccdf-1.2:value>
            <xccdf-1.2:value selector="sha512">sha512</xccdf-1.2:value>
            <xccdf-1.2:value>sha1</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sssd_memcache_timeout" type="number">
            <xccdf-1.2:title>SSSD memcache_timeout option</xccdf-1.2:title>
            <xccdf-1.2:description>Value of the memcache_timeout option in the [nss] section
of SSSD config /etc/sssd/sssd.conf.</xccdf-1.2:description>
            <xccdf-1.2:value selector="3_minutes">180</xccdf-1.2:value>
            <xccdf-1.2:value selector="5_minutes">300</xccdf-1.2:value>
            <xccdf-1.2:value selector="10_minutes">600</xccdf-1.2:value>
            <xccdf-1.2:value selector="15_minutes">900</xccdf-1.2:value>
            <xccdf-1.2:value selector="30_minutes">1800</xccdf-1.2:value>
            <xccdf-1.2:value selector="1_day">86400</xccdf-1.2:value>
            <xccdf-1.2:value>300</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sssd_ssh_known_hosts_timeout" type="number">
            <xccdf-1.2:title>SSSD ssh_known_hosts_timeout option</xccdf-1.2:title>
            <xccdf-1.2:description>Value of the ssh_known_hosts_timeout option in the [ssh] section
of SSSD configuration file /etc/sssd/sssd.conf.</xccdf-1.2:description>
            <xccdf-1.2:value selector="3_minutes">180</xccdf-1.2:value>
            <xccdf-1.2:value selector="5_minutes">300</xccdf-1.2:value>
            <xccdf-1.2:value selector="10_minutes">600</xccdf-1.2:value>
            <xccdf-1.2:value selector="15_minutes">900</xccdf-1.2:value>
            <xccdf-1.2:value selector="30_minutes">1800</xccdf-1.2:value>
            <xccdf-1.2:value selector="1_day">86400</xccdf-1.2:value>
            <xccdf-1.2:value>180</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_sssd-ipa_installed" severity="medium">
            <xccdf-1.2:title>Install sssd-ipa Package</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>sssd-ipa</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install sssd-ipa</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:rationale><html:code>sssd-ipa</html:code> provides the IPA back end that the SSSD can utilize to
fetch identity data from and authenticate against an IPA server.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#sssd"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_sssd-ipa_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q sssd-common; then

if ! rpm -q --quiet "sssd-ipa" ; then
    dnf install -y "sssd-ipa"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_sssd-ipa_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_sssd-ipa_installed

- name: Ensure sssd-ipa is installed
  package:
    name: sssd-ipa
    state: present
  when: '"sssd-common" in ansible_facts.packages'
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_sssd-ipa_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_sssd-ipa_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_sssd-ipa

class install_sssd-ipa {
  package { 'sssd-ipa':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_sssd-ipa_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=sssd-ipa
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_sssd-ipa_installed">
[[packages]]
name = "sssd-ipa"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_sssd-ipa_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_sssd-ipa_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sssd_certificate_verification" severity="medium">
            <xccdf-1.2:title>Certificate status checking in SSSD</xccdf-1.2:title>
            <xccdf-1.2:description>Multifactor solutions that require devices separate from information systems gaining access include,
for example, hardware tokens providing time-based or challenge-response authenticators and smart cards.
Configuring <html:code>certificate_verification</html:code> to <html:code>ocsp_dgst=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sssd_certificate_verification_digest_function" use="legacy"/></html:code> ensures that certificates for
multifactor solutions are checked via Online Certificate Status Protocol (OCSP).</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001948</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(11)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00160</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000377-GPOS-00162</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Ensuring that multifactor solutions certificates are checked via Online Certificate Status Protocol (OCSP)
ensures the security of the system.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#sssd"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sssd_certificate_verification" complexity="low" disruption="medium" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q sssd-common; then

var_sssd_certificate_verification_digest_function='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sssd_certificate_verification_digest_function" use="legacy"/>'


MAIN_CONF="/etc/sssd/conf.d/certificate_verification.conf"

found=false

# set value in all files if they contain section or key
for f in $(echo -n "$MAIN_CONF /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf"); do
    if [ ! -e "$f" ]; then
        continue
    fi

    # find key in section and change value
    if grep -qzosP "[[:space:]]*\[sssd\]([^\n\[]*\n+)+?[[:space:]]*certificate_verification" "$f"; then
            sed -i "s/certificate_verification[^(\n)]*/certificate_verification = ocsp_dgst = $var_sssd_certificate_verification_digest_function/" "$f"
            found=true

    # find section and add key = value to it
    elif grep -qs "[[:space:]]*\[sssd\]" "$f"; then
            sed -i "/[[:space:]]*sssd/a certificate_verification = ocsp_dgst = $var_sssd_certificate_verification_digest_function" "$f"
            found=true
    fi
done

# if section not in any file, append section with key = value to FIRST file in files parameter
if ! $found ; then
    file=$(echo "$MAIN_CONF /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf" | cut -f1 -d' ')
    mkdir -p "$(dirname "$file")"
    echo -e "[sssd]\ncertificate_verification = ocsp_dgst = $var_sssd_certificate_verification_digest_function" &gt;&gt; "$file"
fi

if [ -e "$MAIN_CONF" ]; then
    chown root:root "$MAIN_CONF"
	chmod 600 "$MAIN_CONF"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sssd_certificate_verification" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-IA-2(11)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_certificate_verification

- name: Ensure that "certificate_verification" is not set in /etc/sssd/sssd.conf
  ini_file:
    path: /etc/sssd/sssd.conf
    section: sssd
    option: certificate_verification
    state: absent
  when: '"sssd-common" in ansible_facts.packages'
  tags:
    - NIST-800-53-IA-2(11)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_certificate_verification

- name: Ensure that "certificate_verification" is not set in  /etc/sssd/conf.d/*.conf
  ini_file:
    path: /etc/sssd/conf.d/*.conf
    section: sssd
    option: certificate_verification
    state: absent
  when: '"sssd-common" in ansible_facts.packages'
  tags:
    - NIST-800-53-IA-2(11)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_certificate_verification

- name: Ensure that "certificate_verification" is set
  ini_file:
    path: /etc/sssd/conf.d/certificate_verification.conf
    section: sssd
    option: certificate_verification
    value: ocsp_dgst = sha1
    state: present
  when: '"sssd-common" in ansible_facts.packages'
  tags:
    - NIST-800-53-IA-2(11)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_certificate_verification
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_sssd_certificate_verification_digest_function:var:1" value-id="xccdf_org.ssgproject.content_value_var_sssd_certificate_verification_digest_function"/>
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sssd_certificate_verification:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sssd_certificate_verification_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sssd_enable_certmap" severity="medium">
            <xccdf-1.2:title>Enable Certmap in SSSD</xccdf-1.2:title>
            <xccdf-1.2:description>SSSD should be configured to verify the certificate of the user or group. To set this up
 ensure that section like <html:code>certmap/testing.test/rule_name</html:code> is setup in
<html:code>/etc/sssd/sssd.conf</html:code>. For example
<html:pre>
[certmap/testing.test/rule_name]
matchrule =&lt;SAN&gt;.*EDIPI@mil
maprule = (userCertificate;binary={cert!bin})
domains = testing.test
</html:pre></xccdf-1.2:description>
            <xccdf-1.2:warning category="general">Automatic remediation of this control is not available, since all of the settings in
in the certmap need to be customized.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000187</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5 (2) (c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000068-GPOS-00036</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Without mapping the certificate used to authenticate to the user account, the ability to
determine the identity of the individual user or group will not be available for forensic
analysis.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#sssd"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sssd_enable_certmap:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sssd_enable_certmap_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sssd_enable_smartcards" severity="medium">
            <xccdf-1.2:title>Enable Smartcards in SSSD</xccdf-1.2:title>
            <xccdf-1.2:description>SSSD should be configured to authenticate access to the system
using smart cards. To enable smart cards in SSSD, set <html:code>pam_cert_auth</html:code>
to <html:code>true</html:code> under the <html:code>[pam]</html:code>
section in <html:code>/etc/sssd/sssd.conf</html:code>. For example:
<html:pre>[pam]
pam_cert_auth = true
</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001954</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000765</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">0421</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">0422</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">0431</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">0974</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1173</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1401</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1504</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1505</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1546</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1557</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1558</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1559</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1560</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1561</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00160</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000105-GPOS-00052</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">SRG-OS-000107-VMM-000530</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Using an authentication device, such as a CAC or token that is separate from
the information system, ensures that even if the information system is
compromised, that compromise will not affect credentials stored on the
authentication device.
<html:br/><html:br/>
Multifactor solutions that require devices separate from
information systems gaining access include, for example, hardware tokens
providing time-based or challenge-response authenticators and smart cards such
as the U.S. Government Personal Identity Verification card and the DoD Common
Access Card.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sssd_enable_smartcards" complexity="low" disruption="medium" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q sssd-common &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

found=false

# set value in all files if they contain section or key
for f in $(echo -n "/etc/sssd/sssd.conf"); do
    if [ ! -e "$f" ]; then
        continue
    fi

    # find key in section and change value
    if grep -qzosP "[[:space:]]*\[pam\]([^\n\[]*\n+)+?[[:space:]]*pam_cert_auth" "$f"; then
            sed -i "s/pam_cert_auth[^(\n)]*/pam_cert_auth = true/" "$f"
            found=true

    # find section and add key = value to it
    elif grep -qs "[[:space:]]*\[pam\]" "$f"; then
            sed -i "/[[:space:]]*pam/a pam_cert_auth = true" "$f"
            found=true
    fi
done

# if section not in any file, append section with key = value to FIRST file in files parameter
if ! $found ; then
    file=$(echo "/etc/sssd/sssd.conf" | cut -f1 -d' ')
    mkdir -p "$(dirname "$file")"
    echo -e "[pam]\npam_cert_auth = true" &gt;&gt; "$file"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sssd_enable_smartcards" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_enable_smartcards

- name: Test for domain group
  command: grep '^\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
  register: test_grep_domain
  ignore_errors: true
  changed_when: false
  check_mode: false
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_enable_smartcards

- name: Add default domain group (if no domain there)
  ini_file:
    path: /etc/sssd/sssd.conf
    section: '{{ item.section }}'
    option: '{{ item.option }}'
    value: '{{ item.value }}'
    create: true
    mode: 384
  with_items:
    - section: sssd
      option: domains
      value: default
    - section: domain/default
      option: id_provider
      value: files
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - test_grep_domain.stdout is defined
    - test_grep_domain.stdout | length &lt; 1
  tags:
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_enable_smartcards

- name: Enable Smartcards in SSSD
  ini_file:
    dest: /etc/sssd/sssd.conf
    section: pam
    option: pam_cert_auth
    value: 'true'
    create: true
    mode: 384
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_enable_smartcards
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sssd_enable_smartcards:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sssd_enable_smartcards_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sssd_memcache_timeout" severity="medium">
            <xccdf-1.2:title>Configure SSSD's Memory Cache to Expire</xccdf-1.2:title>
            <xccdf-1.2:description>SSSD's memory cache should be configured to set to expire records after
<html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sssd_memcache_timeout" use="legacy"/></html:code> seconds.
To configure SSSD to expire memory cache, set <html:code>memcache_timeout</html:code> to
<html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sssd_memcache_timeout" use="legacy"/></html:code> under the
<html:code>[nss]</html:code> section in <html:code>/etc/sssd/sssd.conf</html:code>.

For example:
<html:pre>[nss]
memcache_timeout = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sssd_memcache_timeout" use="legacy"/>
</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002007</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(13)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000383-GPOS-00166</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">SRG-OS-000383-VMM-001570</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If cached authentication information is out-of-date, the validity of the
authentication information may be questionable.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sssd_memcache_timeout"># Remediation is applicable only in certain platforms
if rpm --quiet -q sssd-common &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

var_sssd_memcache_timeout='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sssd_memcache_timeout" use="legacy"/>'


found=false

# set value in all files if they contain section or key
for f in $(echo -n "/etc/sssd/sssd.conf"); do
    if [ ! -e "$f" ]; then
        continue
    fi

    # find key in section and change value
    if grep -qzosP "[[:space:]]*\[nss\]([^\n\[]*\n+)+?[[:space:]]*memcache_timeout" "$f"; then
            sed -i "s/memcache_timeout[^(\n)]*/memcache_timeout = $var_sssd_memcache_timeout/" "$f"
            found=true

    # find section and add key = value to it
    elif grep -qs "[[:space:]]*\[nss\]" "$f"; then
            sed -i "/[[:space:]]*nss/a memcache_timeout = $var_sssd_memcache_timeout" "$f"
            found=true
    fi
done

# if section not in any file, append section with key = value to FIRST file in files parameter
if ! $found ; then
    file=$(echo "/etc/sssd/sssd.conf" | cut -f1 -d' ')
    mkdir -p "$(dirname "$file")"
    echo -e "[nss]\nmemcache_timeout = $var_sssd_memcache_timeout" &gt;&gt; "$file"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sssd_memcache_timeout" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_memcache_timeout
    - unknown_strategy
- name: XCCDF Value var_sssd_memcache_timeout # promote to variable
  set_fact:
    var_sssd_memcache_timeout: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sssd_memcache_timeout" use="legacy"/>
  tags:
    - always

- name: Test for domain group
  command: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
  register: test_grep_domain
  ignore_errors: true
  changed_when: false
  check_mode: false
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_memcache_timeout
    - unknown_strategy

- name: Add default domain group (if no domain there)
  ini_file:
    path: /etc/sssd/sssd.conf
    section: '{{ item.section }}'
    option: '{{ item.option }}'
    value: '{{ item.value }}'
    create: true
    mode: 384
  with_items:
    - section: sssd
      option: domains
      value: default
    - section: domain/default
      option: id_provider
      value: files
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - test_grep_domain.stdout is defined
    - test_grep_domain.stdout | length &lt; 1
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_memcache_timeout
    - unknown_strategy

- name: Configure SSSD's Memory Cache to Expire
  ini_file:
    dest: /etc/sssd/sssd.conf
    section: nss
    option: memcache_timeout
    value: '{{ var_sssd_memcache_timeout }}'
    create: true
    mode: 384
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_memcache_timeout
    - unknown_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_sssd_memcache_timeout:var:1" value-id="xccdf_org.ssgproject.content_value_var_sssd_memcache_timeout"/>
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sssd_memcache_timeout:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sssd_memcache_timeout_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sssd_offline_cred_expiration" severity="medium">
            <xccdf-1.2:title>Configure SSSD to Expire Offline Credentials</xccdf-1.2:title>
            <xccdf-1.2:description>SSSD should be configured to expire offline credentials after 1 day.
To configure SSSD to expire offline credentials, set
<html:code>offline_credentials_expiration</html:code> to <html:code>1</html:code> under the <html:code>[pam]</html:code>
section in <html:code>/etc/sssd/sssd.conf</html:code>. For example:
<html:pre>[pam]
offline_credentials_expiration = 1
</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002007</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(13)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000383-GPOS-00166</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">SRG-OS-000383-VMM-001570</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If cached authentication information is out-of-date, the validity of the
authentication information may be questionable.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sssd_offline_cred_expiration" complexity="low" disruption="medium" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q sssd-common &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

found=false

# set value in all files if they contain section or key
for f in $(echo -n "/etc/sssd/sssd.conf"); do
    if [ ! -e "$f" ]; then
        continue
    fi

    # find key in section and change value
    if grep -qzosP "[[:space:]]*\[pam\]([^\n\[]*\n+)+?[[:space:]]*offline_credentials_expiration" "$f"; then
            sed -i "s/offline_credentials_expiration[^(\n)]*/offline_credentials_expiration = 1/" "$f"
            found=true

    # find section and add key = value to it
    elif grep -qs "[[:space:]]*\[pam\]" "$f"; then
            sed -i "/[[:space:]]*pam/a offline_credentials_expiration = 1" "$f"
            found=true
    fi
done

# if section not in any file, append section with key = value to FIRST file in files parameter
if ! $found ; then
    file=$(echo "/etc/sssd/sssd.conf" | cut -f1 -d' ')
    mkdir -p "$(dirname "$file")"
    echo -e "[pam]\noffline_credentials_expiration = 1" &gt;&gt; "$file"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sssd_offline_cred_expiration" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_offline_cred_expiration

- name: Test for domain group
  command: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
  register: test_grep_domain
  ignore_errors: true
  changed_when: false
  check_mode: false
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_offline_cred_expiration

- name: Add default domain group (if no domain there)
  ini_file:
    path: /etc/sssd/sssd.conf
    section: '{{ item.section }}'
    option: '{{ item.option }}'
    value: '{{ item.value }}'
    create: true
    mode: 384
  with_items:
    - section: sssd
      option: domains
      value: default
    - section: domain/default
      option: id_provider
      value: files
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - test_grep_domain.stdout is defined
    - test_grep_domain.stdout | length &lt; 1
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_offline_cred_expiration

- name: Configure SSD to Expire Offline Credentials
  ini_file:
    dest: /etc/sssd/sssd.conf
    section: pam
    option: offline_credentials_expiration
    value: 1
    create: true
    mode: 384
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_offline_cred_expiration
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sssd_offline_cred_expiration:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sssd_offline_cred_expiration_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sssd_run_as_sssd_user" severity="medium">
            <xccdf-1.2:title>Configure SSSD to run as user sssd</xccdf-1.2:title>
            <xccdf-1.2:description>SSSD processes should be configured to run as user sssd, not root.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:rationale>To minimize privileges of SSSD processes, they are configured to
run as non-root user.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#sssd"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sssd_run_as_sssd_user"># Remediation is applicable only in certain platforms
if rpm --quiet -q sssd-common; then

MAIN_CONF="/etc/sssd/conf.d/ospp.conf"

found=false

# set value in all files if they contain section or key
for f in $(echo -n "$MAIN_CONF /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf"); do
    if [ ! -e "$f" ]; then
        continue
    fi

    # find key in section and change value
    if grep -qzosP "[[:space:]]*\[sssd\]([^\n\[]*\n+)+?[[:space:]]*user" "$f"; then
            sed -i "s/user[^(\n)]*/user = sssd/" "$f"
            found=true

    # find section and add key = value to it
    elif grep -qs "[[:space:]]*\[sssd\]" "$f"; then
            sed -i "/[[:space:]]*sssd/a user = sssd" "$f"
            found=true
    fi
done

# if section not in any file, append section with key = value to FIRST file in files parameter
if ! $found ; then
    file=$(echo "$MAIN_CONF /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf" | cut -f1 -d' ')
    mkdir -p "$(dirname "$file")"
    echo -e "[sssd]\nuser = sssd" &gt;&gt; "$file"
fi

if [ -e "$MAIN_CONF" ]; then
    chown root:root "$MAIN_CONF"
	chmod 600 "$MAIN_CONF"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sssd_run_as_sssd_user:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sssd_run_as_sssd_user_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sssd_ssh_known_hosts_timeout" severity="medium">
            <xccdf-1.2:title>Configure SSSD to Expire SSH Known Hosts</xccdf-1.2:title>
            <xccdf-1.2:description>SSSD should be configured to expire keys from known SSH hosts after
<html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sssd_ssh_known_hosts_timeout" use="legacy"/></html:code> seconds.
To configure SSSD to known SSH hosts, set <html:code>ssh_known_hosts_timeout</html:code>
to <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sssd_ssh_known_hosts_timeout" use="legacy"/></html:code> under the
<html:code>[ssh]</html:code> section in <html:code>/etc/sssd/sssd.conf</html:code>. For example:
<html:pre>[ssh]
ssh_known_hosts_timeout = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sssd_ssh_known_hosts_timeout" use="legacy"/>
</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002007</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(13)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000383-GPOS-00166</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If cached authentication information is out-of-date, the validity of the
authentication information may be questionable.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sssd_ssh_known_hosts_timeout"># Remediation is applicable only in certain platforms
if rpm --quiet -q sssd-common &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

var_sssd_ssh_known_hosts_timeout='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sssd_ssh_known_hosts_timeout" use="legacy"/>'


found=false

# set value in all files if they contain section or key
for f in $(echo -n "/etc/sssd/sssd.conf"); do
    if [ ! -e "$f" ]; then
        continue
    fi

    # find key in section and change value
    if grep -qzosP "[[:space:]]*\[ssh\]([^\n\[]*\n+)+?[[:space:]]*ssh_known_hosts_timeout" "$f"; then
            sed -i "s/ssh_known_hosts_timeout[^(\n)]*/ssh_known_hosts_timeout = $var_sssd_ssh_known_hosts_timeout/" "$f"
            found=true

    # find section and add key = value to it
    elif grep -qs "[[:space:]]*\[ssh\]" "$f"; then
            sed -i "/[[:space:]]*ssh/a ssh_known_hosts_timeout = $var_sssd_ssh_known_hosts_timeout" "$f"
            found=true
    fi
done

# if section not in any file, append section with key = value to FIRST file in files parameter
if ! $found ; then
    file=$(echo "/etc/sssd/sssd.conf" | cut -f1 -d' ')
    mkdir -p "$(dirname "$file")"
    echo -e "[ssh]\nssh_known_hosts_timeout = $var_sssd_ssh_known_hosts_timeout" &gt;&gt; "$file"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sssd_ssh_known_hosts_timeout" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_ssh_known_hosts_timeout
    - unknown_strategy
- name: XCCDF Value var_sssd_ssh_known_hosts_timeout # promote to variable
  set_fact:
    var_sssd_ssh_known_hosts_timeout: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sssd_ssh_known_hosts_timeout" use="legacy"/>
  tags:
    - always

- name: Test for domain group
  command: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
  register: test_grep_domain
  ignore_errors: true
  changed_when: false
  check_mode: false
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_ssh_known_hosts_timeout
    - unknown_strategy

- name: Add default domain group (if no domain there)
  ini_file:
    path: /etc/sssd/sssd.conf
    section: '{{ item.section }}'
    option: '{{ item.option }}'
    value: '{{ item.value }}'
    create: true
    mode: 384
  with_items:
    - section: sssd
      option: domains
      value: default
    - section: domain/default
      option: id_provider
      value: files
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - test_grep_domain.stdout is defined
    - test_grep_domain.stdout | length &lt; 1
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_ssh_known_hosts_timeout
    - unknown_strategy

- name: Configure SSSD to Expire SSH Known Hosts
  ini_file:
    dest: /etc/sssd/sssd.conf
    section: ssh
    option: ssh_known_hosts_timeout
    value: '{{ var_sssd_ssh_known_hosts_timeout }}'
    create: true
    mode: 384
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_ssh_known_hosts_timeout
    - unknown_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_sssd_ssh_known_hosts_timeout:var:1" value-id="xccdf_org.ssgproject.content_value_var_sssd_ssh_known_hosts_timeout"/>
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-sssd_ssh_known_hosts_timeout:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-sssd_ssh_known_hosts_timeout_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_sssd-ldap">
            <xccdf-1.2:title>System Security Services Daemon (SSSD) - LDAP</xccdf-1.2:title>
            <xccdf-1.2:description>The System Security Services Daemon (SSSD) is a system daemon that provides access
to different identity and authentication providers such as Red Hat's IdM, Microsoft's AD,
openLDAP, MIT Kerberos, etc. It uses a common framework that can provide caching and offline
support to systems utilizing SSSD. SSSD using caching to reduce load on authentication
servers permit offline authentication as well as store extended user data.
<html:br/><html:br/>
SSSD can support many backends including LDAP. The <html:code>sssd-ldap</html:code> backend
allows SSSD to fetch identity information from an LDAP server.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sssd_ldap_tls_ca_dir" type="string">
              <xccdf-1.2:title>SSSD LDAP Backend Client CA Certificate Location</xccdf-1.2:title>
              <xccdf-1.2:description>Path of a directory that contains Certificate Authority certificates.</xccdf-1.2:description>
              <xccdf-1.2:value>/etc/openldap/cacerts</xccdf-1.2:value>
            </xccdf-1.2:Value>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_usbguard">
          <xccdf-1.2:title>USBGuard daemon</xccdf-1.2:title>
          <xccdf-1.2:description>The USBGuard daemon enforces the USB device authorization policy for all USB devices.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#not_s390x_arch"/>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_usbguard_installed" severity="medium">
            <xccdf-1.2:title>Install usbguard Package</xccdf-1.2:title>
            <xccdf-1.2:description>
The <html:code>usbguard</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install usbguard</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001958</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1418</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-8(3)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</xccdf-1.2:reference>
            <xccdf-1.2:rationale><html:code>usbguard</html:code> is a software framework that helps to protect
against rogue USB devices by implementing basic whitelisting/blacklisting
capabilities based on USB device attributes.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#not_s390x_arch"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_usbguard_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if ! grep -q s390x /proc/sys/kernel/osrelease; then

if ! rpm -q --quiet "usbguard" ; then
    dnf install -y "usbguard"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_usbguard_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure usbguard is installed
  package:
    name: usbguard
    state: present
  tags:
    - NIST-800-53-CM-8(3)
    - NIST-800-53-IA-3
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_usbguard_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_usbguard_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_usbguard

class install_usbguard {
  package { 'usbguard':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_usbguard_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=usbguard
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="package_usbguard_installed">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
  extensions:
    - usbguard
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_usbguard_installed">
[[packages]]
name = "usbguard"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_usbguard_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_usbguard_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_usbguard_enabled" severity="medium">
            <xccdf-1.2:title>Enable the USBGuard Service</xccdf-1.2:title>
            <xccdf-1.2:description>The USBGuard service should be enabled.

The <html:code>usbguard</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable usbguard.service</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000416</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001958</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1418</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-8(3)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The <html:code>usbguard</html:code> service must be running in order to
enforce the USB device authorization policy for all USB devices.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_usbguard_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if ! grep -q s390x /proc/sys/kernel/osrelease &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'usbguard.service'
"$SYSTEMCTL_EXEC" start 'usbguard.service'
"$SYSTEMCTL_EXEC" enable 'usbguard.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_usbguard_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Enable service usbguard
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service usbguard
      service:
        name: usbguard
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"usbguard" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-8(3)(a)
    - NIST-800-53-IA-3
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_usbguard_enabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_usbguard_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_usbguard

class enable_usbguard {
  service {'usbguard':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="service_usbguard_enabled">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  annotations:
    complianceascode.io/depends-on: xccdf_org.ssgproject.content_rule_package_usbguard_installed
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: usbguard.service
        enabled: true
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_usbguard_enabled">
[customizations.services]
enabled = ["usbguard"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-service_usbguard_enabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-service_usbguard_enabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configure_usbguard_auditbackend" severity="medium">
            <xccdf-1.2:title>Log USBGuard daemon audit events using Linux Audit</xccdf-1.2:title>
            <xccdf-1.2:description>To configure USBGuard daemon to log via Linux Audit
(as opposed directly to a file),
<html:code>AuditBackend</html:code> option in <html:code>/etc/usbguard/usbguard-daemon.conf</html:code>
needs to be set to <html:code>LinuxAudit</html:code>.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-8(3)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Using the Linux Audit logging allows for centralized trace
of events.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#usbguard"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="configure_usbguard_auditbackend" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if ! grep -q s390x /proc/sys/kernel/osrelease &amp;&amp; { rpm --quiet -q usbguard; }; then

if [ -e "/etc/usbguard/usbguard-daemon.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*AuditBackend=/d" "/etc/usbguard/usbguard-daemon.conf"
else
    touch "/etc/usbguard/usbguard-daemon.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/usbguard/usbguard-daemon.conf"

cp "/etc/usbguard/usbguard-daemon.conf" "/etc/usbguard/usbguard-daemon.conf.bak"
# Insert at the end of the file
printf '%s\n' "AuditBackend=LinuxAudit" &gt;&gt; "/etc/usbguard/usbguard-daemon.conf"
# Clean up after ourselves.
rm "/etc/usbguard/usbguard-daemon.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="configure_usbguard_auditbackend">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  annotations:
    complianceascode.io/depends-on: xccdf_org.ssgproject.content_rule_package_usbguard_installed
    complianceascode.io/ocp-version: '&gt;=4.7.0'
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ %0A%23%0A%23%20Rule%20set%20file%20path.%0A%23%0A%23%20The%20USBGuard%20daemon%20will%20use%20this%20file%20to%20load%20the%20policy%0A%23%20rule%20set%20from%20it%20and%20to%20write%20new%20rules%20received%20via%20the%0A%23%20IPC%20interface.%0A%23%0A%23%20RuleFile%3D/path/to/rules.conf%0A%23%0ARuleFile%3D/etc/usbguard/rules.conf%0A%0A%23%0A%23%20Rule%20set%20folder%20path.%0A%23%0A%23%20The%20USBGuard%20daemon%20will%20use%20this%20folder%20to%20load%20the%20policy%0A%23%20rule%20set%20from%20it%20and%20to%20write%20new%20rules%20received%20via%20the%0A%23%20IPC%20interface.%20Usually%2C%20we%20set%20the%20option%20to%0A%23%20/etc/usbguard/rules.d/.%20The%20USBGuard%20daemon%20is%20supposed%20to%0A%23%20behave%20like%20any%20other%20standard%20Linux%20daemon%20therefore%20it%0A%23%20loads%20rule%20files%20in%20alpha-numeric%20order.%20File%20names%20inside%0A%23%20RuleFolder%20directory%20should%20start%20with%20a%20two-digit%20number%0A%23%20prefix%20indicating%20the%20position%2C%20in%20which%20the%20rules%20are%0A%23%20scanned%20by%20the%20daemon.%0A%23%0A%23%20RuleFolder%3D/path/to/rulesfolder/%0A%23%0ARuleFolder%3D/etc/usbguard/rules.d/%0A%0A%23%0A%23%20Implicit%20policy%20target.%0A%23%0A%23%20How%20to%20treat%20devices%20that%20don%27t%20match%20any%20rule%20in%20the%0A%23%20policy.%20One%20of%3A%0A%23%0A%23%20%2A%20allow%20%20-%20authorize%20the%20device%0A%23%20%2A%20block%20%20-%20block%20the%20device%0A%23%20%2A%20reject%20-%20remove%20the%20device%0A%23%0AImplicitPolicyTarget%3Dblock%0A%0A%23%0A%23%20Present%20device%20policy.%0A%23%0A%23%20How%20to%20treat%20devices%20that%20are%20already%20connected%20when%20the%0A%23%20daemon%20starts.%20One%20of%3A%0A%23%0A%23%20%2A%20allow%20%20%20%20%20%20%20%20-%20authorize%20every%20present%20device%0A%23%20%2A%20block%20%20%20%20%20%20%20%20-%20deauthorize%20every%20present%20device%0A%23%20%2A%20reject%20%20%20%20%20%20%20-%20remove%20every%20present%20device%0A%23%20%2A%20keep%20%20%20%20%20%20%20%20%20-%20just%20sync%20the%20internal%20state%20and%20leave%20it%0A%23%20%2A%20apply-policy%20-%20evaluate%20the%20ruleset%20for%20every%20present%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20device%0A%23%0APresentDevicePolicy%3Dapply-policy%0A%0A%23%0A%23%20Present%20controller%20policy.%0A%23%0A%23%20How%20to%20treat%20USB%20controllers%20that%20are%20already%20connected%0A%23%20when%20the%20daemon%20starts.%20One%20of%3A%0A%23%0A%23%20%2A%20allow%20%20%20%20%20%20%20%20-%20authorize%20every%20present%20device%0A%23%20%2A%20block%20%20%20%20%20%20%20%20-%20deauthorize%20every%20present%20device%0A%23%20%2A%20reject%20%20%20%20%20%20%20-%20remove%20every%20present%20device%0A%23%20%2A%20keep%20%20%20%20%20%20%20%20%20-%20just%20sync%20the%20internal%20state%20and%20leave%20it%0A%23%20%2A%20apply-policy%20-%20evaluate%20the%20ruleset%20for%20every%20present%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20device%0A%23%0APresentControllerPolicy%3Dkeep%0A%0A%23%0A%23%20Inserted%20device%20policy.%0A%23%0A%23%20How%20to%20treat%20USB%20devices%20that%20are%20already%20connected%0A%23%20%2Aafter%2A%20the%20daemon%20starts.%20One%20of%3A%0A%23%0A%23%20%2A%20block%20%20%20%20%20%20%20%20-%20deauthorize%20every%20present%20device%0A%23%20%2A%20reject%20%20%20%20%20%20%20-%20remove%20every%20present%20device%0A%23%20%2A%20apply-policy%20-%20evaluate%20the%20ruleset%20for%20every%20present%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20device%0A%23%0AInsertedDevicePolicy%3Dapply-policy%0A%0A%23%0A%23%20Control%20which%20devices%20are%20authorized%20by%20default.%0A%23%0A%23%20The%20USBGuard%20daemon%20modifies%20some%20the%20default%20authorization%20state%20attributes%0A%23%20of%20controller%20devices.%20This%20setting%2C%20enables%20you%20to%20define%20what%20value%20the%0A%23%20default%20authorization%20is%20set%20to.%0A%23%0A%23%20%2A%20keep%20%20%20%20%20%20%20%20%20-%20do%20not%20change%20the%20authorization%20state%0A%23%20%2A%20none%20%20%20%20%20%20%20%20%20-%20every%20new%20device%20starts%20out%20deauthorized%0A%23%20%2A%20all%20%20%20%20%20%20%20%20%20%20-%20every%20new%20device%20starts%20out%20authorized%0A%23%20%2A%20internal%20%20%20%20%20-%20internal%20devices%20start%20out%20authorized%2C%20external%20devices%20start%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20out%20deauthorized%20%28this%20requires%20the%20ACPI%20tables%20to%20properly%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20label%20internal%20devices%2C%20and%20kernel%20support%29%0A%23%0A%23AuthorizedDefault%3Dnone%0A%0A%23%0A%23%20Restore%20controller%20device%20state.%0A%23%0A%23%20The%20USBGuard%20daemon%20modifies%20some%20attributes%20of%20controller%0A%23%20devices%20like%20the%20default%20authorization%20state%20of%20new%20child%20device%0A%23%20instances.%20Using%20this%20setting%2C%20you%20can%20control%20whether%20the%0A%23%20daemon%20will%20try%20to%20restore%20the%20attribute%20values%20to%20the%20state%0A%23%20before%20modification%20on%20shutdown.%0A%23%0A%23%20SECURITY%20CONSIDERATIONS%3A%20If%20set%20to%20true%2C%20the%20USB%20authorization%0A%23%20policy%20could%20be%20bypassed%20by%20performing%20some%20sort%20of%20attack%20on%20the%0A%23%20daemon%20%28via%20a%20local%20exploit%20or%20via%20a%20USB%20device%29%20to%20make%20it%20shutdown%0A%23%20and%20restore%20to%20the%20operating-system%20default%20state%20%28known%20to%20be%20permissive%29.%0A%23%0ARestoreControllerDeviceState%3Dfalse%0A%0A%23%0A%23%20Device%20manager%20backend%0A%23%0A%23%20Which%20device%20manager%20backend%20implementation%20to%20use.%20One%20of%3A%0A%23%0A%23%20%2A%20uevent%20%20%20-%20Netlink%20based%20implementation%20which%20uses%20sysfs%20to%20scan%20for%20present%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20devices%20and%20an%20uevent%20netlink%20socket%20for%20receiving%20USB%20device%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20related%20events.%0A%23%20%2A%20umockdev%20-%20umockdev%20based%20device%20manager%20capable%20of%20simulating%20devices%20based%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20on%20umockdev-record%20files.%20Useful%20for%20testing.%0A%23%0ADeviceManagerBackend%3Duevent%0A%0A%23%21%21%21%20WARNING%3A%20It%27s%20good%20practice%20to%20set%20at%20least%20one%20of%20the%20%21%21%21%0A%23%21%21%21%20%20%20%20%20%20%20%20%20%20two%20options%20bellow.%20If%20none%20of%20them%20are%20set%2C%20%20%21%21%21%0A%23%21%21%21%20%20%20%20%20%20%20%20%20%20the%20daemon%20will%20accept%20IPC%20connections%20from%20%20%20%21%21%21%0A%23%21%21%21%20%20%20%20%20%20%20%20%20%20anyone%2C%20thus%20allowing%20anyone%20to%20modify%20the%20%20%20%20%21%21%21%0A%23%21%21%21%20%20%20%20%20%20%20%20%20%20rule%20set%20and%20%28de%29authorize%20USB%20devices.%20%20%20%20%20%20%20%21%21%21%0A%0A%23%0A%23%20Users%20allowed%20to%20use%20the%20IPC%20interface.%0A%23%0A%23%20A%20space%20delimited%20list%20of%20usernames%20that%20the%20daemon%20will%0A%23%20accept%20IPC%20connections%20from.%0A%23%0A%23%20IPCAllowedUsers%3Dusername1%20username2%20...%0A%23%0AIPCAllowedUsers%3Droot%0A%0A%23%0A%23%20Groups%20allowed%20to%20use%20the%20IPC%20interface.%0A%23%0A%23%20A%20space%20delimited%20list%20of%20groupnames%20that%20the%20daemon%20will%0A%23%20accept%20IPC%20connections%20from.%0A%23%0A%23%20IPCAllowedGroups%3Dgroupname1%20groupname2%20...%0A%23%0AIPCAllowedGroups%3Dwheel%0A%0A%23%0A%23%20IPC%20access%20control%20definition%20files%20path.%0A%23%0A%23%20The%20files%20at%20this%20location%20will%20be%20interpreted%20by%20the%20daemon%0A%23%20as%20access%20control%20definition%20files.%20The%20%28base%29name%20of%20a%20file%0A%23%20should%20be%20in%20the%20form%3A%0A%23%0A%23%20%20%20%5Buser%5D%5B%3A%3Cgroup%3E%5D%0A%23%0A%23%20and%20should%20contain%20lines%20in%20the%20form%3A%0A%23%0A%23%20%20%20%3Csection%3E%3D%5Bprivilege%5D%20...%0A%23%0A%23%20This%20way%20each%20file%20defines%20who%20is%20able%20to%20connect%20to%20the%20IPC%0A%23%20bus%20and%20what%20privileges%20he%20has.%0A%23%0AIPCAccessControlFiles%3D/etc/usbguard/IPCAccessControl.d/%0A%0A%23%0A%23%20Generate%20device%20specific%20rules%20including%20the%20%22via-port%22%0A%23%20attribute.%0A%23%0A%23%20This%20option%20modifies%20the%20behavior%20of%20the%20allowDevice%0A%23%20action.%20When%20instructed%20to%20generate%20a%20permanent%20rule%2C%0A%23%20the%20action%20can%20generate%20a%20port%20specific%20rule.%20Because%0A%23%20some%20systems%20have%20unstable%20port%20numbering%2C%20the%20generated%0A%23%20rule%20might%20not%20match%20the%20device%20after%20rebooting%20the%20system.%0A%23%0A%23%20If%20set%20to%20false%2C%20the%20generated%20rule%20will%20still%20contain%0A%23%20the%20%22parent-hash%22%20attribute%20which%20also%20defines%20an%20association%0A%23%20to%20the%20parent%20device.%20See%20usbguard-rules.conf%285%29%20for%20more%0A%23%20details.%0A%23%0ADeviceRulesWithPort%3Dfalse%0A%0A%23%0A%23%20USBGuard%20Audit%20events%20log%20backend%0A%23%0A%23%20One%20of%3A%0A%23%0A%23%20%2A%20FileAudit%20-%20Log%20audit%20events%20into%20a%20file%20specified%20by%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20AuditFilePath%20setting%20%28see%20below%29%0A%23%20%2A%20LinuxAudit%20-%20Log%20audit%20events%20using%20the%20Linux%20Audit%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20subsystem%20%28using%20audit_log_user_message%29%0A%23%0AAuditBackend%3DLinuxAudit%0A%0A%23%0A%23%20USBGuard%20audit%20events%20log%20file%20path.%0A%23%0A%23AuditFilePath%3D/var/log/usbguard/usbguard-audit.log%0A%0A%23%0A%23%20Hides%20personally%20identifiable%20information%20such%20as%20device%20serial%20numbers%20and%0A%23%20hashes%20of%20descriptors%20%28which%20include%20the%20serial%20number%29%20from%20audit%20entries.%0A%23%0A%23HidePII%3Dfalse }}
        mode: 0600
        path: /etc/usbguard/usbguard-daemon.conf
        overwrite: true
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-configure_usbguard_auditbackend:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-configure_usbguard_auditbackend_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_usbguard_allow_hid" severity="medium">
            <xccdf-1.2:title>Authorize Human Interface Devices in USBGuard daemon</xccdf-1.2:title>
            <xccdf-1.2:description>To allow authorization of Human Interface Devices (keyboard, mouse)
by USBGuard daemon,
add the line
<html:code>allow with-interface match-all { 03:*:* }</html:code>
to <html:code>/etc/usbguard/rules.conf</html:code>.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">This rule should be understood primarily as a convenience administration feature. This rule ensures that if the USBGuard default rules.conf file is present, it will alter it so that USB human interface devices are allowed. However, if the rules.conf file is altered by system administrator, the rule does not check if USB human interface devices are allowed. This assumes that an administrator modified the file with some purpose in mind.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000114-GPOS-00059</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Without allowing Human Interface Devices, it might not be possible
to interact with the system.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#not_s390x_arch"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="usbguard_allow_hid"># Remediation is applicable only in certain platforms
if ! grep -q s390x /proc/sys/kernel/osrelease; then

# path of file with Usbguard rules
rulesfile="/etc/usbguard/rules.conf"

echo "allow with-interface match-all { 03:*:* }" &gt;&gt; $rulesfile

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="usbguard_allow_hid" complexity="low" disruption="low" reboot="false" strategy="configure">- name: allow HID devices
  lineinfile:
    path: /etc/usbguard/rules.conf
    create: true
    line: allow with-interface match-all { 03:*:* }
    state: present
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - usbguard_allow_hid
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-usbguard_allow_hid:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-usbguard_allow_hid_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_usbguard_allow_hid_and_hub" severity="medium">
            <xccdf-1.2:title>Authorize Human Interface Devices and USB hubs in USBGuard daemon</xccdf-1.2:title>
            <xccdf-1.2:description>To allow authorization of USB devices combining human interface device and hub capabilities
by USBGuard daemon,
add the line
<html:code>allow with-interface match-all { 03:*:* 09:00:* }</html:code>
to <html:code>/etc/usbguard/rules.conf</html:code>.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">This rule should be understood primarily as a convenience administration feature. This rule ensures that if the USBGuard default rules.conf file is present, it will alter it so that USB human interface devices and hubs are allowed. However, if the rules.conf file is altered by system administrator, the rule does not check if USB human interface devices and hubs are allowed. This assumes that an administrator modified the file with some purpose in mind.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-8(3)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000114-GPOS-00059</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Without allowing Human Interface Devices, it might not be possible
to interact with the system. Without allowing hubs, it might not be possible to use any
USB devices on the system.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#not_s390x_arch"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="usbguard_allow_hid_and_hub"># Remediation is applicable only in certain platforms
if ! grep -q s390x /proc/sys/kernel/osrelease; then

echo "allow with-interface match-all { 03:*:* 09:00:* }" &gt;&gt; /etc/usbguard/rules.conf

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="usbguard_allow_hid_and_hub" complexity="low" disruption="low" reboot="false" strategy="configure">- name: allow HID devices and hubs
  lineinfile:
    path: /etc/usbguard/rules.conf
    create: true
    line: allow with-interface match-all { 03:*:* 09:00:* }
    state: present
  tags:
    - NIST-800-53-CM-8(3)
    - NIST-800-53-IA-3
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - usbguard_allow_hid_and_hub
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="usbguard_allow_hid_and_hub">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  annotations:
    complianceascode.io/depends-on: xccdf_org.ssgproject.content_rule_package_usbguard_installed
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ %0Aallow%20with-interface%20match-all%20%7B%2003%3A%2A%3A%2A%2009%3A00%3A%2A%20%7D }}
        mode: 0600
        path: /etc/usbguard/rules.d/75-hid-and-hub.conf
        overwrite: true
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-usbguard_allow_hid_and_hub:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-usbguard_allow_hid_and_hub_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_usbguard_allow_hub" severity="medium">
            <xccdf-1.2:title>Authorize USB hubs in USBGuard daemon</xccdf-1.2:title>
            <xccdf-1.2:description>To allow authorization of USB hub devices by USBGuard daemon,
add line
<html:code>allow with-interface match-all { 09:00:* }</html:code>
to <html:code>/etc/usbguard/rules.conf</html:code>.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">This rule should be understood primarily as a convenience administration feature. This rule ensures that if the USBGuard default rules.conf file is present, it will alter it so that USB hub devices are allowed. However, if the rules.conf file is altered by system administrator, the rule does not check if USB hub devices are allowed. This assumes that an administrator modified the file with some purpose in mind.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000114-GPOS-00059</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Without allowing hubs, it might not be possible to use any
USB devices on the system.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#not_s390x_arch"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="usbguard_allow_hub"># Remediation is applicable only in certain platforms
if ! grep -q s390x /proc/sys/kernel/osrelease; then

echo "allow with-interface match-all { 09:00:* }" &gt;&gt; /etc/usbguard/rules.conf

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="usbguard_allow_hub" complexity="low" disruption="low" reboot="false" strategy="configure">- name: allow hubs
  lineinfile:
    path: /etc/usbguard/rules.conf
    create: true
    line: allow with-interface match-all { 09:00:* }
    state: present
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - usbguard_allow_hub
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-usbguard_allow_hub:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-usbguard_allow_hub_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_xwindows">
          <xccdf-1.2:title>X Window System</xccdf-1.2:title>
          <xccdf-1.2:description>The X Window System implementation included with the
system is called X.org.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_xwindows">
            <xccdf-1.2:title>Disable X Windows</xccdf-1.2:title>
            <xccdf-1.2:description>Unless there is a mission-critical reason for the
system to run a graphical user interface, ensure X is not set to start
automatically at boot and remove the X Windows software packages.
There is usually no reason to run X Windows
on a dedicated server system, as it increases the system's attack surface and consumes
system resources. Administrators of server systems should instead login via
SSH or on the text console.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_xorg-x11-server-common_removed" severity="medium">
              <xccdf-1.2:title>Remove the X Windows Package Group</xccdf-1.2:title>
              <xccdf-1.2:description>By removing the xorg-x11-server-common package, the system no longer has X Windows
installed. If X Windows is not installed then the system cannot boot into graphical user mode.
This prevents the system from being accidentally or maliciously booted into a <html:code>graphical.target</html:code>
mode. To do so, run the following command:
<html:pre>$ sudo dnf groupremove "X Window System"</html:pre>
<html:pre>$ sudo dnf remove xorg-x11-server-common</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning category="functionality">The installation and use of a Graphical User Interface (GUI) increases your attack vector and decreases your
overall security posture. Removing the package xorg-x11-server-common package will remove the graphical target
which might bring your system to an inconsistent state requiring additional configuration to access the system
again. If a GUI is an operational requirement, a tailored profile that removes this rule should used before
continuing installation.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Unnecessary service packages must not be installed to decrease the attack surface of the system. X windows has a long history of security
vulnerabilities and should not be installed unless approved and documented.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_xorg-x11-server-common_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove xorg-x11-server-common
#	   from the system, and may remove any packages
#	   that depend on xorg-x11-server-common. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "xorg-x11-server-common" ; then

    dnf remove -y "xorg-x11-server-common"

fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_xorg-x11-server-common_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure xorg-x11-server-common is removed
  package:
    name: xorg-x11-server-common
    state: absent
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_xorg-x11-server-common_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_xorg-x11-server-common_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_xorg-x11-server-common

class remove_xorg-x11-server-common {
  package { 'xorg-x11-server-common':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_xorg-x11-server-common_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=xorg-x11-server-common
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-package_xorg-x11-server-common_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-package_xorg-x11-server-common_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_xwindows_runlevel_target" severity="medium">
              <xccdf-1.2:title>Disable X Windows Startup By Setting Default Target</xccdf-1.2:title>
              <xccdf-1.2:description>Systems that do not require a graphical user interface should only boot by
default into <html:code>multi-user.target</html:code> mode. This prevents accidental booting of the system
into a <html:code>graphical.target</html:code> mode. Setting the system's default target to
<html:code>multi-user.target</html:code> will prevent automatic startup of the X server. To do so, run:
<html:pre>$ systemctl set-default multi-user.target</html:pre>
You should see the following output:
<html:pre>Removed symlink /etc/systemd/system/default.target.
Created symlink from /etc/systemd/system/default.target to /usr/lib/systemd/system/multi-user.target.</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Services that are not required for system and application processes
must not be active to decrease the attack surface of the system. X windows has a
long history of security vulnerabilities and should not be used unless approved
and documented.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#machine"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="xwindows_runlevel_target" complexity="low" disruption="low" reboot="true" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

systemctl set-default multi-user.target

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="xwindows_runlevel_target" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Switch to multi-user runlevel
  file:
    src: /usr/lib/systemd/system/multi-user.target
    dest: /etc/systemd/system/default.target
    state: link
    force: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
    - xwindows_runlevel_target
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-fedora-oval.xml" name="oval:ssg-xwindows_runlevel_target:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-fedora-ocil.xml" name="ocil:ssg-xwindows_runlevel_target_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
      </xccdf-1.2:Group>
      <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_intro">
        <xccdf-1.2:title>Introduction</xccdf-1.2:title>
        <xccdf-1.2:description>The purpose of this guidance is to provide security configuration
recommendations and baselines for the Fedora operating
system. Recommended settings for the basic operating system are provided,
as well as for many network services that the system can provide to other systems.
The guide is intended for system administrators. Readers are assumed to
possess basic system administration skills for Unix-like systems, as well
as some familiarity with the product's documentation and administration
conventions. Some instructions within this guide are complex.
All directions should be followed completely and with understanding of
their effects in order to avoid serious adverse effects on the system
and its security.</xccdf-1.2:description>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_general-principles">
          <xccdf-1.2:title>General Principles</xccdf-1.2:title>
          <xccdf-1.2:description>The following general principles motivate much of the advice in this
guide and should also influence any configuration decisions that are
not explicitly covered.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_principle-encrypt-transmitted-data">
            <xccdf-1.2:title>Encrypt Transmitted Data Whenever Possible</xccdf-1.2:title>
            <xccdf-1.2:description>Data transmitted over a network, whether wired or wireless, is susceptible
to passive monitoring. Whenever practical solutions for encrypting
such data exist, they should be applied. Even if data is expected to
be transmitted only over a local network, it should still be encrypted.
Encrypting authentication data, such as passwords, is particularly
important. Networks of Fedora machines can and should be configured
so that no unencrypted authentication data is ever transmitted between
machines.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_principle-least-privilege">
            <xccdf-1.2:title>Least Privilege</xccdf-1.2:title>
            <xccdf-1.2:description>Grant the least privilege necessary for user accounts and software to perform tasks.
For example, <html:code>sudo</html:code> can be implemented to limit authorization to super user
accounts on the system only to designated personnel. Another example is to limit
logins on server systems to only those administrators who need to log into them in
order to perform administration tasks. Using SELinux also follows the principle of
least privilege: SELinux policy can confine software to perform only actions on the
system that are specifically allowed. This can be far more restrictive than the
actions permissible by the traditional Unix permissions model.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_principle-minimize-software">
            <xccdf-1.2:title>Minimize Software to Minimize Vulnerability</xccdf-1.2:title>
            <xccdf-1.2:description>The simplest way to avoid vulnerabilities in software is to avoid
installing that software. On Fedora,the RPM Package Manager (originally Red Hat Package Manager, abbreviated RPM)
allows for careful management of
the set of software packages installed on a system. Installed software
contributes to system vulnerability in several ways. Packages that
include setuid programs may provide local attackers a potential path to
privilege escalation. Packages that include network services may give
this opportunity to network-based attackers. Packages that include
programs which are predictably executed by local users (e.g. after
graphical login) may provide opportunities for trojan horses or other
attack code to be run undetected. The number of software packages
installed on a system can almost always be significantly pruned to include
only the software for which there is an environmental or operational need.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_principle-separate-servers">
            <xccdf-1.2:title>Run Different Network Services on Separate Systems</xccdf-1.2:title>
            <xccdf-1.2:description>Whenever possible, a server should be dedicated to serving exactly one
network service. This limits the number of other services that can
be compromised in the event that an attacker is able to successfully
exploit a software flaw in one network service.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_principle-use-security-tools">
            <xccdf-1.2:title>Configure Security Tools to Improve System Robustness</xccdf-1.2:title>
            <xccdf-1.2:description>Several tools exist which can be effectively used to improve a system's
resistance to and detection of unknown attacks. These tools can improve
robustness against attack at the cost of relatively little configuration
effort. In particular, this guide recommends and discusses the use of
host-based firewalling, SELinux for protection against
vulnerable services, and a logging and auditing infrastructure for
detection of problems.</xccdf-1.2:description>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_how-to-use">
          <xccdf-1.2:title>How to Use This Guide</xccdf-1.2:title>
          <xccdf-1.2:description>Readers should heed the following points when using the guide.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_intro-formatting-conventions">
            <xccdf-1.2:title>Formatting Conventions</xccdf-1.2:title>
            <xccdf-1.2:description>Commands intended for shell execution, as well as configuration file text,
are featured in a <html:code>monospace font</html:code>. <html:i>Italics</html:i> are used
to indicate instances where the system administrator must substitute
the appropriate information into a command or configuration file.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_intro-read-sections-completely">
            <xccdf-1.2:title>Read Sections Completely and in Order</xccdf-1.2:title>
            <xccdf-1.2:description>Each section may build on information and recommendations discussed in
prior sections. Each section should be read and understood completely;
instructions should never be blindly applied. Relevant discussion may
occur after instructions for an action.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_intro-reboot-required">
            <xccdf-1.2:title>Reboot Required</xccdf-1.2:title>
            <xccdf-1.2:description>A system reboot is implicitly required after some actions in order to
complete the reconfiguration of the system. In many cases, the changes
will not take effect until a reboot is performed. In order to ensure
that changes are applied properly and to test functionality, always
reboot the system after applying a set of recommendations from this guide.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_intro-root-shell-assumed">
            <xccdf-1.2:title>Root Shell Environment Assumed</xccdf-1.2:title>
            <xccdf-1.2:description>Most of the actions listed in this document are written with the
assumption that they will be executed by the root user running the
<html:code>/bin/bash</html:code> shell. Commands preceded with a hash mark (#)
assume that the administrator will execute the commands as root, i.e.
apply the command via <html:code>sudo</html:code> whenever possible, or use
<html:code>su</html:code> to gain root privileges if <html:code>sudo</html:code> cannot be
used. Commands which can be executed as a non-root user are are preceded
by a dollar sign ($) prompt.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_intro-test-non-production">
            <xccdf-1.2:title>Test in Non-Production Environment</xccdf-1.2:title>
            <xccdf-1.2:description>This guidance should always be tested in a non-production environment
before deployment. This test environment should simulate the setup in
which the system will be deployed as closely as possible.</xccdf-1.2:description>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
      </xccdf-1.2:Group>
    </xccdf-1.2:Benchmark>
  </ds:component>
  <ds:component id="scap_org.open-scap_comp_ssg-fedora-oval.xml" timestamp="2022-07-23T00:00:00">
    <oval-def:oval_definitions xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
      <oval-def:generator>
        <oval:product_name>combine_ovals.py from SCAP Security Guide</oval:product_name>
        <oval:product_version>ssg: [0, 1, 62], python: 3.11.0b4</oval:product_version>
        <oval:schema_version>5.11</oval:schema_version>
        <oval:timestamp>2022-07-23T00:00:00</oval:timestamp>
      </oval-def:generator>
      <oval-def:definitions>
        <oval-def:definition class="compliance" id="oval:ssg-ftp_log_transactions:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable Logging of All FTP Transactions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>To trace malicious activity facilitated by the FTP 
      service, it must be configured to ensure that all commands sent to 
      the FTP server are logged using the verbose vsftpd log format.
      </oval-def:description>
            <oval-def:reference ref_id="ftp_log_transactions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="FTP is not being used or the conditions are met" operator="OR">
            <oval-def:extend_definition comment="vsftp package is not installed" definition_ref="oval:ssg-package_vsftpd_installed:def:1" negate="true"/>
            <oval-def:criteria comment="FTP configuration conditions are not set or are met" operator="AND">
              <oval-def:criterion comment="log ftp transactions enable" test_ref="oval:ssg-test_ftp_log_transactions_enable:tst:1"/>
              <oval-def:criterion comment="log ftp transactions format" test_ref="oval:ssg-test_ftp_log_transactions_format:tst:1"/>
              <oval-def:criterion comment="log ftp transactions protocol" test_ref="oval:ssg-test_ftp_log_transactions_protocol:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-ftp_present_banner:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Create Warning Banners for All FTP Users</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This setting will cause the system greeting banner to be 
      used for FTP connections as well.</oval-def:description>
            <oval-def:reference ref_id="ftp_present_banner" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="vsftpd package is not installed" definition_ref="oval:ssg-package_vsftpd_removed:def:1"/>
            <oval-def:criterion comment="Banner for FTP Users" test_ref="oval:ssg-test_ftp_present_banner:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kerberos_disable_no_keytab:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Kerberos by removing host keytab</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that there is no Kerberos keytab file present in /etc</oval-def:description>
            <oval-def:reference ref_id="kerberos_disable_no_keytab" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_kerberos_disable_no_keytab:tst:1" comment="Restrict Kerberos operation by removing keytab files"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-postfix_client_configure_mail_alias:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure System to Forward All Mail For The Root Account</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if root has the correct mail alias.</oval-def:description>
            <oval-def:reference ref_id="postfix_client_configure_mail_alias" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check if root has the correct mail alias.">
            <oval-def:criterion comment="Check if root has the correct mail alias." test_ref="oval:ssg-test_postfix_client_configure_mail_alias:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_insecure_locks_exports:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Insecure File Locking is Not Allowed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Allowing insecure file locking could allow for sensitive 
      data to be viewed or edited by an unauthorized user.</oval-def:description>
            <oval-def:reference ref_id="no_insecure_locks_exports" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check for insecure NFS locks in /etc/exports" test_ref="oval:ssg-test_no_insecure_locks_exports:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-chronyd_client_only:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable chrony daemon from acting as server</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Configure the port setting in {{{ chrony_conf_path }}} to disable
      server operation.</oval-def:description>
            <oval-def:reference ref_id="chronyd_client_only" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition definition_ref="oval:ssg-service_chronyd_enabled:def:1" comment="service chronyd enabled"/>
            <oval-def:criterion test_ref="oval:ssg-test_chronyd_client_only:tst:1" comment="check if port is 0 in /etc/chrony.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-chronyd_no_chronyc_network:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable network management of chrony daemon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Configure the cmdport setting in {{{ chrony_conf_path }}} to disable
      chronyc management connections over network.</oval-def:description>
            <oval-def:reference ref_id="chronyd_no_chronyc_network" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition definition_ref="oval:ssg-service_chronyd_enabled:def:1" comment="service chronyd enabled"/>
            <oval-def:criterion test_ref="oval:ssg-test_chronyd_no_chronyc_network:tst:1" comment="check if cmdport is 0 in /etc/chrony.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-chronyd_or_ntpd_set_maxpoll:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure Time Service Maxpoll Interval</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Configure the maxpoll setting in /etc/ntp.conf or chrony.conf
      to continuously poll the time source servers.</oval-def:description>
            <oval-def:reference ref_id="chronyd_or_ntpd_set_maxpoll" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="check if no server entry is set in /etc/ntp.conf" test_ref="oval:ssg-test_ntp_no_server:tst:1"/>
              <oval-def:criteria operator="AND">
                <oval-def:criterion comment="check if maxpoll is set in /etc/ntp.conf" test_ref="oval:ssg-test_ntp_set_maxpoll:tst:1"/>
                <oval-def:criterion comment="check if all server entries have maxpoll set in /etc/ntp.conf" test_ref="oval:ssg-test_ntp_all_server_has_maxpoll:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="check if no server or pool entry is set in /etc/chrony.conf" test_ref="oval:ssg-test_chrony_no_server_nor_pool:tst:1"/>
              <oval-def:criteria operator="AND">
                <oval-def:criterion comment="check if maxpoll is set in /etc/chrony.conf" test_ref="oval:ssg-test_chrony_set_maxpoll:tst:1"/>
                <oval-def:criterion comment="check if all server entries have maxpoll set in /etc/chrony.conf" test_ref="oval:ssg-test_chrony_all_server_has_maxpoll:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-chronyd_or_ntpd_specify_multiple_servers:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Specify Additional Remote NTP Servers</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Multiple remote chronyd or ntpd NTP Servers for time synchronization should be specified (and dependencies are met)</oval-def:description>
            <oval-def:reference ref_id="chronyd_or_ntpd_specify_multiple_servers" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria comment="chronyd enabled and multiple remote servers specified" operator="AND">
              <oval-def:extend_definition comment="service chronyd enabled" definition_ref="oval:ssg-service_chronyd_enabled:def:1"/>
              <oval-def:extend_definition comment="multiple chronyd remote servers specified" definition_ref="oval:ssg-chronyd_specify_multiple_servers:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="ntpd enabled and multile remote servers specified" operator="AND">
              <oval-def:extend_definition comment="service ntpd enabled" definition_ref="oval:ssg-service_ntpd_enabled:def:1"/>
              <oval-def:extend_definition comment="multiple ntpd remote servers specified" definition_ref="oval:ssg-ntpd_specify_multiple_servers:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-chronyd_or_ntpd_specify_remote_server:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Specify a Remote NTP Server</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>A remote chronyd or ntpd NTP Server for time synchronization should be specified (and dependencies are met)</oval-def:description>
            <oval-def:reference ref_id="chronyd_or_ntpd_specify_remote_server" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria comment="chronyd enabled and remote server specified" operator="AND">
              <oval-def:extend_definition comment="service chronyd enabled" definition_ref="oval:ssg-service_chronyd_enabled:def:1"/>
              <oval-def:extend_definition comment="chronyd remote server specified" definition_ref="oval:ssg-chronyd_specify_remote_server:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="ntpd enabled and remote server specified" operator="AND">
              <oval-def:extend_definition comment="service ntpd enabled" definition_ref="oval:ssg-service_ntpd_enabled:def:1"/>
              <oval-def:extend_definition comment="ntpd remote server specified" definition_ref="oval:ssg-ntpd_specify_remote_server:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-chronyd_run_as_chrony_user:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure that chronyd is running under chrony user account</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'OPTIONS' is configured with value '["]?.*-u chrony.*["]?' in /etc/sysconfig/chronyd</oval-def:description>
            <oval-def:reference ref_id="chronyd_run_as_chrony_user" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="The respective application or service is configured correctly and configuration file exists" operator="AND">
            <oval-def:criteria comment="The respective application or service is configured correctly" operator="OR">
              <oval-def:criterion comment="Check the OPTIONS in /etc/sysconfig/chronyd" test_ref="oval:ssg-test_chronyd_run_as_chrony_user:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="test if configuration file /etc/sysconfig/chronyd exists for chronyd_run_as_chrony_user" test_ref="oval:ssg-test_chronyd_run_as_chrony_user_config_file_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-chronyd_server_directive:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Chrony is only configured with the server directive</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure Chrony has time sources configured with server directive</oval-def:description>
            <oval-def:reference ref_id="chronyd_server_directive" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="chrony.conf only has server directive">
            <oval-def:criterion test_ref="oval:ssg-test_chronyd_server_directive_with_server:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_chronyd_server_directive_no_pool:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-chronyd_specify_remote_server:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>A remote time server for Chrony is configured</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>A remote NTP Server for time synchronization should be
      specified (and dependencies are met)</oval-def:description>
            <oval-def:reference ref_id="chronyd_specify_remote_server" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="chrony.conf conditions are met">
            <oval-def:criterion test_ref="oval:ssg-test_chronyd_remote_server:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-ntpd_configure_restrictions:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Configure server restrictions for ntpd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Certain restrictions are imposed on ntp servers configured to be used by ntpd</oval-def:description>
            <oval-def:reference ref_id="ntpd_configure_restrictions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="test ipv6 configuration" test_ref="oval:ssg-test_ntpd_configure_restrictions_ipv6:tst:1"/>
            <oval-def:criterion comment="test ipv4 configuration" test_ref="oval:ssg-test_ntpd_configure_restrictions_ipv4:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-ntpd_run_as_ntp_user:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure ntpd To Run As ntp User</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure ntpd is configured to run correctly under the ntp user.</oval-def:description>
            <oval-def:reference ref_id="ntpd_run_as_ntp_user" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="check /etc/sysconfig/ntpd is configured correctly" test_ref="oval:ssg-test_ntpd_run_as_ntp_user_etc_sysconfig_ntpd:tst:1"/>
            <oval-def:criterion comment="check /usr/lib/systemd/system/ntpd.service is configured correctly" test_ref="oval:ssg-test_ntpd_run_as_ntp_user_systemd:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-ntpd_specify_multiple_servers:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Specify Additional Remote NTP Servers</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Multiple ntpd NTP Servers for time synchronization should be specified.</oval-def:description>
            <oval-def:reference ref_id="ntpd_specify_multiple_servers" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="ntp.conf conditions are met">
            <oval-def:criterion test_ref="oval:ssg-test_ntpd_multiple_servers:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-ntpd_specify_remote_server:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Specify a Remote NTP Server</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>A remote ntpd NTP Server for time synchronization should be
      specified (and dependencies are met)</oval-def:description>
            <oval-def:reference ref_id="ntpd_specify_remote_server" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="ntp.conf conditions are met">
            <oval-def:criterion test_ref="oval:ssg-test_ntp_remote_server:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_chronyd_or_ntpd_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable the NTP Daemon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>At least one of the chronyd or ntpd services should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_chronyd_or_ntpd_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="chronyd or ntpd service enabled" operator="OR">
            <oval-def:extend_definition comment="service chronyd enabled" definition_ref="oval:ssg-service_chronyd_enabled:def:1"/>
            <oval-def:extend_definition comment="service ntpd enabled" definition_ref="oval:ssg-service_ntpd_enabled:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_rsh_trust_files:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Remove Rsh Trust Files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>There should not be any .rhosts or hosts.equiv files on the system.</oval-def:description>
            <oval-def:reference ref_id="no_rsh_trust_files" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_no_rsh_trust_files_root:tst:1" negate="true"/>
            <oval-def:criterion test_ref="oval:ssg-test_no_rsh_trust_files_home:tst:1" negate="true"/>
            <oval-def:criterion test_ref="oval:ssg-test_no_rsh_trust_files_etc:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-snmpd_not_default_password:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure Default SNMP Password Is Not Used</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>SNMP default communities must be removed.</oval-def:description>
            <oval-def:reference ref_id="snmpd_not_default_password" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="SNMP communities" test_ref="oval:ssg-test_snmp_default_communities:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-snmpd_use_newer_protocol:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Configure SNMP Service to Use Only SNMPv3 or Newer</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>SNMP version 1 and 2c must not be enabled.</oval-def:description>
            <oval-def:reference ref_id="snmpd_use_newer_protocol" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="SNMP installed" definition_ref="oval:ssg-package_net-snmp_removed:def:1"/>
            <oval-def:criterion comment="SNMP protocols" test_ref="oval:ssg-test_snmp_versions:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_allow_only_protocol2:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Allow Only SSH Protocol 2</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The OpenSSH daemon should be running protocol 2.</oval-def:description>
            <oval-def:reference ref_id="sshd_allow_only_protocol2" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="SSH version is equal or higher than 7.4 or it is configured with protocol 2" operator="OR">
                <oval-def:extend_definition comment="OpenSSH version 7.4 or higher supports only protocol 2" definition_ref="oval:ssg-sshd_version_equal_or_higher_than_74:def:1"/>
                <oval-def:criterion comment="Check Protocol in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_allow_only_protocol2:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_disable_compression:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Compression Or Set Compression to delayed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>SSH should either have compression disabled or set to delayed.</oval-def:description>
            <oval-def:reference ref_id="sshd_disable_compression" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criterion comment="Check Compression in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_compression:tst:1"/>
            </oval-def:criteria>
            <oval-def:extend_definition comment="OpenSSH version 7.4 or higher contains fix for authentication Compression exploit" definition_ref="oval:ssg-sshd_version_equal_or_higher_than_74:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_disable_rhosts_rsa:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable SSH Support for Rhosts RSA Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>SSH can allow authentication through the obsolete rsh command
      through the use of the authenticating user's SSH keys. This should be disabled.</oval-def:description>
            <oval-def:reference ref_id="sshd_disable_rhosts_rsa" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="SSH version is equal or higher than 7.4 has deprecated RhostsRSAAuthentication" operator="OR">
                <oval-def:extend_definition comment="OpenSSH version 7.4 or higher has deprecated RhostsRSAAuthentication" definition_ref="oval:ssg-sshd_version_equal_or_higher_than_74:def:1"/>
                <oval-def:criterion comment="Check RhostsRSAAuthentication in /etc/ssh/sshd_config" negate="true" test_ref="oval:ssg-test_sshd_disable_rhosts_rsa:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_rekey_limit:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Force frequent session key renegotiation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure {{{ parameter }}} is configured with the appropriate value in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_rekey_limit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured corectly" operator="OR">
                <oval-def:criterion comment="Check the RekeyLimit in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_rekey_limit:tst:1"/>
                <oval-def:criterion comment="Check the RekeyLimit in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_rekey_limit_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_set_idle_timeout:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set SSH Idle Timeout Interval</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The SSH idle timeout interval should be set to an
      appropriate value.</oval-def:description>
            <oval-def:reference ref_id="sshd_set_idle_timeout" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="ClientAliveInterval is configured correctly" operator="OR">
                <oval-def:criterion comment="Check ClientAliveInterval in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_idle_timeout:tst:1"/>
                <oval-def:criterion comment="Check ClientAliveInterval in /etc/ssh/sshd_config.d/" test_ref="oval:ssg-test_sshd_idle_timeout_config_dir:tst:1"/>
              </oval-def:criteria>
              <oval-def:extend_definition comment="The SSH ClientAliveCountMax is set to zero" definition_ref="oval:ssg-sshd_set_keepalive:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_set_keepalive:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set SSH Client Alive Count Max</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The SSH ClientAliveCountMax should be set to an appropriate
      value (and dependencies are met)</oval-def:description>
            <oval-def:reference ref_id="sshd_set_keepalive" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured" operator="OR">
                <oval-def:criterion comment="Check ClientAliveCountMax in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_clientalivecountmax:tst:1"/>
                <oval-def:criterion comment="Check ClientAliveCountMax in /etc/ssh/sshd_config.d/ files" test_ref="oval:ssg-test_sshd_clientalivecountmax_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_set_login_grace_time:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure SSH LoginGraceTime is configured</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The SSH number seconds for login grace time should be set to an
      appropriate value.</oval-def:description>
            <oval-def:reference ref_id="sshd_set_login_grace_time" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criterion comment="Check LoginGraceTime in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_login_grace_time:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_set_max_auth_tries:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set SSH authentication attempt limit</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The SSH MaxAuthTries should be set to an
      appropriate value.</oval-def:description>
            <oval-def:reference ref_id="sshd_set_max_auth_tries" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH is not being used or conditions are met" operator="OR">
            <oval-def:extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
            <oval-def:criterion comment="Check MaxAuthTries in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_max_auth_tries:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_set_max_sessions:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set SSH MaxSessions limit</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The SSH number of max sessions should be set to an
      appropriate value.</oval-def:description>
            <oval-def:reference ref_id="sshd_set_max_sessions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criterion comment="Check MaxSessions in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_max_sessions:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_set_maxstartups:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure SSH MaxStartups is configured</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'MaxStartups' is configured in
      '/etc/ssh/sshd_config'</oval-def:description>
            <oval-def:reference ref_id="sshd_set_maxstartups" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion test_ref="oval:ssg-tst_maxstartups_start_parameter:tst:1" comment="SSH MaxStartups start parameter is less than or equal to 10"/>
              <oval-def:criterion test_ref="oval:ssg-tst_maxstartups_rate_parameter:tst:1" comment="SSH MaxStartups rate parameter is greater than or equal to 30"/>
              <oval-def:criterion test_ref="oval:ssg-tst_maxstartups_full_parameter:tst:1" comment="SSH MaxStartups full parameter is less than or equal to 100"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_use_directory_configuration:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Distribute the SSH Server configuration to multiple files in a config directory.</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>foo</oval-def:description>
            <oval-def:reference ref_id="sshd_use_directory_configuration" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:extend_definition comment="sshd includes config files from its .d directory" definition_ref="oval:ssg-sshd_includes_config_files:def:1"/>
                <oval-def:criterion comment="Check the absence of match in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_use_directory_configuration_default_not_overriden:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_use_priv_separation:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable Use of Privilege Separation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'UsePrivilegeSeparation' is configured with value 'sandbox' in '/etc/ssh/sshd_config'</oval-def:description>
            <oval-def:reference ref_id="sshd_use_priv_separation" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check the UsePrivilegeSeparation in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_use_priv_separation:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sssd_certificate_verification:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Certificate status checking in SSSD</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>SSSD should be configured with the correct ocsp_dgst
            digest function</oval-def:description>
            <oval-def:reference ref_id="sssd_certificate_verification" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="check value of certificate_verification in sssd configuration" test_ref="oval:ssg-test_sssd_certificate_verification:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sssd_enable_smartcards:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable Smartcards in SSSD</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>SSSD should be configured to authenticate access to the system
    using smart cards.</oval-def:description>
            <oval-def:reference ref_id="sssd_enable_smartcards" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="OR">
              <oval-def:extend_definition comment="Check if sssd service is disabled" definition_ref="oval:ssg-service_sssd_disabled:def:1"/>
              <oval-def:extend_definition comment="Check if /etc/sssd/sssd.conf is configured for usage" definition_ref="oval:ssg-sssd_conf_exists:def:1" negate="true"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check pam_cert_auth in /etc/sssd/sssd.conf" test_ref="oval:ssg-test_sssd_enable_smartcards:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sssd_memcache_timeout:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure SSSD's Memory Cache to Expire</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>SSSD's memory cache should be configured to set to expire records after 1 day.</oval-def:description>
            <oval-def:reference ref_id="sssd_memcache_timeout" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="OR">
              <oval-def:extend_definition comment="Check if sssd service is disabled" definition_ref="oval:ssg-service_sssd_disabled:def:1"/>
              <oval-def:extend_definition comment="Check if /etc/sssd/sssd.conf is configured for usage" definition_ref="oval:ssg-sssd_conf_exists:def:1" negate="true"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check memcache_timeout in /etc/sssd/sssd.conf" test_ref="oval:ssg-test_sssd_memcache_timeout:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sssd_offline_cred_expiration:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure SSSD to Expire Offline Credentials</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>SSSD should be configured to expire offline credentials after 1 day.</oval-def:description>
            <oval-def:reference ref_id="sssd_offline_cred_expiration" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="OR">
              <oval-def:extend_definition comment="Check if sssd service is disabled" definition_ref="oval:ssg-service_sssd_disabled:def:1"/>
              <oval-def:extend_definition comment="Check if /etc/sssd/sssd.conf is configured for usage" definition_ref="oval:ssg-sssd_conf_exists:def:1" negate="true"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check offline_credentials_expiration in /etc/sssd/sssd.conf" test_ref="oval:ssg-test_sssd_offline_cred_expiration:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sssd_run_as_sssd_user:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure SSSD to run as user sssd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>SSSD processes should be configured to run as user sssd, not root.</oval-def:description>
            <oval-def:reference ref_id="sssd_run_as_sssd_user" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check user setting in SSSD configuration" test_ref="oval:ssg-test_sssd_run_as_sssd_user:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sssd_ssh_known_hosts_timeout:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure SSSD to Expire SSH Known Hosts</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>SSSD should be configured to expire keys from known SSH hosts after 1 day.</oval-def:description>
            <oval-def:reference ref_id="sssd_ssh_known_hosts_timeout" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="OR">
              <oval-def:extend_definition comment="Check if sssd service is disabled" definition_ref="oval:ssg-service_sssd_disabled:def:1"/>
              <oval-def:extend_definition comment="Check if /etc/sssd/sssd.conf is configured for usage" definition_ref="oval:ssg-sssd_conf_exists:def:1" negate="true"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check ssh_known_hosts_timeout in /etc/sssd/sssd.conf" test_ref="oval:ssg-test_sssd_ssh_known_hosts_timeout:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_usbguard_auditbackend:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Log USBGuard daemon audit events using Linux Audit</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'AuditBackend' is configured with value 'LinuxAudit' in /etc/usbguard/usbguard-daemon.conf</oval-def:description>
            <oval-def:reference ref_id="configure_usbguard_auditbackend" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="usbguard is configured correctly and configuration file exists" operator="AND">
            <oval-def:criteria comment="usbguard is configured correctly" operator="OR">
              <oval-def:criterion comment="Check the AuditBackend in /etc/usbguard/usbguard-daemon.conf" test_ref="oval:ssg-test_configure_usbguard_auditbackend:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="test if configuration file /etc/usbguard/usbguard-daemon.conf exists for configure_usbguard_auditbackend" test_ref="oval:ssg-test_configure_usbguard_auditbackend_config_file_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-usbguard_allow_hid:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Authorize Human Interface Devices in USBGuard daemon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that /etc/usbguard/rules.conf exists and that it contains at least one non white space character.</oval-def:description>
            <oval-def:reference ref_id="usbguard_allow_hid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character." operator="AND">
            <oval-def:extend_definition comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character." definition_ref="oval:ssg-usbguard_rules_not_empty_not_missing:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-usbguard_allow_hid_and_hub:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Authorize Human Interface Devices and USB hubs in USBGuard daemon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that /etc/usbguard/rules.conf contains at least one non whitespace character and exists.</oval-def:description>
            <oval-def:reference ref_id="usbguard_allow_hid_and_hub" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character." operator="AND">
            <oval-def:extend_definition comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character." definition_ref="oval:ssg-usbguard_rules_not_empty_not_missing:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-usbguard_allow_hub:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Authorize USB hubs in USBGuard daemon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that /etc/usbguard/rules.conf contains at least one non whitespace character and exists.</oval-def:description>
            <oval-def:reference ref_id="usbguard_allow_hub" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character." operator="AND">
            <oval-def:extend_definition comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character." definition_ref="oval:ssg-usbguard_rules_not_empty_not_missing:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-xwindows_runlevel_target:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable X Windows Startup By Setting Default Target</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure that the default runlevel target is set to multi-user.target.</oval-def:description>
            <oval-def:reference ref_id="xwindows_runlevel_target" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="default.target systemd softlink exists" test_ref="oval:ssg-test_disable_xwindows_runlevel_target:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-banner_etc_issue:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Modify the System Login Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The system login banner text should be set correctly.</oval-def:description>
            <oval-def:reference ref_id="banner_etc_issue" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="/etc/issue is set appropriately" test_ref="oval:ssg-test_banner_etc_issue:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-banner_etc_motd:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Modify the System Message of the Day Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The system login banner text should be set correctly.</oval-def:description>
            <oval-def:reference ref_id="banner_etc_motd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="/etc/motd is set appropriately" test_ref="oval:ssg-test_banner_etc_motd:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_banner_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable GNOME3 Login Warning Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Enable the GNOME3 Login warning banner.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_banner_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Enable GUI banner and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Enable GUI banner" test_ref="oval:ssg-test_banner_gui_enabled:tst:1"/>
              <oval-def:criterion comment="Prevent user from disabling banner" test_ref="oval:ssg-test_prevent_user_banner_gui_enabled_change:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_login_banner_text:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set the GNOME3 Login Warning Banner Text</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Enable the GUI warning banner.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_login_banner_text" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Enable GUI banner and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Prevent user from changing banner" test_ref="oval:ssg-test_prevent_user_banner_change:tst:1"/>
              <oval-def:criterion comment="Login banner is correctly set" test_ref="oval:ssg-test_gdm_login_banner_text_setting:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-disallow_bypass_password_sudo:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disallow Configuration to Bypass Password Requirements for Privilege Escalation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disallow Configuration to Bypass Password Requirements for Privilege Escalation.</oval-def:description>
            <oval-def:reference ref_id="disallow_bypass_password_sudo" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check absence of conf pam_succeed_if in /etc/pam.d/sudo" test_ref="oval:ssg-test_disallow_bypass_password_sudo:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-display_login_attempts:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Displays Last Logon/Access Notification</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Configure the system to notify users of last login/access using pam_lastlog.</oval-def:description>
            <oval-def:reference ref_id="display_login_attempts" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Conditions for pam_lastlog are satisfied" test_ref="oval:ssg-test_display_login_attempts:tst:1"/>
            <oval-def:criterion comment="silent option for pam_lastlog is not set" test_ref="oval:ssg-test_display_login_attempts_silent:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-enable_pam_namespace:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set Up a Private Namespace in PAM Configuration</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check presence of pam_namespace.so module in the /etc/pam.d/login file</oval-def:description>
            <oval-def:reference ref_id="enable_pam_namespace" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Check that /etc/pam.d/login contains a line with certain text">
            <oval-def:criterion comment="Check that /etc/pam.d/login contains a line with certain text" test_ref="oval:ssg-test_enable_pam_namespace:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_pwhistory_remember_password_auth:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Limit Password Reuse: password-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The passwords to remember should be set correctly.</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_pwhistory_remember_password_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="remember parameter of pam_pwhistory.so is set correctly in password-auth" operator="AND">
            <oval-def:criterion comment="remember parameter of pam_pwhistory.so is set correctly in password-auth" test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_pwhistory_remember_system_auth:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Limit Password Reuse: system-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The passwords to remember should be set correctly.</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_pwhistory_remember_system_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="remember parameter of pam_pwhistory.so is set correctly" operator="AND">
            <oval-def:criterion comment="remember parameter of pam_pwhistory.so is set correctly" test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_unix_remember:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Limit Password Reuse</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The passwords to remember should be set correctly.</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_unix_remember" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="remember parameter of pam_unix.so or pam_pwhistory.so is set correctly" operator="OR">
            <oval-def:criterion comment="remember parameter of pam_unix.so is set correctly" test_ref="oval:ssg-test_accounts_password_pam_unix_remember:tst:1"/>
            <oval-def:criterion comment="remember parameter of pam_pwhistory.so is set correctly" test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_passwords_pam_faillock_deny:def:1" version="5">
          <oval-def:metadata>
            <oval-def:title>Lock Accounts After Failed Password Attempts</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Lockout account after failed login attempts</oval-def:description>
            <oval-def:reference ref_id="accounts_passwords_pam_faillock_deny" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Check the proper configuration of pam_faillock.so">
            <oval-def:criteria operator="AND" comment="Check if pam_faillock.so is properly enabled">
              <oval-def:criteria operator="AND" comment="Count occurrences of pam_unix.so in system-auth and password-auth">
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_unix_auth:tst:1" comment="pam_unix.so appears only once in auth section of system-auth"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_unix_auth:tst:1" comment="pam_unix.so appears only once in auth section of password-auth"/>
              </oval-def:criteria>
              <oval-def:criteria operator="AND" comment="Check common definition of pam_faillock.so">
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_faillock_auth:tst:1" comment="pam_faillock.so is properly defined in auth section of system-auth"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_faillock_account:tst:1" comment="pam_faillock.so is properly defined in account section of system-auth"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_faillock_auth:tst:1" comment="pam_faillock.so is properly defined in auth section of password-auth"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_faillock_account:tst:1" comment="pam_faillock.so is properly defined in account section of password-auth"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="OR" comment="Check expected value for pam_faillock.so deny parameter">
              <oval-def:criteria operator="AND" comment="Check expected pam_faillock.so deny parameter in pam files">
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_pamd_system:tst:1" comment="Check the deny parameter in auth section of system-auth file"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_pamd_password:tst:1" comment="Check the deny parameter in auth section of password-auth file"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_faillock_conf:tst:1" comment="Ensure /etc/security/faillock.conf is not used together with pam files"/>
              </oval-def:criteria>
              <oval-def:criteria operator="AND" comment="Check expected pam_faillock.so deny parameter in faillock.conf">
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_pamd_system:tst:1" comment="Check the deny parameter is not present system-auth file"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_pamd_password:tst:1" comment="Check the deny parameter is not present password-auth file"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_faillock_conf:tst:1" comment="Ensure the deny parameter is present in /etc/security/faillock.conf"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_passwords_pam_faillock_deny_root:def:1" version="5">
          <oval-def:metadata>
            <oval-def:title>Configure the root Account for Failed Password Attempts</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The root account should be configured to deny access after the number of
      defined failed attempts has been reached.</oval-def:description>
            <oval-def:reference ref_id="accounts_passwords_pam_faillock_deny_root" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Check the proper configuration of pam_faillock.so">
            <oval-def:criteria operator="AND" comment="Check if pam_faillock.so is properly enabled">
              <oval-def:criteria operator="AND" comment="Count occurrences of pam_unix.so in system-auth and password-auth">
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_system_pam_unix_auth:tst:1" comment="pam_unix.so appears only once in auth section of system-auth"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_password_pam_unix_auth:tst:1" comment="pam_unix.so appears only once in auth section of password-auth"/>
              </oval-def:criteria>
              <oval-def:criteria operator="AND" comment="Check common definition of pam_faillock.so">
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_auth:tst:1" comment="pam_faillock.so is properly defined in auth section of system-auth"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_account:tst:1" comment="pam_faillock.so is properly defined in account section of system-auth"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_auth:tst:1" comment="pam_faillock.so is properly defined in auth section of password-auth"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_account:tst:1" comment="pam_faillock.so is properly defined in account section of password-auth"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="OR" comment="Check expected value for pam_faillock.so even_deny_root parameter">
              <oval-def:criteria operator="AND" comment="Check expected pam_faillock.so even_deny_root parameter in pam files">
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_pamd_system:tst:1" comment="Check the even_deny_root parameter in auth section of system-auth file"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_pamd_password:tst:1" comment="Check the even_deny_root parameter in auth section of password-auth file"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_no_faillock_conf:tst:1" comment="Ensure /etc/security/faillock.conf is not used together with pam files"/>
              </oval-def:criteria>
              <oval-def:criteria operator="AND" comment="Check expected pam_faillock.so even_deny_root parameter in faillock.conf">
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_no_pamd_system:tst:1" comment="Check the even_deny_root parameter is not present system-auth file"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_no_pamd_password:tst:1" comment="Check the even_deny_root parameter is not present password-auth file"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_faillock_conf:tst:1" comment="Ensure the even_deny_root parameter is present in /etc/security/faillock.conf"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_passwords_pam_faillock_enforce_local:def:1" version="5">
          <oval-def:metadata>
            <oval-def:title>Enforce pam_faillock for Local Accounts Only</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Enforce pam_faillock for Local Accounts Only</oval-def:description>
            <oval-def:reference ref_id="accounts_passwords_pam_faillock_enforce_local" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Check the proper configuration of pam_faillock.so">
            <oval-def:criteria operator="AND" comment="Check if pam_faillock.so is properly enabled">
              <oval-def:criteria operator="AND" comment="Count occurrences of pam_unix.so in system-auth and password-auth">
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_system_pam_unix_auth:tst:1" comment="pam_unix.so appears only once in auth section of system-auth"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_password_pam_unix_auth:tst:1" comment="pam_unix.so appears only once in auth section of password-auth"/>
              </oval-def:criteria>
              <oval-def:criteria operator="AND" comment="Check common definition of pam_faillock.so">
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_system_pam_faillock_auth:tst:1" comment="pam_faillock.so is properly defined in auth section of system-auth"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_system_pam_faillock_account:tst:1" comment="pam_faillock.so is properly defined in account section of system-auth"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_password_pam_faillock_auth:tst:1" comment="pam_faillock.so is properly defined in auth section of password-auth"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_password_pam_faillock_account:tst:1" comment="pam_faillock.so is properly defined in account section of password-auth"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_parameter_faillock_conf:tst:1" comment="Ensure the local_users_only parameter is present in /etc/security/faillock.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_passwords_pam_faillock_interval:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Set Interval For Counting Failed Password Attempts</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The number of allowed failed logins should be set correctly.</oval-def:description>
            <oval-def:reference ref_id="accounts_passwords_pam_faillock_interval" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Check the proper configuration of pam_faillock.so">
            <oval-def:criteria operator="AND" comment="Check if pam_faillock.so is properly enabled">
              <oval-def:criteria operator="AND" comment="Count occurrences of pam_unix.so in system-auth and password-auth">
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_unix_auth:tst:1" comment="pam_unix.so appears only once in auth section of system-auth"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_unix_auth:tst:1" comment="pam_unix.so appears only once in auth section of password-auth"/>
              </oval-def:criteria>
              <oval-def:criteria operator="AND" comment="Check common definition of pam_faillock.so">
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_faillock_auth:tst:1" comment="pam_faillock.so is properly defined in auth section of system-auth"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_faillock_account:tst:1" comment="pam_faillock.so is properly defined in account section of system-auth"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_faillock_auth:tst:1" comment="pam_faillock.so is properly defined in auth section of password-auth"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_faillock_account:tst:1" comment="pam_faillock.so is properly defined in account section of password-auth"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="OR" comment="Check expected value for pam_faillock.so fail_interval parameter">
              <oval-def:criteria operator="AND" comment="Check expected pam_faillock.so fail_interval parameter in pam files">
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_pamd_system:tst:1" comment="Check the fail_interval parameter in auth section of system-auth file"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_pamd_password:tst:1" comment="Check the fail_interval parameter in auth section of password-auth file"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_faillock_conf:tst:1" comment="Ensure /etc/security/faillock.conf is not used together with pam files"/>
              </oval-def:criteria>
              <oval-def:criteria operator="AND" comment="Check expected pam_faillock.so fail_interval parameter in faillock.conf">
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_pamd_system:tst:1" comment="Check the fail_interval parameter is not present system-auth file"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_pamd_password:tst:1" comment="Check the fail_interval parameter is not present password-auth file"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_faillock_conf:tst:1" comment="Ensure the fail_interval parameter is present in /etc/security/faillock.conf"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_passwords_pam_faillock_unlock_time:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Set Lockout Time for Failed Password Attempts</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The unlock time after number of failed logins should be set correctly.</oval-def:description>
            <oval-def:reference ref_id="accounts_passwords_pam_faillock_unlock_time" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Check the proper configuration of pam_faillock.so">
            <oval-def:criteria operator="AND" comment="Check if pam_faillock.so is properly enabled">
              <oval-def:criteria operator="AND" comment="Count occurrences of pam_unix.so in system-auth and password-auth">
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_unix_auth:tst:1" comment="pam_unix.so appears only once in auth section of system-auth"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_unix_auth:tst:1" comment="pam_unix.so appears only once in auth section of password-auth"/>
              </oval-def:criteria>
              <oval-def:criteria operator="AND" comment="Check common definition of pam_faillock.so">
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_auth:tst:1" comment="pam_faillock.so is properly defined in auth section of system-auth"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_account:tst:1" comment="pam_faillock.so is properly defined in account section of system-auth"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_auth:tst:1" comment="pam_faillock.so is properly defined in auth section of password-auth"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_account:tst:1" comment="pam_faillock.so is properly defined in account section of password-auth"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="OR" comment="Check expected value for pam_faillock.so unlock_time parameter">
              <oval-def:criteria operator="AND" comment="Check expected pam_faillock.so unlock_time parameter in pam files">
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_system:tst:1" comment="Check the unlock_time parameter in auth section of system-auth file"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_password:tst:1" comment="Check the unlock_time parameter in auth section of password-auth file"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_faillock_conf:tst:1" comment="Ensure /etc/security/faillock.conf is not used together with pam files"/>
              </oval-def:criteria>
              <oval-def:criteria operator="AND" comment="Check expected pam_faillock.so unlock_time parameter in faillock.conf">
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_pamd_system:tst:1" comment="Check the unlock_time parameter is not present system-auth file"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_pamd_password:tst:1" comment="Check the unlock_time parameter is not present password-auth file"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_faillock_conf:tst:1" comment="Ensure the unlock_time parameter is present in /etc/security/faillock.conf"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_pwquality_password_auth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM password complexity module is enabled in password-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The PAM module pam_pwquality is used in password-auth</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_pwquality_password_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Condition for pam_pwquality in password-auth is satisfied">
            <oval-def:criterion comment="pam_pwquality password-auth" test_ref="oval:ssg-test_accounts_password_pam_pwquality_password_auth:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_pwquality_system_auth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM password complexity module is enabled in system-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The PAM module pam_pwquality is used in system-auth</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_pwquality_system_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Condition for pam_pwquality in system-auth is satisfied">
            <oval-def:criterion comment="pam_pwquality system-auth" test_ref="oval:ssg-test_accounts_password_pam_pwquality_system_auth:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_retry:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password retry should meet minimum requirements</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_retry" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR" comment="Conditions for retry are satisfied">
            <oval-def:criteria operator="AND" comment="Conditions for retry in PAM files are satisfied">
              <oval-def:criterion comment="pam_pwquality system-auth" test_ref="oval:ssg-test_password_pam_pwquality_retry_system_auth:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND" comment="Conditions for retry in pwquality.conf file are satisfied">
              <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
              <oval-def:criterion comment="check retry parameter in pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_retry_pwquality_conf:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-set_password_hashing_algorithm_libuserconf:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set Password Hashing Algorithm in /etc/libuser.conf</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password hashing algorithm should be set correctly in /etc/libuser.conf.</oval-def:description>
            <oval-def:reference ref_id="set_password_hashing_algorithm_libuserconf" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_etc_libuser_conf_cryptstyle:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-set_password_hashing_algorithm_logindefs:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Set Password Hashing Algorithm in /etc/login.defs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password hashing algorithm should be set correctly in /etc/login.defs.</oval-def:description>
            <oval-def:reference ref_id="set_password_hashing_algorithm_logindefs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_etc_login_defs_encrypt_method:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-set_password_hashing_algorithm_passwordauth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set PAM's Password Hashing Algorithm - password-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password hashing algorithm should be set correctly in /etc/pam.d/password-auth.</oval-def:description>
            <oval-def:reference ref_id="set_password_hashing_algorithm_passwordauth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_pam_unix_passwordauth_sha512:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-set_password_hashing_algorithm_systemauth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set PAM's Password Hashing Algorithm</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password hashing algorithm should be set correctly in /etc/pam.d/system-auth.</oval-def:description>
            <oval-def:reference ref_id="set_password_hashing_algorithm_systemauth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_pam_unix_sha512:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-disable_ctrlaltdel_reboot:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Ctrl-Alt-Del Reboot Activation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>By default, the system will reboot when the
      Ctrl-Alt-Del key sequence is pressed.</oval-def:description>
            <oval-def:reference ref_id="disable_ctrlaltdel_reboot" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Disable Ctrl-Alt-Del systemd softlink exists" test_ref="oval:ssg-test_disable_ctrlaltdel_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_disable_interactive_boot:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Verify that Interactive Boot is Disabled</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The ability for users to perform interactive startups should
      be disabled.</oval-def:description>
            <oval-def:reference ref_id="grub2_disable_interactive_boot" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux:tst:1" comment="Check systemd.confirm_spawn=(1|yes|true|on) not in GRUB_CMDLINE_LINUX"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion test_ref="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux_default:tst:1" comment="Check systemd.confirm_spawn=(1|yes|true|on) not in GRUB_CMDLINE_LINUX_DEFAULT"/>
              <oval-def:extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-require_emergency_target_auth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Require Authentication for Emergency Systemd Target</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The requirement for a password to boot into emergency mode
      should be configured correctly.</oval-def:description>
            <oval-def:reference ref_id="require_emergency_target_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Conditions are satisfied" test_ref="oval:ssg-test_require_emergency_service:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_require_emergency_service_emergency_target:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_no_custom_emergency_target:tst:1" negate="true"/>
            <oval-def:criterion test_ref="oval:ssg-test_no_custom_emergency_service:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-require_singleuser_auth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Require Authentication for Single User Mode</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The requirement for a password to boot into single-user mode
      should be configured correctly.</oval-def:description>
            <oval-def:reference ref_id="require_singleuser_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Conditions are satisfied" test_ref="oval:ssg-test_require_rescue_service:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_require_rescue_service_runlevel1:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_no_custom_runlevel1_target:tst:1" negate="true"/>
            <oval-def:criterion test_ref="oval:ssg-test_no_custom_rescue_service:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_bashrc_exec_tmux:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Support session locking with tmux</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if tmux is configured to exec at the end of bashrc.</oval-def:description>
            <oval-def:reference ref_id="configure_bashrc_exec_tmux" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check exec tmux configured at the end of bashrc" operator="AND">
            <oval-def:criterion comment="check tmux is configured to exec on the last line of /etc/bashrc" test_ref="oval:ssg-test_configure_bashrc_exec_tmux:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_tmux_lock_after_time:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure tmux to lock session after inactivity</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if tmux is configured to lock sessions after period of inactivity.</oval-def:description>
            <oval-def:reference ref_id="configure_tmux_lock_after_time" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Configure tmux to lock session after inactivity" operator="AND">
            <oval-def:criterion comment="check lock-after-time is set to 900 in /etc/tmux.conf" test_ref="oval:ssg-test_configure_tmux_lock_after_time:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_tmux_lock_command:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure the tmux Lock Command</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if the vlock command is configured to be used as a locking mechanism in tmux.</oval-def:description>
            <oval-def:reference ref_id="configure_tmux_lock_command" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Configure the tmux Lock Command" operator="AND">
            <oval-def:criterion comment="check lock-command is set to vlock in /etc/tmux.conf" test_ref="oval:ssg-test_configure_tmux_lock_command:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_tmux_in_shells:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Prevent user from disabling the screen lock</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that tmux is not listed in /etc/shells</oval-def:description>
            <oval-def:reference ref_id="no_tmux_in_shells" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check that tmux is not listed in /etc/shells" operator="AND">
            <oval-def:criterion comment="check that tmux is not listed in /etc/shells" test_ref="oval:ssg-test_no_tmux_in_shells:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_opensc_card_drivers:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure opensc Smart Card Drivers</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Configure the organization's smart card driver so that only
      the smart card in use by the organization will be recognized by the system.</oval-def:description>
            <oval-def:reference ref_id="configure_opensc_card_drivers" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_configure_opensc_card_drivers:tst:1" comment="Check that card_drivers is configured for opensc"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_opensc_nss_db:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure NSS DB To Use opensc</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The NSS DB should be set to use opensc library.</oval-def:description>
            <oval-def:reference ref_id="configure_opensc_nss_db" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_configure_opensc_nss_db:tst:1" comment="Check opensc library is configured in /etc/pki/nssdb/pkcs11.txt"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-force_opensc_card_drivers:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Force opensc To Use Defined Smart Card Driver</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Force opensc to use the organization's smart card driver so that only
      the smart card in use by the organization will be recognized by the system.</oval-def:description>
            <oval-def:reference ref_id="force_opensc_card_drivers" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_force_opensc_card_drivers:tst:1" comment="Check that force_card_driver is configured for opensc"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-smartcard_auth:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Smart Card Login</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Enable Smart Card logins</oval-def:description>
            <oval-def:reference ref_id="smartcard_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="smart card authentication is configured" operator="AND">
            <oval-def:extend_definition comment="packages needed for smartcard support are installed" definition_ref="oval:ssg-install_smartcard_packages:def:1"/>
            <oval-def:extend_definition comment="pcscd service is enabled" definition_ref="oval:ssg-service_pcscd_enabled:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:extend_definition comment="esc package is installed" definition_ref="oval:ssg-package_esc_installed:def:1"/>
              <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            </oval-def:criteria>
            <oval-def:criterion comment="cert_policy directive contains oscp_on" test_ref="oval:ssg-test_pam_pkcs11_cert_policy_ocsp_on:tst:1"/>
            <oval-def:criteria comment="smart card authentication is enabled or required in system-auth" operator="OR">
              <oval-def:criterion comment="smart card authentication is enabled in /etc/pam.d/system-auth" test_ref="oval:ssg-test_smart_card_enabled_system_auth:tst:1"/>
              <oval-def:criterion comment="smart card is required in /etc/pam.d/system-auth" test_ref="oval:ssg-test_smart_card_required_system_auth:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="smart card is required in /etc/pam.d/smartcard-auth" test_ref="oval:ssg-test_smart_card_required_smartcard_auth:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-account_unique_id:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure All Accounts on the System Have Unique User IDs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All accounts on the system should have unique IDs for proper accountability.</oval-def:description>
            <oval-def:reference ref_id="account_unique_id" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="There should not exist duplicate user IDs entries in /etc/passwd">
            <oval-def:criterion test_ref="oval:ssg-test_etc_passwd_no_duplicate_user_ids:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_authorized_local_users:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Only Authorized Local User Accounts Exist on Operating System</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Besides the default operating system user, there should be no other users
      except the users that are authorized to exist locally on the operating system.</oval-def:description>
            <oval-def:reference ref_id="accounts_authorized_local_users" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_accounts_authorized_local_users:tst:1" comment="only root user and explicitly authorized users are allowed in /etc/passwd"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-group_unique_id:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure All Groups on the System Have Unique Group ID</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All groups on the system should have unique names for proper accountability.</oval-def:description>
            <oval-def:reference ref_id="group_unique_id" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="There should not exist duplicate group ids entries in /etc/passwd">
            <oval-def:criterion test_ref="oval:ssg-test_etc_group_no_duplicate_group_ids:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-group_unique_name:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure All Groups on the System Have Unique Group Names</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All groups on the system should have unique names for proper accountability.</oval-def:description>
            <oval-def:reference ref_id="group_unique_name" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="There should not exist duplicate group names entries in /etc/passwd">
            <oval-def:criterion test_ref="oval:ssg-test_etc_group_no_duplicate_group_names:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-account_disable_post_pw_expiration:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Set Account Expiration Following Inactivity</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The accounts should be configured to expire automatically following password expiration.</oval-def:description>
            <oval-def:reference ref_id="account_disable_post_pw_expiration" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="the value INACTIVE parameter should be set appropriately in /etc/default/useradd">
            <oval-def:criterion test_ref="oval:ssg-test_etc_default_useradd_inactive:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-account_unique_name:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure All Accounts on the System Have Unique Names</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All accounts on the system should have unique names for proper accountability.</oval-def:description>
            <oval-def:reference ref_id="account_unique_name" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="There should not exist duplicate user name entries in /etc/passwd">
            <oval-def:criterion test_ref="oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_maximum_age_login_defs:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Set Password Maximum Age</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The maximum password age policy should meet minimum requirements.</oval-def:description>
            <oval-def:reference ref_id="accounts_maximum_age_login_defs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="The value PASS_MAX_DAYS should be set appropriately in /etc/login.defs">
            <oval-def:criterion test_ref="oval:ssg-test_pass_max_days:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_minimum_age_login_defs:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Set Password Minimum Age</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The minimum password age policy should be set appropriately.</oval-def:description>
            <oval-def:reference ref_id="accounts_minimum_age_login_defs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="The value of PASS_MIN_DAYS should be set appropriately in /etc/login.defs">
            <oval-def:criterion test_ref="oval:ssg-test_pass_min_days:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_minlen_login_defs:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Set Password Minimum Length in login.defs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password minimum length should be set appropriately.</oval-def:description>
            <oval-def:reference ref_id="accounts_password_minlen_login_defs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_pass_min_len:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_warn_age_login_defs:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Set Password Warning Age</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password expiration warning age should be set appropriately.</oval-def:description>
            <oval-def:reference ref_id="accounts_password_warn_age_login_defs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_pass_warn_age:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_all_shadowed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify All Account Password Hashes are Shadowed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All password hashes should be shadowed.</oval-def:description>
            <oval-def:reference ref_id="accounts_password_all_shadowed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="password hashes are shadowed" test_ref="oval:ssg-test_accounts_password_all_shadowed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_all_shadowed_sha512:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify All Account Password Hashes are Shadowed with SHA512</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All password hashes should be shadowed.</oval-def:description>
            <oval-def:reference ref_id="accounts_password_all_shadowed_sha512" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="password hashes are shadowed using sha512" test_ref="oval:ssg-test_accounts_password_all_shadowed_sha512:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_unix_rounds_password_auth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set number of Password Hashing Rounds - password-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The number of rounds for password hashing should be set correctly.</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_unix_rounds_password_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check if rounds option of pam_unix is as expected" operator="OR">
            <oval-def:criterion comment="The value of rounds is set correctly in pam_unix.so" test_ref="oval:ssg-test_password_auth_pam_unix_rounds_is_set:tst:1"/>
            <oval-def:criteria comment="The value of rounds is no set, in this case the system default is used" operator="AND">
              <oval-def:criterion comment="The default value of rounds is used in pam_unix.so" test_ref="oval:ssg-test_password_auth_pam_unix_rounds_is_default:tst:1"/>
              <oval-def:criterion comment="The target value of rounds is the default" test_ref="oval:ssg-test_password_auth_default_pam_unix_rounds_var:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_unix_rounds_system_auth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set number of Password Hashing Rounds - system-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The number of rounds for password hashing should be set correctly.</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_unix_rounds_system_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check if rounds option of pam_unix is as expected" operator="OR">
            <oval-def:criterion comment="The value of rounds is set correctly in pam_unix.so" test_ref="oval:ssg-test_system_auth_pam_unix_rounds_is_set:tst:1"/>
            <oval-def:criteria comment="The value of rounds is no set, in this case the system default is used" operator="AND">
              <oval-def:criterion comment="The default value of rounds is used in pam_unix.so" test_ref="oval:ssg-test_system_auth_pam_unix_rounds_is_default:tst:1"/>
              <oval-def:criterion comment="The target value of rounds is the default" test_ref="oval:ssg-test_system_auth_default_pam_unix_rounds_var:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-gid_passwd_group_same:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>All GIDs referenced in /etc/passwd must be defined in /etc/group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All GIDs referenced in /etc/passwd must be defined in /etc/group.</oval-def:description>
            <oval-def:reference ref_id="gid_passwd_group_same" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_gid_passwd_group_same:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_empty_passwords:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Prevent Login to Accounts With Empty Password</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The file /etc/pam.d/system-auth should not contain the nullok option</oval-def:description>
            <oval-def:reference ref_id="no_empty_passwords" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="make sure the nullok option is not used in /etc/pam.d/system-auth" test_ref="oval:ssg-test_no_empty_passwords:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_empty_passwords_etc_shadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure There Are No Accounts With Blank or Null Passwords</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The file /etc/shadow shows that there aren't empty passwords</oval-def:description>
            <oval-def:reference ref_id="no_empty_passwords_etc_shadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="make sure there aren't blank or null passwords in /etc/shadow" test_ref="oval:ssg-test_no_empty_passwords_etc_shadow:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_legacy_plus_entries_etc_group:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure there are no legacy + NIS entries in /etc/group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>No lines starting with + are in /etc/group</oval-def:description>
            <oval-def:reference ref_id="no_legacy_plus_entries_etc_group" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="no lines starting with + are in /etc/group">
            <oval-def:criterion test_ref="oval:ssg-test_no_legacy_plus_entries_etc_group:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_legacy_plus_entries_etc_passwd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure there are no legacy + NIS entries in /etc/passwd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>No lines starting with + are in /etc/passwd</oval-def:description>
            <oval-def:reference ref_id="no_legacy_plus_entries_etc_passwd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="no lines starting with + are in /etc/passwd">
            <oval-def:criterion test_ref="oval:ssg-test_no_legacy_plus_entries_etc_passwd:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_legacy_plus_entries_etc_shadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure there are no legacy + NIS entries in /etc/shadow</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>No lines starting with + are in /etc/shadow</oval-def:description>
            <oval-def:reference ref_id="no_legacy_plus_entries_etc_shadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="no lines starting with + are in /etc/shadow">
            <oval-def:criterion test_ref="oval:ssg-test_no_legacy_plus_entries_etc_shadow:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_netrc_files:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify No netrc Files Exist</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The .netrc files contain login information used to auto-login into FTP servers and reside in the user's home directory. Any .netrc files should be removed.</oval-def:description>
            <oval-def:reference ref_id="no_netrc_files" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_no_netrc_files_home:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_no_uid_except_zero:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Only Root Has UID 0</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Only the root account should be assigned a user id of 0.</oval-def:description>
            <oval-def:reference ref_id="accounts_no_uid_except_zero" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="tests that there are no accounts with UID 0 except root in the /etc/passwd file" test_ref="oval:ssg-test_accounts_no_uid_except_root:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_root_gid_zero:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Root Has A Primary GID 0</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The root account should have primary group of 0</oval-def:description>
            <oval-def:reference ref_id="accounts_root_gid_zero" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="tests that the root account's gid is equal to 0" test_ref="oval:ssg-test_accounts_root_gid_zero:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_direct_root_logins:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Direct root Logins Not Allowed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Preventing direct root logins help ensure accountability for actions
      taken on the system using the root account.</oval-def:description>
            <oval-def:reference ref_id="no_direct_root_logins" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="serial ports /etc/securetty" test_ref="oval:ssg-test_no_direct_root_logins:tst:1"/>
            <oval-def:criterion comment="serial ports /etc/securetty" test_ref="oval:ssg-test_etc_securetty_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_shelllogin_for_systemaccounts:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure that System Accounts Do Not Run a Shell Upon Login</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The root account is the only system account that should have
      a login shell.</oval-def:description>
            <oval-def:reference ref_id="no_shelllogin_for_systemaccounts" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Test SYS_UID_MIN not defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_min_not_defined:tst:1"/>
              <oval-def:criterion comment="Test SYS_UID_MAX not defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_max_not_defined:tst:1"/>
              <oval-def:criterion comment="Test shell defined for UID from &lt;0, UID_MIN -1&gt;" test_ref="oval:ssg-test_shell_defined_default_uid_range:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Test SYS_UID_MIN defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_min_not_defined:tst:1" negate="true"/>
              <oval-def:criterion comment="Test SYS_UID_MAX defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_max_not_defined:tst:1" negate="true"/>
              <oval-def:criterion comment="Test shell defined for reserved system UIDs" test_ref="oval:ssg-test_shell_defined_reserved_uid_range:tst:1"/>
              <oval-def:criterion comment="Test shell defined for dynamically allocated system UIDs" test_ref="oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-restrict_serial_port_logins:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Restrict Serial Port Root Logins</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Preventing direct root login to serial port interfaces helps
      ensure accountability for actions taken on the system using the root
      account.</oval-def:description>
            <oval-def:reference ref_id="restrict_serial_port_logins" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="serial ports /etc/securetty" test_ref="oval:ssg-test_serial_ports_etc_securetty:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-securetty_root_login_console_only:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Restrict Virtual Console Root Logins</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Preventing direct root login to virtual console devices
      helps ensure accountability for actions taken on the system using the
      root account.</oval-def:description>
            <oval-def:reference ref_id="securetty_root_login_console_only" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="virtual consoles /etc/securetty" test_ref="oval:ssg-test_virtual_consoles_etc_securetty:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-use_pam_wheel_for_su:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enforce usage of pam_wheel for su authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Only members of the wheel group should be able to authenticate through the su command.</oval-def:description>
            <oval-def:reference ref_id="use_pam_wheel_for_su" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_use_pam_wheel_for_su:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_have_homedir_login_defs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Home Directories are Created for New Users</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>CREATE_HOME should be enabled</oval-def:description>
            <oval-def:reference ref_id="accounts_have_homedir_login_defs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check CREATE_HOME in /etc/login.defs" test_ref="oval:ssg-test_accounts_have_homedir_login_defs:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_logon_fail_delay:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure the Logon Failure Delay is Set Correctly in login.defs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The delay between failed authentication attempts should be
      set for all users specified in /etc/login.defs</oval-def:description>
            <oval-def:reference ref_id="accounts_logon_fail_delay" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_accounts_logon_fail_delay:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_max_concurrent_login_sessions:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Limit the Number of Concurrent Login Sessions Allowed Per User</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The maximum number of concurrent login sessions per user should meet
      minimum requirements.</oval-def:description>
            <oval-def:reference ref_id="accounts_max_concurrent_login_sessions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf" test_ref="oval:ssg-test_limitsd_maxlogins:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="the value maxlogins should not be set at all in /etc/security/limits.d/*.conf" test_ref="oval:ssg-test_limitsd_maxlogins_exists:tst:1" negate="true"/>
              <oval-def:criterion comment="the value maxlogins should be set appropriately in /etc/security/limits.conf" test_ref="oval:ssg-test_maxlogins:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_polyinstantiated_tmp:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure Polyinstantiation of /tmp Directories</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description/>
            <oval-def:reference ref_id="accounts_polyinstantiated_tmp" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Check Polyinstantiation of /tmp Directories">
            <oval-def:criterion comment="Check that /tmp/tmp-inst exists and has mode 000" test_ref="oval:ssg-test_tmp_inst:tst:1"/>
            <oval-def:criterion comment="Check configuration of /tmp in /etc/security/namespace.conf file" test_ref="oval:ssg-test_tmp_in_namespace_conf:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_polyinstantiated_var_tmp:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure Polyinstantiation of /var/tmp Directories</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description/>
            <oval-def:reference ref_id="accounts_polyinstantiated_var_tmp" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Check Polyinstantiation of /tmp Directories">
            <oval-def:criterion comment="Check that /var/tmp/tmp-inst exists and has mode 000" test_ref="oval:ssg-test_var_tmp_tmp_inst:tst:1"/>
            <oval-def:criterion comment="Check configuration of /var/tmp in /etc/security/namespace.conf file" test_ref="oval:ssg-test_var_tmp_in_namespace_conf:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_tmout:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Set Interactive Session Timeout</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks interactive shell timeout</oval-def:description>
            <oval-def:reference ref_id="accounts_tmout" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="TMOUT value in /etc/profile &lt;= var_accounts_tmout" test_ref="oval:ssg-test_etc_profile_tmout:tst:1"/>
            <oval-def:criterion comment="TMOUT value in /etc/profile.d/*.sh &lt;= var_accounts_tmout" test_ref="oval:ssg-test_etc_profiled_tmout:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_home_dirs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure that User Home Directories are not Group-Writable or World-Readable</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure that User Home Directories are not Group-Writable or World-Readable</oval-def:description>
            <oval-def:reference ref_id="file_permissions_home_dirs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="home directories" test_ref="oval:ssg-test_file_permissions_home_dirs:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_root_path_dirs_no_write:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure that Root's Path Does Not Include World or Group-Writable Directories</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check each directory in root's path and make use it does
      not grant write permission to group and other</oval-def:description>
            <oval-def:reference ref_id="accounts_root_path_dirs_no_write" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check that write permission to group and other in root's path is denied">
            <oval-def:criterion comment="Check for write permission to group and other in root's path" test_ref="oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-root_path_no_dot:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure that Root's Path Does Not Include Relative Paths or Null Directories</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The environment variable PATH should be set correctly for
      the root user.</oval-def:description>
            <oval-def:reference ref_id="root_path_no_dot" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="environment variable PATH contains dangerous path" operator="AND">
            <oval-def:criterion comment="environment variable PATH starts with : or ." test_ref="oval:ssg-test_env_var_begins:tst:1"/>
            <oval-def:criterion comment="environment variable PATH contains : twice in a row" test_ref="oval:ssg-test_env_var_contains_doublecolon:tst:1"/>
            <oval-def:criterion comment="environment variable PATH contains . twice in a row" test_ref="oval:ssg-test_env_var_contains_doubleperiod:tst:1"/>
            <oval-def:criterion comment="environment variable PATH ends with : or ." test_ref="oval:ssg-test_env_var_ends:tst:1"/>
            <oval-def:criterion comment="environment variable PATH doesn't begin with a /" test_ref="oval:ssg-test_env_var_begins_slash:tst:1"/>
            <oval-def:criterion comment="environment variable PATH doesn't contain relative paths" test_ref="oval:ssg-test_env_var_contains_relative_path:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_umask_etc_login_defs:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure the Default Umask is Set Correctly in login.defs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The default umask for all users specified in /etc/login.defs</oval-def:description>
            <oval-def:reference ref_id="accounts_umask_etc_login_defs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Get value of var_accounts_user_umask variable as octal number" definition_ref="oval:ssg-var_accounts_user_umask_as_number:def:1"/>
            <oval-def:criterion test_ref="oval:ssg-tst_accounts_umask_etc_login_defs:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_umask_etc_profile:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure the Default Umask is Set Correctly in /etc/profile</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The default umask for all users should be set correctly</oval-def:description>
            <oval-def:reference ref_id="accounts_umask_etc_profile" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Get value of var_accounts_user_umask variable as octal number" definition_ref="oval:ssg-var_accounts_user_umask_as_number:def:1"/>
            <oval-def:criterion test_ref="oval:ssg-tst_accounts_umask_etc_profile:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_enable_syscall_auditing:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable Syscall Auditing</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Syscall auditing should not be disabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_enable_syscall_auditing" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="check that no audit rule exists in /etc/audit/rules.d/*.rules that disables all syscall auditing" test_ref="oval:ssg-test_enable_syscall_audit_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="check that no audit rule exists in /etc/audit/audit.rules that disables all syscall auditing" test_ref="oval:ssg-test_enable_syscall_audit_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_immutable:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Make the auditd Configuration Immutable</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Force a reboot to change audit rules is enabled</oval-def:description>
            <oval-def:reference ref_id="audit_rules_immutable" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules configuration locked" test_ref="oval:ssg-test_ari_locked_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl configuration locked" test_ref="oval:ssg-test_ari_locked_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_mac_modification:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Mandatory Access Controls</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules that detect changes to the system's mandatory access controls (SELinux) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_mac_modification" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit selinux changes augenrules" test_ref="oval:ssg-test_armm_selinux_watch_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit selinux changes auditctl" test_ref="oval:ssg-test_armm_selinux_watch_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_networkconfig_modification:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Network Environment</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The network environment should not be modified by anything other than
      administrator action. Any change to network parameters should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_networkconfig_modification" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit /etc/issue augenrules" test_ref="oval:ssg-test_arnm_etc_issue_augenrules:tst:1"/>
              <oval-def:criterion comment="audit /etc/issue.net augenrules" test_ref="oval:ssg-test_arnm_etc_issue_net_augenrules:tst:1"/>
              <oval-def:criterion comment="audit /etc/hosts augenrules" test_ref="oval:ssg-test_arnm_etc_hosts_augenrules:tst:1"/>
              <oval-def:criterion comment="audit /etc/sysconfig/network augenrules" test_ref="oval:ssg-test_arnm_etc_sysconfig_network_augenrules:tst:1"/>
              <oval-def:extend_definition comment="audit augenrules sethostname" definition_ref="oval:ssg-audit_rules_networkconfig_modification_hostname:def:1"/>
              <oval-def:extend_definition comment="audit augenrules setdomainname" definition_ref="oval:ssg-audit_rules_networkconfig_modification_domainname:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit /etc/issue auditctl" test_ref="oval:ssg-test_arnm_etc_issue_auditctl:tst:1"/>
              <oval-def:criterion comment="audit /etc/issue.net auditctl" test_ref="oval:ssg-test_arnm_etc_issue_net_auditctl:tst:1"/>
              <oval-def:criterion comment="audit /etc/hosts auditctl" test_ref="oval:ssg-test_arnm_etc_hosts_auditctl:tst:1"/>
              <oval-def:criterion comment="audit /etc/sysconfig/network auditctl" test_ref="oval:ssg-test_arnm_etc_sysconfig_network_auditctl:tst:1"/>
              <oval-def:extend_definition comment="audit augenrules sethostname" definition_ref="oval:ssg-audit_rules_networkconfig_modification_hostname:def:1"/>
              <oval-def:extend_definition comment="audit augenrules setdomainname" definition_ref="oval:ssg-audit_rules_networkconfig_modification_domainname:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_session_events:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to Alter Process and Session Initiation Information</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules should capture information about session initiation.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_session_events" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules utmp" test_ref="oval:ssg-test_arse_utmp_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules btmp" test_ref="oval:ssg-test_arse_btmp_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules wtmp" test_ref="oval:ssg-test_arse_wtmp_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl utmp" test_ref="oval:ssg-test_arse_utmp_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl btmp" test_ref="oval:ssg-test_arse_btmp_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl wtmp" test_ref="oval:ssg-test_arse_wtmp_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_sysadmin_actions:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects System Administrator Actions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit actions taken by system administrators on the system.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_sysadmin_actions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules sudoers" test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules sudoers_d" test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl sudoers" test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl sudoers_d" test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_usergroup_modification:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules should detect modification to system files that hold information about users and groups.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_usergroup_modification" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit /etc/group" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_group_augen:tst:1"/>
              <oval-def:criterion comment="audit /etc/passwd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_augen:tst:1"/>
              <oval-def:criterion comment="audit /etc/gshadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_augen:tst:1"/>
              <oval-def:criterion comment="audit /etc/shadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_augen:tst:1"/>
              <oval-def:criterion comment="audit /etc/security/opasswd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_augen:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit /etc/group" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_group_auditctl:tst:1"/>
              <oval-def:criterion comment="audit /etc/passwd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_auditctl:tst:1"/>
              <oval-def:criterion comment="audit /etc/gshadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_auditctl:tst:1"/>
              <oval-def:criterion comment="audit /etc/shadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_auditctl:tst:1"/>
              <oval-def:criterion comment="audit /etc/security/opasswd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-directory_access_var_log_audit:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Access Events to Audit Log Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the read events to /var/log/audit</oval-def:description>
            <oval-def:reference ref_id="directory_access_var_log_audit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record read access events to /var/log/audit" test_ref="oval:ssg-test_directory_acccess_var_log_audit_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record read access events to /var/log/audit" test_ref="oval:ssg-test_directory_acccess_var_log_audit_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-directory_permissions_var_log_audit:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>System Audit Logs Must Have Mode 0750 or Less Permissive</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks for correct permissions for audit logs.</oval-def:description>
            <oval-def:reference ref_id="directory_permissions_var_log_audit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND" comment="log_file set">
              <oval-def:extend_definition comment="log_file set in auditd.conf" definition_ref="oval:ssg-auditd_conf_log_file_not_set:def:1" negate="true"/>
              <oval-def:criteria operator="AND" comment="log_group in auditd.conf is not root">
                <oval-def:extend_definition comment="log_group in auditd.conf is not root" definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1"/>
                <oval-def:criterion test_ref="oval:ssg-test_dir_permissions_audit_log-non_root:tst:1" negate="true"/>
              </oval-def:criteria>
              <oval-def:criterion test_ref="oval:ssg-test_dir_permissions_audit_log:tst:1" negate="true"/>
            </oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_dir_permissions_var_log_audit:tst:1" negate="true"/>
            <oval-def:criteria operator="AND" comment="log_group in auditd.conf is not root">
              <oval-def:extend_definition comment="log_group in auditd.conf is not root" definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1"/>
              <oval-def:criterion test_ref="oval:ssg-test_dir_permissions_var_log_audit-non_root:tst:1" negate="true"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_ownership_var_log_audit:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>System Audit Logs Must Be Owned By Root</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks that all /var/log/audit files and directories are owned by the root user and group.</oval-def:description>
            <oval-def:reference ref_id="file_ownership_var_log_audit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND" comment="directories are root owned">
              <oval-def:criterion test_ref="oval:ssg-test_ownership_var_log_audit_files:tst:1"/>
              <oval-def:criterion test_ref="oval:ssg-test_ownership_var_log_audit_directories:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND" comment="log_group in auditd.conf is not root">
              <oval-def:extend_definition comment="log_group in auditd.conf is not root" definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1"/>
              <oval-def:criterion test_ref="oval:ssg-test_ownership_var_log_audit_files-non_root:tst:1"/>
              <oval-def:criterion test_ref="oval:ssg-test_ownership_var_log_audit_directories-non_root:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_var_log_audit:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>System Audit Logs Must Have Mode 0640 or Less Permissive</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks for correct permissions for all audit log files.</oval-def:description>
            <oval-def:reference ref_id="file_permissions_var_log_audit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND" comment="log_file set">
              <oval-def:extend_definition comment="log_file set in auditd.conf" definition_ref="oval:ssg-auditd_conf_log_file_not_set:def:1" negate="true"/>
              <oval-def:criteria operator="AND" comment="log_group in auditd.conf is not root">
                <oval-def:extend_definition comment="log_group in auditd.conf is not root" definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1"/>
                <oval-def:criterion test_ref="oval:ssg-test_file_permissions_audit_log-non_root:tst:1" negate="true"/>
              </oval-def:criteria>
              <oval-def:criterion test_ref="oval:ssg-test_file_permissions_audit_log:tst:1" negate="true"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND" comment="log_group in auditd.conf is not root">
              <oval-def:extend_definition comment="log_group in auditd.conf is not root" definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1"/>
              <oval-def:criterion test_ref="oval:ssg-test_file_permissions_var_log_audit-non_root:tst:1" negate="true"/>
            </oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_file_permissions_var_log_audit:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_umount:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - umount</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_umount" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit umount" test_ref="oval:ssg-test_32bit_ardm_umount_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit umount" test_ref="oval:ssg-test_32bit_ardm_umount_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_file_deletion_events:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects File Deletion Events by User</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit files deletion events.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_file_deletion_events" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="audit rmdir" definition_ref="oval:ssg-audit_rules_file_deletion_events_rmdir:def:1"/>
            <oval-def:extend_definition comment="audit unlink" definition_ref="oval:ssg-audit_rules_file_deletion_events_unlink:def:1"/>
            <oval-def:extend_definition comment="audit unlinkat" definition_ref="oval:ssg-audit_rules_file_deletion_events_unlinkat:def:1"/>
            <oval-def:extend_definition comment="audit rename" definition_ref="oval:ssg-audit_rules_file_deletion_events_rename:def:1"/>
            <oval-def:extend_definition comment="audit renameat" definition_ref="oval:ssg-audit_rules_file_deletion_events_renameat:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="audit creat" definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_creat:def:1"/>
            <oval-def:extend_definition comment="audit ftruncate" definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_ftruncate:def:1"/>
            <oval-def:extend_definition comment="audit openat" definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_openat:def:1"/>
            <oval-def:extend_definition comment="audit open_by_handle_at" definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at:def:1"/>
            <oval-def:extend_definition comment="audit open" definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_open:def:1"/>
            <oval-def:extend_definition comment="audit truncate" definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_truncate:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_kernel_module_loading:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on Kernel Module Loading and Unloading</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The audit rules should be configured to log information about kernel module loading and unloading.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_kernel_module_loading" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="audit init_module" definition_ref="oval:ssg-audit_rules_kernel_module_loading_init:def:1"/>
            <oval-def:extend_definition comment="audit delete_module" definition_ref="oval:ssg-audit_rules_kernel_module_loading_delete:def:1"/>
            <oval-def:extend_definition comment="audit finit_module" definition_ref="oval:ssg-audit_rules_kernel_module_loading_finit:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_kernel_module_loading_delete:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on Kernel Module Unloading - delete_module</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The audit rules should be configured to log information about kernel module loading and unloading.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_kernel_module_loading_delete" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit delete_module" test_ref="oval:ssg-test_32bit_ardm_delete_module_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit delete_module" test_ref="oval:ssg-test_64bit_ardm_delete_module_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit delete_module" test_ref="oval:ssg-test_32bit_ardm_delete_module_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit delete_module" test_ref="oval:ssg-test_64bit_ardm_delete_module_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_kernel_module_loading_finit:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The audit rules should be configured to log information about kernel module loading and unloading.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_kernel_module_loading_finit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit finit_module" test_ref="oval:ssg-test_32bit_ardm_finit_module_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit finit_module" test_ref="oval:ssg-test_64bit_ardm_finit_module_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit finit_module" test_ref="oval:ssg-test_32bit_ardm_finit_module_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit finit_module" test_ref="oval:ssg-test_64bit_ardm_finit_module_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_kernel_module_loading_init:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on Kernel Module Loading - init_module</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The audit rules should be configured to log information about kernel module loading and unloading.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_kernel_module_loading_init" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit init_module" test_ref="oval:ssg-test_32bit_ardm_init_module_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit init_module" test_ref="oval:ssg-test_64bit_ardm_init_module_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit init_module" test_ref="oval:ssg-test_32bit_ardm_init_module_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit init_module" test_ref="oval:ssg-test_64bit_ardm_init_module_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_login_events:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to Alter Logon and Logout Events</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules should be configured to log successful and unsuccessful login and logout events.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_login_events" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="audit tallylog" definition_ref="oval:ssg-audit_rules_login_events_tallylog:def:1"/>
            <oval-def:extend_definition comment="audit faillock" definition_ref="oval:ssg-audit_rules_login_events_faillock:def:1"/>
            <oval-def:extend_definition comment="audit lastlog" definition_ref="oval:ssg-audit_rules_login_events_lastlog:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of privileged commands are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules suid sgid" test_ref="oval:ssg-test_arpc_suid_sgid_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules binaries count matches rules count" test_ref="oval:ssg-test_arpc_bin_count_equals_rules_count_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl suid sgid" test_ref="oval:ssg-test_arpc_suid_sgid_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl binaries count matches rules count" test_ref="oval:ssg-test_arpc_bin_count_equals_rules_count_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_time_adjtimex:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record attempts to alter time through adjtimex</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Record attempts to alter time through adjtimex.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_time_adjtimex" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit adjtimex" test_ref="oval:ssg-test_32bit_art_adjtimex_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit adjtimex" test_ref="oval:ssg-test_64bit_art_adjtimex_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit adjtimex" test_ref="oval:ssg-test_32bit_art_adjtimex_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit adjtimex" test_ref="oval:ssg-test_64bit_art_adjtimex_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_time_clock_settime:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to Alter Time Through clock_settime</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Record attempts to alter time through clock_settime.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_time_clock_settime" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit clock_settime" test_ref="oval:ssg-test_32bit_art_clock_settime_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit clock_settime" test_ref="oval:ssg-test_64bit_art_clock_settime_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit clock_settime" test_ref="oval:ssg-test_32bit_art_clock_settime_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit clock_settime" test_ref="oval:ssg-test_64bit_art_clock_settime_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_time_settimeofday:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record attempts to alter time through settimeofday</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Record attempts to alter time through settimeofday.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_time_settimeofday" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit settimeofday" test_ref="oval:ssg-test_32bit_art_settimeofday_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit settimeofday" test_ref="oval:ssg-test_64bit_art_settimeofday_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit settimeofday" test_ref="oval:ssg-test_32bit_art_settimeofday_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit settimeofday" test_ref="oval:ssg-test_64bit_art_settimeofday_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_time_stime:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to Alter Time Through stime</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Record attempts to alter time through stime. Note that on
      64-bit architectures the stime system call is not defined in the audit
      system calls lookup table.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_time_stime" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria comment="32-bit or 64-bit system" operator="OR">
              <oval-def:extend_definition comment="32-bit system" definition_ref="oval:ssg-system_info_architecture_x86:def:1"/>
              <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="audit augenrules or audit auditctl" operator="OR">
              <oval-def:criteria comment="audit augenrules stime" operator="AND">
                <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
                <oval-def:criterion comment="audit augenrules 32-bit stime" test_ref="oval:ssg-test_32bit_art_stime_augenrules:tst:1"/>
              </oval-def:criteria>
              <oval-def:criteria comment="audit auditctl stime" operator="AND">
                <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
                <oval-def:criterion comment="audit auditctl 32-bit stime" test_ref="oval:ssg-test_32bit_art_stime_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_time_watch_localtime:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to Alter the localtime File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Record attempts to alter time through /etc/localtime.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_time_watch_localtime" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit /etc/localtime watch augenrules" test_ref="oval:ssg-test_artw_etc_localtime_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit /etc/localtime watch auditctl" test_ref="oval:ssg-test_artw_etc_localtime_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_audispd_configure_remote_server:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure audispd Plugin To Send Logs To Remote Server</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>remote_server setting in /etc/audit/audisp-remote.conf is set to a certain IP address or hostname</oval-def:description>
            <oval-def:reference ref_id="auditd_audispd_configure_remote_server" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="remote_server setting in audisp-remote.conf" test_ref="oval:ssg-test_auditd_audispd_configure_remote_server:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_audispd_encrypt_sent_records:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Encrypt Audit Records Sent With audispd Plugin</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>transport setting in /etc/audit/audisp-remote.conf is set to 'KRB5'</oval-def:description>
            <oval-def:reference ref_id="auditd_audispd_encrypt_sent_records" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="setting in audisp-remote.conf" test_ref="oval:ssg-test_auditd_audispd_encrypt_sent_records:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_audispd_syslog_plugin_activated:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure auditd to use audispd's syslog plugin</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>active setting in /etc/audit/plugins.d/syslog.conf is set to 'yes'</oval-def:description>
            <oval-def:reference ref_id="auditd_audispd_syslog_plugin_activated" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="active setting in syslog.conf" test_ref="oval:ssg-test_auditd_audispd_syslog_plugin_activated:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_data_disk_error_action:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure auditd Disk Error Action on Disk Error</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>disk_error_action setting in /etc/audit/auditd.conf is set to a certain action</oval-def:description>
            <oval-def:reference ref_id="auditd_data_disk_error_action" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="disk_error_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_disk_error_action:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_data_disk_full_action:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure auditd Disk Full Action when Disk Space Is Full</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>disk_full_action setting in /etc/audit/auditd.conf is set to a certain action</oval-def:description>
            <oval-def:reference ref_id="auditd_data_disk_full_action" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="disk_full_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_disk_full_action:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_data_retention_action_mail_acct:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Configure auditd mail_acct Action on Low Disk Space</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>action_mail_acct setting in /etc/audit/auditd.conf is set to a certain account</oval-def:description>
            <oval-def:reference ref_id="auditd_data_retention_action_mail_acct" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="action_mail_acct setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_action_mail_acct:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_data_retention_admin_space_left_action:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Configure auditd admin_space_left Action on Low Disk Space</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>admin_space_left_action setting in /etc/audit/auditd.conf is set to a certain action</oval-def:description>
            <oval-def:reference ref_id="auditd_data_retention_admin_space_left_action" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="admin_space_left_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_admin_space_left_action:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_data_retention_flush:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure auditd flush priority</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The setting for flush in /etc/audit/auditd.conf</oval-def:description>
            <oval-def:reference ref_id="auditd_data_retention_flush" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="flush setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_flush:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_data_retention_max_log_file:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Configure auditd Max Log File Size</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>max_log_file setting in /etc/audit/auditd.conf is set to at least a certain value</oval-def:description>
            <oval-def:reference ref_id="auditd_data_retention_max_log_file" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="max_log_file setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_max_log_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_data_retention_max_log_file_action:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Configure auditd max_log_file_action Upon Reaching Maximum Log Size</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>max_log_file_action setting in /etc/audit/auditd.conf is set to a certain action</oval-def:description>
            <oval-def:reference ref_id="auditd_data_retention_max_log_file_action" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="max_log_file_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_max_log_file_action:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_data_retention_num_logs:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Configure auditd Number of Logs Retained</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>num_logs setting in /etc/audit/auditd.conf is set to at least a certain value</oval-def:description>
            <oval-def:reference ref_id="auditd_data_retention_num_logs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="num_logs setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_num_logs:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_data_retention_space_left_action:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure auditd space_left Action on Low Disk Space</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>space_left_action setting in /etc/audit/auditd.conf is set to a certain action</oval-def:description>
            <oval-def:reference ref_id="auditd_data_retention_space_left_action" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="space_left_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_space_left_action:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_data_retention_space_left_percentage:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Configure auditd space_left on Low Disk Space</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>space_left setting in /etc/audit/auditd.conf is set to at least a certain value</oval-def:description>
            <oval-def:reference ref_id="auditd_data_retention_space_left_percentage" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="space_left setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_space_left_percentage:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_overflow_action:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Appropriate Action Must be Setup When the Internal Audit Event Queue is Full</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'overflow_action' is configured with value '(syslog|single|halt)' in /etc/audit/auditd.conf</oval-def:description>
            <oval-def:reference ref_id="auditd_overflow_action" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="The respective application or service is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the overflow_action in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_overflow_action:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_admin_username:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set the Boot Loader Admin Username to a Non-Default Value</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The grub2 boot loader superuser should have a username that is hard to guess.</oval-def:description>
            <oval-def:reference ref_id="grub2_admin_username" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Superuser is defined in /boot/grub2/grub.cfg and it isn't             root, admin, administrator nor equal to any system username" test_ref="oval:ssg-test_bootloader_superuser_differ_from_other_users:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_password:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set Boot Loader Password in grub2</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The grub2 boot loader should have password protection enabled.</oval-def:description>
            <oval-def:reference ref_id="grub2_password" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criteria comment="check both files to account for procedure change in documenation" operator="OR">
                <oval-def:criterion comment="make sure a password is defined in /boot/grub2/user.cfg" test_ref="oval:ssg-test_grub2_password_usercfg:tst:1"/>
                <oval-def:criterion comment="make sure a password is defined in /boot/grub2/grub.cfg" test_ref="oval:ssg-test_grub2_password_grubcfg:tst:1"/>
              </oval-def:criteria>
              <oval-def:criterion comment="make sure a superuser is defined in /boot/grub2/grub.cfg" test_ref="oval:ssg-test_bootloader_superuser:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_uefi_admin_username:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set the UEFI Boot Loader Admin Username to a Non-Default Value</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The grub2 boot loader superuser should have a username that is hard to guess.</oval-def:description>
            <oval-def:reference ref_id="grub2_uefi_admin_username" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Superuser is defined in /boot/grub2/grub.cfg and it             isn't root, admin, administrator nor equal to any system username" test_ref="oval:ssg-test_bootloader_uefi_superuser_differ_from_other_users:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_uefi_password:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set the UEFI Boot Loader Password</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The UEFI grub2 boot loader should have password protection enabled.</oval-def:description>
            <oval-def:reference ref_id="grub2_uefi_password" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="make sure a password is defined in /boot/grub2/user.cfg" test_ref="oval:ssg-test_grub2_uefi_password_usercfg:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-logwatch_configured_hostlimit:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure Logwatch HostLimit Line</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Test if HostLimit line in logwatch.conf is set appropriately.</oval-def:description>
            <oval-def:reference ref_id="logwatch_configured_hostlimit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Test value of HostLimit" test_ref="oval:ssg-test_logwatch_configured_hostlimit:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-logwatch_configured_splithosts:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure Logwatch SplitHosts Line</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if SplitHosts line in logwatch.conf is set appropriately.</oval-def:description>
            <oval-def:reference ref_id="logwatch_configured_splithosts" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Test value of SplitHosts" test_ref="oval:ssg-test_logwatch_configured_splithosts:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rsyslog_cron_logging:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure cron Is Logging To Rsyslog</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Rsyslog should be configured to capture cron messages.</oval-def:description>
            <oval-def:reference ref_id="rsyslog_cron_logging" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="cron is configured in /etc/rsyslog.conf" test_ref="oval:ssg-test_cron_logging_rsyslog:tst:1"/>
            <oval-def:criterion comment="cron is configured in /etc/rsyslog.d" test_ref="oval:ssg-test_cron_logging_rsyslog_dir:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Rsyslog Authenticates Off-Loaded Audit Records</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Rsyslogd must authenticate remote system its sending logs to.</oval-def:description>
            <oval-def:reference ref_id="rsyslog_encrypt_offload_actionsendstreamdriverauthmode" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf" test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:tst:1"/>
              <oval-def:criterion comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in files in /etc/rsyslog.d" test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Rsyslog Encrypts Off-Loaded Audit Records</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Rsyslogd must encrypt the off-loading of logs off of the system.</oval-def:description>
            <oval-def:reference ref_id="rsyslog_encrypt_offload_actionsendstreamdrivermode" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf" test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:tst:1"/>
              <oval-def:criterion comment="Check if $ActionSendStreamDriverMode 1 is set in files in /etc/rsyslog.d" test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Rsyslog Encrypts Off-Loaded Audit Records</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Rsyslogd must encrypt the off-loading of logs off of the system.</oval-def:description>
            <oval-def:reference ref_id="rsyslog_encrypt_offload_defaultnetstreamdriver" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf" test_ref="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:tst:1"/>
              <oval-def:criterion comment="Check if $DefaultNetstreamDriver gtls is set in files in /etc/rsyslog.d" test_ref="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rsyslog_files_groupownership:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Log Files Are Owned By Appropriate Group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All syslog log files should be owned by the appropriate group.</oval-def:description>
            <oval-def:reference ref_id="rsyslog_files_groupownership" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check if all system log files are owned by the appropriate group" test_ref="oval:ssg-test_rsyslog_files_groupownership:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rsyslog_files_ownership:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Log Files Are Owned By Appropriate User</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All syslog log files should be owned by the appropriate user.</oval-def:description>
            <oval-def:reference ref_id="rsyslog_files_ownership" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check if all system log files are owned by appropriate user" test_ref="oval:ssg-test_rsyslog_files_ownership:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rsyslog_files_permissions:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure System Log Files Have Correct Permissions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>File permissions for all syslog log files should be set correctly.</oval-def:description>
            <oval-def:reference ref_id="rsyslog_files_permissions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check permissions of all system log files" test_ref="oval:ssg-test_rsyslog_files_permissions:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rsyslog_remote_access_monitoring:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure remote access methods are monitored in Rsyslog</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Rsyslog should be configured to monitor remote access methods.</oval-def:description>
            <oval-def:reference ref_id="rsyslog_remote_access_monitoring" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="remote access methods are configured in rsyslog" operator="AND">
            <oval-def:criterion comment="ensure 'auth.*' remote method is configured in rsyslog" test_ref="oval:ssg-test_remote_method_monitoring_auth:tst:1"/>
            <oval-def:criterion comment="ensure 'authpriv.*' remote method is configured in rsyslog" test_ref="oval:ssg-test_remote_method_monitoring_authpriv:tst:1"/>
            <oval-def:criterion comment="ensure 'daemon.*' remote method is configured in rsyslog" test_ref="oval:ssg-test_remote_method_monitoring_daemon:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-ensure_logrotate_activated:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Logrotate Runs Periodically</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>
      The frequency of automatic log files rotation performed by the logrotate utility should be configured to run daily
      </oval-def:description>
            <oval-def:reference ref_id="ensure_logrotate_activated" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="/etc/logrotate.conf contains daily setting and /etc/cron.daily/logrotate file exists" operator="AND">
            <oval-def:criterion comment="Check if daily is set in /etc/logrotate.conf" test_ref="oval:ssg-test_logrotate_conf_daily_setting:tst:1"/>
            <oval-def:criterion comment="check that there is no weekly/monthly/yearly keyword in logrotate.conf" test_ref="oval:ssg-test_logrotate_conf_no_other_keyword:tst:1"/>
            <oval-def:criterion comment="Check if /etc/cron.daily/logrotate file exists (and calls logrotate)" test_ref="oval:ssg-test_cron_daily_logrotate_existence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rsyslog_nolisten:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>rsyslogd should reject remote messages</oval-def:description>
            <oval-def:reference ref_id="rsyslog_nolisten" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Conditions are satisfied" test_ref="oval:ssg-test_rsyslog_nolisten:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rsyslog_remote_loghost:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Logs Sent To Remote Host</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Syslog logs should be sent to a remote loghost</oval-def:description>
            <oval-def:reference ref_id="rsyslog_remote_loghost" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Remote logging set within /etc/rsyslog.conf" test_ref="oval:ssg-test_remote_rsyslog_conf:tst:1"/>
            <oval-def:criterion comment="Remote logging set within /etc/rsyslog.d" test_ref="oval:ssg-test_remote_rsyslog_d:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rsyslog_remote_tls:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure TLS for rsyslog remote logging</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that all needed TLS-related options are present</oval-def:description>
            <oval-def:reference ref_id="rsyslog_remote_tls" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check that rsyslog is configured to use TLS for remote logging" operator="AND">
            <oval-def:criterion comment="Check that all needed TLS-related options are present" test_ref="oval:ssg-test_rsyslog_remote_tls:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rsyslog_remote_tls_cacert:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure CA certificate for rsyslog remote logging</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that the CA certificate path is set</oval-def:description>
            <oval-def:reference ref_id="rsyslog_remote_tls_cacert" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check that CA certificate is configured for rsyslog remote logging" operator="AND">
            <oval-def:criterion comment="Check that the CA certificate path is set" test_ref="oval:ssg-test_rsyslog_remote_tls_cacert:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-network_disable_zeroconf:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Zeroconf Networking</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disable Zeroconf automatic route assignment in the
      169.254.0.0 subnet.</oval-def:description>
            <oval-def:reference ref_id="network_disable_zeroconf" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Look for NOZEROCONF=yes in /etc/sysconfig/network" test_ref="oval:ssg-test_sysconfig_nozeroconf_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-network_nmcli_permissions:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Prevent non-Privileged Users from Modifying Network Interfaces using nmcli</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>polkit is properly configured to prevent non-privileged users from changing networking settings</oval-def:description>
            <oval-def:reference ref_id="network_nmcli_permissions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_network_nmcli_permissions:tst:1" comment="check for properly configured .pkla file"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-network_sniffer_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure System is Not Acting as a Network Sniffer</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disable the network sniffer</oval-def:description>
            <oval-def:reference ref_id="network_sniffer_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="promisc interfaces" test_ref="oval:ssg-test_promisc_interfaces:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-set_firewalld_default_zone:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Set Default firewalld Zone for Incoming Packets</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Change the default firewalld zone to drop.</oval-def:description>
            <oval-def:reference ref_id="set_firewalld_default_zone" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Set default zone to drop" test_ref="oval:ssg-test_firewalld_input_drop:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-network_ipv6_default_gateway:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Manually Assign IPv6 Router Address</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Define default gateways for IPv6 traffic</oval-def:description>
            <oval-def:reference ref_id="network_ipv6_default_gateway" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="IPv6 disabled or..." definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criterion comment="Define default gateways" test_ref="oval:ssg-test_network_ipv6_default_gateway:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-network_ipv6_privacy_extensions:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Use Privacy Extensions for Address</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Enable privacy extensions for IPv6</oval-def:description>
            <oval-def:reference ref_id="network_ipv6_privacy_extensions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="IPv6 disabled or..." definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criterion comment="Enable privacy extensions per interface" test_ref="oval:ssg-test_network_ipv6_privacy_extensions:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-network_ipv6_static_address:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Manually Assign Global IPv6 Address</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Manually configure addresses for IPv6</oval-def:description>
            <oval-def:reference ref_id="network_ipv6_static_address" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="IPv6 disabled or..." definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criterion comment="Set static IPv6 address on each interface" test_ref="oval:ssg-test_network_ipv6_static_address:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_ipv6_option_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable IPv6 Networking Support Automatic Loading</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The disable option will allow the IPv6 module to be inserted, but prevent address assignment and activation of the network stack.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_ipv6_option_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_kernel_module_ipv6_option_disabled:tst:1" comment="ipv6 disabled any modprobe conf file"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-network_ipv6_disable_rpc:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Support for RPC IPv6</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disable ipv6 based rpc services</oval-def:description>
            <oval-def:reference ref_id="network_ipv6_disable_rpc" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Disable udp6" test_ref="oval:ssg-test_network_ipv6_disable_rpc_udp6:tst:1"/>
            <oval-def:criterion comment="Disable tcp6" test_ref="oval:ssg-test_network_ipv6_disable_rpc_tcp6:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-wireless_disable_interfaces:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Deactivate Wireless Network Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All wireless interfaces should be disabled.</oval-def:description>
            <oval-def:reference ref_id="wireless_disable_interfaces" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="check if wifi interfaces are disabled" test_ref="oval:ssg-test_wireless_disable_interfaces:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dir_perms_world_writable_root_owned:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure All World-Writable Directories Are Owned by root user</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All world writable directories should be owned by root.</oval-def:description>
            <oval-def:reference ref_id="dir_perms_world_writable_root_owned" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="check for local directories that are world writable and have uid greater than 0" negate="true">
            <oval-def:criterion comment="check for local directories that are world writable and have uid greater than 0" test_ref="oval:ssg-test_dir_world_writable_uid_gt_zero:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dir_perms_world_writable_sticky_bits:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify that All World-Writable Directories Have Sticky Bits Set</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The sticky bit should be set for all world-writable directories.</oval-def:description>
            <oval-def:reference ref_id="dir_perms_world_writable_sticky_bits" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="all local world writable directories have sticky bit set" test_ref="oval:ssg-test_dir_perms_world_writable_sticky_bits:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dir_perms_world_writable_system_owned:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure All World-Writable Directories Are Owned by a System Account</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All world writable directories should be owned by a system user.</oval-def:description>
            <oval-def:reference ref_id="dir_perms_world_writable_system_owned" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="check for local directories that are world writable and have uid greater than or equal to 1000" negate="true">
            <oval-def:criterion comment="check for local directories that are world writable and have uid greater than or equal to 1000" test_ref="oval:ssg-test_dir_world_writable_uid_gt_value:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dir_perms_world_writable_system_owned_group:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure All World-Writable Directories Are Group Owned by a System Account</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All world writable directories should be group owned by a system user.</oval-def:description>
            <oval-def:reference ref_id="dir_perms_world_writable_system_owned_group" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="check for local directories that are world writable and have gid greater than or equal to 1000" negate="true">
            <oval-def:criterion comment="check for local directories that are world writable and have gid greater than or equal to 1000" test_ref="oval:ssg-test_dir_world_writable_gid_gt_value:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_systemmap:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify that local System.map file (if exists) is readable only by root</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>
        Checks that /boot/System.map-* are only readable by root.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_systemmap" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_permissions_systemmap_files:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_unauthorized_sgid:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure All SGID Executables Are Authorized</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Evaluates to true if all files with SGID set are owned by RPM packages.</oval-def:description>
            <oval-def:reference ref_id="file_permissions_unauthorized_sgid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check all sgid files" test_ref="oval:ssg-test_file_permissions_unauthorized_sgid:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_unauthorized_suid:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure All SUID Executables Are Authorized</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Evaluates to true if all files with SUID set are owned by RPM packages.</oval-def:description>
            <oval-def:reference ref_id="file_permissions_unauthorized_suid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check all suid files" test_ref="oval:ssg-test_file_permissions_unauthorized_suid:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_unauthorized_world_writable:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure No World-Writable Files Exist</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The world-write permission should be disabled for all files.</oval-def:description>
            <oval-def:reference ref_id="file_permissions_unauthorized_world_writable" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_file_permissions_unauthorized_world_write:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_ungroupowned:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure All Files Are Owned by a Group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All files should be owned by a group</oval-def:description>
            <oval-def:reference ref_id="file_permissions_ungroupowned" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check all files and make sure they are owned by a group" test_ref="oval:ssg-test_file_permissions_ungroupowned:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_files_unowned_by_user:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure All Files Are Owned by a User</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All files should be owned by a user</oval-def:description>
            <oval-def:reference ref_id="no_files_unowned_by_user" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check all files and make sure they are owned by a user" test_ref="oval:ssg-no_files_unowned_by_user_test:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupownership_system_commands_dirs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify that system commands files are group owned by root</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>
        Checks that system commands in /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin 
        are owned by root group.
      </oval-def:description>
            <oval-def:reference ref_id="file_groupownership_system_commands_dirs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_groupownership_system_commands_dirs:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_ownership_binary_dirs:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Verify that System Executables Have Root Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>
        Checks that /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin,
        /usr/local/sbin, /usr/libexec, and objects therein, are owned by root.
      </oval-def:description>
            <oval-def:reference ref_id="file_ownership_binary_dirs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_ownership_binary_directories:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_ownership_binary_files:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_binary_dirs:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Verify that System Executables Have Restrictive Permissions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>
        Checks that binary files under /bin, /sbin, /usr/bin, /usr/sbin,
        /usr/local/bin, /usr/local/sbin, and /usr/libexec are not group-writable or world-writable.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_binary_dirs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_perms_binary_files:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_nousb_argument:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Support for USB via Bootloader Configuration</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'GRUB_CMDLINE_LINUX' is configured with value 'nousb' in /etc/default/grub</oval-def:description>
            <oval-def:reference ref_id="grub2_nousb_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="grub is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the GRUB_CMDLINE_LINUX in /etc/default/grub" test_ref="oval:ssg-test_grub2_nousb_argument:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_nodev_nonroot_local_partitions:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to Non-Root Local Partitions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The nodev mount option prevents files from being interpreted
      as character or block devices. Legitimate character and block devices
      should exist in the /dev directory on the root partition or within chroot
      jails built for system services. All other locations should not allow
      character and block devices.</oval-def:description>
            <oval-def:reference ref_id="mount_option_nodev_nonroot_local_partitions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="nodev on local filesystems" test_ref="oval:ssg-test_nodev_nonroot_local_partitions:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_var_tmp_bind:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Bind Mount /var/tmp To /tmp</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The /var/tmp directory should be bind mounted to /tmp in
      order to consolidate temporary storage into one location protected by the
      same techniques as /tmp.</oval-def:description>
            <oval-def:reference ref_id="mount_option_var_tmp_bind" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Ensure /var/tmp is configured to bind mount to /tmp" test_ref="oval:ssg-test_configure_mount_option_var_tmp_bind_tmp:tst:1"/>
            <oval-def:criterion comment="Ensure /var/tmp is mounted" test_ref="oval:ssg-test_mount_option_var_tmp:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Ensure /var/tmp is mounted and binded" test_ref="oval:ssg-test_mount_option_var_tmp_bind:tst:1"/>
              <oval-def:criterion comment="Ensure /var/tmp and /tmp have the same source device" test_ref="oval:ssg-test_mount_option_var_tmp_bind_compare_source:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-coredump_disable_backtraces:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable core dump backtraces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'ProcessSizeMax' is configured with value '0 in section 'Coredump' in /etc/systemd/coredump.conf</oval-def:description>
            <oval-def:reference ref_id="coredump_disable_backtraces" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="systemd-coredump is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the ProcessSizeMax in /etc/systemd/coredump.conf" test_ref="oval:ssg-test_coredump_disable_backtraces:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-coredump_disable_storage:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable storing core dump</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'Storage' is configured with value 'none in section 'Coredump' in /etc/systemd/coredump.conf</oval-def:description>
            <oval-def:reference ref_id="coredump_disable_storage" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="systemd-coredump is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the Storage in /etc/systemd/coredump.conf" test_ref="oval:ssg-test_coredump_disable_storage:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-disable_users_coredumps:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Core Dumps for All Users</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Core dumps for all users should be disabled</oval-def:description>
            <oval-def:reference ref_id="disable_users_coredumps" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Are core dumps disabled in /etc/security/limits.d/*" test_ref="oval:ssg-test_core_dumps_limits_d:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Are core dumps configured in /etc/security/limits.d/*" test_ref="oval:ssg-test_core_dumps_limits_d_exists:tst:1" negate="true"/>
              <oval-def:criterion comment="Are core dumps disabled in /etc/security/limits.conf" test_ref="oval:ssg-test_core_dumps_limitsconf:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-umask_for_daemons:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Set Daemon Umask</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The daemon umask should be set as appropriate</oval-def:description>
            <oval-def:reference ref_id="umask_for_daemons" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Get value of var_accounts_user_umask variable as octal number" definition_ref="oval:ssg-var_umask_for_daemons_as_number:def:1"/>
            <oval-def:criterion test_ref="oval:ssg-tst_umask_for_daemons:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_exec_shield:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Enable ExecShield via sysctl</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel runtime parameter 'kernel.exec-shield' should not be disabled and set to 1 on 32-bit systems.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_exec_shield" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
              <oval-def:criterion comment="NX is supported and is not disabled" test_ref="oval:ssg-test_nx_disabled_grub:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-bios_enable_execution_restrictions:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Enable NX or XD Support in the BIOS</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The NX (no-execution) bit flag should be set on the system.</oval-def:description>
            <oval-def:reference ref_id="bios_enable_execution_restrictions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="NX bit is set" test_ref="oval:ssg-test_NX_cpu_support:tst:1"/>
            <oval-def:criterion comment="No log messages about NX being disabled" test_ref="oval:ssg-test_messages_nx_active:tst:1"/>
            <oval-def:criterion comment="NX is not disabled in the kernel command line" test_ref="oval:ssg-test_noexec_cmd_line:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-install_PAE_kernel_on_x86-32:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Install PAE Kernel on Supported 32-bit x86 Systems</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package kernel-PAE should be installed on 32-bit
      systems.</oval-def:description>
            <oval-def:reference ref_id="install_PAE_kernel_on_x86-32" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="Not a 32-bit system" definition_ref="oval:ssg-system_info_architecture_x86:def:1" negate="true"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Check if PAE or NX is supported by the CPUs" test_ref="oval:ssg-test_PAE_NX_cpu_support:tst:1" negate="true"/>
              <oval-def:criteria operator="AND">
                <oval-def:extend_definition comment="A 32-bit system" definition_ref="oval:ssg-system_info_architecture_x86:def:1"/>
                <oval-def:criterion comment="Package kernel-PAE is installed" test_ref="oval:ssg-test_package_kernel-PAE_installed:tst:1"/>
                <oval-def:criterion comment="check for DEFAULTKERNEL set to kernel-PAE in /etc/sysconfig/kernel" test_ref="oval:ssg-test_defaultkernel_sysconfig_kernel:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_enable_selinux:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure SELinux Not Disabled in /etc/default/grub</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>
        Check if selinux=0 OR enforcing=0 within the GRUB2 configuration files, fail if found.
      </oval-def:description>
            <oval-def:reference ref_id="grub2_enable_selinux" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="check value selinux|enforcing=0 in /etc/default/grub, fail if found" test_ref="oval:ssg-test_selinux_default_grub:tst:1"/>
            <oval-def:criterion comment="check value selinux|enforcing=0 in /etc/grub2.cfg, fail if found" test_ref="oval:ssg-test_selinux_grub2_cfg:tst:1"/>
            <oval-def:criterion comment="check value selinux|enforcing=0 in /etc/grub.d, fail if found" test_ref="oval:ssg-test_selinux_grub_dir:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-selinux_all_devicefiles_labeled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure No Device Files are Unlabeled by SELinux</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All device files in /dev should be assigned an SELinux security context other than 'device_t' and 'unlabeled_t'.</oval-def:description>
            <oval-def:reference ref_id="selinux_all_devicefiles_labeled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="device_t in /dev" test_ref="oval:ssg-test_selinux_dev_device_t:tst:1"/>
            <oval-def:criterion comment="unlabeled_t in /dev" test_ref="oval:ssg-test_selinux_dev_unlabeled_t:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-selinux_confinement_of_daemons:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure No Daemons are Unconfined by SELinux</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All pids in /proc should be assigned an SELinux security context other than 'unconfined_service_t'.</oval-def:description>
            <oval-def:reference ref_id="selinux_confinement_of_daemons" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="no unconfined_service_t in /proc" test_ref="oval:ssg-test_selinux_confinement_of_daemons:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-selinux_policytype:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure SELinux Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The SELinux policy should be set appropriately.</oval-def:description>
            <oval-def:reference ref_id="selinux_policytype" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_selinux_policy:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-selinux_state:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure SELinux State is Enforcing</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The SELinux state should be enforcing the local policy.</oval-def:description>
            <oval-def:reference ref_id="selinux_state" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="enforce is disabled" test_ref="oval:ssg-test_etc_selinux_config:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-prefer_64bit_os:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Prefer to use a 64-bit Operating System when supported</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if the system supports a 64-bit Operating System</oval-def:description>
            <oval-def:reference ref_id="prefer_64bit_os" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Either the OS is 64-bit, or the CPU doesn't support 64-bit (it is 32 or 16 bit)" operator="OR">
            <oval-def:criterion comment="Check if OS is 64-bit" test_ref="oval:ssg-test_proc_sys_kernel_osrelease_64_bit:tst:1"/>
            <oval-def:criterion comment="Check if CPU is not 64-bit" test_ref="oval:ssg-test_proc_cpuinfo_64_bit:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_db_up_to_date:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Make sure that the dconf databases are up-to-date with regards to respective keyfiles</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Make sure that the dconf databases are up-to-date with regards to respective keyfiles.</oval-def:description>
            <oval-def:reference ref_id="dconf_db_up_to_date" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="check that all DBs in question are up-to-date" operator="AND">
              <oval-def:criteria comment="check that all DBs in question are up-to-date" operator="OR">
                <oval-def:criterion comment="distro database is up-to-date wrt keyfiles" test_ref="oval:ssg-test_dconf_distro_up_to_date:tst:1"/>
                <oval-def:criterion comment="no keyfiles applicable to the distro database" test_ref="oval:ssg-test_dconf_distro_no_keyfiles:tst:1"/>
              </oval-def:criteria>
              <oval-def:criteria comment="check that all DBs in question are up-to-date" operator="OR">
                <oval-def:criterion comment="local database is up-to-date wrt keyfiles" test_ref="oval:ssg-test_dconf_local_up_to_date:tst:1"/>
                <oval-def:criterion comment="no keyfiles applicable to the local database" test_ref="oval:ssg-test_dconf_local_no_keyfiles:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-enable_dconf_user_profile:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure GNOME3 DConf User Profile</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The DConf User profile should have the local DB configured.</oval-def:description>
            <oval-def:reference ref_id="enable_dconf_user_profile" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criterion comment="dconf user profile exists" test_ref="oval:ssg-test_dconf_user_profile:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_disable_restart_shutdown:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable the GNOME3 Login Restart and Shutdown Buttons</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disable the GNOME3 Login GUI Restart and Shutdown buttons to all users on the login screen.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_disable_restart_shutdown" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Disable GUI shutdown and restart buttons and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable restart and shutdown buttons" test_ref="oval:ssg-test_disable_restart_buttons:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_enable_restart_buttons:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_disable_user_list:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable the GNOME3 Login User List</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disable the GNOME3 GUI listing of all known users on the login screen.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_disable_user_list" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Disable GUI listing of known users and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable user list" test_ref="oval:ssg-test_disable_user_list:tst:1"/>
              <oval-def:criterion comment="Prevent user from disabling banner" test_ref="oval:ssg-test_prevent_user_disable_user_list:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_enable_smartcard_auth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable the GNOME3 Login Smartcard Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Enable smartcard authentication in the GNOME3 Login GUI.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_enable_smartcard_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Enable smartcard authentication and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Enable smartcard authentication" test_ref="oval:ssg-test_enable_gnome_smartcard:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_disable_smartcard:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_login_retries:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set the GNOME3 Login Number of Failures</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Set the GNOME3 number of login failure attempts.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_login_retries" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Set number of login attempts and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Set number of login tries" test_ref="oval:ssg-test_configure_allowed_failures:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_allowed-failures_change:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-gnome_gdm_disable_automatic_login:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Disable GDM Automatic Login</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disable the GNOME Display Manager (GDM) ability to allow users to
      automatically login.</oval-def:description>
            <oval-def:reference ref_id="gnome_gdm_disable_automatic_login" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="gdm installed" definition_ref="oval:ssg-package_gdm_installed:def:1" negate="true"/>
            <oval-def:criterion comment="Disable GDM Automatic Login" test_ref="oval:ssg-test_disable_automatic_login:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-gnome_gdm_disable_guest_login:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Disable GDM Guest Login</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disable the GNOME Display Manager (GDM) ability to allow guest users
      to login.</oval-def:description>
            <oval-def:reference ref_id="gnome_gdm_disable_guest_login" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="gdm installed" definition_ref="oval:ssg-package_gdm_installed:def:1" negate="true"/>
            <oval-def:criterion comment="Disable GDM Guest Login" test_ref="oval:ssg-test_disable_guest_login:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-gnome_gdm_disable_xdmcp:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable XDMCP in GDM</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'Enable' is configured with value 'false in section 'xdmcp' in /etc/gdm/custom.conf</oval-def:description>
            <oval-def:reference ref_id="gnome_gdm_disable_xdmcp" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="gdm is configured correctly and configuration file exists" operator="AND">
            <oval-def:criteria comment="gdm is configured correctly" operator="OR">
              <oval-def:criterion comment="Check the Enable in /etc/gdm/custom.conf" test_ref="oval:ssg-test_gnome_gdm_disable_xdmcp:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="test if configuration file /etc/gdm/custom.conf exists for gnome_gdm_disable_xdmcp" test_ref="oval:ssg-test_gnome_gdm_disable_xdmcp_config_file_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_disable_automount:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Disable GNOME3 automount</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The system's default desktop environment, GNOME3, will mount
      devices and removable media (such as DVDs, CDs and USB flash drives)
      whenever they are inserted into the system. Disable automount within GNOME3.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_disable_automount" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Disable GNOME3 automount and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable automount in GNOME3" test_ref="oval:ssg-test_dconf_gnome_disable_automount:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing automount setting" test_ref="oval:ssg-test_prevent_user_gnome_automount:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_disable_automount_open:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable GNOME3 automount-open</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The system's default desktop environment, GNOME3, will mount
    devices and removable media (such as DVDs, CDs and USB flash drives)
    whenever they are inserted into the system. Disable automount-open within GNOME3.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_disable_automount_open" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Disable GNOME3 automount/autorun and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable automount-open in GNOME3" test_ref="oval:ssg-test_dconf_gnome_disable_automount_open:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing automount-open setting" test_ref="oval:ssg-test_prevent_user_gnome_automount_open:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_disable_autorun:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable GNOME3 autorun</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The system's default desktop environment, GNOME3, will mount
    devices and removable media (such as DVDs, CDs and USB flash drives)
    whenever they are inserted into the system. Disable autorun within GNOME3.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_disable_autorun" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Disable GNOME3 autorun and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable autorun in GNOME3" test_ref="oval:ssg-test_dconf_gnome_disable_autorun:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing autorun setting" test_ref="oval:ssg-test_prevent_user_gnome_autorun:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_disable_thumbnailers:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable All GNOME3 Thumbnailers</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The system's default desktop environment, GNOME3, uses a
      number of different thumbnailer programs to generate thumbnails for any
      new or modified content in an opened folder. Disable the execution of
      these thumbnail applications within GNOME3.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_disable_thumbnailers" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Disable Gnome3 Thumbnailers and prevent user from enabling" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable thumbnailers in GNOME3" test_ref="oval:ssg-test_gnome_disable_thumbnailers:tst:1"/>
              <oval-def:criterion comment="prevent user from changing idle delay" test_ref="oval:ssg-test_prevent_user_change_gnome_thumbnailers:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_disable_wifi_create:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable WIFI Network Connection Creation in GNOME3</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disable the GNOME3 wireless network creation settings.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_disable_wifi_create" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable wifi creation" test_ref="oval:ssg-test_disable_wifi_creation:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_enable_wifi_creation:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_disable_wifi_notification:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable WIFI Network Notification in GNOME3</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disable the GNOME3 wireless network notification.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_disable_wifi_notification" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable wifi notification" test_ref="oval:ssg-test_disable_wifi_notification:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_enable_wifi_notification:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_remote_access_credential_prompt:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Require Credential Prompting for Remote Access in GNOME3</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Configure GNOME3 to require credential prompting for remote access.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_remote_access_credential_prompt" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="configure remote access credentials" test_ref="oval:ssg-test_configure_remote_access_creds:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_remote_access_creds:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_remote_access_encryption:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Require Encryption for Remote Access in GNOME3</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Configure GNOME3 to require encryption for remote access connections.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_remote_access_encryption" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="configure remote access encryption" test_ref="oval:ssg-test_configure_remote_access_encryption:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_remote_access_encryption:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_screensaver_idle_activation_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable GNOME3 Screensaver Idle Activation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Idle activation of the screen saver should be enabled.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_screensaver_idle_activation_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="check screensaver idle activation and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="idle activation has been configured" test_ref="oval:ssg-test_screensaver_idle_activation_enabled:tst:1"/>
              <oval-def:criterion comment="prevent user from changing idle delay" test_ref="oval:ssg-test_prevent_user_change_idle_activation_enabled:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_screensaver_idle_activation_locked:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Users Cannot Change GNOME3 Screensaver Idle Activation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Idle activation of the screen saver should not be changed by users.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_screensaver_idle_activation_locked" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="check screensaver idle activation and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="prevent user from changing idle delay" test_ref="oval:ssg-test_prevent_user_change_idle_activation_locked:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_screensaver_idle_delay:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Set GNOME3 Screensaver Inactivity Timeout</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The allowed period of inactivity before the screensaver is activated.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_screensaver_idle_delay" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="check screensaver idle delay and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="idle delay has been configured" test_ref="oval:ssg-test_screensaver_idle_delay:tst:1"/>
              <oval-def:criterion comment="idle delay is set correctly" test_ref="oval:ssg-test_screensaver_idle_delay_setting:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_screensaver_lock_delay:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Set GNOME3 Screensaver Lock Delay After Activation Period</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Idle activation of the screen lock should be enabled immediately or
      after a delay.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_screensaver_lock_delay" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Enable screensaver lock and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="screensaver lock delay is configured" test_ref="oval:ssg-test_screensaver_lock_delay:tst:1"/>
              <oval-def:criterion comment="lock delay is set correctly" test_ref="oval:ssg-test_screensaver_lock_delay_setting:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_screensaver_lock_enabled:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Enable GNOME3 Screensaver Lock After Idle Period</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Idle activation of the screen lock should be enabled.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_screensaver_lock_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Enable screensaver lock and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="screensaver lock is enabled" test_ref="oval:ssg-test_screensaver_lock_enabled:tst:1"/>
              <oval-def:criterion comment="screensaver lock prevent user from changing" test_ref="oval:ssg-test_prevent_user_screensaver_lock:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_screensaver_lock_locked:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Users Cannot Change GNOME3 Screensaver Lock After Idle Period</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Idle activation of the screen lock should not be changed by users.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_screensaver_lock_locked" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Enable screensaver lock and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="screensaver lock prevent user from changing" test_ref="oval:ssg-test_prevent_user_screensaver_lock_locked:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_screensaver_mode_blank:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Implement Blank Screensaver</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The GNOME3 screensaver should be blank.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_screensaver_mode_blank" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Enable blank screensaver and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="screensaver is blank" test_ref="oval:ssg-test_screensaver_mode_blank:tst:1"/>
              <oval-def:criterion comment="screensaver prevent user from changing mode" test_ref="oval:ssg-test_prevent_user_screensaver_mode_change:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_screensaver_user_info:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Full User Name on Splash Shield</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>GNOME3 screen splash shield should not display full name of logged in user.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_screensaver_user_info" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Disable screensaver user info and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="screensaver user info is disabled" test_ref="oval:ssg-test_screensaver_disable_user_info:tst:1"/>
              <oval-def:criterion comment="screensaver prevent user from changing" test_ref="oval:ssg-test_prevent_user_info_change:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_screensaver_user_locks:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Users Cannot Change GNOME3 Screensaver Settings</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure that users cannot change GNOME3 screensaver idle and lock settings.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_screensaver_user_locks" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="check screensaver idle delay and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="prevent user from changing screensaver lock delay" test_ref="oval:ssg-test_user_change_lock_delay_lock:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_session_idle_user_locks:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Users Cannot Change GNOME3 Session Idle Settings</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure that users cannot change GNOME3 session idle settings.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_session_idle_user_locks" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="check screensaver idle delay and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="prevent user from changing idle delay" test_ref="oval:ssg-test_user_change_idle_delay_lock:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_disable_ctrlaltdel_reboot:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disable the GNOME3 ctrl-alt-del reboot key sequence in GNOME3.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_disable_ctrlaltdel_reboot" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable Ctrl-Alt-Del" test_ref="oval:ssg-test_disable_gnome_ctrlaltdel:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_enable_ctrlaltdel:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_disable_geolocation:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Geolocation in GNOME3</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disable GNOME3 Geolocation for the clock and system.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_disable_geolocation" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable system geolocation" test_ref="oval:ssg-test_disable_sys_geolocation:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_sys_geolocation:tst:1"/>
              <oval-def:criterion comment="Disable clock geolocation" test_ref="oval:ssg-test_disable_clock_geolocation:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_clock_geolocation:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_disable_power_settings:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Power Settings in GNOME3</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disable GNOME3 power settings.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_disable_power_settings" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable power settings" test_ref="oval:ssg-test_disable_gnome_power_setting:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_power_setting_change:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-installed_OS_is_FIPS_certified:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>The Installed Operating System Is FIPS 140-2 Certified</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>
          The operating system installed on the system is a certified operating system that meets FIPS 140-2 requirements.
      </oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_FIPS_certified" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Installed operating system is a certified operating system" operator="OR">
            <oval-def:extend_definition comment="Installed OS is RHEL7" definition_ref="oval:ssg-installed_OS_is_rhel7:def:1"/>
            <oval-def:extend_definition comment="Installed OS is RHEL8" definition_ref="oval:ssg-installed_OS_is_rhel8:def:1"/>
            <oval-def:extend_definition comment="Installed OS is RHCOS4" definition_ref="oval:ssg-installed_OS_is_rhcos4:def:1"/>
            <oval-def:extend_definition comment="Installed OS is OL7" definition_ref="oval:ssg-installed_OS_is_ol7_family:def:1"/>
            <oval-def:extend_definition comment="Installed OS is SLE12" definition_ref="oval:ssg-installed_OS_is_sle12:def:1"/>
            <oval-def:extend_definition comment="Installed OS is SLE15" definition_ref="oval:ssg-installed_OS_is_sle15:def:1"/>
            <oval-def:extend_definition comment="Installed OS is Ubuntu 16.04" definition_ref="oval:ssg-installed_OS_is_ubuntu1604:def:1"/>
            <oval-def:extend_definition comment="Installed OS is Ubuntu 18.04" definition_ref="oval:ssg-installed_OS_is_ubuntu1804:def:1"/>
            <oval-def:extend_definition comment="Installed OS is Ubuntu 20.04" definition_ref="oval:ssg-installed_OS_is_ubuntu2004:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-installed_OS_is_vendor_supported:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>The Installed Operating System Is Vendor Supported</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>
        The operating system installed on the system is supported by a vendor that provides security patches.
      </oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_vendor_supported" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Installed operating system is supported by a vendor" operator="OR">
            <oval-def:extend_definition comment="Installed OS is RHEL7" definition_ref="oval:ssg-installed_OS_is_rhel7:def:1"/>
            <oval-def:extend_definition comment="Installed OS is RHEL8" definition_ref="oval:ssg-installed_OS_is_rhel8:def:1"/>
            <oval-def:extend_definition comment="Installed OS is RHEL9" definition_ref="oval:ssg-installed_OS_is_rhel9:def:1"/>
            <oval-def:extend_definition comment="Installed OS is OL7" definition_ref="oval:ssg-installed_OS_is_ol7_family:def:1"/>
            <oval-def:extend_definition comment="Installed OS is OL8" definition_ref="oval:ssg-installed_OS_is_ol8_family:def:1"/>
            <oval-def:extend_definition comment="Installed OS is SLE12" definition_ref="oval:ssg-installed_OS_is_sle12:def:1"/>
            <oval-def:extend_definition comment="Installed OS is SLE15" definition_ref="oval:ssg-installed_OS_is_sle15:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_bind_crypto_policy:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure BIND to use System Crypto Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>BIND should be configured to use the system-wide crypto policy setting.</oval-def:description>
            <oval-def:reference ref_id="configure_bind_crypto_policy" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="Check if package bind is not installed" definition_ref="oval:ssg-package_bind_removed:def:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_configure_bind_crypto_policy:tst:1" comment="Check that the configuration includes the policy config file."/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_crypto_policy:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure System Cryptography Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure crypto policy is correctly configured in /etc/crypto-policies/config, and the policy is current.</oval-def:description>
            <oval-def:reference ref_id="configure_crypto_policy" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="check for crypto policy correctly configured in /etc/crypto-policy/config" test_ref="oval:ssg-test_configure_crypto_policy:tst:1"/>
            <oval-def:criterion comment="check for crypto policy correctly configured in /etc/crypto-policy/state/current" test_ref="oval:ssg-test_configure_crypto_policy_current:tst:1"/>
            <oval-def:criterion comment="Check if update-crypto-policies has been run after config update" test_ref="oval:ssg-test_crypto_policies_updated:tst:1"/>
            <oval-def:criterion comment="Check if /etc/crypto-policies/back-ends/nss.config exists" test_ref="oval:ssg-test_crypto_policy_nss_config:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_gnutls_tls_crypto_policy:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure GnuTLS library to use DoD-approved TLS Encryption</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check presence of +VERS-ALL:-VERS-DTLS0.9:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS1.0 in /etc/crypto-policies/back-ends/gnutls.config</oval-def:description>
            <oval-def:reference ref_id="configure_gnutls_tls_crypto_policy" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check that /etc/crypto-policies/back-ends/gnutls.config contains a line with certain text" test_ref="oval:ssg-test_configure_gnutls_tls_crypto_policy:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_kerberos_crypto_policy:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Configure Kerberos to use System Crypto Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Kerberos should be configured to use the system-wide crypto policy setting.</oval-def:description>
            <oval-def:reference ref_id="configure_kerberos_crypto_policy" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR" comment="The config file is always a symlink to the backend, but the backend itself may be either a file, or a symlink. For this reason, we need two tests, if one passes, the other one is expected to either fail, or error.">
            <oval-def:criterion comment="kerberos crypto-policy configuration links to same file as kerberos crypto-policy backend" test_ref="oval:ssg-test_configure_kerberos_crypto_policy_symlink:tst:1"/>
            <oval-def:criterion comment="kerberos crypto-policy configuration links to the crypto-policy backend file" test_ref="oval:ssg-test_configure_kerberos_crypto_policy_nosymlink:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_libreswan_crypto_policy:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure Libreswan to use System Crypto Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Libreswan should be configured to use the system-wide crypto policy setting.</oval-def:description>
            <oval-def:reference ref_id="configure_libreswan_crypto_policy" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="Check if package libreswan is not installed" definition_ref="oval:ssg-package_libreswan_installed:def:1" negate="true"/>
            <oval-def:criterion test_ref="oval:ssg-test_configure_libreswan_crypto_policy:tst:1" comment="Check that the libreswan configuration includes the crypto policy config file"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_openssl_crypto_policy:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure OpenSSL library to use System Crypto Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>OpenSSL should be configured to use the system-wide crypto policy setting.</oval-def:description>
            <oval-def:reference ref_id="configure_openssl_crypto_policy" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_configure_openssl_crypto_policy:tst:1" comment="Check that the configuration mandates usage of system-wide crypto policies."/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_ssh_crypto_policy:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure SSH to use System Crypto Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>SSH should be configured to use the system-wide crypto policy setting.</oval-def:description>
            <oval-def:reference ref_id="configure_ssh_crypto_policy" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_configure_ssh_crypto_policy:tst:1" comment="Check that the SSH configuration mandates usage of system-wide crypto policies."/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-harden_ssh_client_crypto_policy:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Harden SSH client Crypto Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure the ssh client ciphers are configured correctly in /etc/ssh/ssh_config.d/02-ospp.conf</oval-def:description>
            <oval-def:reference ref_id="harden_ssh_client_crypto_policy" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH client is configured correctly" operator="AND">
            <oval-def:criterion comment="Check the Match in /etc/ssh/ssh_config.d/02-ospp.conf" test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_Match:tst:1"/>
            <oval-def:criterion comment="Check the RekeyLimit in /etc/ssh/ssh_config.d/02-ospp.conf" test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_RekeyLimit:tst:1"/>
            <oval-def:criterion comment="Check the GSSAPIAuthentication in /etc/ssh/ssh_config.d/02-ospp.conf" test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_GSSAPIAuthentication:tst:1"/>
            <oval-def:criterion comment="Check the Ciphers in /etc/ssh/ssh_config.d/02-ospp.conf" test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_Ciphers:tst:1"/>
            <oval-def:criterion comment="Check the PubkeyAcceptedKeyTypes in /etc/ssh/ssh_config.d/02-ospp.conf" test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:tst:1"/>
            <oval-def:criterion comment="Check the MACs in /etc/ssh/ssh_config.d/02-ospp.conf" test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_MACs:tst:1"/>
            <oval-def:criterion comment="Check the KexAlgorithms in /etc/ssh/ssh_config.d/02-ospp.conf" test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_KexAlgorithms:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure SSH Client to Use FIPS 140-2 Validated Ciphers: openssh.config</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Limit the Ciphers to those which are FIPS-approved.</oval-def:description>
            <oval-def:reference ref_id="harden_sshd_ciphers_openssh_conf_crypto_policy" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Test conditions - presence of the file plus.">
            <oval-def:criterion comment="Check that /etc/crypto-policies/back-ends/openssh.config contains FIPS-approved SSHD Ciphers" test_ref="oval:ssg-test_harden_sshd_ciphers_openssh_conf_crypto_policy:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-harden_sshd_crypto_policy:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Harden SSHD Crypto Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'CRYPTO_POLICY' is configured with value ''-oCiphers=aes256-ctr,aes128-ctr,aes256-cbc,aes128-cbc -oMACs=hmac-sha2-512,hmac-sha2-256 -oGSSAPIKeyExchange=no -oKexAlgorithms=ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256 -oPubkeyAcceptedKeyTypes=rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256'' in /etc/crypto-policies/back-ends/opensshserver.config</oval-def:description>
            <oval-def:reference ref_id="harden_sshd_crypto_policy" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the CRYPTO_POLICY in /etc/crypto-policies/back-ends/opensshserver.config" test_ref="oval:ssg-test_harden_sshd_crypto_policy:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-harden_sshd_macs_openssh_conf_crypto_policy:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure SSH Client to Use FIPS 140-2 Validated MACs: openssh.config</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Limit the Message Authentication Codes (MACs) to those which are FIPS-approved.</oval-def:description>
            <oval-def:reference ref_id="harden_sshd_macs_openssh_conf_crypto_policy" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Test conditions - presence of the file plus.">
            <oval-def:criterion comment="Check that /etc/crypto-policies/back-ends/openssh.config contains FIPS-approved SSHD MACs" test_ref="oval:ssg-test_harden_sshd_macs_openssh_conf_crypto_policy:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-install_antivirus:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install Virus Scanning Software</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Antivirus software should be installed.</oval-def:description>
            <oval-def:reference ref_id="install_antivirus" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Antivirus is not being used or conditions are met">
            <oval-def:extend_definition comment="McAfee A/V Installed" definition_ref="oval:ssg-install_mcafee_antivirus:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-install_hids:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install Intrusion Detection Software</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Intrusion detection software or SELinux should be installed and enabled.</oval-def:description>
            <oval-def:reference ref_id="install_hids" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_hbss:def:1"/>
            <oval-def:criterion comment="SELinux enabled" test_ref="oval:ssg-test_selinux_enforcing:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-install_mcafee_antivirus:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install McAfee Virus Scanning Software</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>McAfee Antivirus software should be installed.</oval-def:description>
            <oval-def:reference ref_id="install_mcafee_antivirus" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Antivirus is not being used or conditions are met" operator="AND">
            <oval-def:extend_definition comment="McAfee Runtime Libraries and Agent" definition_ref="oval:ssg-install_mcafee_cma_rt:def:1"/>
            <oval-def:criterion comment="Linuxshield AntiVirus package is installed" test_ref="oval:ssg-test_linuxshield_install_antivirus:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-install_mcafee_cma_rt:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install the McAfee Runtime Libraries and Linux Agent</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Install the McAfee Runtime Libraries (MFErt) and Linux Agent (MFEcma).</oval-def:description>
            <oval-def:reference ref_id="install_mcafee_cma_rt" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="McAfee runtime library package installed" test_ref="oval:ssg-test_mcafee_runtime_installed:tst:1"/>
            <oval-def:criterion comment="McAfee management agent package installed" test_ref="oval:ssg-test_mcafee_management_agent:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-install_mcafee_hbss_accm:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install the Asset Configuration Compliance Module (ACCM)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Install the Asset Configuration Compliance Module (ACCM).</oval-def:description>
            <oval-def:reference ref_id="install_mcafee_hbss_accm" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="McAfee ACCM is installed" test_ref="oval:ssg-test_mcafee_accm_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-install_mcafee_hbss_pa:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install the Policy Auditor (PA) Module</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Install the Policy Auditor (PA) Module.</oval-def:description>
            <oval-def:reference ref_id="install_mcafee_hbss_pa" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="McAfee Policy Auditor is installed" test_ref="oval:ssg-test_mcafee_auditengine_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-enable_dracut_fips_module:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable Dracut FIPS Module</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>fips module should be enabled in Dracut configuration</oval-def:description>
            <oval-def:reference ref_id="enable_dracut_fips_module" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="dracut fips module is enabled" test_ref="oval:ssg-test_enable_dracut_fips_module:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-enable_fips_mode:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable FIPS Mode</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if FIPS mode is enabled on the system</oval-def:description>
            <oval-def:reference ref_id="enable_fips_mode" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="check /etc/system-fips exists" definition_ref="oval:ssg-etc_system_fips_exists:def:1"/>
            <oval-def:extend_definition comment="check sysctl crypto.fips_enabled = 1" definition_ref="oval:ssg-sysctl_crypto_fips_enabled:def:1"/>
            <oval-def:extend_definition comment="Dracut FIPS module is enabled" definition_ref="oval:ssg-enable_dracut_fips_module:def:1"/>
            <oval-def:extend_definition comment="system cryptography policy is configured" definition_ref="oval:ssg-configure_crypto_policy:def:1"/>
            <oval-def:criterion comment="check if system crypto policy selection in var_system_crypto_policy in the profile is set to FIPS" test_ref="oval:ssg-test_system_crypto_policy_value:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-etc_system_fips_exists:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure '/etc/system-fips' exists</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check /etc/system-fips exists</oval-def:description>
            <oval-def:reference ref_id="etc_system_fips_exists" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_etc_system_fips:tst:1" comment="/etc/system-fips exists"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_crypto_fips_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set kernel parameter 'crypto.fips_enabled' to 1</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'crypto.fips_enabled' parameter should be set to '1' in system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_crypto_fips_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter crypto.fips_enabled set to 1" test_ref="oval:ssg-test_sysctl_crypto_fips_enabled:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-aide_build_database:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Build and Test AIDE Database</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The aide database must be initialized.</oval-def:description>
            <oval-def:reference ref_id="aide_build_database" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Aide is installed" definition_ref="oval:ssg-package_aide_installed:def:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_aide_build_new_database_absolute_path:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_aide_operational_database_absolute_path:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-aide_check_audit_tools:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure AIDE to Verify the Audit Tools</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The {{{ full_name }}} operating system file integrity tool must be configured to protect the integrity of the audit tools.</oval-def:description>
            <oval-def:reference ref_id="aide_check_audit_tools" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Aide is installed" definition_ref="oval:ssg-package_aide_installed:def:1"/>
            <oval-def:criterion comment="auditctl is checked in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_auditctl:tst:1"/>
            <oval-def:criterion comment="auditd is checked in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_auditd:tst:1"/>
            <oval-def:criterion comment="ausearch is checked in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_ausearch:tst:1"/>
            <oval-def:criterion comment="aureport is checked in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_aureport:tst:1"/>
            <oval-def:criterion comment="autrace is checked in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_autrace:tst:1"/>
            <oval-def:criterion comment="audispd is checked in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_audispd:tst:1"/>
            <oval-def:criterion comment="augenrules is checked in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_augenrules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-aide_periodic_cron_checking:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Periodic Execution of AIDE</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>By default, AIDE does not install itself for periodic
      execution. Periodically running AIDE is necessary to reveal
      unexpected changes in installed files.
      </oval-def:description>
            <oval-def:reference ref_id="aide_periodic_cron_checking" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Aide is installed" definition_ref="oval:ssg-package_aide_installed:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="run aide with cron" test_ref="oval:ssg-test_aide_periodic_cron_checking:tst:1"/>
              <oval-def:criterion comment="run aide with cron" test_ref="oval:ssg-test_aide_crond_checking:tst:1"/>
              <oval-def:criterion comment="run aide with cron" test_ref="oval:ssg-test_aide_var_cron_checking:tst:1"/>
              <oval-def:criterion comment="run aide with cron.(daily|weekly)" test_ref="oval:ssg-test_aide_crontabs_checking:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rpm_verify_hashes:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Verify File Hashes with RPM</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Verify the RPM digests of system binaries using the RPM database.</oval-def:description>
            <oval-def:reference ref_id="rpm_verify_hashes" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_files_fail_md5_hash:tst:1" comment="verify file md5 hashes"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rpm_verify_permissions:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Verify and Correct File Permissions with RPM</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Verify the permissions of installed packages
      by comparing the installed files with information about the
      files taken from the package metadata stored in the RPM
      database.</oval-def:description>
            <oval-def:reference ref_id="rpm_verify_permissions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_verify_all_rpms_mode:tst:1" comment="mode of all files matches local rpm database"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudo_remove_no_authenticate:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks sudo usage without authentication</oval-def:description>
            <oval-def:reference ref_id="sudo_remove_no_authenticate" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="!authenticate does not exist in /etc/sudoers" test_ref="oval:ssg-test_no_authenticate_etc_sudoers:tst:1"/>
            <oval-def:criterion comment="!authenticate does not exist in /etc/sudoers.d" test_ref="oval:ssg-test_no_authenticate_etc_sudoers_d:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudo_remove_nopasswd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks sudo usage without password</oval-def:description>
            <oval-def:reference ref_id="sudo_remove_nopasswd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="NOPASSWD is not configured in /etc/sudoers" test_ref="oval:ssg-test_nopasswd_etc_sudoers:tst:1"/>
            <oval-def:criterion comment="NOPASSWD is not configured in /etc/sudoers.d" test_ref="oval:ssg-test_nopasswd_etc_sudoers_d:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudo_require_authentication:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks sudo usage without password</oval-def:description>
            <oval-def:reference ref_id="sudo_require_authentication" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition definition_ref="oval:ssg-sudo_remove_no_authenticate:def:1"/>
            <oval-def:extend_definition definition_ref="oval:ssg-sudo_remove_nopasswd:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudo_vdsm_nopasswd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Only the VDSM User Can Use sudo NOPASSWD</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks sudo usage for the vdsm user without a password</oval-def:description>
            <oval-def:reference ref_id="sudo_vdsm_nopasswd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="NOPASSWD only exists for vdsm user in /etc/sudoers" test_ref="oval:ssg-test_vdsm_nopasswd_etc_sudoers:tst:1"/>
            <oval-def:criterion comment="NOPASSWD only exists for vdsm user in /etc/sudoers.d" test_ref="oval:ssg-test_vdsm_nopasswd_etc_sudoers_d:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudoers_default_includedir:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure sudo only includes the default configuration directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if sudo includes only the default includedir</oval-def:description>
            <oval-def:reference ref_id="sudoers_default_includedir" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check /etc/sudoers for #includedir" test_ref="oval:ssg-test_sudoers_default_includedir:tst:1"/>
            <oval-def:criterion comment="Check /etc/sudoers for #include" test_ref="oval:ssg-test_sudoers_without_include:tst:1"/>
            <oval-def:criterion comment="Check /etc/sudoers.d for includes" test_ref="oval:ssg-test_sudoersd_without_includes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudoers_explicit_command_args:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Explicit arguments in sudo specifications</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that sudoers doesn't contain commands without arguments specified</oval-def:description>
            <oval-def:reference ref_id="sudoers_explicit_command_args" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Make sure that no commands are without arguments" test_ref="oval:ssg-test_sudoers_explicit_command_args:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudoers_no_command_negation:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Don't define allowed commands in sudoers by means of exclusion</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that sudoers doesn't contain command negations</oval-def:description>
            <oval-def:reference ref_id="sudoers_no_command_negation" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Make sure that no command in user spec contains negation" test_ref="oval:ssg-test_sudoers_no_command_negation:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudoers_no_root_target:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Don't target root user in the sudoers file</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that sudoers doesn't allow users to run commands as root</oval-def:description>
            <oval-def:reference ref_id="sudoers_no_root_target" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Make sure that no user spec in sudoers has a runas spec that includes root or ALL" test_ref="oval:ssg-test_no_root_or_ALL_in_runas_spec:tst:1"/>
            <oval-def:criterion comment="Make sure that all user specs in sudoers feature a runas spec" test_ref="oval:ssg-test_no_user_spec_rules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudoers_validate_passwd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure invoking users password for privilege escalation when using sudo</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure invoking user's password for privilege escalation when using sudo</oval-def:description>
            <oval-def:reference ref_id="sudoers_validate_passwd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check Defaults !targetpw exists in /etc/sudoers file" test_ref="oval:ssg-test_sudoers_targetpw_config:tst:1"/>
            <oval-def:criterion comment="Check Defaults !rootpw exists in /etc/sudoers file" test_ref="oval:ssg-test_sudoers_rootpw_config:tst:1"/>
            <oval-def:criterion comment="Check Defaults !runaspw exists in /etc/sudoers file" test_ref="oval:ssg-test_sudoers_runaspw_config:tst:1"/>
            <oval-def:criterion comment="Verify that results come from only one file" test_ref="oval:ssg-test_sudoers_passwd_n_files:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-clean_components_post_updating:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure dnf Removes Previous Package Versions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The clean_requirements_on_remove option should be used to ensure that old 
      versions of software components are removed after updating.</oval-def:description>
            <oval-def:reference ref_id="clean_components_post_updating" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="check value of clean_requirements_on_remove in /etc/dnf/dnf.conf" test_ref="oval:ssg-test_yum_clean_components_post_updating:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dnf-automatic_apply_updates:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure dnf-automatic to Install Available Updates Automatically</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'apply_updates' is configured with value 'yes in section 'commands' in /etc/dnf/automatic.conf</oval-def:description>
            <oval-def:reference ref_id="dnf-automatic_apply_updates" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="dnf-automatic is configured correctly and configuration file exists" operator="AND">
            <oval-def:criteria comment="dnf-automatic is configured correctly" operator="OR">
              <oval-def:criterion comment="Check the apply_updates in /etc/dnf/automatic.conf" test_ref="oval:ssg-test_dnf-automatic_apply_updates:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="test if configuration file /etc/dnf/automatic.conf exists for dnf-automatic_apply_updates" test_ref="oval:ssg-test_dnf-automatic_apply_updates_config_file_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dnf-automatic_security_updates_only:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure dnf-automatic to Install Only Security Updates</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'upgrade_type' is configured with value 'security in section 'commands' in /etc/dnf/automatic.conf</oval-def:description>
            <oval-def:reference ref_id="dnf-automatic_security_updates_only" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="dnf-automatic is configured correctly and configuration file exists" operator="AND">
            <oval-def:criteria comment="dnf-automatic is configured correctly" operator="OR">
              <oval-def:criterion comment="Check the upgrade_type in /etc/dnf/automatic.conf" test_ref="oval:ssg-test_dnf-automatic_security_updates_only:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="test if configuration file /etc/dnf/automatic.conf exists for dnf-automatic_security_updates_only" test_ref="oval:ssg-test_dnf-automatic_security_updates_only_config_file_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-ensure_fedora_gpgkey_installed:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure Fedora GPG Key Installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The Fedora release key package is required to be installed.</oval-def:description>
            <oval-def:reference ref_id="ensure_fedora_gpgkey_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Fedora Vendor keys" operator="AND">
            <oval-def:extend_definition comment="Fedora installed" definition_ref="oval:ssg-installed_OS_is_fedora:def:1"/>
            <oval-def:criteria comment="Supported Fedora key is installed" operator="OR">
              <oval-def:criterion comment="Fedora 37 package gpg-pubkey-5323552a-6112bcdc is installed" test_ref="oval:ssg-test_package_gpgkey-5323552a-6112bcdc_installed:tst:1"/>
              <oval-def:criterion comment="Fedora 36 package gpg-pubkey-38ab71f4-60242b08 is installed" test_ref="oval:ssg-test_package_gpgkey-38ab71f4-60242b08_installed:tst:1"/>
              <oval-def:criterion comment="Fedora 35 package gpg-pubkey-9867c58f-601c49ca is installed" test_ref="oval:ssg-test_package_gpgkey-9867c58f-601c49ca_installed:tst:1"/>
              <oval-def:criterion comment="Fedora 34 package gpg-pubkey-45719a39-5f2c0192 is installed" test_ref="oval:ssg-test_package_gpgkey-45719a39-5f2c0192_installed:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-ensure_gpgcheck_globally_activated:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure gpgcheck Enabled In Main dnf Configuration</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The gpgcheck option should be used to ensure that checking
      of an RPM package's signature always occurs prior to its
      installation.</oval-def:description>
            <oval-def:reference ref_id="ensure_gpgcheck_globally_activated" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="check value of gpgcheck in /etc/dnf/dnf.conf" test_ref="oval:ssg-test_ensure_gpgcheck_globally_activated:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-ensure_gpgcheck_local_packages:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure gpgcheck Enabled for Local Packages</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The localpkg_gpgcheck option should be used to ensure that checking 
      of an RPM package's signature always occurs prior to its
      installation.</oval-def:description>
            <oval-def:reference ref_id="ensure_gpgcheck_local_packages" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="check value of localpkg_gpgcheck in /etc/dnf/dnf.conf" test_ref="oval:ssg-test_yum_ensure_gpgcheck_local_packages:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-ensure_gpgcheck_never_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure gpgcheck Enabled for All dnf Package Repositories</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure all yum or dnf repositories utilize signature checking.</oval-def:description>
            <oval-def:reference ref_id="ensure_gpgcheck_never_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="ensure all yum or dnf repositories utilize signiature checking" operator="AND">
            <oval-def:criterion comment="verify no gpgpcheck=0 present in /etc/yum.repos.d files" test_ref="oval:ssg-test_ensure_gpgcheck_never_disabled:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-ensure_gpgcheck_repo_metadata:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure gpgcheck Enabled for Repository Metadata</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The repo_gpgcheck option should be used to ensure that checking
      of repository metadata always occurs.</oval-def:description>
            <oval-def:reference ref_id="ensure_gpgcheck_repo_metadata" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="check value of repo_gpgcheck in /etc/dnf/dnf.conf" test_ref="oval:ssg-test_yum_ensure_gpgcheck_repo_metadata:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_dcredit:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Minimum Digit Characters</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password dcredit should meet minimum requirements</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_dcredit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="conditions for dcredit are satisfied">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_dcredit:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_dictcheck:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password dictcheck should meet minimum requirements</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_dictcheck" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="conditions for dictcheck are satisfied">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_dictcheck:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_difok:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Minimum Different Characters</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password difok should meet minimum requirements</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_difok" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="conditions for difok are satisfied">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_difok:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_enforce_local:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Enforce for Local Accounts Only</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check presence of local_users_only in /etc/security/pwquality.conf</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_enforce_local" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Test conditions - presence of the file plus 1 extra definitions.">
            <oval-def:extend_definition comment="extend_definition added explicitly" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criterion comment="Check that /etc/security/pwquality.conf contains a line with certain text" test_ref="oval:ssg-test_accounts_password_pam_enforce_local:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_enforce_root:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Enforce for root User</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check presence of enforce_for_root in /etc/security/pwquality.conf</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_enforce_root" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Test conditions - presence of the file plus 1 extra definitions.">
            <oval-def:extend_definition comment="extend_definition added explicitly" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criterion comment="Check that /etc/security/pwquality.conf contains a line with certain text" test_ref="oval:ssg-test_accounts_password_pam_enforce_root:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_lcredit:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password lcredit should meet minimum requirements</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_lcredit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="conditions for lcredit are satisfied">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_lcredit:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_maxclassrepeat:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password maxclassrepeat should meet minimum requirements</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_maxclassrepeat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="conditions for maxclassrepeat are satisfied">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_maxclassrepeat:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_maxrepeat:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Set Password Maximum Consecutive Repeating Characters</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password maxrepeat should meet minimum requirements</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_maxrepeat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="conditions for maxrepeat are satisfied">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_maxrepeat:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_minclass:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Minimum Different Categories</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password minclass should meet minimum requirements</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_minclass" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="conditions for minclass are satisfied">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_minclass:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_minlen:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Minimum Length</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password minlen should meet minimum requirements</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_minlen" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="conditions for minlen are satisfied">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_minlen:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_ocredit:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Minimum Special Characters</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password ocredit should meet minimum requirements</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_ocredit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="conditions for ocredit are satisfied">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_ocredit:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_ucredit:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password ucredit should meet minimum requirements</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_ucredit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="conditions for ucredit are satisfied">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_ucredit:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_chmod:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - chmod</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_chmod" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit chmod" test_ref="oval:ssg-test_32bit_ardm_chmod_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit chmod" test_ref="oval:ssg-test_64bit_ardm_chmod_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit chmod" test_ref="oval:ssg-test_32bit_ardm_chmod_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit chmod" test_ref="oval:ssg-test_64bit_ardm_chmod_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_chown:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - chown</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_chown" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit chown" test_ref="oval:ssg-test_32bit_ardm_chown_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit chown" test_ref="oval:ssg-test_64bit_ardm_chown_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit chown" test_ref="oval:ssg-test_32bit_ardm_chown_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit chown" test_ref="oval:ssg-test_64bit_ardm_chown_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_fchmod:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - fchmod</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_fchmod" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit fchmod" test_ref="oval:ssg-test_32bit_ardm_fchmod_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit fchmod" test_ref="oval:ssg-test_64bit_ardm_fchmod_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit fchmod" test_ref="oval:ssg-test_32bit_ardm_fchmod_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit fchmod" test_ref="oval:ssg-test_64bit_ardm_fchmod_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_fchmodat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - fchmodat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_fchmodat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit fchmodat" test_ref="oval:ssg-test_32bit_ardm_fchmodat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit fchmodat" test_ref="oval:ssg-test_64bit_ardm_fchmodat_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit fchmodat" test_ref="oval:ssg-test_32bit_ardm_fchmodat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit fchmodat" test_ref="oval:ssg-test_64bit_ardm_fchmodat_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_fchown:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - fchown</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_fchown" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit fchown" test_ref="oval:ssg-test_32bit_ardm_fchown_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit fchown" test_ref="oval:ssg-test_64bit_ardm_fchown_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit fchown" test_ref="oval:ssg-test_32bit_ardm_fchown_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit fchown" test_ref="oval:ssg-test_64bit_ardm_fchown_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_fchownat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - fchownat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_fchownat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit fchownat" test_ref="oval:ssg-test_32bit_ardm_fchownat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit fchownat" test_ref="oval:ssg-test_64bit_ardm_fchownat_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit fchownat" test_ref="oval:ssg-test_32bit_ardm_fchownat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit fchownat" test_ref="oval:ssg-test_64bit_ardm_fchownat_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_fremovexattr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - fremovexattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_fremovexattr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit fremovexattr" test_ref="oval:ssg-test_32bit_ardm_fremovexattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit fremovexattr" test_ref="oval:ssg-test_64bit_ardm_fremovexattr_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit fremovexattr" test_ref="oval:ssg-test_32bit_ardm_fremovexattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit fremovexattr" test_ref="oval:ssg-test_64bit_ardm_fremovexattr_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_fsetxattr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - fsetxattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_fsetxattr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit fsetxattr" test_ref="oval:ssg-test_32bit_ardm_fsetxattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit fsetxattr" test_ref="oval:ssg-test_64bit_ardm_fsetxattr_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit fsetxattr" test_ref="oval:ssg-test_32bit_ardm_fsetxattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit fsetxattr" test_ref="oval:ssg-test_64bit_ardm_fsetxattr_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_lchown:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - lchown</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_lchown" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit lchown" test_ref="oval:ssg-test_32bit_ardm_lchown_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit lchown" test_ref="oval:ssg-test_64bit_ardm_lchown_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit lchown" test_ref="oval:ssg-test_32bit_ardm_lchown_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit lchown" test_ref="oval:ssg-test_64bit_ardm_lchown_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_lremovexattr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - lremovexattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_lremovexattr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit lremovexattr" test_ref="oval:ssg-test_32bit_ardm_lremovexattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit lremovexattr" test_ref="oval:ssg-test_64bit_ardm_lremovexattr_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit lremovexattr" test_ref="oval:ssg-test_32bit_ardm_lremovexattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit lremovexattr" test_ref="oval:ssg-test_64bit_ardm_lremovexattr_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_lsetxattr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - lsetxattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_lsetxattr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit lsetxattr" test_ref="oval:ssg-test_32bit_ardm_lsetxattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit lsetxattr" test_ref="oval:ssg-test_64bit_ardm_lsetxattr_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit lsetxattr" test_ref="oval:ssg-test_32bit_ardm_lsetxattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit lsetxattr" test_ref="oval:ssg-test_64bit_ardm_lsetxattr_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_removexattr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - removexattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_removexattr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit removexattr" test_ref="oval:ssg-test_32bit_ardm_removexattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit removexattr" test_ref="oval:ssg-test_64bit_ardm_removexattr_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit removexattr" test_ref="oval:ssg-test_32bit_ardm_removexattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit removexattr" test_ref="oval:ssg-test_64bit_ardm_removexattr_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_setxattr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - setxattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_setxattr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit setxattr" test_ref="oval:ssg-test_32bit_ardm_setxattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit setxattr" test_ref="oval:ssg-test_64bit_ardm_setxattr_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit setxattr" test_ref="oval:ssg-test_32bit_ardm_setxattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit setxattr" test_ref="oval:ssg-test_64bit_ardm_setxattr_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_umount2:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - umount2</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_umount2" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit umount2" test_ref="oval:ssg-test_32bit_ardm_umount2_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit umount2" test_ref="oval:ssg-test_64bit_ardm_umount2_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit umount2" test_ref="oval:ssg-test_32bit_ardm_umount2_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit umount2" test_ref="oval:ssg-test_64bit_ardm_umount2_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_etc_group_open:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information via open syscall - /etc/group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the write events to /etc/group</oval-def:description>
            <oval-def:reference ref_id="audit_rules_etc_group_open" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/group" test_ref="oval:ssg-test_audit_rules_tc_group_open_32bit_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/group" test_ref="oval:ssg-test_audit_rules_tc_group_open_64bit_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/group" test_ref="oval:ssg-test_audit_rules_tc_group_open_32bit_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/group" test_ref="oval:ssg-test_audit_rules_tc_group_open_64bit_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_etc_group_open_by_handle_at:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the write events to /etc/group</oval-def:description>
            <oval-def:reference ref_id="audit_rules_etc_group_open_by_handle_at" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/group" test_ref="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_32bit_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/group" test_ref="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_64bit_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/group" test_ref="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_32bit_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/group" test_ref="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_64bit_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_etc_group_openat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information via openat syscall - /etc/group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the write events to /etc/group</oval-def:description>
            <oval-def:reference ref_id="audit_rules_etc_group_openat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/group" test_ref="oval:ssg-test_audit_rules_tc_group_openat_32bit_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/group" test_ref="oval:ssg-test_audit_rules_tc_group_openat_64bit_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/group" test_ref="oval:ssg-test_audit_rules_tc_group_openat_32bit_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/group" test_ref="oval:ssg-test_audit_rules_tc_group_openat_64bit_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_etc_gshadow_open:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information via open syscall - /etc/gshadow</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the write events to /etc/gshadow</oval-def:description>
            <oval-def:reference ref_id="audit_rules_etc_gshadow_open" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/gshadow" test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_32bit_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/gshadow" test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_64bit_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/gshadow" test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_32bit_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/gshadow" test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_64bit_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_etc_gshadow_open_by_handle_at:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the write events to /etc/gshadow</oval-def:description>
            <oval-def:reference ref_id="audit_rules_etc_gshadow_open_by_handle_at" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/gshadow" test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_32bit_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/gshadow" test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_64bit_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/gshadow" test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_32bit_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/gshadow" test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_64bit_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_etc_gshadow_openat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information via openat syscall - /etc/gshadow</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the write events to /etc/gshadow</oval-def:description>
            <oval-def:reference ref_id="audit_rules_etc_gshadow_openat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/gshadow" test_ref="oval:ssg-test_audit_rules_tc_gshadow_openat_32bit_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/gshadow" test_ref="oval:ssg-test_audit_rules_tc_gshadow_openat_64bit_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/gshadow" test_ref="oval:ssg-test_audit_rules_tc_gshadow_openat_32bit_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/gshadow" test_ref="oval:ssg-test_audit_rules_tc_gshadow_openat_64bit_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_etc_passwd_open:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information via open syscall - /etc/passwd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the write events to /etc/passwd</oval-def:description>
            <oval-def:reference ref_id="audit_rules_etc_passwd_open" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/passwd" test_ref="oval:ssg-test_audit_rules_tc_passwd_open_32bit_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/passwd" test_ref="oval:ssg-test_audit_rules_tc_passwd_open_64bit_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/passwd" test_ref="oval:ssg-test_audit_rules_tc_passwd_open_32bit_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/passwd" test_ref="oval:ssg-test_audit_rules_tc_passwd_open_64bit_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_etc_passwd_open_by_handle_at:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the write events to /etc/passwd</oval-def:description>
            <oval-def:reference ref_id="audit_rules_etc_passwd_open_by_handle_at" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/passwd" test_ref="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_32bit_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/passwd" test_ref="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_64bit_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/passwd" test_ref="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_32bit_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/passwd" test_ref="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_64bit_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_etc_passwd_openat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information via openat syscall - /etc/passwd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the write events to /etc/passwd</oval-def:description>
            <oval-def:reference ref_id="audit_rules_etc_passwd_openat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/passwd" test_ref="oval:ssg-test_audit_rules_tc_passwd_openat_32bit_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/passwd" test_ref="oval:ssg-test_audit_rules_tc_passwd_openat_64bit_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/passwd" test_ref="oval:ssg-test_audit_rules_tc_passwd_openat_32bit_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/passwd" test_ref="oval:ssg-test_audit_rules_tc_passwd_openat_64bit_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_etc_shadow_open:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information via open syscall - /etc/shadow</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the write events to /etc/shadow</oval-def:description>
            <oval-def:reference ref_id="audit_rules_etc_shadow_open" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/shadow" test_ref="oval:ssg-test_audit_rules_tc_shadow_open_32bit_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/shadow" test_ref="oval:ssg-test_audit_rules_tc_shadow_open_64bit_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/shadow" test_ref="oval:ssg-test_audit_rules_tc_shadow_open_32bit_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/shadow" test_ref="oval:ssg-test_audit_rules_tc_shadow_open_64bit_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_etc_shadow_open_by_handle_at:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the write events to /etc/shadow</oval-def:description>
            <oval-def:reference ref_id="audit_rules_etc_shadow_open_by_handle_at" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/shadow" test_ref="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_32bit_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/shadow" test_ref="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_64bit_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/shadow" test_ref="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_32bit_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/shadow" test_ref="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_64bit_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_etc_shadow_openat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information via openat syscall - /etc/shadow</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the write events to /etc/shadow</oval-def:description>
            <oval-def:reference ref_id="audit_rules_etc_shadow_openat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/shadow" test_ref="oval:ssg-test_audit_rules_tc_shadow_openat_32bit_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/shadow" test_ref="oval:ssg-test_audit_rules_tc_shadow_openat_64bit_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/shadow" test_ref="oval:ssg-test_audit_rules_tc_shadow_openat_32bit_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/shadow" test_ref="oval:ssg-test_audit_rules_tc_shadow_openat_64bit_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_execution_chcon:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run chcon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of chcon is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_execution_chcon" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules chcon" test_ref="oval:ssg-test_audit_rules_execution_chcon_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl chcon" test_ref="oval:ssg-test_audit_rules_execution_chcon_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_execution_restorecon:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run restorecon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of restorecon is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_execution_restorecon" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules restorecon" test_ref="oval:ssg-test_audit_rules_execution_restorecon_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl restorecon" test_ref="oval:ssg-test_audit_rules_execution_restorecon_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_execution_semanage:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run semanage</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of semanage is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_execution_semanage" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules semanage" test_ref="oval:ssg-test_audit_rules_execution_semanage_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl semanage" test_ref="oval:ssg-test_audit_rules_execution_semanage_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_execution_setsebool:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run setsebool</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of setsebool is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_execution_setsebool" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules setsebool" test_ref="oval:ssg-test_audit_rules_execution_setsebool_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl setsebool" test_ref="oval:ssg-test_audit_rules_execution_setsebool_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_execution_seunshare:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run seunshare</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of seunshare is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_execution_seunshare" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules seunshare" test_ref="oval:ssg-test_audit_rules_execution_seunshare_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl seunshare" test_ref="oval:ssg-test_audit_rules_execution_seunshare_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_file_deletion_events_rename:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects File Deletion Events by User - rename</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The deletion of files should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_file_deletion_events_rename" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit rename" test_ref="oval:ssg-test_32bit_ardm_rename_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit rename" test_ref="oval:ssg-test_64bit_ardm_rename_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit rename" test_ref="oval:ssg-test_32bit_ardm_rename_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit rename" test_ref="oval:ssg-test_64bit_ardm_rename_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_file_deletion_events_renameat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects File Deletion Events by User - renameat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The deletion of files should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_file_deletion_events_renameat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit renameat" test_ref="oval:ssg-test_32bit_ardm_renameat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit renameat" test_ref="oval:ssg-test_64bit_ardm_renameat_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit renameat" test_ref="oval:ssg-test_32bit_ardm_renameat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit renameat" test_ref="oval:ssg-test_64bit_ardm_renameat_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_file_deletion_events_rmdir:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects File Deletion Events by User - rmdir</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The deletion of files should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_file_deletion_events_rmdir" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit rmdir" test_ref="oval:ssg-test_32bit_ardm_rmdir_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit rmdir" test_ref="oval:ssg-test_64bit_ardm_rmdir_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit rmdir" test_ref="oval:ssg-test_32bit_ardm_rmdir_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit rmdir" test_ref="oval:ssg-test_64bit_ardm_rmdir_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_file_deletion_events_unlink:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects File Deletion Events by User - unlink</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The deletion of files should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_file_deletion_events_unlink" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit unlink" test_ref="oval:ssg-test_32bit_ardm_unlink_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit unlink" test_ref="oval:ssg-test_64bit_ardm_unlink_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit unlink" test_ref="oval:ssg-test_32bit_ardm_unlink_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit unlink" test_ref="oval:ssg-test_64bit_ardm_unlink_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_file_deletion_events_unlinkat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects File Deletion Events by User - unlinkat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The deletion of files should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_file_deletion_events_unlinkat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit unlinkat" test_ref="oval:ssg-test_32bit_ardm_unlinkat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit unlinkat" test_ref="oval:ssg-test_64bit_ardm_unlinkat_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit unlinkat" test_ref="oval:ssg-test_32bit_ardm_unlinkat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit unlinkat" test_ref="oval:ssg-test_64bit_ardm_unlinkat_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_login_events_faillock:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to Alter Logon and Logout Events - faillock</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules should be configured to log successful and unsuccessful login and logout events.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_login_events_faillock" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules faillock" test_ref="oval:ssg-test_arle_faillock_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl faillock" test_ref="oval:ssg-test_arle_faillock_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_login_events_lastlog:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to Alter Logon and Logout Events - lastlog</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules should be configured to log successful and unsuccessful login and logout events.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_login_events_lastlog" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules lastlog" test_ref="oval:ssg-test_arle_lastlog_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl lastlog" test_ref="oval:ssg-test_arle_lastlog_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_login_events_tallylog:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to Alter Logon and Logout Events - tallylog</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules should be configured to log successful and unsuccessful login and logout events.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_login_events_tallylog" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules tallylog" test_ref="oval:ssg-test_arle_tallylog_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl tallylog" test_ref="oval:ssg-test_arle_tallylog_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_media_export:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on Exporting to Media (successful)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_media_export" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit mount" test_ref="oval:ssg-test_32bit_ardm_mount_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit mount" test_ref="oval:ssg-test_64bit_ardm_mount_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit mount" test_ref="oval:ssg-test_32bit_ardm_mount_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit mount" test_ref="oval:ssg-test_64bit_ardm_mount_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_at:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - at</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of at is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_at" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules at" test_ref="oval:ssg-test_audit_rules_privileged_commands_at_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl at" test_ref="oval:ssg-test_audit_rules_privileged_commands_at_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_chage:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - chage</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of chage is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_chage" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules chage" test_ref="oval:ssg-test_audit_rules_privileged_commands_chage_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl chage" test_ref="oval:ssg-test_audit_rules_privileged_commands_chage_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_chsh:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - chsh</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of chsh is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_chsh" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules chsh" test_ref="oval:ssg-test_audit_rules_privileged_commands_chsh_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl chsh" test_ref="oval:ssg-test_audit_rules_privileged_commands_chsh_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_crontab:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - crontab</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of crontab is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_crontab" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules crontab" test_ref="oval:ssg-test_audit_rules_privileged_commands_crontab_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl crontab" test_ref="oval:ssg-test_audit_rules_privileged_commands_crontab_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_gpasswd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of gpasswd is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_gpasswd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules gpasswd" test_ref="oval:ssg-test_audit_rules_privileged_commands_gpasswd_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl gpasswd" test_ref="oval:ssg-test_audit_rules_privileged_commands_gpasswd_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_mount:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - mount</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of mount is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_mount" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules mount" test_ref="oval:ssg-test_audit_rules_privileged_commands_mount_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl mount" test_ref="oval:ssg-test_audit_rules_privileged_commands_mount_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_newgidmap:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - newgidmap</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of newgidmap is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_newgidmap" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules newgidmap" test_ref="oval:ssg-test_audit_rules_privileged_commands_newgidmap_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl newgidmap" test_ref="oval:ssg-test_audit_rules_privileged_commands_newgidmap_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_newgrp:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of newgrp is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_newgrp" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules newgrp" test_ref="oval:ssg-test_audit_rules_privileged_commands_newgrp_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl newgrp" test_ref="oval:ssg-test_audit_rules_privileged_commands_newgrp_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_newuidmap:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - newuidmap</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of newuidmap is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_newuidmap" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules newuidmap" test_ref="oval:ssg-test_audit_rules_privileged_commands_newuidmap_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl newuidmap" test_ref="oval:ssg-test_audit_rules_privileged_commands_newuidmap_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_passwd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - passwd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of passwd is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_passwd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules passwd" test_ref="oval:ssg-test_audit_rules_privileged_commands_passwd_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl passwd" test_ref="oval:ssg-test_audit_rules_privileged_commands_passwd_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_pt_chown:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - pt_chown</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of pt_chown is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_pt_chown" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules pt_chown" test_ref="oval:ssg-test_audit_rules_privileged_commands_pt_chown_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl pt_chown" test_ref="oval:ssg-test_audit_rules_privileged_commands_pt_chown_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_ssh_keysign:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of ssh_keysign is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_ssh_keysign" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules ssh_keysign" test_ref="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl ssh_keysign" test_ref="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_su:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - su</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of su is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_su" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules su" test_ref="oval:ssg-test_audit_rules_privileged_commands_su_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl su" test_ref="oval:ssg-test_audit_rules_privileged_commands_su_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_sudo:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - sudo</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of sudo is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_sudo" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules sudo" test_ref="oval:ssg-test_audit_rules_privileged_commands_sudo_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl sudo" test_ref="oval:ssg-test_audit_rules_privileged_commands_sudo_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_sudoedit:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of sudoedit is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_sudoedit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules sudoedit" test_ref="oval:ssg-test_audit_rules_privileged_commands_sudoedit_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl sudoedit" test_ref="oval:ssg-test_audit_rules_privileged_commands_sudoedit_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_umount:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - umount</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of umount is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_umount" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules umount" test_ref="oval:ssg-test_audit_rules_privileged_commands_umount_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl umount" test_ref="oval:ssg-test_audit_rules_privileged_commands_umount_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_unix_chkpwd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of unix_chkpwd is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_unix_chkpwd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules unix_chkpwd" test_ref="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl unix_chkpwd" test_ref="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_userhelper:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - userhelper</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of userhelper is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_userhelper" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules userhelper" test_ref="oval:ssg-test_audit_rules_privileged_commands_userhelper_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl userhelper" test_ref="oval:ssg-test_audit_rules_privileged_commands_userhelper_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_usernetctl:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - usernetctl</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of usernetctl is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_usernetctl" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules usernetctl" test_ref="oval:ssg-test_audit_rules_privileged_commands_usernetctl_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl usernetctl" test_ref="oval:ssg-test_audit_rules_privileged_commands_usernetctl_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_chmod:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Permission Changes to Files - chmod</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_chmod" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_chmod_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_chmod_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_chmod_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_chmod_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_chmod_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_chmod_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_chmod_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_chmod_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_chown:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Ownership Changes to Files - chown</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_chown" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_chown_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_chown_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_chown_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_chown_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_chown_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_chown_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_chown_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_chown_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_creat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Access Attempts to Files - creat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_creat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_creat_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_creat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_creat_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_creat_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_creat_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_creat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_creat_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_creat_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_fchmod:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Permission Changes to Files - fchmod</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_fchmod" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_fchmod_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_fchmod_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_fchmod_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_fchmod_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_fchmod_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_fchmod_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_fchmod_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_fchmod_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_fchmodat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Permission Changes to Files - fchmodat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_fchmodat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_fchmodat_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_fchmodat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_fchmodat_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_fchmodat_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_fchmodat_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_fchmodat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_fchmodat_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_fchmodat_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_fchown:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Ownership Changes to Files - fchown</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_fchown" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_fchown_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_fchown_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_fchown_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_fchown_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_fchown_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_fchown_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_fchown_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_fchown_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_fchownat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Ownership Changes to Files - fchownat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_fchownat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_fchownat_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_fchownat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_fchownat_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_fchownat_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_fchownat_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_fchownat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_fchownat_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_fchownat_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_fremovexattr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Permission Changes to Files - fremovexattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_fremovexattr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_fremovexattr_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_fremovexattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_fremovexattr_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_fremovexattr_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_fremovexattr_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_fremovexattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_fremovexattr_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_fremovexattr_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_fsetxattr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Permission Changes to Files - fsetxattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_fsetxattr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_fsetxattr_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_fsetxattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_fsetxattr_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_fsetxattr_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_fsetxattr_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_fsetxattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_fsetxattr_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_fsetxattr_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_ftruncate:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Access Attempts to Files - ftruncate</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_ftruncate" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_ftruncate_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_ftruncate_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_ftruncate_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_ftruncate_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_ftruncate_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_ftruncate_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_ftruncate_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_ftruncate_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_lchown:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Ownership Changes to Files - lchown</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_lchown" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_lchown_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_lchown_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_lchown_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_lchown_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_lchown_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_lchown_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_lchown_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_lchown_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_lremovexattr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Permission Changes to Files - lremovexattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_lremovexattr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_lremovexattr_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_lremovexattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_lremovexattr_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_lremovexattr_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_lremovexattr_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_lremovexattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_lremovexattr_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_lremovexattr_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_lsetxattr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Permission Changes to Files - lsetxattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_lsetxattr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_lsetxattr_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_lsetxattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_lsetxattr_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_lsetxattr_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_lsetxattr_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_lsetxattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_lsetxattr_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_lsetxattr_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_open:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Access Attempts to Files - open</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_open" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_open_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_open_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_open_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_open_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_open_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_open_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_open_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_open_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Access Attempts to Files - open_by_handle_at</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_open_by_handle_at" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the unsuccessful use of open_by_handle_at O_CREAT is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="Verify audit rule open_by_handle_at 32bit a2&amp;0100 eacces augenrules exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_augenrules:tst:1"/>
              <oval-def:criterion comment="Verify audit rule open_by_handle_at 32bit a2&amp;0100 eperm augenrules exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="Verify audit rule open_by_handle_at 64bit a2&amp;0100 eacces augenrules exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_augenrules:tst:1"/>
                  <oval-def:criterion comment="Verify audit rule open_by_handle_at 64bit a2&amp;0100 eperm augenrules exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="Verify audit rule open_by_handle_at 32bit a2&amp;0100 eacces auditctl exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_auditctl:tst:1"/>
              <oval-def:criterion comment="Verify audit rule open_by_handle_at 32bit a2&amp;0100 eperm auditctl exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="Verify audit rule open_by_handle_at 64bit a2&amp;0100 eacces auditctl exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_auditctl:tst:1"/>
                  <oval-def:criterion comment="Verify audit rule open_by_handle_at 64bit a2&amp;0100 eperm auditctl exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the unsuccessful use of open_by_handle_at O_TRUNC is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="Verify audit rule open_by_handle_at 32bit a2&amp;01003 eacces augenrules exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_augenrules:tst:1"/>
              <oval-def:criterion comment="Verify audit rule open_by_handle_at 32bit a2&amp;01003 eperm augenrules exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="Verify audit rule open_by_handle_at 64bit a2&amp;01003 eacces augenrules exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_augenrules:tst:1"/>
                  <oval-def:criterion comment="Verify audit rule open_by_handle_at 64bit a2&amp;01003 eperm augenrules exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="Verify audit rule open_by_handle_at 32bit a2&amp;01003 eacces auditctl exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_auditctl:tst:1"/>
              <oval-def:criterion comment="Verify audit rule open_by_handle_at 32bit a2&amp;01003 eperm auditctl exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="Verify audit rule open_by_handle_at 64bit a2&amp;01003 eacces auditctl exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_auditctl:tst:1"/>
                  <oval-def:criterion comment="Verify audit rule open_by_handle_at 64bit a2&amp;01003 eperm auditctl exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the unsuccessful use of open_by_handle_at is configured in the proper rule order.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eacces_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eperm_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit" test_ref="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eacces_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit" test_ref="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eperm_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eacces_auditctl:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eperm_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eacces_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eperm_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_open_o_creat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Creation Attempts to Files - open O_CREAT</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the unsuccessful use of open O_CREAT is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_open_o_creat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="Verify audit rule open 32bit a1&amp;0100 eacces augenrules exists" test_ref="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eacces_augenrules:tst:1"/>
              <oval-def:criterion comment="Verify audit rule open 32bit a1&amp;0100 eperm augenrules exists" test_ref="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eperm_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="Verify audit rule open 64bit a1&amp;0100 eacces augenrules exists" test_ref="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eacces_augenrules:tst:1"/>
                  <oval-def:criterion comment="Verify audit rule open 64bit a1&amp;0100 eperm augenrules exists" test_ref="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eperm_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="Verify audit rule open 32bit a1&amp;0100 eacces auditctl exists" test_ref="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eacces_auditctl:tst:1"/>
              <oval-def:criterion comment="Verify audit rule open 32bit a1&amp;0100 eperm auditctl exists" test_ref="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eperm_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="Verify audit rule open 64bit a1&amp;0100 eacces auditctl exists" test_ref="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eacces_auditctl:tst:1"/>
                  <oval-def:criterion comment="Verify audit rule open 64bit a1&amp;0100 eperm auditctl exists" test_ref="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eperm_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the unsuccessful use of open O_TRUNC is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_open_o_trunc_write" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="Verify audit rule open 32bit a1&amp;01003 eacces augenrules exists" test_ref="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eacces_augenrules:tst:1"/>
              <oval-def:criterion comment="Verify audit rule open 32bit a1&amp;01003 eperm augenrules exists" test_ref="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eperm_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="Verify audit rule open 64bit a1&amp;01003 eacces augenrules exists" test_ref="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eacces_augenrules:tst:1"/>
                  <oval-def:criterion comment="Verify audit rule open 64bit a1&amp;01003 eperm augenrules exists" test_ref="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eperm_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="Verify audit rule open 32bit a1&amp;01003 eacces auditctl exists" test_ref="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eacces_auditctl:tst:1"/>
              <oval-def:criterion comment="Verify audit rule open 32bit a1&amp;01003 eperm auditctl exists" test_ref="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eperm_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="Verify audit rule open 64bit a1&amp;01003 eacces auditctl exists" test_ref="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eacces_auditctl:tst:1"/>
                  <oval-def:criterion comment="Verify audit rule open 64bit a1&amp;01003 eperm auditctl exists" test_ref="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eperm_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_open_rule_order:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the unsuccessful use of open is configured in the proper rule order.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_open_rule_order" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_open_order_32bit_eacces_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_open_order_32bit_eperm_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit" test_ref="oval:ssg-test_arufm_open_order_64bit_eacces_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit" test_ref="oval:ssg-test_arufm_open_order_64bit_eperm_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_open_order_32bit_eacces_auditctl:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_open_order_32bit_eperm_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_open_order_64bit_eacces_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_open_order_64bit_eperm_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_openat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Access Attempts to Files - openat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_openat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_openat_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_openat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_openat_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_openat_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_openat_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_openat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_openat_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_openat_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Creation Attempts to Files - openat O_CREAT</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the unsuccessful use of openat O_CREAT is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_openat_o_creat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="Verify audit rule openat 32bit a2&amp;0100 eacces augenrules exists" test_ref="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eacces_augenrules:tst:1"/>
              <oval-def:criterion comment="Verify audit rule openat 32bit a2&amp;0100 eperm augenrules exists" test_ref="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eperm_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="Verify audit rule openat 64bit a2&amp;0100 eacces augenrules exists" test_ref="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eacces_augenrules:tst:1"/>
                  <oval-def:criterion comment="Verify audit rule openat 64bit a2&amp;0100 eperm augenrules exists" test_ref="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eperm_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="Verify audit rule openat 32bit a2&amp;0100 eacces auditctl exists" test_ref="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eacces_auditctl:tst:1"/>
              <oval-def:criterion comment="Verify audit rule openat 32bit a2&amp;0100 eperm auditctl exists" test_ref="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eperm_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="Verify audit rule openat 64bit a2&amp;0100 eacces auditctl exists" test_ref="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eacces_auditctl:tst:1"/>
                  <oval-def:criterion comment="Verify audit rule openat 64bit a2&amp;0100 eperm auditctl exists" test_ref="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eperm_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the unsuccessful use of openat O_TRUNC is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_openat_o_trunc_write" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="Verify audit rule openat 32bit a2&amp;01003 eacces augenrules exists" test_ref="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eacces_augenrules:tst:1"/>
              <oval-def:criterion comment="Verify audit rule openat 32bit a2&amp;01003 eperm augenrules exists" test_ref="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eperm_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="Verify audit rule openat 64bit a2&amp;01003 eacces augenrules exists" test_ref="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eacces_augenrules:tst:1"/>
                  <oval-def:criterion comment="Verify audit rule openat 64bit a2&amp;01003 eperm augenrules exists" test_ref="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eperm_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="Verify audit rule openat 32bit a2&amp;01003 eacces auditctl exists" test_ref="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eacces_auditctl:tst:1"/>
              <oval-def:criterion comment="Verify audit rule openat 32bit a2&amp;01003 eperm auditctl exists" test_ref="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eperm_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="Verify audit rule openat 64bit a2&amp;01003 eacces auditctl exists" test_ref="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eacces_auditctl:tst:1"/>
                  <oval-def:criterion comment="Verify audit rule openat 64bit a2&amp;01003 eperm auditctl exists" test_ref="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eperm_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_openat_rule_order:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the unsuccessful use of openat is configured in the proper rule order.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_openat_rule_order" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_openat_order_32bit_eacces_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_openat_order_32bit_eperm_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit" test_ref="oval:ssg-test_arufm_openat_order_64bit_eacces_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit" test_ref="oval:ssg-test_arufm_openat_order_64bit_eperm_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_openat_order_32bit_eacces_auditctl:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_openat_order_32bit_eperm_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_openat_order_64bit_eacces_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_openat_order_64bit_eperm_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_removexattr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Permission Changes to Files - removexattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_removexattr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_removexattr_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_removexattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_removexattr_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_removexattr_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_removexattr_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_removexattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_removexattr_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_removexattr_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_rename:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Delete Attempts to Files - rename</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_rename" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_rename_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_rename_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_rename_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_rename_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_rename_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_rename_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_rename_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_rename_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_renameat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Delete Attempts to Files - renameat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_renameat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_renameat_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_renameat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_renameat_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_renameat_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_renameat_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_renameat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_renameat_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_renameat_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_setxattr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Permission Changes to Files - setxattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_setxattr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_setxattr_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_setxattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_setxattr_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_setxattr_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_setxattr_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_setxattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_setxattr_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_setxattr_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_truncate:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Access Attempts to Files - truncate</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_truncate" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_truncate_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_truncate_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_truncate_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_truncate_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_truncate_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_truncate_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_truncate_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_truncate_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_unlink:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Delete Attempts to Files - unlink</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_unlink" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_unlink_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_unlink_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_unlink_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_unlink_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_unlink_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_unlink_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_unlink_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_unlink_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_unlinkat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Delete Attempts to Files - unlinkat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_unlinkat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_unlinkat_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_unlinkat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_unlinkat_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_unlinkat_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_unlinkat_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_unlinkat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_unlinkat_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_unlinkat_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_usergroup_modification_group:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information - /etc/group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit user/group modification.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_usergroup_modification_group" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit group" test_ref="oval:ssg-test_audit_rules_usergroup_modification_group_augen:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit group" test_ref="oval:ssg-test_audit_rules_usergroup_modification_group_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_usergroup_modification_gshadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information - /etc/gshadow</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit user/group modification.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_usergroup_modification_gshadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit gshadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_gshadow_augen:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit gshadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_gshadow_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_usergroup_modification_opasswd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information - /etc/security/opasswd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit user/group modification.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_usergroup_modification_opasswd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit opasswd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_opasswd_augen:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit opasswd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_opasswd_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_usergroup_modification_passwd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information - /etc/passwd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit user/group modification.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_usergroup_modification_passwd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit passwd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_passwd_augen:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit passwd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_passwd_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_usergroup_modification_shadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information - /etc/shadow</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit user/group modification.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_usergroup_modification_shadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit shadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_shadow_augen:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit shadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_shadow_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_freq:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set number of records to cause an explicit flush to audit logs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'freq' is configured with value '50' in /etc/audit/auditd.conf</oval-def:description>
            <oval-def:reference ref_id="auditd_freq" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="auditd is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the freq in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_freq:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_local_events:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Include Local Events in Audit Logs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'local_events' is configured with value 'yes' in /etc/audit/auditd.conf</oval-def:description>
            <oval-def:reference ref_id="auditd_local_events" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="auditd is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the local_events in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_local_events:tst:1"/>
            <oval-def:criterion comment="Check the absence of local_events in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_local_events_default_not_overriden:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_log_format:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Resolve information before writing to audit logs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'log_format' is configured with value 'ENRICHED' in /etc/audit/auditd.conf</oval-def:description>
            <oval-def:reference ref_id="auditd_log_format" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="auditd is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the log_format in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_log_format:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_name_format:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set hostname as computer node name in audit logs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'name_format' is configured with value 'hostname' in /etc/audit/auditd.conf</oval-def:description>
            <oval-def:reference ref_id="auditd_name_format" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="auditd is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the name_format in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_name_format:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_write_logs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Write Audit Logs to the Disk</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'write_logs' is configured with value 'yes' in /etc/audit/auditd.conf</oval-def:description>
            <oval-def:reference ref_id="auditd_write_logs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="auditd is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the write_logs in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_write_logs:tst:1"/>
            <oval-def:criterion comment="Check the absence of write_logs in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_write_logs_default_not_overriden:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-coreos_enable_selinux_kernel_argument:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure SELinux Not Disabled in the kernel arguments</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure selinux=0 argument is not present in the 'options' line of /boot/loader/entries/ostree-2-*.conf (or ostree-1-*.conf if there is no ostree-2-*.conf as ostree has only two enries at the most, with *-2-*.conf entry always being the most recent). Also, ensure that kernel is currently running with this argument by checking /proc/cmdline.</oval-def:description>
            <oval-def:reference ref_id="coreos_enable_selinux_kernel_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criteria operator="AND">
                <oval-def:criterion comment="Pass if there are no files matching pattern '/boot/loader/entries/ostree-2-.*.conf' exist in the system" test_ref="oval:ssg-test_coreos_enable_selinux_kernel_argument_file_boot_loader_entries_ostree_2_conf_absent:tst:1"/>
                <oval-def:criterion comment="Check if argument selinux=0 for Linux kernel is not present in /boot/loader/entries/ostree-1-.*.conf" test_ref="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:tst:1" negate="true"/>
              </oval-def:criteria>
              <oval-def:criteria operator="AND">
                <oval-def:criterion comment="Check if argument selinux=0 for Linux kernel is not present in /boot/loader/entries/ostree-2-.*.conf" test_ref="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:tst:1" negate="true"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check if argument selinux=0 for Linux kernel is not present in /proc/cmdline" test_ref="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:tst:1" negate="true"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_disable_user_admin:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable User Administration in GNOME3</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'user-administration-disabled' is configured with value 'true in section 'org/gnome/desktop/lockdown' in /etc/dconf/db/local.d/</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_disable_user_admin" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="dconf is configured correctly" operator="AND">
            <oval-def:criterion comment="Check the user-administration-disabled in /etc/dconf/db/local.d/" test_ref="oval:ssg-test_dconf_gnome_disable_user_admin:tst:1"/>
            <oval-def:criterion comment="Prevent user from modifying user-administration-disabled" test_ref="oval:ssg-test_prevent_user_user-administration-disabled:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_lock_screen_on_smartcard_removal:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable the GNOME3 Screen Locking On Smartcard Removal</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'removal-action' is configured with value ''lock-screen' in section 'org/gnome/settings-daemon/peripherals/smartcard' in /etc/dconf/db/local.d/</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_lock_screen_on_smartcard_removal" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="dconf is configured correctly" operator="AND">
            <oval-def:criterion comment="Check the removal-action in /etc/dconf/db/local.d/" test_ref="oval:ssg-test_dconf_gnome_lock_screen_on_smartcard_removal:tst:1"/>
            <oval-def:criterion comment="Prevent user from modifying removal-action" test_ref="oval:ssg-test_prevent_user_removal-action:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dir_group_ownership_library_dirs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify that Shared Library Directories Have Root Group Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="dir_group_ownership_library_dirs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /lib/" test_ref="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_0:tst:1"/>
            <oval-def:criterion comment="Check file group ownership of /lib64/" test_ref="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_1:tst:1"/>
            <oval-def:criterion comment="Check file group ownership of /usr/lib/" test_ref="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_2:tst:1"/>
            <oval-def:criterion comment="Check file group ownership of /usr/lib64/" test_ref="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_3:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dir_ownership_binary_dirs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify that System Executable Have Root Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="dir_ownership_binary_dirs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /bin/" test_ref="oval:ssg-test_file_ownerdir_ownership_binary_dirs_0:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /sbin/" test_ref="oval:ssg-test_file_ownerdir_ownership_binary_dirs_1:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /usr/bin/" test_ref="oval:ssg-test_file_ownerdir_ownership_binary_dirs_2:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /usr/sbin/" test_ref="oval:ssg-test_file_ownerdir_ownership_binary_dirs_3:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /usr/local/bin/" test_ref="oval:ssg-test_file_ownerdir_ownership_binary_dirs_4:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /usr/local/sbin/" test_ref="oval:ssg-test_file_ownerdir_ownership_binary_dirs_5:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dir_ownership_library_dirs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify that Shared Library Directories Have Root Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="dir_ownership_library_dirs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /lib/" test_ref="oval:ssg-test_file_ownerdir_ownership_library_dirs_0:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /lib64/" test_ref="oval:ssg-test_file_ownerdir_ownership_library_dirs_1:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /usr/lib/" test_ref="oval:ssg-test_file_ownerdir_ownership_library_dirs_2:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /usr/lib64/" test_ref="oval:ssg-test_file_ownerdir_ownership_library_dirs_3:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dir_permissions_binary_dirs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify that System Executable Directories Have Restrictive Permissions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH has mode 0755.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="dir_permissions_binary_dirs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /bin/" test_ref="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_0:tst:1"/>
            <oval-def:criterion comment="Check file mode of /sbin/" test_ref="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_1:tst:1"/>
            <oval-def:criterion comment="Check file mode of /usr/bin/" test_ref="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_2:tst:1"/>
            <oval-def:criterion comment="Check file mode of /usr/sbin/" test_ref="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_3:tst:1"/>
            <oval-def:criterion comment="Check file mode of /usr/local/bin/" test_ref="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_4:tst:1"/>
            <oval-def:criterion comment="Check file mode of /usr/local/sbin/" test_ref="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_5:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dir_permissions_library_dirs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify that Shared Library Directories Have Restrictive Permissions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH has mode 0755.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="dir_permissions_library_dirs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /lib/" test_ref="oval:ssg-test_file_permissionsdir_permissions_library_dirs_0:tst:1"/>
            <oval-def:criterion comment="Check file mode of /lib64/" test_ref="oval:ssg-test_file_permissionsdir_permissions_library_dirs_1:tst:1"/>
            <oval-def:criterion comment="Check file mode of /usr/lib/" test_ref="oval:ssg-test_file_permissionsdir_permissions_library_dirs_2:tst:1"/>
            <oval-def:criterion comment="Check file mode of /usr/lib64/" test_ref="oval:ssg-test_file_permissionsdir_permissions_library_dirs_3:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-disable_host_auth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Host-Based Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'HostbasedAuthentication' is configured with value 'no' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="disable_host_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the HostbasedAuthentication in /etc/ssh/sshd_config" test_ref="oval:ssg-test_disable_host_auth:tst:1"/>
                <oval-def:criterion comment="Check the HostbasedAuthentication in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_disable_host_auth_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_at_deny_not_exist:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure that /etc/at.deny does not exist</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that/etc/at.deny does not exist.</oval-def:description>
            <oval-def:reference ref_id="file_at_deny_not_exist" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Ensure that /etc/at.deny does not exist." test_ref="oval:ssg-test_file_at_deny_not_exist:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_cron_deny_not_exist:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure that /etc/cron.deny does not exist</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that/etc/cron.deny does not exist.</oval-def:description>
            <oval-def:reference ref_id="file_cron_deny_not_exist" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Ensure that /etc/cron.deny does not exist." test_ref="oval:ssg-test_file_cron_deny_not_exist:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_backup_etc_group:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns Backup group File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_backup_etc_group" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /etc/group-" test_ref="oval:ssg-test_file_groupowner_backup_etc_group_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_backup_etc_gshadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns Backup gshadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_backup_etc_gshadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /etc/gshadow-" test_ref="oval:ssg-test_file_groupowner_backup_etc_gshadow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_backup_etc_passwd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns Backup passwd File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_backup_etc_passwd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /etc/passwd-" test_ref="oval:ssg-test_file_groupowner_backup_etc_passwd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_backup_etc_shadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns Backup shadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_backup_etc_shadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /etc/shadow-" test_ref="oval:ssg-test_file_groupowner_backup_etc_shadow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_efi_grub2_cfg:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify the UEFI Boot Loader grub.cfg Group Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_efi_grub2_cfg" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /boot/grub2/grub.cfg" test_ref="oval:ssg-test_file_groupowner_efi_grub2_cfg_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_etc_group:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns group File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_etc_group" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /etc/group" test_ref="oval:ssg-test_file_groupowner_etc_group_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_etc_gshadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns gshadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_etc_gshadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /etc/gshadow" test_ref="oval:ssg-test_file_groupowner_etc_gshadow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_etc_issue:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Ownership of System Login Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_etc_issue" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /etc/issue" test_ref="oval:ssg-test_file_groupowner_etc_issue_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_etc_motd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Ownership of Message of the Day Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_etc_motd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /etc/motd" test_ref="oval:ssg-test_file_groupowner_etc_motd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_etc_passwd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns passwd File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_etc_passwd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /etc/passwd" test_ref="oval:ssg-test_file_groupowner_etc_passwd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_etc_shadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns shadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_etc_shadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /etc/shadow" test_ref="oval:ssg-test_file_groupowner_etc_shadow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_grub2_cfg:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify /boot/grub2/grub.cfg Group Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_grub2_cfg" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /boot/grub2/grub.cfg" test_ref="oval:ssg-test_file_groupowner_grub2_cfg_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_var_log:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns /var/log Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_var_log" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /var/log/" test_ref="oval:ssg-test_file_groupowner_var_log_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_var_log_messages:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns /var/log/messages File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_var_log_messages" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /var/log/messages" test_ref="oval:ssg-test_file_groupowner_var_log_messages_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_var_log_syslog:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns /var/log/syslog File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is group owned by 4.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_var_log_syslog" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /var/log/syslog" test_ref="oval:ssg-test_file_groupowner_var_log_syslog_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupownership_audit_configuration:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Audit Configuration Files Must Be Owned By Group root</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupownership_audit_configuration" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /etc/audit/" test_ref="oval:ssg-test_file_groupownership_audit_configuration_0:tst:1"/>
            <oval-def:criterion comment="Check file group ownership of /etc/audit/rules.d/" test_ref="oval:ssg-test_file_groupownership_audit_configuration_1:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_backup_etc_group:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns Backup group File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_backup_etc_group" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /etc/group-" test_ref="oval:ssg-test_file_owner_backup_etc_group_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_backup_etc_gshadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns Backup gshadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_backup_etc_gshadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /etc/gshadow-" test_ref="oval:ssg-test_file_owner_backup_etc_gshadow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_backup_etc_passwd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns Backup passwd File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_backup_etc_passwd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /etc/passwd-" test_ref="oval:ssg-test_file_owner_backup_etc_passwd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_backup_etc_shadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns Backup shadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_backup_etc_shadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /etc/shadow-" test_ref="oval:ssg-test_file_owner_backup_etc_shadow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_efi_grub2_cfg:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify the UEFI Boot Loader grub.cfg User Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_efi_grub2_cfg" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /boot/grub2/grub.cfg" test_ref="oval:ssg-test_file_owner_efi_grub2_cfg_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_etc_group:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns group File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_etc_group" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /etc/group" test_ref="oval:ssg-test_file_owner_etc_group_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_etc_gshadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns gshadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_etc_gshadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /etc/gshadow" test_ref="oval:ssg-test_file_owner_etc_gshadow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_etc_issue:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify ownership of System Login Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_etc_issue" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /etc/issue" test_ref="oval:ssg-test_file_owner_etc_issue_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_etc_motd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify ownership of Message of the Day Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_etc_motd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /etc/motd" test_ref="oval:ssg-test_file_owner_etc_motd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_etc_passwd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns passwd File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_etc_passwd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /etc/passwd" test_ref="oval:ssg-test_file_owner_etc_passwd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_etc_shadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns shadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_etc_shadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /etc/shadow" test_ref="oval:ssg-test_file_owner_etc_shadow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_grub2_cfg:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify /boot/grub2/grub.cfg User Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_grub2_cfg" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /boot/grub2/grub.cfg" test_ref="oval:ssg-test_file_owner_grub2_cfg_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_var_log:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns /var/log Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_var_log" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /var/log/" test_ref="oval:ssg-test_file_owner_var_log_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_var_log_messages:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns /var/log/messages File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_var_log_messages" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /var/log/messages" test_ref="oval:ssg-test_file_owner_var_log_messages_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_var_log_syslog:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns /var/log/syslog File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is owned by 104.</oval-def:description>
            <oval-def:reference ref_id="file_owner_var_log_syslog" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /var/log/syslog" test_ref="oval:ssg-test_file_owner_var_log_syslog_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_ownership_audit_configuration:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Audit Configuration Files Must Be Owned By Root</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_ownership_audit_configuration" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /etc/audit/" test_ref="oval:ssg-test_file_ownership_audit_configuration_0:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /etc/audit/rules.d/" test_ref="oval:ssg-test_file_ownership_audit_configuration_1:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_ownership_library_dirs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify that Shared Library Files Have Root Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_ownership_library_dirs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /lib/" test_ref="oval:ssg-test_file_ownership_library_dirs_0:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /lib64/" test_ref="oval:ssg-test_file_ownership_library_dirs_1:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /usr/lib/" test_ref="oval:ssg-test_file_ownership_library_dirs_2:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /usr/lib64/" test_ref="oval:ssg-test_file_ownership_library_dirs_3:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_backup_etc_group:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on Backup group File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_backup_etc_group" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/group-" test_ref="oval:ssg-test_file_permissions_backup_etc_group_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_backup_etc_gshadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on Backup gshadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH has mode 0000.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_backup_etc_gshadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/gshadow-" test_ref="oval:ssg-test_file_permissions_backup_etc_gshadow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_backup_etc_passwd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on Backup passwd File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_backup_etc_passwd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/passwd-" test_ref="oval:ssg-test_file_permissions_backup_etc_passwd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_backup_etc_shadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on Backup shadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH has mode 0000.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_backup_etc_shadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/shadow-" test_ref="oval:ssg-test_file_permissions_backup_etc_shadow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_efi_grub2_cfg:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify the UEFI Boot Loader grub.cfg Permissions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH has mode 0700.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_efi_grub2_cfg" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /boot/grub2/grub.cfg" test_ref="oval:ssg-test_file_permissions_efi_grub2_cfg_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_etc_audit_auditd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on /etc/audit/auditd.conf</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH has mode 0640.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_etc_audit_auditd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/audit/auditd.conf" test_ref="oval:ssg-test_file_permissions_etc_audit_auditd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_etc_audit_rulesd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on /etc/audit/rules.d/*.rules</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH has mode 0640.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_etc_audit_rulesd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/audit/rules.d/" test_ref="oval:ssg-test_file_permissions_etc_audit_rulesd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_etc_group:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on group File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_etc_group" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/group" test_ref="oval:ssg-test_file_permissions_etc_group_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_etc_gshadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on gshadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH has mode 0000.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_etc_gshadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/gshadow" test_ref="oval:ssg-test_file_permissions_etc_gshadow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_etc_issue:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify permissions on System Login Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_etc_issue" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/issue" test_ref="oval:ssg-test_file_permissions_etc_issue_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_etc_motd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify permissions on Message of the Day Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_etc_motd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/motd" test_ref="oval:ssg-test_file_permissions_etc_motd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_etc_passwd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on passwd File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_etc_passwd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/passwd" test_ref="oval:ssg-test_file_permissions_etc_passwd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_etc_shadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on shadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH has mode 0000.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_etc_shadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/shadow" test_ref="oval:ssg-test_file_permissions_etc_shadow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_grub2_cfg:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify /boot/grub2/grub.cfg Permissions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH has mode 0600.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_grub2_cfg" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /boot/grub2/grub.cfg" test_ref="oval:ssg-test_file_permissions_grub2_cfg_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_library_dirs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify that Shared Library Files Have Restrictive Permissions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH has mode 7755.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_library_dirs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /lib/" test_ref="oval:ssg-test_file_permissions_library_dirs_0:tst:1"/>
            <oval-def:criterion comment="Check file mode of /lib64/" test_ref="oval:ssg-test_file_permissions_library_dirs_1:tst:1"/>
            <oval-def:criterion comment="Check file mode of /usr/lib/" test_ref="oval:ssg-test_file_permissions_library_dirs_2:tst:1"/>
            <oval-def:criterion comment="Check file mode of /usr/lib64/" test_ref="oval:ssg-test_file_permissions_library_dirs_3:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_sshd_private_key:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on SSH Server Private *_key Key Files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH has mode 0600.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_sshd_private_key" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/ssh/" test_ref="oval:ssg-test_file_permissions_sshd_private_key_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_sshd_pub_key:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on SSH Server Public *.pub Key Files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_sshd_pub_key" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/ssh/" test_ref="oval:ssg-test_file_permissions_sshd_pub_key_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_var_log:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on /var/log Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH has mode 0755.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_var_log" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /var/log/" test_ref="oval:ssg-test_file_permissions_var_log_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_var_log_messages:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on /var/log/messages File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH has mode 0640.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_var_log_messages" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /var/log/messages" test_ref="oval:ssg-test_file_permissions_var_log_messages_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_var_log_syslog:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on /var/log/syslog File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH has mode 0640.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_var_log_syslog" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /var/log/syslog" test_ref="oval:ssg-test_file_permissions_var_log_syslog_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_audit_argument:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Enable Auditing for Processes Which Start Prior to the Audit Daemon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure audit=1 is configured in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_audit_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion test_ref="oval:ssg-test_grub2_audit_argument:tst:1" comment="check for audit=1 in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
              <oval-def:criteria operator="AND">
                <oval-def:criterion test_ref="oval:ssg-test_grub2_audit_argument_default:tst:1" comment="check for audit=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                <oval-def:extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_audit_backlog_limit_argument:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Extend Audit Backlog Limit for the Audit Daemon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure audit_backlog_limit=8192 is configured in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_audit_backlog_limit_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion test_ref="oval:ssg-test_grub2_audit_backlog_limit_argument:tst:1" comment="check for audit_backlog_limit=8192 in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
              <oval-def:criteria operator="AND">
                <oval-def:criterion test_ref="oval:ssg-test_grub2_audit_backlog_limit_argument_default:tst:1" comment="check for audit_backlog_limit=8192 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                <oval-def:extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_enable_iommu_force:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>IOMMU configuration directive</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure iommu=force is configured in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_enable_iommu_force" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion test_ref="oval:ssg-test_grub2_iommu_argument:tst:1" comment="check for iommu=force in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
              <oval-def:criteria operator="AND">
                <oval-def:criterion test_ref="oval:ssg-test_grub2_iommu_argument_default:tst:1" comment="check for iommu=force in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                <oval-def:extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_ipv6_disable_argument:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure IPv6 is disabled through kernel boot parameter</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure ipv6.disable=1 is configured in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_ipv6_disable_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion test_ref="oval:ssg-test_grub2_ipv6_disable_argument:tst:1" comment="check for ipv6.disable=1 in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
              <oval-def:criteria operator="AND">
                <oval-def:criterion test_ref="oval:ssg-test_grub2_ipv6_disable_argument_default:tst:1" comment="check for ipv6.disable=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                <oval-def:extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_l1tf_argument:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Configure L1 Terminal Fault mitigations</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure l1tf is configured in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_l1tf_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion test_ref="oval:ssg-test_grub2_l1tf_argument:tst:1" comment="check for l1tf in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
              <oval-def:criteria operator="AND">
                <oval-def:criterion test_ref="oval:ssg-test_grub2_l1tf_argument_default:tst:1" comment="check for l1tf in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                <oval-def:extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_mce_argument:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Force kernel panic on uncorrected MCEs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure mce=0 is configured in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_mce_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion test_ref="oval:ssg-test_grub2_mce_argument:tst:1" comment="check for mce=0 in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
              <oval-def:criteria operator="AND">
                <oval-def:criterion test_ref="oval:ssg-test_grub2_mce_argument_default:tst:1" comment="check for mce=0 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                <oval-def:extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_mds_argument:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Configure Microarchitectural Data Sampling mitigation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure mds is configured in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_mds_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion test_ref="oval:ssg-test_grub2_mds_argument:tst:1" comment="check for mds in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
              <oval-def:criteria operator="AND">
                <oval-def:criterion test_ref="oval:ssg-test_grub2_mds_argument_default:tst:1" comment="check for mds in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                <oval-def:extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_nosmap_argument_absent:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure SMAP is not disabled during boot</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure nosmap is not set in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_nosmap_argument_absent" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion test_ref="oval:ssg-test_grub2_nosmap_argument_absent:tst:1" comment="check for absence of nosmap in /etc/default/grub on GRUB_CMDLINE_LINUX"/>
              <oval-def:criteria operator="AND">
                <oval-def:criterion test_ref="oval:ssg-test_grub2_nosmap_argument_absent_default:tst:1" comment="check for absence ofnosmap in /etc/default/grub on GRUB_CMDLINE_LINUX_DEFAULT"/>
                <oval-def:extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_nosmep_argument_absent:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure SMEP is not disabled during boot</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure nosmep is not set in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_nosmep_argument_absent" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion test_ref="oval:ssg-test_grub2_nosmep_argument_absent:tst:1" comment="check for absence of nosmep in /etc/default/grub on GRUB_CMDLINE_LINUX"/>
              <oval-def:criteria operator="AND">
                <oval-def:criterion test_ref="oval:ssg-test_grub2_nosmep_argument_absent_default:tst:1" comment="check for absence ofnosmep in /etc/default/grub on GRUB_CMDLINE_LINUX_DEFAULT"/>
                <oval-def:extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_page_poison_argument:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Enable page allocator poisoning</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure page_poison=1 is configured in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_page_poison_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion test_ref="oval:ssg-test_grub2_page_poison_argument:tst:1" comment="check for page_poison=1 in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
              <oval-def:criteria operator="AND">
                <oval-def:criterion test_ref="oval:ssg-test_grub2_page_poison_argument_default:tst:1" comment="check for page_poison=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                <oval-def:extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_pti_argument:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Page-Table Isolation (KPTI)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure pti=on is configured in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_pti_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion test_ref="oval:ssg-test_grub2_pti_argument:tst:1" comment="check for pti=on in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
              <oval-def:criteria operator="AND">
                <oval-def:criterion test_ref="oval:ssg-test_grub2_pti_argument_default:tst:1" comment="check for pti=on in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                <oval-def:extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_rng_core_default_quality_argument:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Configure the confidence in TPM for entropy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure rng_core.default_quality is configured in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_rng_core_default_quality_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion test_ref="oval:ssg-test_grub2_rng_core_default_quality_argument:tst:1" comment="check for rng_core.default_quality in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
              <oval-def:criteria operator="AND">
                <oval-def:criterion test_ref="oval:ssg-test_grub2_rng_core_default_quality_argument_default:tst:1" comment="check for rng_core.default_quality in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                <oval-def:extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_slab_nomerge_argument:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Disable merging of slabs with similar size</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure slab_nomerge=yes is configured in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_slab_nomerge_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion test_ref="oval:ssg-test_grub2_slab_nomerge_argument:tst:1" comment="check for slab_nomerge=yes in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
              <oval-def:criteria operator="AND">
                <oval-def:criterion test_ref="oval:ssg-test_grub2_slab_nomerge_argument_default:tst:1" comment="check for slab_nomerge=yes in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                <oval-def:extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_slub_debug_argument:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Enable SLUB/SLAB allocator poisoning</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure slub_debug is configured in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_slub_debug_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion test_ref="oval:ssg-test_grub2_slub_debug_argument:tst:1" comment="check for slub_debug in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
              <oval-def:criteria operator="AND">
                <oval-def:criterion test_ref="oval:ssg-test_grub2_slub_debug_argument_default:tst:1" comment="check for slub_debug in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                <oval-def:extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_spec_store_bypass_disable_argument:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Configure Speculative Store Bypass Mitigation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure spec_store_bypass_disable is configured in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_spec_store_bypass_disable_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion test_ref="oval:ssg-test_grub2_spec_store_bypass_disable_argument:tst:1" comment="check for spec_store_bypass_disable in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
              <oval-def:criteria operator="AND">
                <oval-def:criterion test_ref="oval:ssg-test_grub2_spec_store_bypass_disable_argument_default:tst:1" comment="check for spec_store_bypass_disable in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                <oval-def:extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_spectre_v2_argument:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Enforce Spectre v2 mitigation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure spectre_v2=on is configured in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_spectre_v2_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion test_ref="oval:ssg-test_grub2_spectre_v2_argument:tst:1" comment="check for spectre_v2=on in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
              <oval-def:criteria operator="AND">
                <oval-def:criterion test_ref="oval:ssg-test_grub2_spectre_v2_argument_default:tst:1" comment="check for spectre_v2=on in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                <oval-def:extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_vsyscall_argument:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Disable vsyscalls</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure vsyscall=none is configured in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_vsyscall_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion test_ref="oval:ssg-test_grub2_vsyscall_argument:tst:1" comment="check for vsyscall=none in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
              <oval-def:criteria operator="AND">
                <oval-def:criterion test_ref="oval:ssg-test_grub2_vsyscall_argument_default:tst:1" comment="check for vsyscall=none in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                <oval-def:extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-install_smartcard_packages:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install Smart Card Packages For Multifactor Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package openssl-pkcs11 should be installed.</oval-def:description>
            <oval-def:reference ref_id="install_smartcard_packages" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package openssl-pkcs11 is installed" test_ref="oval:ssg-test_package_openssl-pkcs11_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_acpi_custom_method:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Do not allow ACPI methods to be inserted/replaced at run time</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_ACPI_CUSTOM_METHOD should have value n</oval-def:description>
            <oval-def:reference ref_id="kernel_config_acpi_custom_method" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_acpi_custom_method:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_acpi_custom_method_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_acpi_custom_method_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_arm64_sw_ttbr0_pan:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Emulate Privileged Access Never (PAN)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_ARM64_SW_TTBR0_PAN should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_arm64_sw_ttbr0_pan" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_arm64_sw_ttbr0_pan:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_arm64_sw_ttbr0_pan_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_binfmt_misc:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable kernel support for MISC binaries</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_BINFMT_MISC should have value n</oval-def:description>
            <oval-def:reference ref_id="kernel_config_binfmt_misc" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_binfmt_misc:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_binfmt_misc_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_binfmt_misc_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_bug:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable support for BUG()</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_BUG should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_bug" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_bug:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_bug_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_bug_on_data_corruption:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Trigger a kernel BUG when data corruption is detected</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_BUG_ON_DATA_CORRUPTION should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_bug_on_data_corruption" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_bug_on_data_corruption:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_bug_on_data_corruption_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_compat_brk:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable compatibility with brk()</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_COMPAT_BRK should have value n</oval-def:description>
            <oval-def:reference ref_id="kernel_config_compat_brk" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_compat_brk:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_compat_brk_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_compat_brk_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_compat_vdso:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable the 32-bit vDSO</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_COMPAT_VDSO should have value n</oval-def:description>
            <oval-def:reference ref_id="kernel_config_compat_vdso" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_compat_vdso:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_compat_vdso_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_compat_vdso_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_debug_credentials:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable checks on credential management</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_DEBUG_CREDENTIALS should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_debug_credentials" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_debug_credentials:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_debug_credentials_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_debug_fs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable kernel debugfs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_DEBUG_FS should have value n</oval-def:description>
            <oval-def:reference ref_id="kernel_config_debug_fs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_debug_fs:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_debug_fs_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_debug_fs_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_debug_list:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable checks on linked list manipulation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_DEBUG_LIST should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_debug_list" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_debug_list:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_debug_list_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_debug_notifiers:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable checks on notifier call chains</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_DEBUG_NOTIFIERS should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_debug_notifiers" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_debug_notifiers:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_debug_notifiers_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_debug_sg:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable checks on scatter-gather (SG) table operations</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_DEBUG_SG should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_debug_sg" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_debug_sg:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_debug_sg_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_debug_wx:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Warn on W+X mappings found at boot</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_DEBUG_WX should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_debug_wx" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_debug_wx:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_debug_wx_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_default_mmap_min_addr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure low address space to protect from user allocation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_DEFAULT_MMAP_MIN_ADDR should have value 65536</oval-def:description>
            <oval-def:reference ref_id="kernel_config_default_mmap_min_addr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_default_mmap_min_addr:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_default_mmap_min_addr_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_devkmem:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable /dev/kmem virtual device support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_DEVKMEM should have value n</oval-def:description>
            <oval-def:reference ref_id="kernel_config_devkmem" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_devkmem:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_devkmem_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_devkmem_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_fortify_source:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Harden common str/mem functions against buffer overflows</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_FORTIFY_SOURCE should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_fortify_source" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_fortify_source:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_fortify_source_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_gcc_plugin_latent_entropy:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Generate some entropy during boot and runtime</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_GCC_PLUGIN_LATENT_ENTROPY should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_gcc_plugin_latent_entropy" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_gcc_plugin_latent_entropy:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_gcc_plugin_latent_entropy_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_gcc_plugin_randstruct:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Randomize layout of sensitive kernel structures</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_GCC_PLUGIN_RANDSTRUCT should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_gcc_plugin_randstruct" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_gcc_plugin_randstruct:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_gcc_plugin_randstruct_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_gcc_plugin_stackleak:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Poison kernel stack before returning from syscalls</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_GCC_PLUGIN_STACKLEAK should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_gcc_plugin_stackleak" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_gcc_plugin_stackleak:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_gcc_plugin_stackleak_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_gcc_plugin_structleak:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Force initialization of variables containing userspace addresses</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_GCC_PLUGIN_STRUCTLEAK should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_gcc_plugin_structleak" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_gcc_plugin_structleak:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_gcc_plugin_structleak_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_gcc_plugin_structleak_byref_all:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>zero-init everything passed by reference</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_gcc_plugin_structleak_byref_all" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_gcc_plugin_structleak_byref_all:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_gcc_plugin_structleak_byref_all_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_hardened_usercopy:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Harden memory copies between kernel and userspace</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_HARDENED_USERCOPY should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_hardened_usercopy" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_hardened_usercopy:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_hardened_usercopy_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_hardened_usercopy_fallback:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Do not allow usercopy whitelist violations to fallback to object size</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_HARDENED_USERCOPY_FALLBACK should have value n</oval-def:description>
            <oval-def:reference ref_id="kernel_config_hardened_usercopy_fallback" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_hardened_usercopy_fallback:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_hardened_usercopy_fallback_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_hardened_usercopy_fallback_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_hibernation:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable hibernation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_HIBERNATION should have value n</oval-def:description>
            <oval-def:reference ref_id="kernel_config_hibernation" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_hibernation:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_hibernation_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_hibernation_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_ia32_emulation:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable IA32 emulation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_IA32_EMULATION should have value n</oval-def:description>
            <oval-def:reference ref_id="kernel_config_ia32_emulation" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_ia32_emulation:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_ia32_emulation_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_ia32_emulation_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_ipv6:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable the IPv6 protocol</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_IPV6 should have value n</oval-def:description>
            <oval-def:reference ref_id="kernel_config_ipv6" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_ipv6:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_ipv6_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_ipv6_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_kexec:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable kexec system call</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_KEXEC should have value n</oval-def:description>
            <oval-def:reference ref_id="kernel_config_kexec" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_kexec:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_kexec_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_kexec_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_legacy_ptys:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable legacy (BSD) PTY support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_LEGACY_PTYS should have value n</oval-def:description>
            <oval-def:reference ref_id="kernel_config_legacy_ptys" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_legacy_ptys:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_legacy_ptys_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_legacy_ptys_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_legacy_vsyscall_emulate:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable vsyscall emulation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_LEGACY_VSYSCALL_EMULATE should have value n</oval-def:description>
            <oval-def:reference ref_id="kernel_config_legacy_vsyscall_emulate" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_legacy_vsyscall_emulate:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_legacy_vsyscall_emulate_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_legacy_vsyscall_emulate_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_legacy_vsyscall_none:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable vsyscall mapping</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_LEGACY_VSYSCALL_NONE should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_legacy_vsyscall_none" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_legacy_vsyscall_none:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_legacy_vsyscall_none_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_legacy_vsyscall_xonly:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable vsyscall emulate execution only</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_LEGACY_VSYSCALL_XONLY should have value n</oval-def:description>
            <oval-def:reference ref_id="kernel_config_legacy_vsyscall_xonly" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_legacy_vsyscall_xonly:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_legacy_vsyscall_xonly_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_legacy_vsyscall_xonly_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_modify_ldt_syscall:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable the LDT (local descriptor table)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_MODIFY_LDT_SYSCALL should have value n</oval-def:description>
            <oval-def:reference ref_id="kernel_config_modify_ldt_syscall" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_modify_ldt_syscall:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_modify_ldt_syscall_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_modify_ldt_syscall_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_module_sig:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable module signature verification</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_MODULE_SIG should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_module_sig" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_module_sig:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_module_sig_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_module_sig_all:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable automatic signing of all modules</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_MODULE_SIG_ALL should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_module_sig_all" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_module_sig_all:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_module_sig_all_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_module_sig_force:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Require modules to be validly signed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_MODULE_SIG_FORCE should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_module_sig_force" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_module_sig_force:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_module_sig_force_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_module_sig_hash:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Specify the hash to use when signing modules</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_MODULE_SIG_HASH should have value according to var_kernel_config_module_sig_hash</oval-def:description>
            <oval-def:reference ref_id="kernel_config_module_sig_hash" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_module_sig_hash:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_module_sig_hash_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_module_sig_key:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Specify module signing key to use</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_MODULE_SIG_KEY should have value according to var_kernel_config_module_sig_key</oval-def:description>
            <oval-def:reference ref_id="kernel_config_module_sig_key" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_module_sig_key:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_module_sig_key_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_module_sig_sha512:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Sign kernel modules with SHA-512</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_MODULE_SIG_SHA512 should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_module_sig_sha512" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_module_sig_sha512:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_module_sig_sha512_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_page_poisoning:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable poison of pages after freeing</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_PAGE_POISONING should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_page_poisoning" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_page_poisoning:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_page_poisoning_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_page_poisoning_no_sanity:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable poison without sanity check</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_PAGE_POISONING_NO_SANITY should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_page_poisoning_no_sanity" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_page_poisoning_no_sanity:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_page_poisoning_no_sanity_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_page_poisoning_zero:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Use zero for poisoning instead of debugging value</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_PAGE_POISONING_ZERO should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_page_poisoning_zero" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_page_poisoning_zero:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_page_poisoning_zero_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_page_table_isolation:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Remove the kernel mapping in user mode</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_PAGE_TABLE_ISOLATION should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_page_table_isolation" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_page_table_isolation:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_page_table_isolation_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_panic_on_oops:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Kernel panic oops</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_PANIC_ON_OOPS should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_panic_on_oops" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_panic_on_oops:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_panic_on_oops_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_panic_timeout:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Kernel panic timeout</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_PANIC_TIMEOUT should have value according to var_kernel_config_panic_timeout</oval-def:description>
            <oval-def:reference ref_id="kernel_config_panic_timeout" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_panic_timeout:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_panic_timeout_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_proc_kcore:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable support for /proc/kkcore</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_PROC_KCORE should have value n</oval-def:description>
            <oval-def:reference ref_id="kernel_config_proc_kcore" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_proc_kcore:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_proc_kcore_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_proc_kcore_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_randomize_base:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Randomize the address of the kernel image (KASLR)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_RANDOMIZE_BASE should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_randomize_base" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_randomize_base:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_randomize_base_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_randomize_memory:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Randomize the kernel memory sections</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_RANDOMIZE_MEMORY should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_randomize_memory" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_randomize_memory:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_randomize_memory_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_refcount_full:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Perform full reference count validation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_REFCOUNT_FULL should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_refcount_full" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_refcount_full:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_refcount_full_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_retpoline:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Avoid speculative indirect branches in kernel</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_RETPOLINE should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_retpoline" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_retpoline:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_retpoline_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_sched_stack_end_check:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Detect stack corruption on calls to schedule()</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_SCHED_STACK_END_CHECK should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_sched_stack_end_check" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_sched_stack_end_check:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_sched_stack_end_check_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_seccomp:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable seccomp to safely compute untrusted bytecode</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_SECCOMP should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_seccomp" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_seccomp:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_seccomp_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_seccomp_filter:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable use of Berkeley Packet Filter with seccomp</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_SECCOMP_FILTER should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_seccomp_filter" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_seccomp_filter:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_seccomp_filter_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_security:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable different security models</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_SECURITY should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_security" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_security:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_security_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_security_dmesg_restrict:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Restrict unprivileged access to the kernel syslog</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_SECURITY_DMESG_RESTRICT should have value n</oval-def:description>
            <oval-def:reference ref_id="kernel_config_security_dmesg_restrict" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_security_dmesg_restrict:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_security_dmesg_restrict_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_security_dmesg_restrict_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_security_writable_hooks:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable mutable hooks</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_SECURITY_WRITABLE_HOOKS should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_security_writable_hooks" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_security_writable_hooks:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_security_writable_hooks_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_security_yama:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable Yama support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_SECURITY_YAMA should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_security_yama" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_security_yama:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_security_yama_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_slab_freelist_hardened:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Harden slab freelist metadata</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_SLAB_FREELIST_HARDENED should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_slab_freelist_hardened" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_slab_freelist_hardened:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_slab_freelist_hardened_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_slab_freelist_random:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Randomize slab freelist</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_SLAB_FRELIST_RANDOM should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_slab_freelist_random" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_slab_frelist_random:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_slab_frelist_random_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_slab_merge_default:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disallow merge of slab caches</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_SLAB_MERGE_DEFAULT should have value n</oval-def:description>
            <oval-def:reference ref_id="kernel_config_slab_merge_default" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_slab_merge_default:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_slab_merge_default_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_slab_merge_default_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_slub_debug:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable SLUB debugging support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_SLUB_DEBUG should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_slub_debug" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_slub_debug:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_slub_debug_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_stackprotector:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Stack Protector buffer overlow detection</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_STACKPROTECTOR should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_stackprotector" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_stackprotector:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_stackprotector_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_stackprotector_strong:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Strong Stack Protector</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_STACKPROTECTOR_STRONG should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_stackprotector_strong" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_stackprotector_strong:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_stackprotector_strong_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_strict_kernel_rwx:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Make the kernel text and rodata read-only</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_STRICT_KERNEL_RWX should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_strict_kernel_rwx" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_strict_kernel_rwx:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_strict_kernel_rwx_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_strict_module_rwx:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Make the module text and rodata read-only</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_STRICT_MODULE_RWX should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_strict_module_rwx" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_strict_module_rwx:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_strict_module_rwx_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_syn_cookies:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable TCP/IP syncookie support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_SYN_COOKIES should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_syn_cookies" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_syn_cookies:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_syn_cookies_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_unmap_kernel_at_el0:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Unmap kernel when running in userspace (aka KAISER)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_UNMAP_KERNEL_AT_EL0 should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_unmap_kernel_at_el0" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_unmap_kernel_at_el0:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_unmap_kernel_at_el0_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_vmap_stack:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>User a virtually-mapped stack</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_VMAP_STACK should have value y</oval-def:description>
            <oval-def:reference ref_id="kernel_config_vmap_stack" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_vmap_stack:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_vmap_stack_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_config_x86_vsyscall_emulation:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable x86 vsyscall emulation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel CONFIG_X86_VSYSCALL_EMULATION should have value n</oval-def:description>
            <oval-def:reference ref_id="kernel_config_x86_vsyscall_emulation" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_x86_vsyscall_emulation:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_x86_vsyscall_emulation_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_x86_vsyscall_emulation_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_atm_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable ATM Support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module atm should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_atm_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_atm_disabled:tst:1" comment="kernel module atm disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_atm_etcmodules-load:tst:1" comment="kernel module atm disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_atm_runmodules-load:tst:1" comment="kernel module atm disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_atm_libmodules-load:tst:1" comment="kernel module atm disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_atm_runmodprobed:tst:1" comment="kernel module atm disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_atm_libmodprobed:tst:1" comment="kernel module atm disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_atm_modprobeconf:tst:1" comment="kernel module atm disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_bluetooth_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Bluetooth Kernel Module</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module bluetooth should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_bluetooth_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_bluetooth_disabled:tst:1" comment="kernel module bluetooth disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_bluetooth_etcmodules-load:tst:1" comment="kernel module bluetooth disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_bluetooth_runmodules-load:tst:1" comment="kernel module bluetooth disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_bluetooth_libmodules-load:tst:1" comment="kernel module bluetooth disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_bluetooth_runmodprobed:tst:1" comment="kernel module bluetooth disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_bluetooth_libmodprobed:tst:1" comment="kernel module bluetooth disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_bluetooth_modprobeconf:tst:1" comment="kernel module bluetooth disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_can_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable CAN Support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module can should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_can_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_can_disabled:tst:1" comment="kernel module can disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_can_etcmodules-load:tst:1" comment="kernel module can disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_can_runmodules-load:tst:1" comment="kernel module can disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_can_libmodules-load:tst:1" comment="kernel module can disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_can_runmodprobed:tst:1" comment="kernel module can disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_can_libmodprobed:tst:1" comment="kernel module can disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_can_modprobeconf:tst:1" comment="kernel module can disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_cfg80211_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel cfg80211 Module</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module cfg80211 should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_cfg80211_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_cfg80211_disabled:tst:1" comment="kernel module cfg80211 disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_cfg80211_etcmodules-load:tst:1" comment="kernel module cfg80211 disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_cfg80211_runmodules-load:tst:1" comment="kernel module cfg80211 disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_cfg80211_libmodules-load:tst:1" comment="kernel module cfg80211 disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_cfg80211_runmodprobed:tst:1" comment="kernel module cfg80211 disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_cfg80211_libmodprobed:tst:1" comment="kernel module cfg80211 disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_cfg80211_modprobeconf:tst:1" comment="kernel module cfg80211 disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_cramfs_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Mounting of cramfs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module cramfs should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_cramfs_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_cramfs_disabled:tst:1" comment="kernel module cramfs disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_cramfs_etcmodules-load:tst:1" comment="kernel module cramfs disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_cramfs_runmodules-load:tst:1" comment="kernel module cramfs disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_cramfs_libmodules-load:tst:1" comment="kernel module cramfs disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_cramfs_runmodprobed:tst:1" comment="kernel module cramfs disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_cramfs_libmodprobed:tst:1" comment="kernel module cramfs disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_cramfs_modprobeconf:tst:1" comment="kernel module cramfs disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_dccp_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable DCCP Support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module dccp should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_dccp_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_dccp_disabled:tst:1" comment="kernel module dccp disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_dccp_etcmodules-load:tst:1" comment="kernel module dccp disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_dccp_runmodules-load:tst:1" comment="kernel module dccp disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_dccp_libmodules-load:tst:1" comment="kernel module dccp disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_dccp_runmodprobed:tst:1" comment="kernel module dccp disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_dccp_libmodprobed:tst:1" comment="kernel module dccp disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_dccp_modprobeconf:tst:1" comment="kernel module dccp disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_firewire-core_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable IEEE 1394 (FireWire) Support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module firewire-core should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_firewire-core_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_firewire-core_disabled:tst:1" comment="kernel module firewire-core disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_firewire-core_etcmodules-load:tst:1" comment="kernel module firewire-core disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_firewire-core_runmodules-load:tst:1" comment="kernel module firewire-core disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_firewire-core_libmodules-load:tst:1" comment="kernel module firewire-core disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_firewire-core_runmodprobed:tst:1" comment="kernel module firewire-core disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_firewire-core_libmodprobed:tst:1" comment="kernel module firewire-core disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_firewire-core_modprobeconf:tst:1" comment="kernel module firewire-core disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_freevxfs_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Mounting of freevxfs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module freevxfs should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_freevxfs_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_freevxfs_disabled:tst:1" comment="kernel module freevxfs disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_freevxfs_etcmodules-load:tst:1" comment="kernel module freevxfs disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_freevxfs_runmodules-load:tst:1" comment="kernel module freevxfs disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_freevxfs_libmodules-load:tst:1" comment="kernel module freevxfs disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_freevxfs_runmodprobed:tst:1" comment="kernel module freevxfs disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_freevxfs_libmodprobed:tst:1" comment="kernel module freevxfs disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_freevxfs_modprobeconf:tst:1" comment="kernel module freevxfs disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_hfs_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Mounting of hfs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module hfs should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_hfs_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfs_disabled:tst:1" comment="kernel module hfs disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfs_etcmodules-load:tst:1" comment="kernel module hfs disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfs_runmodules-load:tst:1" comment="kernel module hfs disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfs_libmodules-load:tst:1" comment="kernel module hfs disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfs_runmodprobed:tst:1" comment="kernel module hfs disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfs_libmodprobed:tst:1" comment="kernel module hfs disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfs_modprobeconf:tst:1" comment="kernel module hfs disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_hfsplus_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Mounting of hfsplus</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module hfsplus should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_hfsplus_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfsplus_disabled:tst:1" comment="kernel module hfsplus disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfsplus_etcmodules-load:tst:1" comment="kernel module hfsplus disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfsplus_runmodules-load:tst:1" comment="kernel module hfsplus disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfsplus_libmodules-load:tst:1" comment="kernel module hfsplus disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfsplus_runmodprobed:tst:1" comment="kernel module hfsplus disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfsplus_libmodprobed:tst:1" comment="kernel module hfsplus disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfsplus_modprobeconf:tst:1" comment="kernel module hfsplus disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_iwlmvm_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel iwlmvm Module</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module iwlmvm should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_iwlmvm_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_iwlmvm_disabled:tst:1" comment="kernel module iwlmvm disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_iwlmvm_etcmodules-load:tst:1" comment="kernel module iwlmvm disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_iwlmvm_runmodules-load:tst:1" comment="kernel module iwlmvm disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_iwlmvm_libmodules-load:tst:1" comment="kernel module iwlmvm disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_iwlmvm_runmodprobed:tst:1" comment="kernel module iwlmvm disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_iwlmvm_libmodprobed:tst:1" comment="kernel module iwlmvm disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_iwlmvm_modprobeconf:tst:1" comment="kernel module iwlmvm disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_iwlwifi_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel iwlwifi Module</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module iwlwifi should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_iwlwifi_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_iwlwifi_disabled:tst:1" comment="kernel module iwlwifi disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_iwlwifi_etcmodules-load:tst:1" comment="kernel module iwlwifi disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_iwlwifi_runmodules-load:tst:1" comment="kernel module iwlwifi disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_iwlwifi_libmodules-load:tst:1" comment="kernel module iwlwifi disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_iwlwifi_runmodprobed:tst:1" comment="kernel module iwlwifi disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_iwlwifi_libmodprobed:tst:1" comment="kernel module iwlwifi disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_iwlwifi_modprobeconf:tst:1" comment="kernel module iwlwifi disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_jffs2_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Mounting of jffs2</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module jffs2 should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_jffs2_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_jffs2_disabled:tst:1" comment="kernel module jffs2 disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_jffs2_etcmodules-load:tst:1" comment="kernel module jffs2 disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_jffs2_runmodules-load:tst:1" comment="kernel module jffs2 disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_jffs2_libmodules-load:tst:1" comment="kernel module jffs2 disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_jffs2_runmodprobed:tst:1" comment="kernel module jffs2 disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_jffs2_libmodprobed:tst:1" comment="kernel module jffs2 disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_jffs2_modprobeconf:tst:1" comment="kernel module jffs2 disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_mac80211_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel mac80211 Module</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module mac80211 should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_mac80211_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_mac80211_disabled:tst:1" comment="kernel module mac80211 disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_mac80211_etcmodules-load:tst:1" comment="kernel module mac80211 disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_mac80211_runmodules-load:tst:1" comment="kernel module mac80211 disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_mac80211_libmodules-load:tst:1" comment="kernel module mac80211 disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_mac80211_runmodprobed:tst:1" comment="kernel module mac80211 disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_mac80211_libmodprobed:tst:1" comment="kernel module mac80211 disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_mac80211_modprobeconf:tst:1" comment="kernel module mac80211 disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_rds_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable RDS Support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module rds should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_rds_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_rds_disabled:tst:1" comment="kernel module rds disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_rds_etcmodules-load:tst:1" comment="kernel module rds disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_rds_runmodules-load:tst:1" comment="kernel module rds disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_rds_libmodules-load:tst:1" comment="kernel module rds disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_rds_runmodprobed:tst:1" comment="kernel module rds disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_rds_libmodprobed:tst:1" comment="kernel module rds disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_rds_modprobeconf:tst:1" comment="kernel module rds disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_squashfs_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Mounting of squashfs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module squashfs should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_squashfs_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_squashfs_disabled:tst:1" comment="kernel module squashfs disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_squashfs_etcmodules-load:tst:1" comment="kernel module squashfs disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_squashfs_runmodules-load:tst:1" comment="kernel module squashfs disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_squashfs_libmodules-load:tst:1" comment="kernel module squashfs disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_squashfs_runmodprobed:tst:1" comment="kernel module squashfs disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_squashfs_libmodprobed:tst:1" comment="kernel module squashfs disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_squashfs_modprobeconf:tst:1" comment="kernel module squashfs disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_tipc_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable TIPC Support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module tipc should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_tipc_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_tipc_disabled:tst:1" comment="kernel module tipc disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_tipc_etcmodules-load:tst:1" comment="kernel module tipc disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_tipc_runmodules-load:tst:1" comment="kernel module tipc disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_tipc_libmodules-load:tst:1" comment="kernel module tipc disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_tipc_runmodprobed:tst:1" comment="kernel module tipc disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_tipc_libmodprobed:tst:1" comment="kernel module tipc disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_tipc_modprobeconf:tst:1" comment="kernel module tipc disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_udf_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Mounting of udf</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module udf should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_udf_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_udf_disabled:tst:1" comment="kernel module udf disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_udf_etcmodules-load:tst:1" comment="kernel module udf disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_udf_runmodules-load:tst:1" comment="kernel module udf disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_udf_libmodules-load:tst:1" comment="kernel module udf disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_udf_runmodprobed:tst:1" comment="kernel module udf disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_udf_libmodprobed:tst:1" comment="kernel module udf disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_udf_modprobeconf:tst:1" comment="kernel module udf disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_usb-storage_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Modprobe Loading of USB Storage Driver</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module usb-storage should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_usb-storage_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_usb-storage_disabled:tst:1" comment="kernel module usb-storage disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_usb-storage_etcmodules-load:tst:1" comment="kernel module usb-storage disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_usb-storage_runmodules-load:tst:1" comment="kernel module usb-storage disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_usb-storage_libmodules-load:tst:1" comment="kernel module usb-storage disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_usb-storage_runmodprobed:tst:1" comment="kernel module usb-storage disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_usb-storage_libmodprobed:tst:1" comment="kernel module usb-storage disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_usb-storage_modprobeconf:tst:1" comment="kernel module usb-storage disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_vfat_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Mounting of vFAT filesystems</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module vfat should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_vfat_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_vfat_disabled:tst:1" comment="kernel module vfat disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_vfat_etcmodules-load:tst:1" comment="kernel module vfat disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_vfat_runmodules-load:tst:1" comment="kernel module vfat disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_vfat_libmodules-load:tst:1" comment="kernel module vfat disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_vfat_runmodprobed:tst:1" comment="kernel module vfat disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_vfat_libmodprobed:tst:1" comment="kernel module vfat disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_vfat_modprobeconf:tst:1" comment="kernel module vfat disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_boot_noauto:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Add noauto Option to /boot</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/boot should be mounted with mount option noauto.</oval-def:description>
            <oval-def:reference ref_id="mount_option_boot_noauto" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="noauto on /boot" test_ref="oval:ssg-test_boot_partition_noauto_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_boot_nodev:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to /boot</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/boot should be mounted with mount option nodev.</oval-def:description>
            <oval-def:reference ref_id="mount_option_boot_nodev" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nodev on /boot" test_ref="oval:ssg-test_boot_partition_nodev_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_boot_noexec:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to /boot</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/boot should be mounted with mount option noexec.</oval-def:description>
            <oval-def:reference ref_id="mount_option_boot_noexec" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="noexec on /boot" test_ref="oval:ssg-test_boot_partition_noexec_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_boot_nosuid:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /boot</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/boot should be mounted with mount option nosuid.</oval-def:description>
            <oval-def:reference ref_id="mount_option_boot_nosuid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nosuid on /boot" test_ref="oval:ssg-test_boot_partition_nosuid_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_dev_shm_nodev:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to /dev/shm</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/dev/shm should be mounted with mount option nodev.</oval-def:description>
            <oval-def:reference ref_id="mount_option_dev_shm_nodev" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nodev on /dev/shm" test_ref="oval:ssg-test_dev_shm_partition_nodev_optional_no:tst:1"/>
            <oval-def:criterion comment="/dev/shm does not exist" test_ref="oval:ssg-test_dev_shm_no_partition_nodev_optional_no:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_dev_shm_noexec:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to /dev/shm</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/dev/shm should be mounted with mount option noexec.</oval-def:description>
            <oval-def:reference ref_id="mount_option_dev_shm_noexec" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="noexec on /dev/shm" test_ref="oval:ssg-test_dev_shm_partition_noexec_optional_no:tst:1"/>
            <oval-def:criterion comment="/dev/shm does not exist" test_ref="oval:ssg-test_dev_shm_no_partition_noexec_optional_no:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_dev_shm_nosuid:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /dev/shm</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/dev/shm should be mounted with mount option nosuid.</oval-def:description>
            <oval-def:reference ref_id="mount_option_dev_shm_nosuid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nosuid on /dev/shm" test_ref="oval:ssg-test_dev_shm_partition_nosuid_optional_no:tst:1"/>
            <oval-def:criterion comment="/dev/shm does not exist" test_ref="oval:ssg-test_dev_shm_no_partition_nosuid_optional_no:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_home_noexec:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to /home</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/home should be mounted with mount option noexec.</oval-def:description>
            <oval-def:reference ref_id="mount_option_home_noexec" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="noexec on /home" test_ref="oval:ssg-test_home_partition_noexec_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_nodev_removable_partitions:def:1" version="5">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to Removable Media Partitions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The nodev option should be enabled for all removable devices mounts in /etc/fstab.</oval-def:description>
            <oval-def:reference ref_id="mount_option_nodev_removable_partitions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="Check if removable partition really exists on the system" definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="Check if removable partition value represents CD/DVD drive" definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criterion test_ref="oval:ssg-test_nodev_etc_fstab_cd_dvd_drive:tst:1" comment="Check if at least one from CD/DVD drive alternative names is using 'nodev' mount option in /etc/fstab"/>
                <oval-def:extend_definition definition_ref="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" comment="Check if CD/DVD drive is not configured to automount in /etc/fstab"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_nodev_etc_fstab_not_cd_dvd_drive:tst:1" comment="Check if removable partition is using 'nodev' mount option in /etc/fstab"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_noexec_removable_partitions:def:1" version="5">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to Removable Media Partitions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The noexec option should be enabled for all removable devices mounts in /etc/fstab.</oval-def:description>
            <oval-def:reference ref_id="mount_option_noexec_removable_partitions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="Check if removable partition really exists on the system" definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="Check if removable partition value represents CD/DVD drive" definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criterion test_ref="oval:ssg-test_noexec_etc_fstab_cd_dvd_drive:tst:1" comment="Check if at least one from CD/DVD drive alternative names is using 'noexec' mount option in /etc/fstab"/>
                <oval-def:extend_definition definition_ref="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" comment="Check if CD/DVD drive is not configured to automount in /etc/fstab"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_noexec_etc_fstab_not_cd_dvd_drive:tst:1" comment="Check if removable partition is using 'noexec' mount option in /etc/fstab"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_nosuid_removable_partitions:def:1" version="5">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to Removable Media Partitions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The nosuid option should be enabled for all removable devices mounts in /etc/fstab.</oval-def:description>
            <oval-def:reference ref_id="mount_option_nosuid_removable_partitions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="Check if removable partition really exists on the system" definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="Check if removable partition value represents CD/DVD drive" definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criterion test_ref="oval:ssg-test_nosuid_etc_fstab_cd_dvd_drive:tst:1" comment="Check if at least one from CD/DVD drive alternative names is using 'nosuid' mount option in /etc/fstab"/>
                <oval-def:extend_definition definition_ref="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" comment="Check if CD/DVD drive is not configured to automount in /etc/fstab"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_nosuid_etc_fstab_not_cd_dvd_drive:tst:1" comment="Check if removable partition is using 'nosuid' mount option in /etc/fstab"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_opt_nosuid:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /opt</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/opt should be mounted with mount option nosuid.</oval-def:description>
            <oval-def:reference ref_id="mount_option_opt_nosuid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nosuid on /opt" test_ref="oval:ssg-test_opt_partition_nosuid_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_proc_hidepid:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Add hidepid Option to /proc</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/proc should be mounted with mount option hidepid.</oval-def:description>
            <oval-def:reference ref_id="mount_option_proc_hidepid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="hidepid on /proc" test_ref="oval:ssg-test_proc_partition_hidepid_optional_no:tst:1"/>
            <oval-def:criterion comment="/proc does not exist" test_ref="oval:ssg-test_proc_no_partition_hidepid_optional_no:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_srv_nosuid:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /srv</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/srv should be mounted with mount option nosuid.</oval-def:description>
            <oval-def:reference ref_id="mount_option_srv_nosuid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nosuid on /srv" test_ref="oval:ssg-test_srv_partition_nosuid_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_tmp_nodev:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to /tmp</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/tmp should be mounted with mount option nodev.</oval-def:description>
            <oval-def:reference ref_id="mount_option_tmp_nodev" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nodev on /tmp" test_ref="oval:ssg-test_tmp_partition_nodev_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_tmp_noexec:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to /tmp</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/tmp should be mounted with mount option noexec.</oval-def:description>
            <oval-def:reference ref_id="mount_option_tmp_noexec" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="noexec on /tmp" test_ref="oval:ssg-test_tmp_partition_noexec_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_tmp_nosuid:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /tmp</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/tmp should be mounted with mount option nosuid.</oval-def:description>
            <oval-def:reference ref_id="mount_option_tmp_nosuid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nosuid on /tmp" test_ref="oval:ssg-test_tmp_partition_nosuid_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_var_log_audit_nodev:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to /var/log/audit</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/var/log/audit should be mounted with mount option nodev.</oval-def:description>
            <oval-def:reference ref_id="mount_option_var_log_audit_nodev" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nodev on /var/log/audit" test_ref="oval:ssg-test_var_log_audit_partition_nodev_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_var_log_audit_noexec:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to /var/log/audit</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/var/log/audit should be mounted with mount option noexec.</oval-def:description>
            <oval-def:reference ref_id="mount_option_var_log_audit_noexec" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="noexec on /var/log/audit" test_ref="oval:ssg-test_var_log_audit_partition_noexec_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_var_log_audit_nosuid:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /var/log/audit</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/var/log/audit should be mounted with mount option nosuid.</oval-def:description>
            <oval-def:reference ref_id="mount_option_var_log_audit_nosuid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nosuid on /var/log/audit" test_ref="oval:ssg-test_var_log_audit_partition_nosuid_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_var_log_nodev:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to /var/log</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/var/log should be mounted with mount option nodev.</oval-def:description>
            <oval-def:reference ref_id="mount_option_var_log_nodev" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nodev on /var/log" test_ref="oval:ssg-test_var_log_partition_nodev_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_var_log_noexec:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to /var/log</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/var/log should be mounted with mount option noexec.</oval-def:description>
            <oval-def:reference ref_id="mount_option_var_log_noexec" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="noexec on /var/log" test_ref="oval:ssg-test_var_log_partition_noexec_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_var_log_nosuid:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /var/log</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/var/log should be mounted with mount option nosuid.</oval-def:description>
            <oval-def:reference ref_id="mount_option_var_log_nosuid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nosuid on /var/log" test_ref="oval:ssg-test_var_log_partition_nosuid_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_var_nodev:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to /var</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/var should be mounted with mount option nodev.</oval-def:description>
            <oval-def:reference ref_id="mount_option_var_nodev" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nodev on /var" test_ref="oval:ssg-test_var_partition_nodev_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_var_noexec:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to /var</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/var should be mounted with mount option noexec.</oval-def:description>
            <oval-def:reference ref_id="mount_option_var_noexec" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="noexec on /var" test_ref="oval:ssg-test_var_partition_noexec_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_var_nosuid:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /var</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/var should be mounted with mount option nosuid.</oval-def:description>
            <oval-def:reference ref_id="mount_option_var_nosuid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nosuid on /var" test_ref="oval:ssg-test_var_partition_nosuid_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_GConf2_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>package_GConf2_installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package GConf2 should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_GConf2_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package GConf2 is installed" test_ref="oval:ssg-test_package_GConf2_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_MFEhiplsm_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install the Host Intrusion Prevention System (HIPS) Module</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package MFEhiplsm should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_MFEhiplsm_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package MFEhiplsm is installed" test_ref="oval:ssg-test_package_MFEhiplsm_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_abrt-addon-ccpp_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall abrt-addon-ccpp Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package abrt-addon-ccpp should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_abrt-addon-ccpp_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package abrt-addon-ccpp is removed" test_ref="oval:ssg-test_package_abrt-addon-ccpp_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_abrt-addon-kerneloops_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall abrt-addon-kerneloops Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package abrt-addon-kerneloops should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_abrt-addon-kerneloops_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package abrt-addon-kerneloops is removed" test_ref="oval:ssg-test_package_abrt-addon-kerneloops_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_abrt-cli_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall abrt-cli Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package abrt-cli should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_abrt-cli_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package abrt-cli is removed" test_ref="oval:ssg-test_package_abrt-cli_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_abrt-plugin-logger_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall abrt-plugin-logger Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package abrt-plugin-logger should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_abrt-plugin-logger_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package abrt-plugin-logger is removed" test_ref="oval:ssg-test_package_abrt-plugin-logger_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_abrt-plugin-rhtsupport_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall abrt-plugin-rhtsupport Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package abrt-plugin-rhtsupport should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_abrt-plugin-rhtsupport_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package abrt-plugin-rhtsupport is removed" test_ref="oval:ssg-test_package_abrt-plugin-rhtsupport_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_abrt-plugin-sosreport_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall abrt-plugin-sosreport Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package abrt-plugin-sosreport should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_abrt-plugin-sosreport_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package abrt-plugin-sosreport is removed" test_ref="oval:ssg-test_package_abrt-plugin-sosreport_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_abrt_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall Automatic Bug Reporting Tool (abrt)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package abrt should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_abrt_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package abrt is removed" test_ref="oval:ssg-test_package_abrt_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_aide_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install AIDE</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package aide should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_aide_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package aide is installed" test_ref="oval:ssg-test_package_aide_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_audispd-plugins_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install audispd-plugins Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package audispd-plugins should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_audispd-plugins_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package audispd-plugins is installed" test_ref="oval:ssg-test_package_audispd-plugins_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_audit-audispd-plugins_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure the default plugins for the audit dispatcher are Installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package audit-audispd-plugins should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_audit-audispd-plugins_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package audit-audispd-plugins is installed" test_ref="oval:ssg-test_package_audit-audispd-plugins_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_audit_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure the audit Subsystem is Installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package audit should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_audit_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package audit is installed" test_ref="oval:ssg-test_package_audit_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_avahi_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>package_avahi_installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package avahi should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_avahi_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package avahi is installed" test_ref="oval:ssg-test_package_avahi_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_bind_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall bind Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package bind should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_bind_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package bind is removed" test_ref="oval:ssg-test_package_bind_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_binutils_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install binutils Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package binutils should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_binutils_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package binutils is installed" test_ref="oval:ssg-test_package_binutils_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_chrony_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>The Chrony package is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package chrony should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_chrony_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package chrony is installed" test_ref="oval:ssg-test_package_chrony_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_cron_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install the cron service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package cron should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_cron_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package cron is installed" test_ref="oval:ssg-test_package_cron_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_cryptsetup-luks_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install cryptsetup-luks Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package cryptsetup-luks should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_cryptsetup-luks_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package cryptsetup-luks is installed" test_ref="oval:ssg-test_package_cryptsetup-luks_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_dconf_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>package_dconf_installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package dconf should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_dconf_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package dconf is installed" test_ref="oval:ssg-test_package_dconf_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_dnf-automatic_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install dnf-automatic Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package dnf-automatic should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_dnf-automatic_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package dnf-automatic is installed" test_ref="oval:ssg-test_package_dnf-automatic_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_esc_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>package_esc_installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package esc should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_esc_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package esc is installed" test_ref="oval:ssg-test_package_esc_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_fapolicyd_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install fapolicyd Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package fapolicyd should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_fapolicyd_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package fapolicyd is installed" test_ref="oval:ssg-test_package_fapolicyd_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_gdm_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>package_gdm_installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package gdm should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_gdm_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package gdm is installed" test_ref="oval:ssg-test_package_gdm_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_gdm_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Remove the GDM Package Group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package gdm should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_gdm_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package gdm is removed" test_ref="oval:ssg-test_package_gdm_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_geolite2-city_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall geolite2-city Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package geolite2-city should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_geolite2-city_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package geolite2-city is removed" test_ref="oval:ssg-test_package_geolite2-city_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_geolite2-country_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall geolite2-country Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package geolite2-country should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_geolite2-country_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package geolite2-country is removed" test_ref="oval:ssg-test_package_geolite2-country_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_gnutls-utils_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure gnutls-utils is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package gnutls-utils should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_gnutls-utils_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package gnutls-utils is installed" test_ref="oval:ssg-test_package_gnutls-utils_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_gssproxy_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall gssproxy Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package gssproxy should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_gssproxy_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package gssproxy is removed" test_ref="oval:ssg-test_package_gssproxy_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_inetutils-telnetd_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall the inet-based telnet server</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package inetutils-telnetd should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_inetutils-telnetd_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package inetutils-telnetd is removed" test_ref="oval:ssg-test_package_inetutils-telnetd_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_iprutils_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall iprutils Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package iprutils should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_iprutils_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package iprutils is removed" test_ref="oval:ssg-test_package_iprutils_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_iptables_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install iptables Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package iptables should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_iptables_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package iptables is installed" test_ref="oval:ssg-test_package_iptables_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_krb5-workstation_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall krb5-workstation Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package krb5-workstation should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_krb5-workstation_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package krb5-workstation is removed" test_ref="oval:ssg-test_package_krb5-workstation_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_libcap-ng-utils_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install libcap-ng-utils Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package libcap-ng-utils should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_libcap-ng-utils_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package libcap-ng-utils is installed" test_ref="oval:ssg-test_package_libcap-ng-utils_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_libreport-plugin-logger_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall libreport-plugin-logger Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package libreport-plugin-logger should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_libreport-plugin-logger_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package libreport-plugin-logger is removed" test_ref="oval:ssg-test_package_libreport-plugin-logger_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_libreport-plugin-rhtsupport_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall libreport-plugin-rhtsupport Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package libreport-plugin-rhtsupport should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_libreport-plugin-rhtsupport_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package libreport-plugin-rhtsupport is removed" test_ref="oval:ssg-test_package_libreport-plugin-rhtsupport_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_libreswan_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install libreswan Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package libreswan should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_libreswan_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package libreswan is installed" test_ref="oval:ssg-test_package_libreswan_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_libselinux_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install libselinux Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package libselinux should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_libselinux_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package libselinux is installed" test_ref="oval:ssg-test_package_libselinux_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_mcstrans_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall mcstrans Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package mcstrans should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_mcstrans_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package mcstrans is removed" test_ref="oval:ssg-test_package_mcstrans_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_net-snmp_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall net-snmp Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package net-snmp should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_net-snmp_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package net-snmp is removed" test_ref="oval:ssg-test_package_net-snmp_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_nfs-utils_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall nfs-utils Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package nfs-utils should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_nfs-utils_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package nfs-utils is removed" test_ref="oval:ssg-test_package_nfs-utils_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_nis_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall the nis package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package nis should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_nis_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package nis is removed" test_ref="oval:ssg-test_package_nis_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_nss-tools_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure nss-tools is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package nss-tools should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_nss-tools_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package nss-tools is installed" test_ref="oval:ssg-test_package_nss-tools_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_ntp_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install the ntp service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package ntp should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_ntp_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package ntp is installed" test_ref="oval:ssg-test_package_ntp_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_ntpdate_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall the ntpdate package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package ntpdate should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_ntpdate_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package ntpdate is removed" test_ref="oval:ssg-test_package_ntpdate_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_openldap-clients_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure LDAP client is not installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package openldap-clients should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_openldap-clients_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package openldap-clients is removed" test_ref="oval:ssg-test_package_openldap-clients_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_opensc_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install the opensc Package For Multifactor Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package opensc should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_opensc_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package opensc is installed" test_ref="oval:ssg-test_package_opensc_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_openscap-scanner_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install openscap-scanner Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package openscap-scanner should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_openscap-scanner_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package openscap-scanner is installed" test_ref="oval:ssg-test_package_openscap-scanner_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_openssh-server_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install the OpenSSH Server Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package openssh-server should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_openssh-server_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package openssh-server is installed" test_ref="oval:ssg-test_package_openssh-server_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_openssh-server_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Remove the OpenSSH Server Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package openssh-server should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_openssh-server_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package openssh-server is removed" test_ref="oval:ssg-test_package_openssh-server_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_pam_ldap_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>package_pam_ldap_removed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package pam_ldap should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_pam_ldap_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package pam_ldap is removed" test_ref="oval:ssg-test_package_pam_ldap_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_pcsc-lite_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install the pcsc-lite package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package pcsc-lite should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_pcsc-lite_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package pcsc-lite is installed" test_ref="oval:ssg-test_package_pcsc-lite_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_policycoreutils_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install policycoreutils Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package policycoreutils should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_policycoreutils_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package policycoreutils is installed" test_ref="oval:ssg-test_package_policycoreutils_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_prelink_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>package_prelink_removed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package prelink should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_prelink_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package prelink is removed" test_ref="oval:ssg-test_package_prelink_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_python3-abrt-addon_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall python3-abrt-addon Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package python3-abrt-addon should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_python3-abrt-addon_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package python3-abrt-addon is removed" test_ref="oval:ssg-test_package_python3-abrt-addon_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_rear_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install rear Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package rear should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_rear_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package rear is installed" test_ref="oval:ssg-test_package_rear_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_rng-tools_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install rng-tools Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package rng-tools should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_rng-tools_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package rng-tools is installed" test_ref="oval:ssg-test_package_rng-tools_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_rsyslog-gnutls_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure rsyslog-gnutls is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package rsyslog-gnutls should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_rsyslog-gnutls_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package rsyslog-gnutls is installed" test_ref="oval:ssg-test_package_rsyslog-gnutls_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_rsyslog_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure rsyslog is Installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package rsyslog should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_rsyslog_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package rsyslog is installed" test_ref="oval:ssg-test_package_rsyslog_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_samba-common_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>package_samba-common_removed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package samba-common should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_samba-common_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package samba-common is removed" test_ref="oval:ssg-test_package_samba-common_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_scap-security-guide_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install scap-security-guide Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package scap-security-guide should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_scap-security-guide_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package scap-security-guide is installed" test_ref="oval:ssg-test_package_scap-security-guide_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_screen_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install the screen Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package screen should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_screen_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package screen is installed" test_ref="oval:ssg-test_package_screen_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_sendmail_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall Sendmail Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package sendmail should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_sendmail_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package sendmail is removed" test_ref="oval:ssg-test_package_sendmail_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_setroubleshoot-plugins_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall setroubleshoot-plugins Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package setroubleshoot-plugins should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_setroubleshoot-plugins_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package setroubleshoot-plugins is removed" test_ref="oval:ssg-test_package_setroubleshoot-plugins_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_setroubleshoot-server_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall setroubleshoot-server Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package setroubleshoot-server should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_setroubleshoot-server_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package setroubleshoot-server is removed" test_ref="oval:ssg-test_package_setroubleshoot-server_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_setroubleshoot_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall setroubleshoot Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package setroubleshoot should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_setroubleshoot_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package setroubleshoot is removed" test_ref="oval:ssg-test_package_setroubleshoot_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_sssd-ipa_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install sssd-ipa Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package sssd-ipa should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_sssd-ipa_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package sssd-ipa is installed" test_ref="oval:ssg-test_package_sssd-ipa_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_sudo_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install sudo Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package sudo should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_sudo_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package sudo is installed" test_ref="oval:ssg-test_package_sudo_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_syslogng_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure syslog-ng is Installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package syslog-ng should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_syslogng_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package syslog-ng is installed" test_ref="oval:ssg-test_package_syslog-ng_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_tar_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install tar Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package tar should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_tar_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package tar is installed" test_ref="oval:ssg-test_package_tar_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_telnetd-ssl_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall the ssl compliant telnet server</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package telnetd-ssl should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_telnetd-ssl_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package telnetd-ssl is removed" test_ref="oval:ssg-test_package_telnetd-ssl_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_telnetd_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall the telnet server</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package telnetd should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_telnetd_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package telnetd is removed" test_ref="oval:ssg-test_package_telnetd_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_tmux_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install the tmux Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package tmux should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_tmux_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package tmux is installed" test_ref="oval:ssg-test_package_tmux_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_tuned_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall tuned Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package tuned should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_tuned_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package tuned is removed" test_ref="oval:ssg-test_package_tuned_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_usbguard_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install usbguard Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package usbguard should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_usbguard_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package usbguard is installed" test_ref="oval:ssg-test_package_usbguard_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_vim_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install vim Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package vim-enhanced should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_vim_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package vim-enhanced is installed" test_ref="oval:ssg-test_package_vim-enhanced_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_vsftpd_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install vsftpd Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package vsftpd should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_vsftpd_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package vsftpd is installed" test_ref="oval:ssg-test_package_vsftpd_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_vsftpd_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall vsftpd Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package vsftpd should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_vsftpd_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package vsftpd is removed" test_ref="oval:ssg-test_package_vsftpd_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_xorg-x11-server-common_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Remove the X Windows Package Group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package xorg-x11-server-common should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_xorg-x11-server-common_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package xorg-x11-server-common is removed" test_ref="oval:ssg-test_package_xorg-x11-server-common_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-partition_for_boot:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure /boot Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
            <oval-def:reference ref_id="partition_for_boot" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-testboot_partition:tst:1" comment="/boot on own partition"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-partition_for_home:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure /home Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
            <oval-def:reference ref_id="partition_for_home" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-testhome_partition:tst:1" comment="/home on own partition"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-partition_for_opt:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure /opt Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
            <oval-def:reference ref_id="partition_for_opt" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-testopt_partition:tst:1" comment="/opt on own partition"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-partition_for_srv:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure /srv Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
            <oval-def:reference ref_id="partition_for_srv" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-testsrv_partition:tst:1" comment="/srv on own partition"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-partition_for_tmp:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure /tmp Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
            <oval-def:reference ref_id="partition_for_tmp" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-testtmp_partition:tst:1" comment="/tmp on own partition"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-partition_for_usr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure /usr Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
            <oval-def:reference ref_id="partition_for_usr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-testusr_partition:tst:1" comment="/usr on own partition"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-partition_for_var:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure /var Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
            <oval-def:reference ref_id="partition_for_var" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-testvar_partition:tst:1" comment="/var on own partition"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-partition_for_var_log:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure /var/log Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
            <oval-def:reference ref_id="partition_for_var_log" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-testvar_log_partition:tst:1" comment="/var/log on own partition"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-partition_for_var_log_audit:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure /var/log/audit Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
            <oval-def:reference ref_id="partition_for_var_log_audit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-testvar_log_audit_partition:tst:1" comment="/var/log/audit on own partition"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-root_permissions_syslibrary_files:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify the system-wide library files in directories
"/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are group-owned by root.</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that FILEPATH is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="root_permissions_syslibrary_files" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /lib/" test_ref="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_0:tst:1"/>
            <oval-def:criterion comment="Check file group ownership of /lib64/" test_ref="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_1:tst:1"/>
            <oval-def:criterion comment="Check file group ownership of /usr/lib/" test_ref="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_2:tst:1"/>
            <oval-def:criterion comment="Check file group ownership of /usr/lib64/" test_ref="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_3:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_atd_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable At Service (atd)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The atd service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_atd_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package at removed or service atd is not configured to start" operator="OR">
            <oval-def:criterion comment="at removed" test_ref="oval:ssg-test_service_atd_package_at_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service atd is not configured to start">
              <oval-def:criterion comment="atd is not running" test_ref="oval:ssg-test_service_not_running_atd:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service atd is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_atd:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_auditd_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable auditd Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The auditd service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_auditd_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package audit installed and service auditd is configured to start" operator="AND">
            <oval-def:criterion comment="audit installed" test_ref="oval:ssg-test_service_auditd_package_audit_installed:tst:1"/>
            <oval-def:criteria comment="service auditd is configured to start and is running" operator="AND">
              <oval-def:criterion comment="auditd is running" test_ref="oval:ssg-test_service_running_auditd:tst:1"/>
              <oval-def:criteria operator="OR" comment="service auditd is configured to start">
                <oval-def:criterion comment="multi-user.target wants auditd" test_ref="oval:ssg-test_multi_user_wants_auditd:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants auditd socket" test_ref="oval:ssg-test_multi_user_wants_auditd_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_autofs_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable the Automounter</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The autofs service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_autofs_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package autofs removed or service autofs is not configured to start" operator="OR">
            <oval-def:criterion comment="autofs removed" test_ref="oval:ssg-test_service_autofs_package_autofs_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service autofs is not configured to start">
              <oval-def:criterion comment="autofs is not running" test_ref="oval:ssg-test_service_not_running_autofs:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service autofs is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_autofs:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_bluetooth_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Bluetooth Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The bluetooth service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_bluetooth_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package bluez removed or service bluetooth is not configured to start" operator="OR">
            <oval-def:criterion comment="bluez removed" test_ref="oval:ssg-test_service_bluetooth_package_bluez_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service bluetooth is not configured to start">
              <oval-def:criterion comment="bluetooth is not running" test_ref="oval:ssg-test_service_not_running_bluetooth:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service bluetooth is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_bluetooth:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_chronyd_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>The Chronyd service is enabled</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The chronyd service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_chronyd_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package chrony installed and service chronyd is configured to start" operator="AND">
            <oval-def:criterion comment="chrony installed" test_ref="oval:ssg-test_service_chronyd_package_chrony_installed:tst:1"/>
            <oval-def:criteria comment="service chronyd is configured to start and is running" operator="AND">
              <oval-def:criterion comment="chronyd is running" test_ref="oval:ssg-test_service_running_chronyd:tst:1"/>
              <oval-def:criteria operator="OR" comment="service chronyd is configured to start">
                <oval-def:criterion comment="multi-user.target wants chronyd" test_ref="oval:ssg-test_multi_user_wants_chronyd:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants chronyd socket" test_ref="oval:ssg-test_multi_user_wants_chronyd_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_cron_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable cron Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The cron service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_cron_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package cron installed and service cron is configured to start" operator="AND">
            <oval-def:criterion comment="cron installed" test_ref="oval:ssg-test_service_cron_package_cron_installed:tst:1"/>
            <oval-def:criteria comment="service cron is configured to start and is running" operator="AND">
              <oval-def:criterion comment="cron is running" test_ref="oval:ssg-test_service_running_cron:tst:1"/>
              <oval-def:criteria operator="OR" comment="service cron is configured to start">
                <oval-def:criterion comment="multi-user.target wants cron" test_ref="oval:ssg-test_multi_user_wants_cron:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants cron socket" test_ref="oval:ssg-test_multi_user_wants_cron_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_crond_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable cron Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The crond service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_crond_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package cronie installed and service crond is configured to start" operator="AND">
            <oval-def:criterion comment="cronie installed" test_ref="oval:ssg-test_service_crond_package_cronie_installed:tst:1"/>
            <oval-def:criteria comment="service crond is configured to start and is running" operator="AND">
              <oval-def:criterion comment="crond is running" test_ref="oval:ssg-test_service_running_crond:tst:1"/>
              <oval-def:criteria operator="OR" comment="service crond is configured to start">
                <oval-def:criterion comment="multi-user.target wants crond" test_ref="oval:ssg-test_multi_user_wants_crond:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants crond socket" test_ref="oval:ssg-test_multi_user_wants_crond_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_debug-shell_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable debug-shell SystemD Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The debug-shell service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_debug-shell_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package systemd removed or service debug-shell is not configured to start" operator="OR">
            <oval-def:criterion comment="systemd removed" test_ref="oval:ssg-test_service_debug-shell_package_systemd_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service debug-shell is not configured to start">
              <oval-def:criterion comment="debug-shell is not running" test_ref="oval:ssg-test_service_not_running_debug-shell:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service debug-shell is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_debug-shell:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_firewalld_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify firewalld Enabled</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The firewalld service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_firewalld_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package firewalld installed and service firewalld is configured to start" operator="AND">
            <oval-def:criterion comment="firewalld installed" test_ref="oval:ssg-test_service_firewalld_package_firewalld_installed:tst:1"/>
            <oval-def:criteria comment="service firewalld is configured to start and is running" operator="AND">
              <oval-def:criterion comment="firewalld is running" test_ref="oval:ssg-test_service_running_firewalld:tst:1"/>
              <oval-def:criteria operator="OR" comment="service firewalld is configured to start">
                <oval-def:criterion comment="multi-user.target wants firewalld" test_ref="oval:ssg-test_multi_user_wants_firewalld:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants firewalld socket" test_ref="oval:ssg-test_multi_user_wants_firewalld_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_ip6tables_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify ip6tables Enabled if Using IPv6</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The ip6tables service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_ip6tables_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package iptables-ipv6 installed and service ip6tables is configured to start" operator="AND">
            <oval-def:criterion comment="iptables-ipv6 installed" test_ref="oval:ssg-test_service_ip6tables_package_iptables-ipv6_installed:tst:1"/>
            <oval-def:criteria comment="service ip6tables is configured to start and is running" operator="AND">
              <oval-def:criterion comment="ip6tables is running" test_ref="oval:ssg-test_service_running_ip6tables:tst:1"/>
              <oval-def:criteria operator="OR" comment="service ip6tables is configured to start">
                <oval-def:criterion comment="multi-user.target wants ip6tables" test_ref="oval:ssg-test_multi_user_wants_ip6tables:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants ip6tables socket" test_ref="oval:ssg-test_multi_user_wants_ip6tables_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_iptables_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify iptables Enabled</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The iptables service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_iptables_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package iptables installed and service iptables is configured to start" operator="AND">
            <oval-def:criterion comment="iptables installed" test_ref="oval:ssg-test_service_iptables_package_iptables_installed:tst:1"/>
            <oval-def:criteria comment="service iptables is configured to start and is running" operator="AND">
              <oval-def:criterion comment="iptables is running" test_ref="oval:ssg-test_service_running_iptables:tst:1"/>
              <oval-def:criteria operator="OR" comment="service iptables is configured to start">
                <oval-def:criterion comment="multi-user.target wants iptables" test_ref="oval:ssg-test_multi_user_wants_iptables:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants iptables socket" test_ref="oval:ssg-test_multi_user_wants_iptables_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_netfs_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Network File Systems (netfs)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The netfs service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_netfs_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package netfs removed or service netfs is not configured to start" operator="OR">
            <oval-def:criterion comment="netfs removed" test_ref="oval:ssg-test_service_netfs_package_netfs_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service netfs is not configured to start">
              <oval-def:criterion comment="netfs is not running" test_ref="oval:ssg-test_service_not_running_netfs:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service netfs is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_netfs:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_nfs_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Network File System (nfs)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The nfs-server service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_nfs_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package nfs-utils removed or service nfs-server is not configured to start" operator="OR">
            <oval-def:criterion comment="nfs-utils removed" test_ref="oval:ssg-test_service_nfs-server_package_nfs-utils_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service nfs-server is not configured to start">
              <oval-def:criterion comment="nfs-server is not running" test_ref="oval:ssg-test_service_not_running_nfs-server:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service nfs-server is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_nfs-server:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_nfslock_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Network File System Lock Service (nfslock)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The nfslock service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_nfslock_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package nfs-utils removed or service nfslock is not configured to start" operator="OR">
            <oval-def:criterion comment="nfs-utils removed" test_ref="oval:ssg-test_service_nfslock_package_nfs-utils_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service nfslock is not configured to start">
              <oval-def:criterion comment="nfslock is not running" test_ref="oval:ssg-test_service_not_running_nfslock:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service nfslock is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_nfslock:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_ntp_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable the NTP Daemon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The ntp service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_ntp_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package ntp installed and service ntp is configured to start" operator="AND">
            <oval-def:criterion comment="ntp installed" test_ref="oval:ssg-test_service_ntp_package_ntp_installed:tst:1"/>
            <oval-def:criteria comment="service ntp is configured to start and is running" operator="AND">
              <oval-def:criterion comment="ntp is running" test_ref="oval:ssg-test_service_running_ntp:tst:1"/>
              <oval-def:criteria operator="OR" comment="service ntp is configured to start">
                <oval-def:criterion comment="multi-user.target wants ntp" test_ref="oval:ssg-test_multi_user_wants_ntp:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants ntp socket" test_ref="oval:ssg-test_multi_user_wants_ntp_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_ntpd_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable the NTP Daemon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The ntpd service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_ntpd_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package ntp installed and service ntpd is configured to start" operator="AND">
            <oval-def:criterion comment="ntp installed" test_ref="oval:ssg-test_service_ntpd_package_ntp_installed:tst:1"/>
            <oval-def:criteria comment="service ntpd is configured to start and is running" operator="AND">
              <oval-def:criterion comment="ntpd is running" test_ref="oval:ssg-test_service_running_ntpd:tst:1"/>
              <oval-def:criteria operator="OR" comment="service ntpd is configured to start">
                <oval-def:criterion comment="multi-user.target wants ntpd" test_ref="oval:ssg-test_multi_user_wants_ntpd:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants ntpd socket" test_ref="oval:ssg-test_multi_user_wants_ntpd_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_pcscd_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable the pcscd Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The pcscd service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_pcscd_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package pcsc-lite installed and service pcscd is configured to start" operator="AND">
            <oval-def:criterion comment="pcsc-lite installed" test_ref="oval:ssg-test_service_pcscd_package_pcsc-lite_installed:tst:1"/>
            <oval-def:criteria comment="service pcscd is configured to start and is running" operator="AND">
              <oval-def:criterion comment="pcscd is running" test_ref="oval:ssg-test_service_running_pcscd:tst:1"/>
              <oval-def:criteria operator="OR" comment="service pcscd is configured to start">
                <oval-def:criterion comment="multi-user.target wants pcscd" test_ref="oval:ssg-test_multi_user_wants_pcscd:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants pcscd socket" test_ref="oval:ssg-test_multi_user_wants_pcscd_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_rngd_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable the Hardware RNG Entropy Gatherer Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The rngd service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_rngd_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package rng-tools installed and service rngd is configured to start" operator="AND">
            <oval-def:criterion comment="rng-tools installed" test_ref="oval:ssg-test_service_rngd_package_rng-tools_installed:tst:1"/>
            <oval-def:criteria comment="service rngd is configured to start and is running" operator="AND">
              <oval-def:criterion comment="rngd is running" test_ref="oval:ssg-test_service_running_rngd:tst:1"/>
              <oval-def:criteria operator="OR" comment="service rngd is configured to start">
                <oval-def:criterion comment="multi-user.target wants rngd" test_ref="oval:ssg-test_multi_user_wants_rngd:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants rngd socket" test_ref="oval:ssg-test_multi_user_wants_rngd_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_rpcgssd_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Secure RPC Client Service (rpcgssd)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The rpcgssd service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_rpcgssd_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package nfs-utils removed or service rpcgssd is not configured to start" operator="OR">
            <oval-def:criterion comment="nfs-utils removed" test_ref="oval:ssg-test_service_rpcgssd_package_nfs-utils_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service rpcgssd is not configured to start">
              <oval-def:criterion comment="rpcgssd is not running" test_ref="oval:ssg-test_service_not_running_rpcgssd:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service rpcgssd is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_rpcgssd:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_rpcidmapd_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable RPC ID Mapping Service (rpcidmapd)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The rpcidmapd service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_rpcidmapd_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package nfs-utils removed or service rpcidmapd is not configured to start" operator="OR">
            <oval-def:criterion comment="nfs-utils removed" test_ref="oval:ssg-test_service_rpcidmapd_package_nfs-utils_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service rpcidmapd is not configured to start">
              <oval-def:criterion comment="rpcidmapd is not running" test_ref="oval:ssg-test_service_not_running_rpcidmapd:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service rpcidmapd is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_rpcidmapd:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_rpcsvcgssd_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Secure RPC Server Service (rpcsvcgssd)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The rpcsvcgssd service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_rpcsvcgssd_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package nfs-utils removed or service rpcsvcgssd is not configured to start" operator="OR">
            <oval-def:criterion comment="nfs-utils removed" test_ref="oval:ssg-test_service_rpcsvcgssd_package_nfs-utils_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service rpcsvcgssd is not configured to start">
              <oval-def:criterion comment="rpcsvcgssd is not running" test_ref="oval:ssg-test_service_not_running_rpcsvcgssd:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service rpcsvcgssd is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_rpcsvcgssd:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_rsyncd_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure rsyncd service is diabled</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The rsyncd service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_rsyncd_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package rsync-daemon removed or service rsyncd is not configured to start" operator="OR">
            <oval-def:criterion comment="rsync-daemon removed" test_ref="oval:ssg-test_service_rsyncd_package_rsync-daemon_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service rsyncd is not configured to start">
              <oval-def:criterion comment="rsyncd is not running" test_ref="oval:ssg-test_service_not_running_rsyncd:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service rsyncd is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_rsyncd:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_rsyslog_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable rsyslog Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The rsyslog service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_rsyslog_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package rsyslog installed and service rsyslog is configured to start" operator="AND">
            <oval-def:criterion comment="rsyslog installed" test_ref="oval:ssg-test_service_rsyslog_package_rsyslog_installed:tst:1"/>
            <oval-def:criteria comment="service rsyslog is configured to start and is running" operator="AND">
              <oval-def:criterion comment="rsyslog is running" test_ref="oval:ssg-test_service_running_rsyslog:tst:1"/>
              <oval-def:criteria operator="OR" comment="service rsyslog is configured to start">
                <oval-def:criterion comment="multi-user.target wants rsyslog" test_ref="oval:ssg-test_multi_user_wants_rsyslog:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants rsyslog socket" test_ref="oval:ssg-test_multi_user_wants_rsyslog_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_sshd_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable SSH Server If Possible (Unusual)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The sshd service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_sshd_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package openssh-server removed or service sshd is not configured to start" operator="OR">
            <oval-def:criterion comment="openssh-server removed" test_ref="oval:ssg-test_service_sshd_package_openssh-server_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service sshd is not configured to start">
              <oval-def:criterion comment="sshd is not running" test_ref="oval:ssg-test_service_not_running_sshd:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service sshd is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_sshd:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_sssd_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>service_sssd_disabled</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The sssd service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_sssd_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package sssd-common removed or service sssd is not configured to start" operator="OR">
            <oval-def:criterion comment="sssd-common removed" test_ref="oval:ssg-test_service_sssd_package_sssd-common_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service sssd is not configured to start">
              <oval-def:criterion comment="sssd is not running" test_ref="oval:ssg-test_service_not_running_sssd:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service sssd is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_sssd:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_syslog_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>service_syslog_disabled</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The syslog service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_syslog_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package rsyslog removed or service syslog is not configured to start" operator="OR">
            <oval-def:criterion comment="rsyslog removed" test_ref="oval:ssg-test_service_syslog_package_rsyslog_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service syslog is not configured to start">
              <oval-def:criterion comment="syslog is not running" test_ref="oval:ssg-test_service_not_running_syslog:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service syslog is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_syslog:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_syslogng_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable syslog-ng Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The syslog-ng service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_syslogng_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package syslog-ng installed and service syslog-ng is configured to start" operator="AND">
            <oval-def:criterion comment="syslog-ng installed" test_ref="oval:ssg-test_service_syslog-ng_package_syslog-ng_installed:tst:1"/>
            <oval-def:criteria comment="service syslog-ng is configured to start and is running" operator="AND">
              <oval-def:criterion comment="syslog-ng is running" test_ref="oval:ssg-test_service_running_syslog-ng:tst:1"/>
              <oval-def:criteria operator="OR" comment="service syslog-ng is configured to start">
                <oval-def:criterion comment="multi-user.target wants syslog-ng" test_ref="oval:ssg-test_multi_user_wants_syslog-ng:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants syslog-ng socket" test_ref="oval:ssg-test_multi_user_wants_syslog-ng_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_systemd-coredump_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable acquiring, saving, and processing core dumps</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The systemd-coredump service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_systemd-coredump_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package systemd removed or service systemd-coredump is not configured to start" operator="OR">
            <oval-def:criterion comment="systemd removed" test_ref="oval:ssg-test_service_systemd-coredump_package_systemd_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service systemd-coredump is not configured to start">
              <oval-def:criterion comment="systemd-coredump is not running" test_ref="oval:ssg-test_service_not_running_systemd-coredump:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service systemd-coredump is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_systemd-coredump:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_usbguard_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable the USBGuard Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The usbguard service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_usbguard_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package usbguard installed and service usbguard is configured to start" operator="AND">
            <oval-def:criterion comment="usbguard installed" test_ref="oval:ssg-test_service_usbguard_package_usbguard_installed:tst:1"/>
            <oval-def:criteria comment="service usbguard is configured to start and is running" operator="AND">
              <oval-def:criterion comment="usbguard is running" test_ref="oval:ssg-test_service_running_usbguard:tst:1"/>
              <oval-def:criteria operator="OR" comment="service usbguard is configured to start">
                <oval-def:criterion comment="multi-user.target wants usbguard" test_ref="oval:ssg-test_multi_user_wants_usbguard:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants usbguard socket" test_ref="oval:ssg-test_multi_user_wants_usbguard_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_disable_empty_passwords:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable SSH Access via Empty Passwords</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'PermitEmptyPasswords' is configured with value 'no' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_disable_empty_passwords" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the PermitEmptyPasswords in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_empty_passwords:tst:1"/>
                <oval-def:criterion comment="Check the PermitEmptyPasswords in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_empty_passwords_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_disable_gssapi_auth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable GSSAPI Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'GSSAPIAuthentication' is configured with value 'no' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_disable_gssapi_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the GSSAPIAuthentication in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_gssapi_auth:tst:1"/>
                <oval-def:criterion comment="Check the GSSAPIAuthentication in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_gssapi_auth_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_disable_kerb_auth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Kerberos Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'KerberosAuthentication' is configured with value 'no' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_disable_kerb_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the KerberosAuthentication in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_kerb_auth:tst:1"/>
                <oval-def:criterion comment="Check the KerberosAuthentication in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_kerb_auth_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_disable_pubkey_auth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable PubkeyAuthentication Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'PubkeyAuthentication' is configured with value 'no' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_disable_pubkey_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the PubkeyAuthentication in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_pubkey_auth:tst:1"/>
                <oval-def:criterion comment="Check the PubkeyAuthentication in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_pubkey_auth_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_disable_rhosts:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable SSH Support for .rhosts Files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'IgnoreRhosts' is configured with value 'yes' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_disable_rhosts" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the IgnoreRhosts in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_rhosts:tst:1"/>
                <oval-def:criterion comment="Check the IgnoreRhosts in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_rhosts_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_disable_root_login:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable SSH Root Login</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'PermitRootLogin' is configured with value 'no' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_disable_root_login" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the PermitRootLogin in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_root_login:tst:1"/>
                <oval-def:criterion comment="Check the PermitRootLogin in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_root_login_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_disable_root_password_login:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable SSH root Login with a Password (Insecure)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'PermitRootLogin' is configured with value 'prohibit-password' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_disable_root_password_login" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the PermitRootLogin in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_root_password_login:tst:1"/>
                <oval-def:criterion comment="Check the PermitRootLogin in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_root_password_login_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_disable_tcp_forwarding:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable SSH TCP Forwarding</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'AllowTcpForwarding' is configured with value 'no' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_disable_tcp_forwarding" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the AllowTcpForwarding in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_tcp_forwarding:tst:1"/>
                <oval-def:criterion comment="Check the AllowTcpForwarding in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_tcp_forwarding_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_disable_user_known_hosts:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable SSH Support for User Known Hosts</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'IgnoreUserKnownHosts' is configured with value 'yes' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_disable_user_known_hosts" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the IgnoreUserKnownHosts in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_user_known_hosts:tst:1"/>
                <oval-def:criterion comment="Check the IgnoreUserKnownHosts in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_user_known_hosts_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_disable_x11_forwarding:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable X11 Forwarding</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'X11Forwarding' is configured with value 'no' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_disable_x11_forwarding" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the X11Forwarding in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_x11_forwarding:tst:1"/>
                <oval-def:criterion comment="Check the X11Forwarding in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_x11_forwarding_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_do_not_permit_user_env:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Do Not Allow SSH Environment Options</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'PermitUserEnvironment' is configured with value 'no' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_do_not_permit_user_env" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the PermitUserEnvironment in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_do_not_permit_user_env:tst:1"/>
                <oval-def:criterion comment="Check the PermitUserEnvironment in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_do_not_permit_user_env_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_enable_gssapi_auth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable GSSAPI Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'GSSAPIAuthentication' is configured with value 'yes' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_enable_gssapi_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the GSSAPIAuthentication in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_enable_gssapi_auth:tst:1"/>
                <oval-def:criterion comment="Check the GSSAPIAuthentication in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_enable_gssapi_auth_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_enable_pam:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable PAM</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'UsePAM' is configured with value 'yes' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_enable_pam" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the UsePAM in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_enable_pam:tst:1"/>
                <oval-def:criterion comment="Check the UsePAM in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_enable_pam_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_enable_pubkey_auth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable Public Key Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'PubkeyAuthentication' is configured with value 'yes' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_enable_pubkey_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the PubkeyAuthentication in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_enable_pubkey_auth:tst:1"/>
                <oval-def:criterion comment="Check the PubkeyAuthentication in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_enable_pubkey_auth_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_enable_strictmodes:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable Use of Strict Mode Checking</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'StrictModes' is configured with value 'yes' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_enable_strictmodes" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the StrictModes in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_enable_strictmodes:tst:1"/>
                <oval-def:criterion comment="Check the StrictModes in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_enable_strictmodes_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_enable_warning_banner:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable SSH Warning Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'Banner' is configured with value '/etc/issue' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_enable_warning_banner" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the Banner in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_enable_warning_banner:tst:1"/>
                <oval-def:criterion comment="Check the Banner in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_enable_warning_banner_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_enable_warning_banner_net:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable SSH Warning Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'Banner' is configured with value '/etc/issue.net' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_enable_warning_banner_net" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the Banner in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_enable_warning_banner_net:tst:1"/>
                <oval-def:criterion comment="Check the Banner in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_enable_warning_banner_net_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_enable_x11_forwarding:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable Encrypted X11 Forwarding</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'X11Forwarding' is configured with value 'yes' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_enable_x11_forwarding" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the X11Forwarding in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_enable_x11_forwarding:tst:1"/>
                <oval-def:criterion comment="Check the X11Forwarding in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_enable_x11_forwarding_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_includes_config_files:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>sshd_includes_config_files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check presence of Include /etc/ssh/sshd_config.d/*.conf in /etc/ssh/sshd_config</oval-def:description>
            <oval-def:reference ref_id="sshd_includes_config_files" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Test conditions - presence of the file plus 0 extra definitions.">
            <oval-def:criterion comment="Check that /etc/ssh/sshd_config contains a line with certain text" test_ref="oval:ssg-test_sshd_includes_config_files:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_print_last_log:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable SSH Print Last Log</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'PrintLastLog' is configured with value 'yes' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_print_last_log" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the PrintLastLog in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_print_last_log:tst:1"/>
                <oval-def:criterion comment="Check the PrintLastLog in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_print_last_log_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_set_keepalive_0:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set SSH Client Alive Count Max to zero</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'ClientAliveCountMax' is configured with value '0' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_set_keepalive_0" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the ClientAliveCountMax in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_set_keepalive_0:tst:1"/>
                <oval-def:criterion comment="Check the ClientAliveCountMax in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_set_keepalive_0_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_set_loglevel_info:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set LogLevel to INFO</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'LogLevel' is configured with value 'INFO' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_set_loglevel_info" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the LogLevel in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_set_loglevel_info:tst:1"/>
                <oval-def:criterion comment="Check the LogLevel in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_set_loglevel_info_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_set_loglevel_verbose:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set SSH Daemon LogLevel to VERBOSE</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'LogLevel' is configured with value 'VERBOSE' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_set_loglevel_verbose" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the LogLevel in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_set_loglevel_verbose:tst:1"/>
                <oval-def:criterion comment="Check the LogLevel in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_set_loglevel_verbose_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_x11_use_localhost:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Prevent remote hosts from connecting to the proxy display</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'X11UseLocalhost' is configured with value 'yes' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_x11_use_localhost" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the X11UseLocalhost in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_x11_use_localhost:tst:1"/>
                <oval-def:criterion comment="Check the X11UseLocalhost in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_x11_use_localhost_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sssd_enable_certmap:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable Certmap in SSSD</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check presence of ^\[certmap\/.+\/.+\]$ in /etc/sssd/sssd.conf</oval-def:description>
            <oval-def:reference ref_id="sssd_enable_certmap" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Test conditions - presence of the file plus 0 extra definitions.">
            <oval-def:criterion comment="Check that /etc/sssd/sssd.conf contains a line with certain text" test_ref="oval:ssg-test_sssd_enable_certmap:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudo_add_noexec:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks sudoers Defaults {{ OPTION }} configuration</oval-def:description>
            <oval-def:reference ref_id="sudo_add_noexec" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="noexec is configured in /etc/sudoers or /etc/sudoers.d/" test_ref="oval:ssg-test_noexec_sudoers:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudo_add_requiretty:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo requiretty</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks sudoers Defaults {{ OPTION }} configuration</oval-def:description>
            <oval-def:reference ref_id="sudo_add_requiretty" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="requiretty is configured in /etc/sudoers or /etc/sudoers.d/" test_ref="oval:ssg-test_requiretty_sudoers:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudo_add_use_pty:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks sudoers Defaults {{ OPTION }} configuration</oval-def:description>
            <oval-def:reference ref_id="sudo_add_use_pty" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="use_pty is configured in /etc/sudoers or /etc/sudoers.d/" test_ref="oval:ssg-test_use_pty_sudoers:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudo_custom_logfile:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Sudo Logfile Exists - sudo logfile</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks sudoers Defaults {{ OPTION }} configuration</oval-def:description>
            <oval-def:reference ref_id="sudo_custom_logfile" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="logfile is configured in /etc/sudoers or /etc/sudoers.d/" test_ref="oval:ssg-test_logfile_sudoers:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_fs_protected_fifos:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on FIFOs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'fs.protected_fifos' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_fs_protected_fifos" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="fs.protected_fifos configuration setting check" definition_ref="oval:ssg-sysctl_static_fs_protected_fifos:def:1"/>
            <oval-def:extend_definition comment="fs.protected_fifos runtime setting check" definition_ref="oval:ssg-sysctl_runtime_fs_protected_fifos:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_fs_protected_fifos:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on FIFOs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'fs.protected_fifos' parameter should be set to 2 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_fs_protected_fifos" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter fs.protected_fifos set to 2" test_ref="oval:ssg-test_sysctl_runtime_fs_protected_fifos:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_fs_protected_fifos:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on FIFOs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'fs.protected_fifos' parameter should be set to 2 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_fs_protected_fifos" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter fs.protected_fifos set to 2 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_fs_protected_fifos:tst:1"/>
              <oval-def:criterion comment="kernel static parameter fs.protected_fifos set to 2 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_fifos:tst:1"/>
              <oval-def:criterion comment="kernel static parameter fs.protected_fifos set to 2 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_fs_protected_fifos:tst:1"/>
              <oval-def:criterion comment="kernel static parameter fs.protected_fifos set to 2 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_fifos:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that fs_protected_fifos is defined in only one file" test_ref="oval:ssg-test_sysctl_fs_protected_fifos_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_fs_protected_hardlinks:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on Hardlinks</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'fs.protected_hardlinks' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_fs_protected_hardlinks" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="fs.protected_hardlinks configuration setting check" definition_ref="oval:ssg-sysctl_static_fs_protected_hardlinks:def:1"/>
            <oval-def:extend_definition comment="fs.protected_hardlinks runtime setting check" definition_ref="oval:ssg-sysctl_runtime_fs_protected_hardlinks:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_fs_protected_hardlinks:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on Hardlinks</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'fs.protected_hardlinks' parameter should be set to 1 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_fs_protected_hardlinks" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter fs.protected_hardlinks set to 1" test_ref="oval:ssg-test_sysctl_runtime_fs_protected_hardlinks:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_fs_protected_hardlinks:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on Hardlinks</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'fs.protected_hardlinks' parameter should be set to 1 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_fs_protected_hardlinks" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_fs_protected_hardlinks:tst:1"/>
              <oval-def:criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_hardlinks:tst:1"/>
              <oval-def:criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_fs_protected_hardlinks:tst:1"/>
              <oval-def:criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_hardlinks:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that fs_protected_hardlinks is defined in only one file" test_ref="oval:ssg-test_sysctl_fs_protected_hardlinks_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_fs_protected_regular:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on Regular files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'fs.protected_regular' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_fs_protected_regular" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="fs.protected_regular configuration setting check" definition_ref="oval:ssg-sysctl_static_fs_protected_regular:def:1"/>
            <oval-def:extend_definition comment="fs.protected_regular runtime setting check" definition_ref="oval:ssg-sysctl_runtime_fs_protected_regular:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_fs_protected_regular:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on Regular files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'fs.protected_regular' parameter should be set to 2 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_fs_protected_regular" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter fs.protected_regular set to 2" test_ref="oval:ssg-test_sysctl_runtime_fs_protected_regular:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_fs_protected_regular:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on Regular files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'fs.protected_regular' parameter should be set to 2 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_fs_protected_regular" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter fs.protected_regular set to 2 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_fs_protected_regular:tst:1"/>
              <oval-def:criterion comment="kernel static parameter fs.protected_regular set to 2 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_regular:tst:1"/>
              <oval-def:criterion comment="kernel static parameter fs.protected_regular set to 2 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_fs_protected_regular:tst:1"/>
              <oval-def:criterion comment="kernel static parameter fs.protected_regular set to 2 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_regular:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that fs_protected_regular is defined in only one file" test_ref="oval:ssg-test_sysctl_fs_protected_regular_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_fs_protected_symlinks:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on Symlinks</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'fs.protected_symlinks' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_fs_protected_symlinks" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="fs.protected_symlinks configuration setting check" definition_ref="oval:ssg-sysctl_static_fs_protected_symlinks:def:1"/>
            <oval-def:extend_definition comment="fs.protected_symlinks runtime setting check" definition_ref="oval:ssg-sysctl_runtime_fs_protected_symlinks:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_fs_protected_symlinks:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on Symlinks</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'fs.protected_symlinks' parameter should be set to 1 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_fs_protected_symlinks" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter fs.protected_symlinks set to 1" test_ref="oval:ssg-test_sysctl_runtime_fs_protected_symlinks:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_fs_protected_symlinks:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on Symlinks</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'fs.protected_symlinks' parameter should be set to 1 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_fs_protected_symlinks" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter fs.protected_symlinks set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_fs_protected_symlinks:tst:1"/>
              <oval-def:criterion comment="kernel static parameter fs.protected_symlinks set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_symlinks:tst:1"/>
              <oval-def:criterion comment="kernel static parameter fs.protected_symlinks set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_fs_protected_symlinks:tst:1"/>
              <oval-def:criterion comment="kernel static parameter fs.protected_symlinks set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_symlinks:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that fs_protected_symlinks is defined in only one file" test_ref="oval:ssg-test_sysctl_fs_protected_symlinks_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_fs_suid_dumpable:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Core Dumps for SUID programs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'fs.suid_dumpable' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_fs_suid_dumpable" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="fs.suid_dumpable configuration setting check" definition_ref="oval:ssg-sysctl_static_fs_suid_dumpable:def:1"/>
            <oval-def:extend_definition comment="fs.suid_dumpable runtime setting check" definition_ref="oval:ssg-sysctl_runtime_fs_suid_dumpable:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_fs_suid_dumpable:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Core Dumps for SUID programs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'fs.suid_dumpable' parameter should be set to 0 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_fs_suid_dumpable" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter fs.suid_dumpable set to 0" test_ref="oval:ssg-test_sysctl_runtime_fs_suid_dumpable:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_fs_suid_dumpable:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Core Dumps for SUID programs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'fs.suid_dumpable' parameter should be set to 0 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_fs_suid_dumpable" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_fs_suid_dumpable:tst:1"/>
              <oval-def:criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_fs_suid_dumpable:tst:1"/>
              <oval-def:criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_fs_suid_dumpable:tst:1"/>
              <oval-def:criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_suid_dumpable:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that fs_suid_dumpable is defined in only one file" test_ref="oval:ssg-test_sysctl_fs_suid_dumpable_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_core_pattern:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable storing core dumps</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.core_pattern' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_core_pattern" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.core_pattern configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_core_pattern:def:1"/>
            <oval-def:extend_definition comment="kernel.core_pattern runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_core_pattern:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_core_pattern:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable storing core dumps</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.core_pattern' parameter should be set to |/bin/false in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_core_pattern" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.core_pattern set to |/bin/false" test_ref="oval:ssg-test_sysctl_runtime_kernel_core_pattern:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_core_pattern:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable storing core dumps</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.core_pattern' parameter should be set to |/bin/false in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_core_pattern" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter kernel.core_pattern set to |/bin/false in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_core_pattern:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.core_pattern set to |/bin/false in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_core_pattern:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.core_pattern set to |/bin/false in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_core_pattern:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.core_pattern set to |/bin/false in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_core_pattern:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that kernel_core_pattern is defined in only one file" test_ref="oval:ssg-test_sysctl_kernel_core_pattern_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_dmesg_restrict:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Restrict Access to Kernel Message Buffer</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.dmesg_restrict' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_dmesg_restrict" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.dmesg_restrict configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_dmesg_restrict:def:1"/>
            <oval-def:extend_definition comment="kernel.dmesg_restrict runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_dmesg_restrict:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_dmesg_restrict:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Restrict Access to Kernel Message Buffer</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.dmesg_restrict' parameter should be set to 1 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_dmesg_restrict" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.dmesg_restrict set to 1" test_ref="oval:ssg-test_sysctl_runtime_kernel_dmesg_restrict:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_dmesg_restrict:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Restrict Access to Kernel Message Buffer</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.dmesg_restrict' parameter should be set to 1 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_dmesg_restrict" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_dmesg_restrict:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_dmesg_restrict:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_dmesg_restrict:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_dmesg_restrict:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that kernel_dmesg_restrict is defined in only one file" test_ref="oval:ssg-test_sysctl_kernel_dmesg_restrict_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_kexec_load_disabled:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Image Loading</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.kexec_load_disabled' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_kexec_load_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.kexec_load_disabled configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_kexec_load_disabled:def:1"/>
            <oval-def:extend_definition comment="kernel.kexec_load_disabled runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_kexec_load_disabled:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_kexec_load_disabled:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Image Loading</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.kexec_load_disabled' parameter should be set to 1 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_kexec_load_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.kexec_load_disabled set to 1" test_ref="oval:ssg-test_sysctl_runtime_kernel_kexec_load_disabled:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_kexec_load_disabled:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Image Loading</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.kexec_load_disabled' parameter should be set to 1 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_kexec_load_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter kernel.kexec_load_disabled set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_kexec_load_disabled:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.kexec_load_disabled set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_kexec_load_disabled:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.kexec_load_disabled set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_kexec_load_disabled:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.kexec_load_disabled set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_kexec_load_disabled:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that kernel_kexec_load_disabled is defined in only one file" test_ref="oval:ssg-test_sysctl_kernel_kexec_load_disabled_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_kptr_restrict:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Restrict Exposed Kernel Pointer Addresses Access</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.kptr_restrict' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_kptr_restrict" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.kptr_restrict configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_kptr_restrict:def:1"/>
            <oval-def:extend_definition comment="kernel.kptr_restrict runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_kptr_restrict:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_kptr_restrict:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Restrict Exposed Kernel Pointer Addresses Access</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.kptr_restrict' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_kptr_restrict" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.kptr_restrict set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_kernel_kptr_restrict:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_kptr_restrict:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Restrict Exposed Kernel Pointer Addresses Access</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.kptr_restrict' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_kptr_restrict" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter kernel.kptr_restrict set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_kptr_restrict:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.kptr_restrict set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_kptr_restrict:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.kptr_restrict set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_kptr_restrict:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.kptr_restrict set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_kptr_restrict:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that kernel_kptr_restrict is defined in only one file" test_ref="oval:ssg-test_sysctl_kernel_kptr_restrict_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_modules_disabled:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable loading and unloading of kernel modules</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.modules_disabled' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_modules_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.modules_disabled configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_modules_disabled:def:1"/>
            <oval-def:extend_definition comment="kernel.modules_disabled runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_modules_disabled:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_modules_disabled:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable loading and unloading of kernel modules</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.modules_disabled' parameter should be set to 1 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_modules_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.modules_disabled set to 1" test_ref="oval:ssg-test_sysctl_runtime_kernel_modules_disabled:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_modules_disabled:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable loading and unloading of kernel modules</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.modules_disabled' parameter should be set to 1 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_modules_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter kernel.modules_disabled set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_modules_disabled:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.modules_disabled set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_modules_disabled:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.modules_disabled set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_modules_disabled:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.modules_disabled set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_modules_disabled:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that kernel_modules_disabled is defined in only one file" test_ref="oval:ssg-test_sysctl_kernel_modules_disabled_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_panic_on_oops:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Kernel panic on oops</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.panic_on_oops' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_panic_on_oops" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.panic_on_oops configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_panic_on_oops:def:1"/>
            <oval-def:extend_definition comment="kernel.panic_on_oops runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_panic_on_oops:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_panic_on_oops:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Kernel panic on oops</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.panic_on_oops' parameter should be set to 1 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_panic_on_oops" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.panic_on_oops set to 1" test_ref="oval:ssg-test_sysctl_runtime_kernel_panic_on_oops:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_panic_on_oops:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Kernel panic on oops</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.panic_on_oops' parameter should be set to 1 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_panic_on_oops" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter kernel.panic_on_oops set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_panic_on_oops:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.panic_on_oops set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_panic_on_oops:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.panic_on_oops set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_panic_on_oops:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.panic_on_oops set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_panic_on_oops:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that kernel_panic_on_oops is defined in only one file" test_ref="oval:ssg-test_sysctl_kernel_panic_on_oops_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_perf_cpu_time_max_percent:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Limit CPU consumption of the Perf system</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.perf_cpu_time_max_percent' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_perf_cpu_time_max_percent" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.perf_cpu_time_max_percent configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_perf_cpu_time_max_percent:def:1"/>
            <oval-def:extend_definition comment="kernel.perf_cpu_time_max_percent runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_perf_cpu_time_max_percent:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_perf_cpu_time_max_percent:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Limit CPU consumption of the Perf system</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.perf_cpu_time_max_percent' parameter should be set to 1 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_perf_cpu_time_max_percent" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.perf_cpu_time_max_percent set to 1" test_ref="oval:ssg-test_sysctl_runtime_kernel_perf_cpu_time_max_percent:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_perf_cpu_time_max_percent:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Limit CPU consumption of the Perf system</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.perf_cpu_time_max_percent' parameter should be set to 1 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_perf_cpu_time_max_percent" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_perf_cpu_time_max_percent:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_cpu_time_max_percent:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_cpu_time_max_percent:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that kernel_perf_cpu_time_max_percent is defined in only one file" test_ref="oval:ssg-test_sysctl_kernel_perf_cpu_time_max_percent_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_perf_event_max_sample_rate:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Limit sampling frequency of the Perf system</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.perf_event_max_sample_rate' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_perf_event_max_sample_rate" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.perf_event_max_sample_rate configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_perf_event_max_sample_rate:def:1"/>
            <oval-def:extend_definition comment="kernel.perf_event_max_sample_rate runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_perf_event_max_sample_rate:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_perf_event_max_sample_rate:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Limit sampling frequency of the Perf system</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.perf_event_max_sample_rate' parameter should be set to 1 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_perf_event_max_sample_rate" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.perf_event_max_sample_rate set to 1" test_ref="oval:ssg-test_sysctl_runtime_kernel_perf_event_max_sample_rate:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_perf_event_max_sample_rate:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Limit sampling frequency of the Perf system</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.perf_event_max_sample_rate' parameter should be set to 1 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_perf_event_max_sample_rate" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_perf_event_max_sample_rate:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_event_max_sample_rate:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_event_max_sample_rate:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that kernel_perf_event_max_sample_rate is defined in only one file" test_ref="oval:ssg-test_sysctl_kernel_perf_event_max_sample_rate_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_perf_event_paranoid:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disallow kernel profiling by unprivileged users</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.perf_event_paranoid' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_perf_event_paranoid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.perf_event_paranoid configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_perf_event_paranoid:def:1"/>
            <oval-def:extend_definition comment="kernel.perf_event_paranoid runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_perf_event_paranoid:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_perf_event_paranoid:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disallow kernel profiling by unprivileged users</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.perf_event_paranoid' parameter should be set to 2 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_perf_event_paranoid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.perf_event_paranoid set to 2" test_ref="oval:ssg-test_sysctl_runtime_kernel_perf_event_paranoid:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_perf_event_paranoid:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disallow kernel profiling by unprivileged users</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.perf_event_paranoid' parameter should be set to 2 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_perf_event_paranoid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_perf_event_paranoid:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_event_paranoid:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_event_paranoid:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_paranoid:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that kernel_perf_event_paranoid is defined in only one file" test_ref="oval:ssg-test_sysctl_kernel_perf_event_paranoid_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_pid_max:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure maximum number of process identifiers</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.pid_max' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_pid_max" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.pid_max configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_pid_max:def:1"/>
            <oval-def:extend_definition comment="kernel.pid_max runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_pid_max:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_pid_max:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure maximum number of process identifiers</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.pid_max' parameter should be set to 65536 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_pid_max" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.pid_max set to 65536" test_ref="oval:ssg-test_sysctl_runtime_kernel_pid_max:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_pid_max:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure maximum number of process identifiers</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.pid_max' parameter should be set to 65536 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_pid_max" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter kernel.pid_max set to 65536 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_pid_max:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.pid_max set to 65536 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_pid_max:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.pid_max set to 65536 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_pid_max:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.pid_max set to 65536 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_pid_max:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that kernel_pid_max is defined in only one file" test_ref="oval:ssg-test_sysctl_kernel_pid_max_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_randomize_va_space:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Randomized Layout of Virtual Address Space</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.randomize_va_space' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_randomize_va_space" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.randomize_va_space configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_randomize_va_space:def:1"/>
            <oval-def:extend_definition comment="kernel.randomize_va_space runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_randomize_va_space:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_randomize_va_space:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Randomized Layout of Virtual Address Space</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.randomize_va_space' parameter should be set to 2 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_randomize_va_space" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.randomize_va_space set to 2" test_ref="oval:ssg-test_sysctl_runtime_kernel_randomize_va_space:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_randomize_va_space:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Randomized Layout of Virtual Address Space</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.randomize_va_space' parameter should be set to 2 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_randomize_va_space" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_randomize_va_space:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_randomize_va_space:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_randomize_va_space:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_randomize_va_space:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that kernel_randomize_va_space is defined in only one file" test_ref="oval:ssg-test_sysctl_kernel_randomize_va_space_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_sysrq:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disallow magic SysRq key</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.sysrq' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_sysrq" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.sysrq configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_sysrq:def:1"/>
            <oval-def:extend_definition comment="kernel.sysrq runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_sysrq:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_sysrq:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disallow magic SysRq key</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.sysrq' parameter should be set to 0 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_sysrq" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.sysrq set to 0" test_ref="oval:ssg-test_sysctl_runtime_kernel_sysrq:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_sysrq:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disallow magic SysRq key</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.sysrq' parameter should be set to 0 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_sysrq" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter kernel.sysrq set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_sysrq:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.sysrq set to 0 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_sysrq:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.sysrq set to 0 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_sysrq:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.sysrq set to 0 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_sysrq:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that kernel_sysrq is defined in only one file" test_ref="oval:ssg-test_sysctl_kernel_sysrq_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_unprivileged_bpf_disabled:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Access to Network bpf() Syscall From Unprivileged Processes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.unprivileged_bpf_disabled' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_unprivileged_bpf_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.unprivileged_bpf_disabled configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_unprivileged_bpf_disabled:def:1"/>
            <oval-def:extend_definition comment="kernel.unprivileged_bpf_disabled runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_unprivileged_bpf_disabled:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_unprivileged_bpf_disabled:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Access to Network bpf() Syscall From Unprivileged Processes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.unprivileged_bpf_disabled' parameter should be set to 1 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_unprivileged_bpf_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.unprivileged_bpf_disabled set to 1" test_ref="oval:ssg-test_sysctl_runtime_kernel_unprivileged_bpf_disabled:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_unprivileged_bpf_disabled:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Access to Network bpf() Syscall From Unprivileged Processes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.unprivileged_bpf_disabled' parameter should be set to 1 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_unprivileged_bpf_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter kernel.unprivileged_bpf_disabled set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_unprivileged_bpf_disabled:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.unprivileged_bpf_disabled set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_unprivileged_bpf_disabled:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.unprivileged_bpf_disabled set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_unprivileged_bpf_disabled:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.unprivileged_bpf_disabled set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that kernel_unprivileged_bpf_disabled is defined in only one file" test_ref="oval:ssg-test_sysctl_kernel_unprivileged_bpf_disabled_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_yama_ptrace_scope:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Restrict usage of ptrace to descendant processes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.yama.ptrace_scope' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_yama_ptrace_scope" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.yama.ptrace_scope configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_yama_ptrace_scope:def:1"/>
            <oval-def:extend_definition comment="kernel.yama.ptrace_scope runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_yama_ptrace_scope:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_yama_ptrace_scope:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Restrict usage of ptrace to descendant processes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.yama.ptrace_scope' parameter should be set to 1 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_yama_ptrace_scope" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.yama.ptrace_scope set to 1" test_ref="oval:ssg-test_sysctl_runtime_kernel_yama_ptrace_scope:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_yama_ptrace_scope:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Restrict usage of ptrace to descendant processes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.yama.ptrace_scope' parameter should be set to 1 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_yama_ptrace_scope" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter kernel.yama.ptrace_scope set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_yama_ptrace_scope:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.yama.ptrace_scope set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_yama_ptrace_scope:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.yama.ptrace_scope set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_yama_ptrace_scope:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.yama.ptrace_scope set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_yama_ptrace_scope:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that kernel_yama_ptrace_scope is defined in only one file" test_ref="oval:ssg-test_sysctl_kernel_yama_ptrace_scope_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_core_bpf_jit_harden:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Harden the operation of the BPF just-in-time compiler</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.core.bpf_jit_harden' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_core_bpf_jit_harden" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.core.bpf_jit_harden configuration setting check" definition_ref="oval:ssg-sysctl_static_net_core_bpf_jit_harden:def:1"/>
            <oval-def:extend_definition comment="net.core.bpf_jit_harden runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_core_bpf_jit_harden:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_core_bpf_jit_harden:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Harden the operation of the BPF just-in-time compiler</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.core.bpf_jit_harden' parameter should be set to 2 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_core_bpf_jit_harden" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.core.bpf_jit_harden set to 2" test_ref="oval:ssg-test_sysctl_runtime_net_core_bpf_jit_harden:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_core_bpf_jit_harden:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Harden the operation of the BPF just-in-time compiler</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.core.bpf_jit_harden' parameter should be set to 2 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_core_bpf_jit_harden" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.core.bpf_jit_harden set to 2 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_core_bpf_jit_harden:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.core.bpf_jit_harden set to 2 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_core_bpf_jit_harden:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.core.bpf_jit_harden set to 2 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_core_bpf_jit_harden:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.core.bpf_jit_harden set to 2 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_core_bpf_jit_harden:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_core_bpf_jit_harden is defined in only one file" test_ref="oval:ssg-test_sysctl_net_core_bpf_jit_harden_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_accept_local:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting Packets Routed Between Local Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.all.accept_local' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_accept_local" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.accept_local configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_local:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.accept_local runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_local:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_local:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting Packets Routed Between Local Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.accept_local' parameter should be set to 0 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_all_accept_local" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_local set to 0" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_local:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_local:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting Packets Routed Between Local Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.accept_local' parameter should be set to 0 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_all_accept_local" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_local set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_local:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_local set to 0 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_local:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_local set to 0 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_local:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_local set to 0 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_local:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv4_conf_all_accept_local is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_local_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting ICMP Redirects for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.all.accept_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_accept_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.accept_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_redirects:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.accept_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_redirects:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting ICMP Redirects for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.accept_redirects' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_all_accept_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_redirects:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting ICMP Redirects for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.accept_redirects' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_all_accept_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_redirects set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_redirects:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_redirects set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_redirects set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_redirects:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv4_conf_all_accept_redirects is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.all.accept_source_route' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_accept_source_route" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.accept_source_route configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_source_route:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.accept_source_route runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_source_route:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_source_route:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.accept_source_route' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_all_accept_source_route" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_source_route:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_source_route:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.accept_source_route' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_all_accept_source_route" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_source_route set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_source_route:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_source_route set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_source_route set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_source_route:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_source_route set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv4_conf_all_accept_source_route is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_arp_filter:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure ARP filtering for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.all.arp_filter' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_arp_filter" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.arp_filter configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_arp_filter:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.arp_filter runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_arp_filter:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_arp_filter:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure ARP filtering for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.arp_filter' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_all_arp_filter" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.arp_filter set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_arp_filter:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_arp_filter:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure ARP filtering for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.arp_filter' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_all_arp_filter" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.arp_filter set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_arp_filter:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.arp_filter set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_arp_filter:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.arp_filter set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_arp_filter:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.arp_filter set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_arp_filter:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv4_conf_all_arp_filter is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_filter_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_arp_ignore:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Response Mode of ARP Requests for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.all.arp_ignore' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_arp_ignore" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.arp_ignore configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_arp_ignore:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.arp_ignore runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_arp_ignore:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_arp_ignore:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Response Mode of ARP Requests for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.arp_ignore' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_all_arp_ignore" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.arp_ignore set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_arp_ignore:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_arp_ignore:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Response Mode of ARP Requests for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.arp_ignore' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_all_arp_ignore" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.arp_ignore set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_arp_ignore:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.arp_ignore set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_arp_ignore:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.arp_ignore set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_arp_ignore:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.arp_ignore set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_arp_ignore:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv4_conf_all_arp_ignore is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_ignore_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_drop_gratuitous_arp:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Drop Gratuitious ARP frames on All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.all.drop_gratuitous_arp' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_drop_gratuitous_arp" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.drop_gratuitous_arp configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_drop_gratuitous_arp:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.drop_gratuitous_arp runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_drop_gratuitous_arp:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_drop_gratuitous_arp:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Drop Gratuitious ARP frames on All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.drop_gratuitous_arp' parameter should be set to 1 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_all_drop_gratuitous_arp" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.drop_gratuitous_arp set to 1" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_drop_gratuitous_arp:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_drop_gratuitous_arp:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Drop Gratuitious ARP frames on All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.drop_gratuitous_arp' parameter should be set to 1 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_all_drop_gratuitous_arp" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.drop_gratuitous_arp set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.drop_gratuitous_arp set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.drop_gratuitous_arp set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.drop_gratuitous_arp set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv4_conf_all_drop_gratuitous_arp is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_log_martians:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.all.log_martians' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_log_martians" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.log_martians configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_log_martians:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.log_martians runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_log_martians:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_log_martians:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.log_martians' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_all_log_martians" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.log_martians set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_log_martians:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_log_martians:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.log_martians' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_all_log_martians" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.log_martians set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_log_martians:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.log_martians set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_log_martians:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.log_martians set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_log_martians:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.log_martians set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv4_conf_all_log_martians is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_route_localnet:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Prevent Routing External Traffic to Local Loopback on All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.all.route_localnet' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_route_localnet" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.route_localnet configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_route_localnet:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.route_localnet runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_route_localnet:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_route_localnet:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Prevent Routing External Traffic to Local Loopback on All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.route_localnet' parameter should be set to 0 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_all_route_localnet" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.route_localnet set to 0" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_route_localnet:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_route_localnet:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Prevent Routing External Traffic to Local Loopback on All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.route_localnet' parameter should be set to 0 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_all_route_localnet" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.route_localnet set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_route_localnet:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.route_localnet set to 0 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_route_localnet:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.route_localnet set to 0 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_route_localnet:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.route_localnet set to 0 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_route_localnet:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv4_conf_all_route_localnet is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_route_localnet_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.all.rp_filter' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_rp_filter" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.rp_filter configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_rp_filter:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.rp_filter runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_rp_filter:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_rp_filter:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.rp_filter' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_all_rp_filter" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.rp_filter set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_rp_filter:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_rp_filter:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.rp_filter' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_all_rp_filter" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.rp_filter set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_rp_filter:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.rp_filter set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_rp_filter:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.rp_filter set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_rp_filter:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.rp_filter set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv4_conf_all_rp_filter is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.all.secure_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_secure_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.secure_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_secure_redirects:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.secure_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_secure_redirects:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_secure_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.secure_redirects' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_all_secure_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_secure_redirects:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_secure_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.secure_redirects' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_all_secure_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.secure_redirects set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_secure_redirects:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.secure_redirects set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.secure_redirects set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_secure_redirects:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.secure_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv4_conf_all_secure_redirects is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_send_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.all.send_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_send_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.send_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_send_redirects:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.send_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_send_redirects:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_send_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.send_redirects' parameter should be set to 0 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_all_send_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_send_redirects:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_send_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.send_redirects' parameter should be set to 0 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_all_send_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.send_redirects set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_send_redirects:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.send_redirects set to 0 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_send_redirects:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.send_redirects set to 0 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_send_redirects:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.send_redirects set to 0 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv4_conf_all_send_redirects is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_shared_media:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Sending and Accepting Shared Media Redirects for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.all.shared_media' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_shared_media" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.shared_media configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_shared_media:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.shared_media runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_shared_media:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_shared_media:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Sending and Accepting Shared Media Redirects for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.shared_media' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_all_shared_media" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.shared_media set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_shared_media:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_shared_media:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Sending and Accepting Shared Media Redirects for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.shared_media' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_all_shared_media" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.shared_media set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_shared_media:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.shared_media set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_shared_media:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.shared_media set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_shared_media:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.shared_media set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_shared_media:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv4_conf_all_shared_media is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_shared_media_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.default.accept_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_accept_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.default.accept_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_redirects:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.default.accept_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_redirects:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.default.accept_redirects' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_default_accept_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_redirects:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.default.accept_redirects' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_default_accept_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.accept_redirects set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_redirects:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.accept_redirects set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.accept_redirects set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_redirects:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.accept_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv4_conf_default_accept_redirects is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.default.accept_source_route' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_accept_source_route" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.default.accept_source_route configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_source_route:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.default.accept_source_route runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_source_route:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_source_route:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.default.accept_source_route' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_default_accept_source_route" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_source_route:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_source_route:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.default.accept_source_route' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_default_accept_source_route" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.accept_source_route set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_source_route:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.accept_source_route set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.accept_source_route set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_source_route:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.accept_source_route set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv4_conf_default_accept_source_route is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_default_log_martians:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.default.log_martians' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_log_martians" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.default.log_martians configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_log_martians:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.default.log_martians runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_log_martians:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_log_martians:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.default.log_martians' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_default_log_martians" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.default.log_martians set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_log_martians:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_default_log_martians:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.default.log_martians' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_default_log_martians" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.log_martians set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_log_martians:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.log_martians set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_log_martians:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.log_martians set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_log_martians:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.log_martians set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv4_conf_default_log_martians is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.default.rp_filter' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_rp_filter" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.default.rp_filter configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_rp_filter:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.default.rp_filter runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_rp_filter:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_rp_filter:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.default.rp_filter' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_default_rp_filter" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.default.rp_filter set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_rp_filter:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_default_rp_filter:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.default.rp_filter' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_default_rp_filter" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.rp_filter set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_rp_filter:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.rp_filter set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_rp_filter:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.rp_filter set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_rp_filter:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.rp_filter set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv4_conf_default_rp_filter is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Kernel Parameter for Accepting Secure Redirects By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.default.secure_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_secure_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.default.secure_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_secure_redirects:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.default.secure_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_secure_redirects:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_secure_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Kernel Parameter for Accepting Secure Redirects By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.default.secure_redirects' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_default_secure_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_secure_redirects:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_default_secure_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Kernel Parameter for Accepting Secure Redirects By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.default.secure_redirects' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_default_secure_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.secure_redirects set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_secure_redirects:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.secure_redirects set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.secure_redirects set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_secure_redirects:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.secure_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv4_conf_default_secure_redirects is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_default_send_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.default.send_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_send_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.default.send_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_send_redirects:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.default.send_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_send_redirects:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_send_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.default.send_redirects' parameter should be set to 0 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_default_send_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_send_redirects:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_default_send_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.default.send_redirects' parameter should be set to 0 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_default_send_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.send_redirects set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_send_redirects:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.send_redirects set to 0 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_send_redirects:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.send_redirects set to 0 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_send_redirects:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.send_redirects set to 0 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv4_conf_default_send_redirects is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_default_shared_media:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Sending and Accepting Shared Media Redirects by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.default.shared_media' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_shared_media" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.default.shared_media configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_shared_media:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.default.shared_media runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_shared_media:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_shared_media:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Sending and Accepting Shared Media Redirects by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.default.shared_media' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_default_shared_media" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.default.shared_media set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_shared_media:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_default_shared_media:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Sending and Accepting Shared Media Redirects by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.default.shared_media' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_default_shared_media" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.shared_media set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_shared_media:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.shared_media set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_shared_media:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.shared_media set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_shared_media:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.shared_media set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_shared_media:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv4_conf_default_shared_media is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_shared_media_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.icmp_echo_ignore_broadcasts' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.icmp_echo_ignore_broadcasts configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_icmp_echo_ignore_broadcasts:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.icmp_echo_ignore_broadcasts runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.icmp_echo_ignore_broadcasts' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_icmp_echo_ignore_broadcasts:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.icmp_echo_ignore_broadcasts' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_icmp_echo_ignore_broadcasts" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv4_icmp_echo_ignore_broadcasts is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.icmp_ignore_bogus_error_responses' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.icmp_ignore_bogus_error_responses configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_icmp_ignore_bogus_error_responses:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.icmp_ignore_bogus_error_responses runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.icmp_ignore_bogus_error_responses' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_icmp_ignore_bogus_error_responses:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.icmp_ignore_bogus_error_responses' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_icmp_ignore_bogus_error_responses" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv4_icmp_ignore_bogus_error_responses is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_ip_forward:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.ip_forward' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_ip_forward" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.ip_forward configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_ip_forward:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.ip_forward runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_ip_forward:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_ip_forward:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.ip_forward' parameter should be set to 0 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_ip_forward" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.ip_forward set to 0" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_ip_forward:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_ip_forward:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.ip_forward' parameter should be set to 0 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_ip_forward" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv4.ip_forward set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_ip_forward:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.ip_forward set to 0 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_forward:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.ip_forward set to 0 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_ip_forward:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.ip_forward set to 0 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_forward:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv4_ip_forward is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv4_ip_forward_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_ip_local_port_range:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Set Kernel Parameter to Increase Local Port Range</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.ip_local_port_range' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_ip_local_port_range" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.ip_local_port_range configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_ip_local_port_range:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.ip_local_port_range runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_ip_local_port_range:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_ip_local_port_range:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Set Kernel Parameter to Increase Local Port Range</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.ip_local_port_range' parameter should be set to 32768 65535 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_ip_local_port_range" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.ip_local_port_range set to 32768 65535" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_ip_local_port_range:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_ip_local_port_range:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Set Kernel Parameter to Increase Local Port Range</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.ip_local_port_range' parameter should be set to 32768 65535 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_ip_local_port_range" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv4.ip_local_port_range set to 32768 65535 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_ip_local_port_range:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.ip_local_port_range set to 32768 65535 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_local_port_range:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.ip_local_port_range set to 32768 65535 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_ip_local_port_range:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.ip_local_port_range set to 32768 65535 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_local_port_range:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv4_ip_local_port_range is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv4_ip_local_port_range_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_tcp_syncookies:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.tcp_syncookies' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_tcp_syncookies" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.tcp_syncookies configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_tcp_syncookies:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.tcp_syncookies runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_tcp_syncookies:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_tcp_syncookies:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.tcp_syncookies' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_tcp_syncookies" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.tcp_syncookies set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_tcp_syncookies:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_tcp_syncookies:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.tcp_syncookies' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_tcp_syncookies" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv4.tcp_syncookies set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_tcp_syncookies:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.tcp_syncookies set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_tcp_syncookies:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.tcp_syncookies set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_tcp_syncookies:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.tcp_syncookies set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv4_tcp_syncookies is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_ra_defrtr' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_accept_ra_defrtr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.accept_ra_defrtr set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.accept_ra_defrtr configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_defrtr:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.accept_ra_defrtr runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_ra_defrtr' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_defrtr:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_ra_defrtr' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_all_accept_ra_defrtr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_defrtr:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv6_conf_all_accept_ra_defrtr is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_defrtr_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_ra_pinfo' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_accept_ra_pinfo" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.accept_ra_pinfo set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.accept_ra_pinfo configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_pinfo:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.accept_ra_pinfo runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_ra_pinfo' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_pinfo:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_ra_pinfo' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_all_accept_ra_pinfo" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_pinfo:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv6_conf_all_accept_ra_pinfo is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_pinfo_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_ra_rtr_pref' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_accept_ra_rtr_pref" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.accept_ra_rtr_pref set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.accept_ra_rtr_pref configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_rtr_pref:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.accept_ra_rtr_pref runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_ra_rtr_pref' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_ra_rtr_pref' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_all_accept_ra_rtr_pref" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv6_conf_all_accept_ra_rtr_pref is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_all_autoconf:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure Auto Configuration on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.autoconf' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_autoconf" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.autoconf set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.autoconf configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_autoconf:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.autoconf runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_autoconf:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_autoconf:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Auto Configuration on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.autoconf' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_all_autoconf" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.autoconf set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_autoconf:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_all_autoconf:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Auto Configuration on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.autoconf' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_all_autoconf" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.autoconf set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_autoconf:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.autoconf set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_autoconf:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.autoconf set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_autoconf:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.autoconf set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_autoconf:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv6_conf_all_autoconf is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_autoconf_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_all_disable_ipv6:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Disable IPv6 Addressing on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.disable_ipv6' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_disable_ipv6" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.disable_ipv6 set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.disable_ipv6 configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_disable_ipv6:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.disable_ipv6 runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_disable_ipv6:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_disable_ipv6:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable IPv6 Addressing on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.disable_ipv6' parameter should be set to 1 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_all_disable_ipv6" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_all_disable_ipv6:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable IPv6 Addressing on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.disable_ipv6' parameter should be set to 1 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_all_disable_ipv6" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.disable_ipv6 set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_disable_ipv6:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.disable_ipv6 set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.disable_ipv6 set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.disable_ipv6 set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv6_conf_all_disable_ipv6 is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.max_addresses' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_max_addresses" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.max_addresses set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.max_addresses configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_max_addresses:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.max_addresses runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_max_addresses:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_max_addresses:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.max_addresses' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_all_max_addresses" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.max_addresses set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_max_addresses:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_all_max_addresses:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.max_addresses' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_all_max_addresses" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.max_addresses set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_max_addresses:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.max_addresses set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_max_addresses:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.max_addresses set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_max_addresses:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.max_addresses set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_max_addresses:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv6_conf_all_max_addresses is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_max_addresses_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure Denying Router Solicitations on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.router_solicitations' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_router_solicitations" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.router_solicitations set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.router_solicitations configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_router_solicitations:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.router_solicitations runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_router_solicitations:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_router_solicitations:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Denying Router Solicitations on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.router_solicitations' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_all_router_solicitations" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.router_solicitations set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_router_solicitations:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_all_router_solicitations:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Denying Router Solicitations on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.router_solicitations' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_all_router_solicitations" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.router_solicitations set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_router_solicitations:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.router_solicitations set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_router_solicitations:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.router_solicitations set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_router_solicitations:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.router_solicitations set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_router_solicitations:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv6_conf_all_router_solicitations is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_router_solicitations_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting Router Advertisements on all IPv6 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_ra" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.accept_ra set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_ra configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_ra runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting Router Advertisements on all IPv6 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_default_accept_ra" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting Router Advertisements on all IPv6 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_default_accept_ra" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv6_conf_default_accept_ra is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra_defrtr' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_ra_defrtr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.accept_ra_defrtr set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_ra_defrtr configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_defrtr:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_ra_defrtr runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra_defrtr' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_defrtr:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra_defrtr' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_default_accept_ra_defrtr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_defrtr:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv6_conf_default_accept_ra_defrtr is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_defrtr_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra_pinfo' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_ra_pinfo" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.accept_ra_pinfo set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_ra_pinfo configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_pinfo:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_ra_pinfo runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra_pinfo' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_pinfo:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra_pinfo' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_default_accept_ra_pinfo" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_pinfo:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv6_conf_default_accept_ra_pinfo is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_pinfo_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra_rtr_pref' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_ra_rtr_pref" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.accept_ra_rtr_pref set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_ra_rtr_pref configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_rtr_pref:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_ra_rtr_pref runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra_rtr_pref' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra_rtr_pref' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_default_accept_ra_rtr_pref" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv6_conf_default_accept_ra_rtr_pref is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_redirects' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.accept_redirects set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_redirects:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_redirects:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_redirects' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_default_accept_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_redirects:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_redirects' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_default_accept_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_redirects set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_redirects:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_redirects set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_redirects set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_redirects:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv6_conf_default_accept_redirects is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_default_autoconf:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure Auto Configuration on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.autoconf' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_autoconf" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.autoconf set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.autoconf configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_autoconf:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.autoconf runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_autoconf:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_autoconf:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Auto Configuration on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.autoconf' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_default_autoconf" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.autoconf set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_autoconf:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_default_autoconf:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Auto Configuration on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.autoconf' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_default_autoconf" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.autoconf set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_autoconf:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.autoconf set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_autoconf:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.autoconf set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_autoconf:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.autoconf set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_autoconf:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv6_conf_default_autoconf is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_autoconf_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_default_disable_ipv6:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Disable IPv6 Addressing on IPv6 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.disable_ipv6' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_disable_ipv6" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.disable_ipv6 set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.disable_ipv6 configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_disable_ipv6:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.disable_ipv6 runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_disable_ipv6:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_disable_ipv6:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable IPv6 Addressing on IPv6 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.disable_ipv6' parameter should be set to 1 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_default_disable_ipv6" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.disable_ipv6 set to 1" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_default_disable_ipv6:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable IPv6 Addressing on IPv6 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.disable_ipv6' parameter should be set to 1 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_default_disable_ipv6" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.disable_ipv6 set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_disable_ipv6:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.disable_ipv6 set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.disable_ipv6 set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.disable_ipv6 set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv6_conf_default_disable_ipv6 is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_disable_ipv6_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.max_addresses' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_max_addresses" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.max_addresses set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.max_addresses configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_max_addresses:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.max_addresses runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_max_addresses:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_max_addresses:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.max_addresses' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_default_max_addresses" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.max_addresses set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_max_addresses:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_default_max_addresses:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.max_addresses' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_default_max_addresses" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.max_addresses set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_max_addresses:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.max_addresses set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_max_addresses:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.max_addresses set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_max_addresses:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.max_addresses set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_max_addresses:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv6_conf_default_max_addresses is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_max_addresses_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure Denying Router Solicitations on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.router_solicitations' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_router_solicitations" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.router_solicitations set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.router_solicitations configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_router_solicitations:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.router_solicitations runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_router_solicitations:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_router_solicitations:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Denying Router Solicitations on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.router_solicitations' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_default_router_solicitations" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.router_solicitations set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_router_solicitations:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_default_router_solicitations:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Denying Router Solicitations on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.router_solicitations' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_default_router_solicitations" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.router_solicitations set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_router_solicitations:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.router_solicitations set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_router_solicitations:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.router_solicitations set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_router_solicitations:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.router_solicitations set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_router_solicitations:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that net_ipv6_conf_default_router_solicitations is defined in only one file" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_router_solicitations_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_user_max_user_namespaces:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable the use of user namespaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'user.max_user_namespaces' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_user_max_user_namespaces" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="user.max_user_namespaces configuration setting check" definition_ref="oval:ssg-sysctl_static_user_max_user_namespaces:def:1"/>
            <oval-def:extend_definition comment="user.max_user_namespaces runtime setting check" definition_ref="oval:ssg-sysctl_runtime_user_max_user_namespaces:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_user_max_user_namespaces:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable the use of user namespaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'user.max_user_namespaces' parameter should be set to 0 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_user_max_user_namespaces" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter user.max_user_namespaces set to 0" test_ref="oval:ssg-test_sysctl_runtime_user_max_user_namespaces:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_user_max_user_namespaces:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable the use of user namespaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'user.max_user_namespaces' parameter should be set to 0 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_user_max_user_namespaces" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter user.max_user_namespaces set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_user_max_user_namespaces:tst:1"/>
              <oval-def:criterion comment="kernel static parameter user.max_user_namespaces set to 0 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_user_max_user_namespaces:tst:1"/>
              <oval-def:criterion comment="kernel static parameter user.max_user_namespaces set to 0 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_user_max_user_namespaces:tst:1"/>
              <oval-def:criterion comment="kernel static parameter user.max_user_namespaces set to 0 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_user_max_user_namespaces:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that user_max_user_namespaces is defined in only one file" test_ref="oval:ssg-test_sysctl_user_max_user_namespaces_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_vm_mmap_min_addr:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Prevent applications from mapping low portion of virtual memory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'vm.mmap_min_addr' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_vm_mmap_min_addr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="vm.mmap_min_addr configuration setting check" definition_ref="oval:ssg-sysctl_static_vm_mmap_min_addr:def:1"/>
            <oval-def:extend_definition comment="vm.mmap_min_addr runtime setting check" definition_ref="oval:ssg-sysctl_runtime_vm_mmap_min_addr:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_vm_mmap_min_addr:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Prevent applications from mapping low portion of virtual memory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'vm.mmap_min_addr' parameter should be set to 65536 in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_vm_mmap_min_addr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter vm.mmap_min_addr set to 65536" test_ref="oval:ssg-test_sysctl_runtime_vm_mmap_min_addr:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_vm_mmap_min_addr:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Prevent applications from mapping low portion of virtual memory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'vm.mmap_min_addr' parameter should be set to 65536 in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_vm_mmap_min_addr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter vm.mmap_min_addr set to 65536 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_vm_mmap_min_addr:tst:1"/>
              <oval-def:criterion comment="kernel static parameter vm.mmap_min_addr set to 65536 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_vm_mmap_min_addr:tst:1"/>
              <oval-def:criterion comment="kernel static parameter vm.mmap_min_addr set to 65536 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_vm_mmap_min_addr:tst:1"/>
              <oval-def:criterion comment="kernel static parameter vm.mmap_min_addr set to 65536 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_vm_mmap_min_addr:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that vm_mmap_min_addr is defined in only one file" test_ref="oval:ssg-test_sysctl_vm_mmap_min_addr_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-timer_dnf-automatic_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable dnf-automatic Timer</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The dnf-automatic timer should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="timer_dnf-automatic_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package dnf-automatic installed and timer dnf-automatic is configured to start" operator="AND">
            <oval-def:extend_definition comment="dnf-automatic installed" definition_ref="oval:ssg-package_dnf-automatic_installed:def:1"/>
            <oval-def:criteria comment="timer dnf-automatic is configured to start and is running" operator="AND">
              <oval-def:criterion comment="dnf-automatic is running" test_ref="oval:ssg-test_timer_running_dnf-automatic:tst:1"/>
              <oval-def:criterion comment="multi-user.target wants dnf-automatic" test_ref="oval:ssg-test_multi_user_wants_dnf-automatic:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_faillock:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Check pam_faillock Existence in system-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that pam_faillock.so exists in system-auth</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_faillock" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Conditions for pam_faillock are satisfied" test_ref="oval:ssg-test_accounts_password_pam_faillock:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_pwquality:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Check pam_pwquality Existence in system-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that pam_pwquality.so exists in system-auth</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_pwquality" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Conditions for pam_pwquality are satisfied" test_ref="oval:ssg-test_password_pam_pwquality:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_auditctl:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run semanage</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Test if auditctl is in use for audit rules.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_auditctl" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="audit auditctl" test_ref="oval:ssg-test_audit_rules_auditctl:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_augenrules:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run semanage</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Test if augenrules is enabled for audit rules.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_augenrules" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="audit augenrules" test_ref="oval:ssg-test_audit_rules_augenrules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_networkconfig_modification_domainname:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Network Environment</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The network environment should not be modified by anything other than
      administrator action. Any change to network parameters should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_networkconfig_modification_domainname" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit setdomainname" test_ref="oval:ssg-test_32bit_ardm_setdomainname_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit setdomainname" test_ref="oval:ssg-test_64bit_ardm_setdomainname_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit setdomainname" test_ref="oval:ssg-test_32bit_ardm_setdomainname_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit setdomainname" test_ref="oval:ssg-test_64bit_ardm_setdomainname_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_networkconfig_modification_hostname:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Network Environment</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The network environment should not be modified by anything other than
      administrator action. Any change to network parameters should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_networkconfig_modification_hostname" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit sethostname" test_ref="oval:ssg-test_32bit_ardm_sethostname_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit sethostname" test_ref="oval:ssg-test_64bit_ardm_sethostname_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit sethostname" test_ref="oval:ssg-test_32bit_ardm_sethostname_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit sethostname" test_ref="oval:ssg-test_64bit_ardm_sethostname_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_conf_log_file_not_set:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>'log_file' Not Set In /etc/audit/auditd.conf</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Verify 'log_file' is not set in /etc/audit/auditd.conf.</oval-def:description>
            <oval-def:reference ref_id="auditd_conf_log_file_not_set" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_auditd_conf_log_file_not_set:tst:1" comment="Verify 'log_file' not set in /etc/audit/auditd.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_conf_log_group_not_root:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>'log_group' Not Set To 'root' In /etc/audit/auditd.conf</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Verify 'log_group' is not set to 'root' in
      /etc/audit/auditd.conf.</oval-def:description>
            <oval-def:reference ref_id="auditd_conf_log_group_not_root" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_auditd_conf_log_group_not_root:tst:1" comment="Verify 'log_group' not set to 'root' in /etc/audit/auditd.conf"/>
            <oval-def:criterion test_ref="oval:ssg-test_auditd_conf_log_group_is_set:tst:1" comment="Verify 'log_group' is set in /etc/audit/auditd.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify GRUB_DISABLE_RECOVERY Set to true</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>GRUB_DISABLE_RECOVERY set to 'true' in
      /etc/default/grub</oval-def:description>
            <oval-def:reference ref_id="bootloader_disable_recovery_set_to_true" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_bootloader_disable_recovery_set_to_true:tst:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-chronyd_specify_multiple_servers:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Specify Multiple Remote chronyd NTP Servers for Time Data</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Multiple chronyd NTP Servers for time synchronization should be specified.</oval-def:description>
            <oval-def:reference ref_id="chronyd_specify_multiple_servers" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="chrony.conf conditions are met">
            <oval-def:criterion test_ref="oval:ssg-test_chronyd_multiple_servers:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_default_exists:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>GRUB_CMDLINE_LINUX_DEFAULT existance check</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if GRUB_CMDLINE_LINUX_DEFAULT exists in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_default_exists" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_grub2_default_exists:tst:1" comment="check for GRUB_CMDLINE_LINUX_DEFAULT exists in /etc/default/grub"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_entries_reference_kernelopts:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Use $kernelopts in /boot/loader/entries/*.conf</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure that grubenv-defined kernel options are referenced in individual boot loader entries</oval-def:description>
            <oval-def:reference ref_id="grub2_entries_reference_kernelopts" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_grub2_entries_reference_kernelopts:tst:1" comment="check kernel command line parameters for referenced boot entries reference the $kernelopts variable."/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-install_mcafee_hbss:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install McAfee Host-Based Intrusion Detection Software (HBSS)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>McAfee Host-Based Intrusion Detection Software (HBSS) software
      should be installed.</oval-def:description>
            <oval-def:reference ref_id="install_mcafee_hbss" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_cma_rt:def:1"/>
            <oval-def:extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_hbss_accm:def:1"/>
            <oval-def:extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-package_MFEhiplsm_installed:def:1"/>
            <oval-def:extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_hbss_pa:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_centos6:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>CentOS 6</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:centos:centos:6" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      CentOS 6</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_centos6" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="CentOS6 is installed" test_ref="oval:ssg-test_centos6:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_centos7:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>CentOS 7</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:centos:centos:7" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      CentOS 7</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_centos7" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="CentOS7 is installed" test_ref="oval:ssg-test_centos7:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_centos8:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>CentOS 8</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:centos:centos:8" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      CentOS 8</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_centos8" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="OS is CentOS" test_ref="oval:ssg-test_centos8_name:tst:1"/>
            <oval-def:criterion comment="OS version is 8" test_ref="oval:ssg-test_centos8_version:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_centos9:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>CentOS Stream 9</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:centos:centos:9" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      CentOS Stream 9</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_centos9" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="OS is CentOS Stream" test_ref="oval:ssg-test_centos9_name:tst:1"/>
            <oval-def:criterion comment="OS version is 9" test_ref="oval:ssg-test_centos9_version:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_debian:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Debian</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The operating system installed is a Debian System</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_debian" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="System is Debian" operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="Debian is installed" test_ref="oval:ssg-test_debian:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_debian10:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Debian Linux 10</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:debian:debian_linux:10" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Debian 10</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_debian10" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Debian Linux is version 10" operator="AND">
            <oval-def:extend_definition comment="Debian is installed" definition_ref="oval:ssg-installed_OS_is_debian:def:1"/>
            <oval-def:criterion comment="Debian10 is installed" test_ref="oval:ssg-test_debian_10:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_debian11:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Debian Linux 11</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:debian:debian_linux:11" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Debian 11</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_debian11" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Debian Linux is version 11" operator="AND">
            <oval-def:extend_definition comment="Debian is installed" definition_ref="oval:ssg-installed_OS_is_debian:def:1"/>
            <oval-def:criterion comment="Debian11 is installed" test_ref="oval:ssg-test_debian_11:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_debian9:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Debian 9</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:debian:debian_linux:9" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Debian 9</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_debian9" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="current Debian version is Debian Stretch" operator="AND">
            <oval-def:extend_definition comment="Debian is installed" definition_ref="oval:ssg-installed_OS_is_debian:def:1"/>
            <oval-def:criterion comment="Debian9 is installed" test_ref="oval:ssg-test_debian_9:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_fedora:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Installed operating system is Fedora</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:fedoraproject:fedora:33" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:fedoraproject:fedora:34" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:fedoraproject:fedora:35" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:fedoraproject:fedora:36" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Fedora</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_fedora" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="fedora-release RPM packages are installed" test_ref="oval:ssg-test_fedora_release_rpm:tst:1"/>
            <oval-def:criterion comment="CPE vendor is 'fedoraproject' and product is 'fedora'" test_ref="oval:ssg-test_fedora_vendor_product:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ol7_family:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Oracle Linux 7</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:oracle:linux:7" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Oracle Linux 7</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_ol7_family" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Oracle Linux 7 System is installed" test_ref="oval:ssg-test_ol7_system:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ol8_family:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Oracle Linux 8</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:oracle:linux:8" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Oracle Linux 8</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_ol8_family" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Oracle Linux 8 System is installed" test_ref="oval:ssg-test_ol8_system:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ol9_family:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Oracle Linux 9</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:oracle:linux:9" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Oracle Linux 9</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_ol9_family" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Oracle Linux 9 System is installed" test_ref="oval:ssg-test_ol9_system:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_opensuse:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>openSUSE</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The operating system installed on the system is openSUSE.</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_opensuse" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="openSUSE is installed" test_ref="oval:ssg-test_opensuse_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_opensuse_leap15:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>openSUSE Leap 15</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:opensuse:leap:15.0" source="CPE"/>
            <oval-def:description>The operating system installed on the system is openSUSE Leap 15.</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_opensuse_leap15" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="openSUSE is installed" definition_ref="oval:ssg-installed_OS_is_opensuse:def:1"/>
            <oval-def:criterion comment="openSUSE Leap 15 is installed" test_ref="oval:ssg-test_opensuse_leap15_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_opensuse_leap42:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>openSUSE Leap 42</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:opensuse:leap:42.1" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:opensuse:leap:42.2" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:opensuse:leap:42.3" source="CPE"/>
            <oval-def:description>The operating system installed on the system is openSUSE Leap 42.</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_opensuse_leap42" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="openSUSE is installed" definition_ref="oval:ssg-installed_OS_is_opensuse:def:1"/>
            <oval-def:criterion comment="openSUSE Leap 42 is installed" test_ref="oval:ssg-test_opensuse_leap42_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Installed operating system is part of the Unix family</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The operating system installed on the system is part of the Unix OS family</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_part_of_Unix_family" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_unix_family:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhcos4:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux CoreOS</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux_coreos:4" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Red Hat Enterprise Linux CoreOS release 4</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhcos4" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="RHCOS is installed" test_ref="oval:ssg-test_rhcos:tst:1"/>
              <oval-def:criterion comment="RHCOS version 4 is installed" test_ref="oval:ssg-test_rhcos4:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel7:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 7</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:7" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Red Hat Enterprise Linux 7</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel7" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_rhel7_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="RHEL 7 Client is installed" test_ref="oval:ssg-test_rhel7_client:tst:1"/>
              <oval-def:criterion comment="RHEL 7 Workstation is installed" test_ref="oval:ssg-test_rhel7_workstation:tst:1"/>
              <oval-def:criterion comment="RHEL 7 Server is installed" test_ref="oval:ssg-test_rhel7_server:tst:1"/>
              <oval-def:criterion comment="RHEL 7 Compute Node is installed" test_ref="oval:ssg-test_rhel7_computenode:tst:1"/>
              <oval-def:criteria operator="AND" comment="Red Hat Enterprise Virtualization Host is installed">
                <oval-def:criterion comment="Red Hat Virtualization Host (RHVH)" test_ref="oval:ssg-test_rhvh4_version:tst:1"/>
                <oval-def:criterion comment="Red Hat Enterprise Virtualization Host is based on RHEL 7" test_ref="oval:ssg-test_rhevh_rhel7_version:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Red Hat Enterprise Linux 8</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel8" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_rhel8_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="RHEL 8 is installed" test_ref="oval:ssg-test_rhel8:tst:1"/>
              <oval-def:criteria operator="AND" comment="Red Hat Enterprise Virtualization Host is installed">
                <oval-def:criterion comment="Red Hat Virtualization Host (RHVH)" test_ref="oval:ssg-test_rhvh4_version:tst:1"/>
                <oval-def:criterion comment="Red Hat Enterprise Virtualization Host is based on RHEL 8" test_ref="oval:ssg-test_rhevh_rhel8_version:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_0:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.0</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.0" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.0</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel8_0" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.0 is installed" test_ref="oval:ssg-test_rhel8_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_1:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.1</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.1" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.1</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel8_1" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.1 is installed" test_ref="oval:ssg-test_rhel8_1:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_2:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.2</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.2" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.2</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel8_2" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.2 is installed" test_ref="oval:ssg-test_rhel8_2:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_3:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.3</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.3" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.3</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel8_3" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.3 is installed" test_ref="oval:ssg-test_rhel8_3:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_4:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.4</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.4" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.4</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel8_4" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.4 is installed" test_ref="oval:ssg-test_rhel8_4:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_5:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.5</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.5" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.5</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel8_5" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.5 is installed" test_ref="oval:ssg-test_rhel8_5:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_6:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.6</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.6" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.6</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel8_6" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.6 is installed" test_ref="oval:ssg-test_rhel8_6:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_7:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.7</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.7" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.7</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel8_7" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.7 is installed" test_ref="oval:ssg-test_rhel8_7:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_8:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.8</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.8" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.8</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel8_8" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.8 is installed" test_ref="oval:ssg-test_rhel8_8:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_9:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.9</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.9" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.9</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel8_9" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.9 is installed" test_ref="oval:ssg-test_rhel8_9:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_10:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.10</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.10" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.10</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel8_10" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.10 is installed" test_ref="oval:ssg-test_rhel8_10:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel9:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 9</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:9" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Red Hat Enterprise Linux 9</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel9" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_rhel9_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="RHEL 9 is installed" test_ref="oval:ssg-test_rhel9:tst:1"/>
              <oval-def:criteria operator="AND" comment="Red Hat Enterprise Virtualization Host is installed">
                <oval-def:criterion comment="Red Hat Virtualization Host (RHVH)" test_ref="oval:ssg-test_rhvh4_version:tst:1"/>
                <oval-def:criterion comment="Red Hat Enterprise Virtualization Host is based on RHEL 9" test_ref="oval:ssg-test_rhevh_rhel9_version:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhv4:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Virtualization 4</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:virtualization:4" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Red Hat Virtualization Host 4.4+ or Red Hat Enterprise Host.</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhv4" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="RHEL8 OS installed" definition_ref="oval:ssg-installed_OS_is_rhel8:def:1"/>
            <oval-def:criterion comment="Red Hat Virtualization Host (RHVH)" test_ref="oval:ssg-test_rhvh4_version:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_sl6:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Scientific Linux 6</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:scientificlinux:scientificlinux:6" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Scientific Linux 6</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_sl6" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="Scientific Linux 6 is installed" test_ref="oval:ssg-test_sl6:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_sl7:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Scientific Linux 7</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:scientificlinux:scientificlinux:7" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Scientific Linux 7</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_sl7" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="Scientific Linux 7 is installed" test_ref="oval:ssg-test_sl7:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_sle12:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>SUSE Linux Enterprise 12</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:suse:linux_enterprise_server:12" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:suse:linux_enterprise_desktop:12" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      SUSE Linux Enterprise 12.</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_sle12" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_sle12_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="SLE 12 Desktop is installed" test_ref="oval:ssg-test_sle12_desktop:tst:1"/>
              <oval-def:criterion comment="SLE 12 Server is installed" test_ref="oval:ssg-test_sle12_server:tst:1"/>
              <oval-def:criterion comment="SLES 12 for SAP Applications is installed" test_ref="oval:ssg-test_sles_12_for_sap:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_sle15:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>SUSE Linux Enterprise 15</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:suse:linux_enterprise_server:15" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:suse:linux_enterprise_desktop:15" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      SUSE Linux Enterprise 15.</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_sle15" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_sle15_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="SLE 15 Desktop is installed" test_ref="oval:ssg-test_sle15_desktop:tst:1"/>
              <oval-def:criterion comment="SLE 15 Server is installed" test_ref="oval:ssg-test_sle15_server:tst:1"/>
              <oval-def:criterion comment="SLES 15 for SAP Applications is installed" test_ref="oval:ssg-test_sles_15_for_sap:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ubuntu:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ubuntu</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The operating system installed is an Ubuntu System</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_ubuntu" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="System is Ubuntu" operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="lsb-based distrib" test_ref="oval:ssg-test_lsb:tst:1"/>
            <oval-def:criterion comment="Ubuntu is installed" test_ref="oval:ssg-test_ubuntu:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ubuntu1604:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ubuntu 1604</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:canonical:ubuntu_linux:16.04" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Ubuntu 1604</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_ubuntu1604" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="current Ubuntu version is Xenial" operator="AND">
            <oval-def:extend_definition comment="Ubuntu is installed" definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1"/>
            <oval-def:criterion comment="Xenial is installed" test_ref="oval:ssg-test_ubuntu_xenial:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ubuntu1804:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ubuntu 1804</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:canonical:ubuntu_linux:18.04" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Ubuntu 1804</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_ubuntu1804" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="current Ubuntu version is Bionic" operator="AND">
            <oval-def:extend_definition comment="Ubuntu is installed" definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1"/>
            <oval-def:criterion comment="Bionic is installed" test_ref="oval:ssg-test_ubuntu_bionic:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ubuntu2004:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ubuntu 2004</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:canonical:ubuntu_linux:20.04" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Ubuntu 2004</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_ubuntu2004" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="current Ubuntu version is Focal" operator="AND">
            <oval-def:extend_definition comment="Ubuntu is installed" definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1"/>
            <oval-def:criterion comment="Focal is installed" test_ref="oval:ssg-test_ubuntu_focal:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_wrlinux1019:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>WRLinux 1019</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:windriver:wrlinux" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Wind River Linux 1019</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_wrlinux1019" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_unix_wrlinux1019:tst:1"/>
            <oval-def:criterion comment="Produce name is WRLinux" test_ref="oval:ssg-test_wrlinux1019_name:tst:1"/>
            <oval-def:criterion comment="WRLinux version is 1019" test_ref="oval:ssg-test_wrlinux1019_version:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_wrlinux8:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>WRLinux 8</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:windriver:wrlinux" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Wind River Linux 8</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_wrlinux8" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="current WRLinux version is WRLinux8" operator="AND">
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_unix_wrlinux8:tst:1"/>
            <oval-def:criterion comment="WRLinux 8 is installed" test_ref="oval:ssg-test_wrlinux8_version:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_app_is_rhv4:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Virtualization 4</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/a:redhat:virtualization:4" source="CPE"/>
            <oval-def:description>The application installed installed on the system is
      Red Hat Virtualization 4.</oval-def:description>
            <oval-def:reference ref_id="installed_app_is_rhv4" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="RHEL7 OS installed" definition_ref="oval:ssg-installed_OS_is_rhel7:def:1"/>
            <oval-def:criterion comment="Red Hat Virtualization Manager (RHVM)" test_ref="oval:ssg-test_rhevm4_version:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_audit_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package audit is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package audit is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:audit" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_audit_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package audit is installed" test_ref="oval:ssg-test_env_has_audit_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_chrony_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package chrony is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package chrony is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:chrony" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_chrony_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package chrony is installed" test_ref="oval:ssg-test_env_has_chrony_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_gdm_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package gdm is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package gdm is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:gdm" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_gdm_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package gdm is installed" test_ref="oval:ssg-test_env_has_gdm_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_grub2_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package grub2 is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package grub2-common is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:grub2" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_grub2_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Package grub2-common is installed" test_ref="oval:ssg-test_env_has_grub2_installed:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Test for ppcle64 architecture" test_ref="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" negate="true"/>
              <oval-def:criterion comment="Test if OPAL is not used" test_ref="oval:ssg-test_system_using_opal:tst:1" negate="true"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_libuser_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package libuser is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package libuser is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:libuser" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_libuser_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package libuser is installed" test_ref="oval:ssg-test_env_has_libuser_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_login_defs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package providing /etc/login.defs is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package providing /etc/login.defs and is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:login_defs" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_login_defs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package providing /etc/login.defs is installed" test_ref="oval:ssg-test_env_has_login_defs_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_net-snmp_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package net-snmp is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package net-snmp is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:net-snmp" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_net-snmp_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package net-snmp is installed" test_ref="oval:ssg-test_env_has_net-snmp_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_no_ovirt:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Check if the system doesn't act as an oVirt host or manager</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if the system has neither ovirt-host nor ovirt-engine installed.</oval-def:description>
            <oval-def:reference ref_id="installed_env_has_no_ovirt" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="Package ovirt-host is not installed" definition_ref="oval:ssg-installed_env_has_ovirt:def:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_nss-pam-ldapd_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package nss-pam-ldapd is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package nss-pam-ldapd is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:nss-pam-ldapd" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_nss-pam-ldapd_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package nss-pam-ldapd is installed" test_ref="oval:ssg-test_env_has_nss-pam-ldapd_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_ntp_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package ntp is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package ntp is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:ntp" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_ntp_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package ntp is installed" test_ref="oval:ssg-test_env_has_ntp_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_ovirt:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Check if the system acts as an oVirt host or manager</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if the system has ovirt-host or ovirt-engine installed</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:ovirt-host" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_ovirt" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Package ovirt-host is installed" test_ref="oval:ssg-test_env_has_ovirt-host_installed:tst:1"/>
            <oval-def:criterion comment="Package ovirt-engine is installed" test_ref="oval:ssg-test_env_has_ovirt-engine_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_pam_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package pam is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package pam is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:pam" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_pam_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package pam is installed" test_ref="oval:ssg-test_env_has_pam_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_polkit_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package polkit is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package polkit is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:polkit" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_polkit_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package polkit is installed" test_ref="oval:ssg-test_env_has_polkit_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_postfix_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package postfix is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package postfix is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:postfix" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_postfix_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package postfix is installed" test_ref="oval:ssg-test_env_has_postfix_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_sssd-common_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package sssd-common is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package sssd-common is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:sssd" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_sssd-common_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package sssd-common is installed" test_ref="oval:ssg-test_env_has_sssd-common_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_sudo_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package sudo is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package sudo is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:sudo" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_sudo_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package sudo is installed" test_ref="oval:ssg-test_env_has_sudo_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_systemd_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package systemd is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package systemd is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:systemd" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_systemd_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package systemd is installed" test_ref="oval:ssg-test_env_has_systemd_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_tftp_server_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package tftp-server is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package tftp-server is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:tftp-server" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_tftp_server_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package tftp-server is installed" test_ref="oval:ssg-test_env_has_tftp_server_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_usbguard_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package usbguard is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package usbguard is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:usbguard" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_usbguard_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package usbguard is installed" test_ref="oval:ssg-test_env_has_usbguard_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_wifi_interface:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>WiFi interface is present</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if any wifi interface is present.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:wifi-iface" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_wifi_interface" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="WiFi interface is present" test_ref="oval:ssg-test_proc_net_wireless_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_yum_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package yum is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package yum is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:yum" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_yum_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package yum is installed" test_ref="oval:ssg-test_env_has_yum_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_zipl_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>System uses zIPL</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if system uses zIPL bootloader.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:zipl" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_zipl_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package s390utils-base is installed" test_ref="oval:ssg-test_env_has_zipl_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_is_a_container:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Check if the scan target is a container</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check for presence of files characterizing container filesystems.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:container" source="CPE"/>
            <oval-def:reference ref_id="installed_env_is_a_container" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Check if /.dockerenv exists" test_ref="oval:ssg-test_installed_env_is_a_docker_container:tst:1"/>
            <oval-def:criterion comment="Check if /run/.containerenv exists" test_ref="oval:ssg-test_installed_env_is_a_podman_container:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_is_a_machine:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Check if the scan target is a machine</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check for absence of files characterizing container filesystems.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:machine" source="CPE"/>
            <oval-def:reference ref_id="installed_env_is_a_machine" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="If environment is not a container, it is machine" definition_ref="oval:ssg-installed_env_is_a_container:def:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>No CD/DVD drive is configured to automount in /etc/fstab</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check the /etc/fstab and check if a CD/DVD drive
      is not configured for automount.</oval-def:description>
            <oval-def:reference ref_id="no_cd_dvd_drive_in_etc_fstab" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_no_cd_dvd_drive_in_etc_fstab:tst:1" comment="Check if CD/DVD drive is not configured to automout in /etc/fstab"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-proc_sys_kernel_osrelease_arch_aarch64:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Test that the architecture is aarch64</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that architecture of kernel in /proc/sys/kernel/osrelease is aarch64</oval-def:description>
            <oval-def:reference ref_id="proc_sys_kernel_osrelease_arch_aarch64" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Architecture is aarch64" test_ref="oval:ssg-test_proc_sys_kernel_osrelease_arch_aarch64:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-proc_sys_kernel_osrelease_arch_not_aarch64:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Test for different architecture than aarch64</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that architecture of kernel in /proc/sys/kernel/osrelease is not aarch64</oval-def:description>
            <oval-def:reference ref_id="proc_sys_kernel_osrelease_arch_not_aarch64" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="Architecture is not aarch64" definition_ref="oval:ssg-proc_sys_kernel_osrelease_arch_aarch64:def:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-proc_sys_kernel_osrelease_arch_not_s390x:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Test for different architecture than s390x</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that architecture of kernel in /proc/sys/kernel/osrelease is not s390x</oval-def:description>
            <oval-def:reference ref_id="proc_sys_kernel_osrelease_arch_not_s390x" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="Architecture is not s390x" definition_ref="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Test that the architecture is s390x</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that architecture of kernel in /proc/sys/kernel/osrelease is s390x</oval-def:description>
            <oval-def:reference ref_id="proc_sys_kernel_osrelease_arch_s390x" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Architecture is s390x" test_ref="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-removable_partition_doesnt_exist:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Device Files for Removable Media Partitions Does Not Exist on the System</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Verify if device file representing removable partitions
      exist on the system</oval-def:description>
            <oval-def:reference ref_id="removable_partition_doesnt_exist" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_removable_partition_doesnt_exist:tst:1" comment="Check if removable partition really exists on the system"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_not_required_or_unset:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>SSHD is not required to be installed or requirement not set</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>If SSHD is not required, we check it is not installed. If SSH requirement is unset, we are good.</oval-def:description>
            <oval-def:reference ref_id="sshd_not_required_or_unset" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH not required or not set" operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_sshd_not_required:tst:1"/>
            <oval-def:extend_definition comment="SSH requirement is unset" definition_ref="oval:ssg-sshd_requirement_unset:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_required_or_unset:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>SSHD is required to be installed or requirement not set</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>If SSHD is required, we check it is installed. If SSH requirement is unset, we are good.</oval-def:description>
            <oval-def:reference ref_id="sshd_required_or_unset" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH required or not set" operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_sshd_required:tst:1"/>
            <oval-def:extend_definition comment="SSH requirement is unset" definition_ref="oval:ssg-sshd_requirement_unset:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_requirement_unset:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>It doesn't matter if sshd is installed or not</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Test if value sshd_required is 0.</oval-def:description>
            <oval-def:reference ref_id="sshd_requirement_unset" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_sshd_requirement_unset:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_version_equal_or_higher_than_74:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>OpenSSH Server is 7.4 or newer</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if version of OpenSSH Server is equal or higher than 7.4</oval-def:description>
            <oval-def:reference ref_id="sshd_version_equal_or_higher_than_74" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="OpenSSH Server version is equal or higher than 7.4" operator="OR">
            <oval-def:criterion comment="Check if OpenSSH Server is equal or higher than 7.4" test_ref="oval:ssg-test_openssh-server_version:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sssd_conf_exists:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify The SSSD Configuration File Exists</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The /etc/sssd/sssd.conf file should exist if it is
      in use.</oval-def:description>
            <oval-def:reference ref_id="sssd_conf_exists" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check if sssd_conf_exists" test_ref="oval:ssg-test_sssd_conf_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-sssd_conf_uses_ldap:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>SSSD is configured to use LDAP</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Identification provider is not set to ad within /etc/sssd/sssd.conf</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:sssd-ldap" source="CPE"/>
            <oval-def:reference ref_id="sssd_conf_uses_ldap" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Identification provider is not set to ad within /etc/sssd/sssd.conf" test_ref="oval:ssg-test_id_provider_is_set_to_ad:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Kernel Runtime Parameter IPv6 Check</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disables IPv6 for all network interfaces.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_ipv6_disable" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.disable_ipv6 set correctly" operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.disable_ipv6 configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_disable_ipv6:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.disable_ipv6 runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_disable_ipv6:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-system_boot_mode_is_non_uefi:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Non-UEFI system boot mode check</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if System boot mode is non-UEFI.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:non-uefi" source="CPE"/>
            <oval-def:reference ref_id="system_boot_mode_is_non_uefi" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition definition_ref="oval:ssg-system_boot_mode_is_uefi:def:1" negate="true" comment="Pass if System boot mode is non-UEFI"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-system_boot_mode_is_uefi:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>UEFI system boot mode check</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if system boot mode is UEFI.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:uefi" source="CPE"/>
            <oval-def:reference ref_id="system_boot_mode_is_uefi" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_efi_dir_existence:tst:1" comment="check if /sys/firmware/efi folder exists"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-system_info_architecture_64bit:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Test for 64-bit Architecture</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Generic test for 64-bit architectures to be used by other tests</oval-def:description>
            <oval-def:reference ref_id="system_info_architecture_64bit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="Generic test for x86_64 architecture" definition_ref="oval:ssg-system_info_architecture_x86_64:def:1"/>
            <oval-def:extend_definition comment="Generic test for ppc64 architecture" definition_ref="oval:ssg-system_info_architecture_ppc_64:def:1"/>
            <oval-def:extend_definition comment="Generic test for aarch64 architecture" definition_ref="oval:ssg-system_info_architecture_aarch_64:def:1"/>
            <oval-def:extend_definition comment="Generic test for s390x architecture" definition_ref="oval:ssg-system_info_architecture_s390_64:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-system_info_architecture_aarch_64:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Test for aarch_64 Architecture</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Generic test for aarch_64 architecture to be used by other tests</oval-def:description>
            <oval-def:reference ref_id="system_info_architecture_aarch_64" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Generic test for aarch_64 architecture" test_ref="oval:ssg-test_system_info_architecture_aarch_64:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-system_info_architecture_ppc_64:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Test for PPC and PPCLE Architecture</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Generic test for PPC PPC64LE architecture to be used by other tests</oval-def:description>
            <oval-def:reference ref_id="system_info_architecture_ppc_64" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Generic test for ppc64 architecture" test_ref="oval:ssg-test_system_info_architecture_ppc_64:tst:1"/>
            <oval-def:criterion comment="Generic test for ppcle64 architecture" test_ref="oval:ssg-test_system_info_architecture_ppcle_64:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-system_info_architecture_s390_64:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Test for s390_64 Architecture</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Generic test for s390_64 architecture to be used by other tests</oval-def:description>
            <oval-def:reference ref_id="system_info_architecture_s390_64" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Generic test for s390_64 architecture" test_ref="oval:ssg-test_system_info_architecture_s390_64:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-system_info_architecture_x86:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Test for x86 Architecture</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Generic test for x86 architecture to be used by other tests</oval-def:description>
            <oval-def:reference ref_id="system_info_architecture_x86" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Generic test for x86 architecture" test_ref="oval:ssg-test_system_info_architecture_x86:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-system_info_architecture_x86_64:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Test for x86_64 Architecture</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Generic test for x86_64 architecture to be used by other tests</oval-def:description>
            <oval-def:reference ref_id="system_info_architecture_x86_64" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Generic test for x86_64 architecture" test_ref="oval:ssg-test_system_info_architecture_x86_64:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-usbguard_rules_not_empty_not_missing:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Check that file storing USBGuard rules exists and is not empty</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that file storing USBGuard rules at /etc/usbguard/rules.conf exists and is not empty</oval-def:description>
            <oval-def:reference ref_id="usbguard_rules_not_empty_not_missing" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check that file storing USBGuard rules exists and is not empty" operator="AND">
            <oval-def:criterion comment="Check that the usbguard rules in either /etc/usbguard/rules.conf or /etc/usbguard/rules.d/ contain at least one non white space character." test_ref="oval:ssg-test_usbguard_rules_nonempty:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-var_accounts_user_umask_as_number:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Value of 'var_accounts_user_umask' variable represented as octal number</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Value of 'var_accounts_user_umask' variable represented as octal number</oval-def:description>
            <oval-def:reference ref_id="var_accounts_user_umask_as_number" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Value of 'var_removable_partition' variable is set to '/dev/cdrom'</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Verify if value of 'var_removable_partition' variable is set
      to '/dev/cdrom'</oval-def:description>
            <oval-def:reference ref_id="var_removable_partition_is_cd_dvd_drive" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_var_removable_partition_is_cd_dvd_drive:tst:1" comment="Check if removable partition value represents CD/DVD drive"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-var_umask_for_daemons_as_number:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Value of 'var_umask_for_daemons' variable represented as octal number</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Value of 'var_umask_for_daemons' variable represented as octal number</oval-def:description>
            <oval-def:reference ref_id="var_umask_for_daemons_as_number" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_existence_of_var_umask_for_daemons_as_number_variable:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
      </oval-def:definitions>
      <oval-def:tests>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="log ftp transactions" id="oval:ssg-test_ftp_log_transactions_enable:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_test_ftp_log_transactions_enable:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="log ftp transactions" id="oval:ssg-test_ftp_log_transactions_format:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_test_ftp_log_transactions_format:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="log ftp transactions" id="oval:ssg-test_ftp_log_transactions_protocol:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_test_ftp_log_transactions_protocol:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Banner for FTP Users" id="oval:ssg-test_ftp_present_banner:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_test_ftp_present_banner:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_kerberos_disable_no_keytab:tst:1" check="all" check_existence="none_exist" version="1" comment="Ensure keytab file does not exist">
          <unix:object object_ref="oval:ssg-obj_kerberos_disable_no_keytab:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" comment="Check if root has the correct mail alias." id="oval:ssg-test_postfix_client_configure_mail_alias:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_root_mail_alias:obj:1"/>
          <ind:state state_ref="oval:ssg-state_root_mail_alias:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the insecure locks in /etc/exports" id="oval:ssg-test_no_insecure_locks_exports:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_no_insecure_locks_exports:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_chronyd_client_only:tst:1" comment="check if port is 0 in /etc/chrony.conf" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-obj_chronyd_port_value:obj:1"/>
          <ind:state state_ref="oval:ssg-state_chronyd_port_value_0:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_chronyd_no_chronyc_network:tst:1" comment="check if cmdport is 0 in /etc/chrony.conf" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-obj_chronyd_cmdport_value:obj:1"/>
          <ind:state state_ref="oval:ssg-state_chronyd_cmdport_value_0:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check if maxpoll is set in /etc/ntp.conf" id="oval:ssg-test_ntp_set_maxpoll:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ntp_set_maxpoll:obj:1"/>
          <ind:state state_ref="oval:ssg-state_time_service_set_maxpoll:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check if maxpoll is set in /etc/chrony.conf" id="oval:ssg-test_chrony_set_maxpoll:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_chrony_set_maxpoll:obj:1"/>
          <ind:state state_ref="oval:ssg-state_time_service_set_maxpoll:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check if all server entries have maxpoll set in /etc/ntp.conf" id="oval:ssg-test_ntp_all_server_has_maxpoll:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ntp_all_server_has_maxpoll:obj:1"/>
          <ind:state state_ref="oval:ssg-state_server_has_maxpoll:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check if all server entries have maxpoll set in /etc/chrony.conf" id="oval:ssg-test_chrony_all_server_has_maxpoll:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_chrony_all_server_has_maxpoll:obj:1"/>
          <ind:state state_ref="oval:ssg-state_server_has_maxpoll:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check if no server entries have server or pool set in /etc/chrony.conf" id="oval:ssg-test_chrony_no_server_nor_pool:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_chrony_no_server_nor_pool:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check if no server entries in /etc/ntp.conf" id="oval:ssg-test_ntp_no_server:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ntp_no_server_nor_pool:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of OPTIONS setting in the /etc/sysconfig/chronyd file" id="oval:ssg-test_chronyd_run_as_chrony_user:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_chronyd_run_as_chrony_user:obj:1"/>
          <ind:state state_ref="oval:ssg-state_chronyd_run_as_chrony_user:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_chronyd_run_as_chrony_user_config_file_exists:tst:1" check="all" check_existence="all_exist" comment="The configuration file /etc/sysconfig/chronyd exists for chronyd_run_as_chrony_user" version="1">
          <unix:object object_ref="oval:ssg-obj_chronyd_run_as_chrony_user_config_file:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Ensure at least one time source is set with server directive" id="oval:ssg-test_chronyd_server_directive_with_server:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_chronyd_server_directive:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Ensure no time source is set with pool directive" id="oval:ssg-test_chronyd_server_directive_no_pool:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_chronyd_no_pool_directive:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Ensure at least one NTP server is set" id="oval:ssg-test_chronyd_remote_server:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_chronyd_remote_server:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="ensure ipv4 restrictions" id="oval:ssg-test_ntpd_configure_restrictions_ipv4:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ntpd_configure_restrictions_ipv4:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="ensure ipv6 restrictions" id="oval:ssg-test_ntpd_configure_restrictions_ipv6:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ntpd_configure_restrictions_ipv6:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_ntpd_run_as_ntp_user_etc_sysconfig_ntpd:tst:1" version="1" check="all" comment="check /etc/sysconfig/ntpd">
          <ind:object object_ref="oval:ssg-obj_ntpd_run_as_ntp_user_etc_sysconfig_ntpd:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_ntpd_run_as_ntp_user_systemd:tst:1" version="1" check="all" comment="check /usr/lib/systemd/system/ntpd.service">
          <ind:object object_ref="oval:ssg-obj_ntpd_run_as_ntp_user_systemd:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensure more than one ntpd NTP server is set" id="oval:ssg-test_ntpd_multiple_servers:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ntpd_multiple_servers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Ensure at least one ntpd NTP server is set" id="oval:ssg-test_ntp_remote_server:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ntp_remote_server:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for .rhosts in /root" id="oval:ssg-test_no_rsh_trust_files_root:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_no_rsh_trust_files_root:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for .rhosts in /home" id="oval:ssg-test_no_rsh_trust_files_home:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_no_rsh_trust_files_home:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for /etc/hosts.equiv" id="oval:ssg-test_no_rsh_trust_files_etc:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_no_rsh_trust_files_etc:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check snmpd configuration" id="oval:ssg-test_snmp_default_communities:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_snmp_default_communities:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check snmpd configuration" id="oval:ssg-test_snmp_versions:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_snmp_versions:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="sshd uses protocol 2" id="oval:ssg-test_sshd_allow_only_protocol2:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_sshd_allow_only_protocol2:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of Compression setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_compression:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_compression:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_compression:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the RhostsRSAAuthentication[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_rhosts_rsa:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_rhosts_rsa:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of RekeyLimit setting in the file" id="oval:ssg-test_sshd_rekey_limit:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_rekey_limit:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of RekeyLimit setting in SSHD config directory" id="oval:ssg-test_sshd_rekey_limit_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_rekey_limit_config_dir:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="timeout is configured" id="oval:ssg-test_sshd_idle_timeout:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_sshd_idle_timeout:obj:1"/>
          <ind:state state_ref="oval:ssg-state_timeout_value_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_timeout_value_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="timeout is configured in config directory" id="oval:ssg-test_sshd_idle_timeout_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_sshd_idle_timeout_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_timeout_value_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_timeout_value_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the ClientAliveCountMax setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_clientalivecountmax:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_clientalivecountmax:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_clientalivecountmax:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the ClientAliveCountMax setting in the /etc/ssh/sshd_config.d/ files" id="oval:ssg-test_sshd_clientalivecountmax_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_clientalivecountmax_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_clientalivecountmax:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="LoginGraceTime is configured" id="oval:ssg-test_sshd_login_grace_time:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_sshd_login_grace_time:obj:1"/>
          <ind:state state_ref="oval:ssg-state_logingracetime_value_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_logingracetime_value_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="maxauthtries is configured" id="oval:ssg-test_sshd_max_auth_tries:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_sshd_max_auth_tries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_maxauthtries_value_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_maxauthtries_value_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="maxsessions is configured" id="oval:ssg-test_sshd_max_sessions:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_sshd_max_sessions:obj:1"/>
          <ind:state state_ref="oval:ssg-state_maxsessions_value_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_maxsessions_value_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" id="oval:ssg-tst_maxstartups_start_parameter:tst:1" version="1" comment="SSH MaxStartups start parameter is less than or equal to 10">
          <ind:object object_ref="oval:ssg-obj_sshd_config_maxstartups_first_parameter:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_sshd_config_start_parameter_valid:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" id="oval:ssg-tst_maxstartups_rate_parameter:tst:1" version="1" comment="SSH MaxStartups rate parameter is greater than or equal to 30">
          <ind:object object_ref="oval:ssg-obj_sshd_config_maxstartups_second_parameter:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_sshd_config_rate_parameter_valid:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" id="oval:ssg-tst_maxstartups_full_parameter:tst:1" version="1" comment="SSH MaxStartups full parameter is less than or equal to 100">
          <ind:object object_ref="oval:ssg-obj_sshd_config_maxstartups_third_parameter:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_sshd_config_full_parameter_valid:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of match setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_use_directory_configuration_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_use_directory_configuration_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of UsePrivilegeSeparation setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_use_priv_separation:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_use_priv_separation:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_use_priv_separation:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="test the value of         certificate_verification in sssd configuration" id="oval:ssg-test_sssd_certificate_verification:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sssd_certificate_verification:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sssd_certificate_verification:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of pam_cert_auth setting in the /etc/sssd/sssd.conf file" id="oval:ssg-test_sssd_enable_smartcards:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sssd_enable_smartcards:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of memcache_timeout setting in the /etc/sssd/sssd.conf file" id="oval:ssg-test_sssd_memcache_timeout:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sssd_memcache_timeout:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sssd_memcache_timeout:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of offline_credentials_expiration setting in the /etc/sssd/sssd.conf file" id="oval:ssg-test_sssd_offline_cred_expiration:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sssd_offline_cred_expiration:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sssd_run_as_sssd_user:tst:1" comment="tests the value of user setting in SSSD config files" check_existence="at_least_one_exists" check="all" version="1">
          <ind:object object_ref="oval:ssg-obj_sssd_user_value:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sssd_user_value:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of ssh_known_hosts_timeout setting in the /etc/sssd/sssd.conf file" id="oval:ssg-test_sssd_ssh_known_hosts_timeout:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sssd_ssh_known_hosts_timeout:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sssd_ssh_known_hosts_timeout:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of AuditBackend setting in the /etc/usbguard/usbguard-daemon.conf file" id="oval:ssg-test_configure_usbguard_auditbackend:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_configure_usbguard_auditbackend:obj:1"/>
          <ind:state state_ref="oval:ssg-state_configure_usbguard_auditbackend:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_configure_usbguard_auditbackend_config_file_exists:tst:1" check="all" check_existence="all_exist" comment="The configuration file /etc/usbguard/usbguard-daemon.conf exists for configure_usbguard_auditbackend" version="1">
          <unix:object object_ref="oval:ssg-obj_configure_usbguard_auditbackend_config_file:obj:1"/>
        </unix:file_test>
        <unix:symlink_test check="all" check_existence="all_exist" comment="default.target systemd softlink exists" id="oval:ssg-test_disable_xwindows_runlevel_target:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_disable_xwindows_runlevel_target:obj:1"/>
          <unix:state state_ref="oval:ssg-state_disable_xwindows_runlevel_target:ste:1"/>
        </unix:symlink_test>
        <ind:textfilecontent54_test check="at least one" check_existence="at_least_one_exists" comment="correct banner in /etc/issue" id="oval:ssg-test_banner_etc_issue:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_banner_etc_issue:obj:1"/>
          <ind:state state_ref="oval:ssg-state_banner_etc_issue:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="any_exist" comment="correct banner in /etc/motd" id="oval:ssg-test_banner_etc_motd:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_banner_etc_motd:obj:1"/>
          <ind:state state_ref="oval:ssg-state_banner_etc_motd:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="GUI banner is enabled" id="oval:ssg-test_banner_gui_enabled:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_banner_gui_enabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="GUI banner cannot be changed by user" id="oval:ssg-test_prevent_user_banner_gui_enabled_change:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_banner_gui_enabled_change:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="GUI banner cannot be changed by user" id="oval:ssg-test_prevent_user_banner_change:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_banner_change:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="login banner text is correctly set" id="oval:ssg-test_gdm_login_banner_text_setting:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_gdm_login_banner_text_setting:obj:1"/>
          <ind:state state_ref="oval:ssg-state_gdm_login_banner_text_setting:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check absence of conf pam_succeed_if in /etc/pam.d/sudo" id="oval:ssg-test_disallow_bypass_password_sudo:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disallow_bypass_password_sudo:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="Check the pam_lastlog configuration" id="oval:ssg-test_display_login_attempts:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_display_login_attempts:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Forbid 'silent' option for pam_lastlog" id="oval:ssg-test_display_login_attempts_silent:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_display_login_attempts_silent:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="tests the presence of pam_namespace.so module in the /etc/pam.d/login file" id="oval:ssg-test_enable_pam_namespace:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_enable_pam_namespace:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/password-auth" id="oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_accounts_password_pam_pwhistory_remember_password_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_password_pam_pwhistory_remember_password_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth" id="oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_accounts_password_pam_pwhistory_remember_system_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_password_pam_pwhistory_remember_system_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_unix_remember:tst:1" check="all" check_existence="all_exist" comment="Test if remember attribute of pam_unix.so is set correctly in /etc/pam.d/system-auth" version="1">
          <ind:object object_ref="oval:ssg-object_accounts_password_pam_unix_remember:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_password_pam_unix_remember:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_pwhistory_remember:tst:1" check="all" check_existence="all_exist" comment="Test if remember attribute of pam_pwhistory.so is set correctly in /etc/pam.d/system-auth" version="1">
          <ind:object object_ref="oval:ssg-object_accounts_password_pam_pwhistory_remember:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_password_pam_unix_remember:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_unix_auth:tst:1" comment="No more than one pam_unix.so is expected in auth section of system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_unix_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_unix_auth:tst:1" comment="No more than one pam_unix.so is expected in auth section of password-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_unix_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_faillock_auth:tst:1" comment="One and only one occurrence is expected in auth section of system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_faillock_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_faillock_account:tst:1" comment="One and only one occurrence is expected in auth section of system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_faillock_account:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_faillock_auth:tst:1" comment="One and only one occurrence is expected in auth section of password-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_faillock_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_faillock_account:tst:1" comment="One and only one occurrence is expected in auth section of password-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_faillock_account:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_pamd_system:tst:1" comment="Check the expected deny value in system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_system:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_deny_parameter_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_deny_parameter_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_pamd_system:tst:1" comment="Check the absence of deny parameter in system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_system:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_pamd_password:tst:1" comment="Check the expected deny value in password-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_password:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_deny_parameter_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_deny_parameter_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_pamd_password:tst:1" comment="Check the absence of deny parameter in password-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_password:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_faillock_conf:tst:1" comment="Check the expected deny value in in /etc/security/faillock.conf">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_faillock_conf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_deny_parameter_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_deny_parameter_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_faillock_conf:tst:1" comment="Check the absence of deny parameter in /etc/security/faillock.conf">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_faillock_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_system_pam_unix_auth:tst:1" comment="No more than one pam_unix.so is expected in auth section of system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_system_pam_unix_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_password_pam_unix_auth:tst:1" comment="No more than one pam_unix.so is expected in auth section of password-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_password_pam_unix_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_auth:tst:1" comment="One and only one pattern occurrence is expected in auth section of system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_account:tst:1" comment="One and only one pattern occurrence is expected in account section of system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_account:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_auth:tst:1" comment="One and only one pattern occurrence is expected in auth section of system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_account:tst:1" comment="One and only one pattern occurrence is expected in account section of password-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_account:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_pamd_system:tst:1" comment="Check the expected even_deny_root parameter in system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_pamd_system:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_no_pamd_system:tst:1" comment="Check the absence of even_deny_root parameter in system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_pamd_system:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_pamd_password:tst:1" comment="Check the expected even_deny_root parameter in password-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_pamd_password:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_no_pamd_password:tst:1" comment="Check the absence of even_deny_root parameter in password-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_pamd_password:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_faillock_conf:tst:1" comment="Check the expected even_deny_root parameter in /etc/security/faillock.conf">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_faillock_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_no_faillock_conf:tst:1" comment="Check the absence of even_deny_root parameter in /etc/security/faillock.conf">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_faillock_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_system_pam_unix_auth:tst:1" comment="No more than one pam_unix.so is expected in auth section of system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_system_pam_unix_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_password_pam_unix_auth:tst:1" comment="No more than one pam_unix.so is expected in auth section of password-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_password_pam_unix_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_system_pam_faillock_auth:tst:1" comment="One and only one pattern occurrence is expected in auth section of system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_system_pam_faillock_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_system_pam_faillock_account:tst:1" comment="One and only one pattern occurrence is expected in account section of system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_system_pam_faillock_account:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_password_pam_faillock_auth:tst:1" comment="One and only one pattern occurrence is expected in auth section of system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_password_pam_faillock_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_password_pam_faillock_account:tst:1" comment="One and only one pattern occurrence is expected in account section of password-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_password_pam_faillock_account:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_parameter_faillock_conf:tst:1" comment="Check the expected local_users_only parameter in /etc/security/faillock.conf">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_parameter_faillock_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_unix_auth:tst:1" comment="No more than one pam_unix.so is expected in auth section of system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_interval_system_pam_unix_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_unix_auth:tst:1" comment="No more than one pam_unix.so is expected in auth section of password-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_interval_password_pam_unix_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_faillock_auth:tst:1" comment="One and only one occurrence is expected in auth section of system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_interval_system_pam_faillock_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_faillock_account:tst:1" comment="One and only one occurrence is expected in auth section of system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_interval_system_pam_faillock_account:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_faillock_auth:tst:1" comment="One and only one occurrence is expected in auth section of password-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_interval_password_pam_faillock_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_faillock_account:tst:1" comment="One and only one occurrence is expected in auth section of password-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_interval_password_pam_faillock_account:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_pamd_system:tst:1" comment="Check the expected fail_interval value in system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_pamd_system:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_interval_parameter_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_pamd_system:tst:1" comment="Check the absence of fail_interval parameter in system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_pamd_system:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_pamd_password:tst:1" comment="Check the expected fail_interval value in password-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_pamd_password:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_interval_parameter_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_pamd_password:tst:1" comment="Check the absence of fail_interval parameter in password-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_pamd_password:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_faillock_conf:tst:1" comment="Check the expected fail_interval value in in /etc/security/faillock.conf">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_faillock_conf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_interval_parameter_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_faillock_conf:tst:1" comment="Check the absence of fail_interval parameter in /etc/security/faillock.conf">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_faillock_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_unix_auth:tst:1" comment="No more than one pam_unix.so is expected in auth section of system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_unix_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_unix_auth:tst:1" comment="No more than one pam_unix.so is expected in auth section of password-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_unix_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_auth:tst:1" comment="One and only one occurrence is expected in auth section of system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_account:tst:1" comment="One and only one occurrence is expected in auth section of system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_account:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_auth:tst:1" comment="One and only one occurrence is expected in auth section of password-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_account:tst:1" comment="One and only one occurrence is expected in auth section of password-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_account:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_system:tst:1" comment="Check the expected unlock_time value in system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_system:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_unlock_time_parameter_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_pamd_system:tst:1" comment="Check the absence of unlock_time parameter in system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_system:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_password:tst:1" comment="Check the expected unlock_time value in password-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_password:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_unlock_time_parameter_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_pamd_password:tst:1" comment="Check the absence of unlock_time parameter in password-auth">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_password:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_faillock_conf:tst:1" comment="Check the expected unlock_time value in in /etc/security/faillock.conf">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_faillock_conf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_unlock_time_parameter_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1" id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_faillock_conf:tst:1" comment="Check the absence of unlock_time parameter in /etc/security/faillock.conf">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_faillock_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" version="1" id="oval:ssg-test_accounts_password_pam_pwquality_password_auth:tst:1" comment="check the configuration of /etc/pam.d/password-auth">
          <ind:object object_ref="oval:ssg-object_accounts_password_pam_pwquality_password_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" version="1" id="oval:ssg-test_accounts_password_pam_pwquality_system_auth:tst:1" comment="check the configuration of /etc/pam.d/system-auth">
          <ind:object object_ref="oval:ssg-object_accounts_password_pam_pwquality_system_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" id="oval:ssg-test_password_pam_pwquality_retry_system_auth:tst:1" version="1" comment="check the configuration of /etc/pam.d/system-auth">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_retry_system_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_retry_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_retry_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" version="1" id="oval:ssg-test_password_pam_pwquality_retry_pwquality_conf:tst:1" comment="check the configuration of /etc/security/pwquality.conf">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_retry_pwquality_conf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_retry_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_retry_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="The password hashing algorithm should be set correctly in /etc/libuser.conf" id="oval:ssg-test_etc_libuser_conf_cryptstyle:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_etc_libuser_conf_cryptstyle:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_etc_login_defs_encrypt_method:tst:1" check="all" comment="The value of ENCRYPT_METHOD should be set appropriately in /etc/login.defs" version="1">
          <ind:object object_ref="oval:ssg-object_last_encrypt_method_instance_value:obj:1"/>
          <ind:state state_ref="oval:ssg-state_last_encrypt_method_instance_value:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check /etc/pam.d/password-auth for correct settings" id="oval:ssg-test_pam_unix_passwordauth_sha512:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_pam_unix_passwordauth_sha512:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check /etc/pam.d/system-auth for correct settings" id="oval:ssg-test_pam_unix_sha512:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_pam_unix_sha512:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:symlink_test check="all" check_existence="all_exist" comment="Disable Ctrl-Alt-Del key sequence override exists" id="oval:ssg-test_disable_ctrlaltdel_exists:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_disable_ctrlaltdel_exists:obj:1"/>
          <unix:state state_ref="oval:ssg-state_disable_ctrlaltdel_exists:ste:1"/>
        </unix:symlink_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux:tst:1" comment="Check systemd.confirm_spawn=(1|true|yes|on) not in GRUB_CMDLINE_LINUX" check="all" check_existence="none_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_disable_interactive_boot_grub_cmdline_linux:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux_default:tst:1" comment="Check systemd.confirm_spawn=(1|true|yes|on) not in GRUB_CMDLINE_LINUX_DEFAULT" check="all" check_existence="none_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_disable_interactive_boot_grub_cmdline_linux_default:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests that     /usr/lib/systemd/systemd-sulogin-shell     was not removed from the default systemd emergency.service to ensure that a   password must be entered to access single user mode" id="oval:ssg-test_require_emergency_service:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_require_emergency_service:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests that the systemd emergency.service is in the emergency.target" id="oval:ssg-test_require_emergency_service_emergency_target:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_require_emergency_service_emergency:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for emergency.service in /etc/systemd/system" id="oval:ssg-test_no_custom_emergency_service:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_no_custom_emergency_service:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for emergency.target in /etc/systemd/system" id="oval:ssg-test_no_custom_emergency_target:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_no_custom_emergency_target:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests that     /usr/lib/systemd/systemd-sulogin-shell     was not removed from the default systemd rescue.service to ensure that a   password must be entered to access single user mode" id="oval:ssg-test_require_rescue_service:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_require_rescue_service:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests that the systemd rescue.service is in the runlevel1.target" id="oval:ssg-test_require_rescue_service_runlevel1:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_require_rescue_service_runlevel1:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for rescue.service in /etc/systemd/system" id="oval:ssg-test_no_custom_rescue_service:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_no_custom_rescue_service:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for runlevel1.target in /etc/systemd/system" id="oval:ssg-test_no_custom_runlevel1_target:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_no_custom_runlevel1_target:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check tmux is configured to exec on the last line of /etc/bashrc" id="oval:ssg-test_configure_bashrc_exec_tmux:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_configure_bashrc_exec_tmux:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check lock-after-time is set to 900 in /etc/tmux.conf" id="oval:ssg-test_configure_tmux_lock_after_time:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_configure_tmux_lock_after_time:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check lock-command is set to vlock in /etc/tmux.conf" id="oval:ssg-test_configure_tmux_lock_command:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_configure_tmux_lock_command:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check_existence="none_exist" check="all" comment="check that tmux is not listed in /etc/shells" id="oval:ssg-test_no_tmux_in_shells:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_no_tmux_in_shells:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_opensc_card_drivers:tst:1" comment="Check that card_drivers is configured for opensc" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_configure_opensc_card_drivers:obj:1"/>
          <ind:state state_ref="oval:ssg-state_configure_opensc_card_drivers:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_opensc_nss_db:tst:1" comment="Check opensc library is configured in /etc/pki/nssdb/pkcs11.txt" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_configure_opensc_nss_db:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_force_opensc_card_drivers:tst:1" comment="Check that force_card_driver is configured for opensc" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_force_opensc_card_drivers:obj:1"/>
          <ind:state state_ref="oval:ssg-state_force_opensc_card_drivers:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_pam_pkcs11_cert_policy_ocsp_on:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test ocsp_on in /etc/pam_pkcs11/pkcs11.conf" version="1">
          <ind:object object_ref="oval:ssg-object_pam_pkcs11_cert_policy_ocsp_on:obj:1"/>
          <ind:state state_ref="oval:ssg-state_pam_pkcs11_cert_policy_ocsp_on:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_smart_card_enabled_system_auth:tst:1" check="all" check_existence="all_exist" comment="Test smartcard authentication is enabled in /etc/pam.d/system-auth file" version="1">
          <ind:object object_ref="oval:ssg-object_smart_card_enabled_system_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_smart_card_required_system_auth:tst:1" check="all" check_existence="all_exist" comment="Test smartcard authentication is required in /etc/pam.d/system-auth file" version="1">
          <ind:object object_ref="oval:ssg-object_smart_card_required_system_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_smart_card_required_smartcard_auth:tst:1" check="all" check_existence="all_exist" comment="Test smartcard authentication is required in /etc/pam.d/smartcard-auth file" version="1">
          <ind:object object_ref="oval:ssg-object_smart_card_required_smartcard_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_etc_passwd_no_duplicate_user_ids:tst:1" check="all" check_existence="all_exist" comment="There should not exist duplicate user ids in /etc/passwd" version="1">
          <ind:object object_ref="oval:ssg-obj_count_of_all_uids:obj:1"/>
          <ind:state state_ref="oval:ssg-state_no_duplicate_uids:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_authorized_local_users:tst:1" version="1" check_existence="any_exist" check="all" comment="query /etc/passwd">
          <ind:object object_ref="oval:ssg-object_accounts_authorized_local_users:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_authorized_local_users:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_etc_group_no_duplicate_group_ids:tst:1" check="all" check_existence="all_exist" comment="There should not exist duplicate group ids in /etc/passwd" version="1">
          <ind:object object_ref="oval:ssg-obj_count_of_all_group_ids:obj:1"/>
          <ind:state state_ref="oval:ssg-state_no_duplicate_group_ids:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_etc_group_no_duplicate_group_names:tst:1" check="all" check_existence="all_exist" comment="There should not exist duplicate group names in /etc/passwd" version="1">
          <ind:object object_ref="oval:ssg-obj_count_of_all_group_names:obj:1"/>
          <ind:state state_ref="oval:ssg-state_no_duplicate_group_names:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="the value INACTIVE parameter should be set appropriately in /etc/default/useradd" id="oval:ssg-test_etc_default_useradd_inactive:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_etc_default_useradd_inactive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_etc_default_useradd_inactive:ste:1"/>
          <ind:state state_ref="oval:ssg-state_etc_default_useradd_inactive_nonnegative:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1" check="all" check_existence="all_exist" comment="There should not exist duplicate user name entries in /etc/passwd" version="1">
          <ind:object object_ref="oval:ssg-object_count_of_all_usernames_from_etc_passwd:obj:1"/>
          <ind:state state_ref="oval:ssg-state_etc_passwd_no_duplicate_user_names:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_pass_max_days:tst:1" check="all" comment="The value of PASS_MAX_DAYS should be set appropriately in /etc/login.defs" version="1">
          <ind:object object_ref="oval:ssg-object_last_pass_max_days_instance_value:obj:1"/>
          <ind:state state_ref="oval:ssg-state_last_pass_max_days_instance_value:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_pass_min_days:tst:1" check="all" comment="The value of PASS_MIN_DAYS should be set appropriately in /etc/login.defs" version="1">
          <ind:object object_ref="oval:ssg-object_last_pass_min_days_instance_value:obj:1"/>
          <ind:state state_ref="oval:ssg-state_last_pass_min_days_instance_value:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_pass_min_len:tst:1" check="all" comment="The value of PASS_MIN_LEN should be set appropriately in /etc/login.defs" version="1">
          <ind:object object_ref="oval:ssg-object_last_pass_min_len_instance_value:obj:1"/>
          <ind:state state_ref="oval:ssg-state_last_pass_min_len_instance_value:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_pass_warn_age:tst:1" check="all" comment="The value of PASS_WARN_AGE should be set appropriately in /etc/login.defs" version="1">
          <ind:object object_ref="oval:ssg-object_last_pass_warn_age_instance_value:obj:1"/>
          <ind:state state_ref="oval:ssg-state_last_pass_warn_age_instance_value:ste:1"/>
        </ind:variable_test>
        <unix:password_test check="all" comment="password hashes are shadowed" id="oval:ssg-test_accounts_password_all_shadowed:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_accounts_password_all_shadowed:obj:1"/>
          <unix:state state_ref="oval:ssg-state_accounts_password_all_shadowed:ste:1"/>
        </unix:password_test>
        <unix:shadow_test check="all" check_existence="none_exist" comment="password hashes are shadowed using sha512" id="oval:ssg-test_accounts_password_all_shadowed_sha512:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_accounts_password_all_shadowed_sha512:obj:1"/>
        </unix:shadow_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_auth_pam_unix_rounds_is_set:tst:1" check="all" check_existence="all_exist" comment="Test if rounds attribute of pam_unix.so is set correctly in /etc/pam.d/password-auth " version="1">
          <ind:object object_ref="oval:ssg-object_password_auth_pam_unix_rounds:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_auth_pam_unix_rounds:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_auth_pam_unix_rounds_is_default:tst:1" check="all" check_existence="none_exist" comment="Test if rounds attribute of pam_unix.so is not set in /etc/pam.d/password-auth " version="1">
          <ind:object object_ref="oval:ssg-object_password_auth_pam_unix_rounds:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" id="oval:ssg-test_password_auth_default_pam_unix_rounds_var:tst:1" version="1" comment="Check if value of var_password_pam_unix_rounds is the system's default">
          <ind:object object_ref="oval:ssg-object_password_auth_default_pam_unix_rounds_var:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_auth_default_pam_unix_rounds_var:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_system_auth_pam_unix_rounds_is_set:tst:1" check="all" check_existence="all_exist" comment="Test if rounds attribute of pam_unix.so is set correctly in /etc/pam.d/system-auth" version="1">
          <ind:object object_ref="oval:ssg-object_system_auth_pam_unix_rounds:obj:1"/>
          <ind:state state_ref="oval:ssg-state_system_auth_pam_unix_rounds:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_system_auth_pam_unix_rounds_is_default:tst:1" check="all" check_existence="none_exist" comment="Test if rounds attribute of pam_unix.so is not set in /etc/pam.d/system-auth" version="1">
          <ind:object object_ref="oval:ssg-object_system_auth_pam_unix_rounds:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" id="oval:ssg-test_system_auth_default_pam_unix_rounds_var:tst:1" version="1" comment="Check if value of var_password_pam_unix_rounds is the system's default">
          <ind:object object_ref="oval:ssg-object_system_auth_default_pam_unix_rounds_var:obj:1"/>
          <ind:state state_ref="oval:ssg-state_system_auth_default_pam_unix_rounds_var:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_gid_passwd_group_same:tst:1" check="all" check_existence="all_exist" comment="Verify all GIDs referenced in /etc/passwd are defined in /etc/group" version="1">
          <ind:object object_ref="oval:ssg-object_gid_passwd_group_same:obj:1"/>
          <ind:state state_ref="oval:ssg-state_gid_passwd_group_same:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1" id="oval:ssg-test_no_empty_passwords:tst:1" comment="make sure nullok is not used in /etc/pam.d/system-auth">
          <ind:object object_ref="oval:ssg-object_no_empty_passwords:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1" id="oval:ssg-test_no_empty_passwords_etc_shadow:tst:1" comment="make sure there aren't blank or null passwords in /etc/shadow">
          <ind:object object_ref="oval:ssg-obj_no_empty_passwords_etc_shadow:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check for existence of lines starting with +" id="oval:ssg-test_no_legacy_plus_entries_etc_group:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_no_legacy_plus_entries_etc_group:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check for existence of lines starting with +" id="oval:ssg-test_no_legacy_plus_entries_etc_passwd:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_no_legacy_plus_entries_etc_passwd:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check for existence of lines starting with +" id="oval:ssg-test_no_legacy_plus_entries_etc_shadow:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_no_legacy_plus_entries_etc_shadow:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for .netrc in /home" id="oval:ssg-test_no_netrc_files_home:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_no_netrc_files_home:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="test that there are no accounts with UID 0 except root in the /etc/passwd file" id="oval:ssg-test_accounts_no_uid_except_root:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_accounts_no_uid_except_root:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_root_gid_zero:tst:1" check="all" comment="test that there are no accounts with UID 0 except root in the /etc/passwd file" version="1">
          <ind:object object_ref="oval:ssg-object_accounts_root_gid_zero:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_root_gid_zero:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="/etc/securetty file exists" id="oval:ssg-test_etc_securetty_exists:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_etc_securetty_exists:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="no entries in /etc/securetty" id="oval:ssg-test_no_direct_root_logins:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_no_direct_root_logins:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test state_operator="OR" id="oval:ssg-test_shell_defined_default_uid_range:tst:1" check="all" check_existence="any_exist" comment="&lt;0, UID_MIN - 1&gt; system UIDs having shell set" version="1">
          <ind:object object_ref="oval:ssg-object_etc_passwd_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_uid_less_than_zero:ste:1"/>
          <ind:state state_ref="oval:ssg-state_uid_greater_than_or_equal_uid_min:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sys_uid_min_not_defined:tst:1" comment="SYS_UID_MIN not defined in /etc/login.defs" check="all" check_existence="none_exist" version="1">
          <ind:object object_ref="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sys_uid_max_not_defined:tst:1" comment="SYS_UID_MAX not defined in /etc/login.defs" check="all" check_existence="none_exist" version="1">
          <ind:object object_ref="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test state_operator="OR" id="oval:ssg-test_shell_defined_reserved_uid_range:tst:1" check="all" check_existence="any_exist" comment="&lt;0, SYS_UID_MIN&gt; system UIDs having shell set" version="1">
          <ind:object object_ref="oval:ssg-object_etc_passwd_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_uid_less_than_zero:ste:1"/>
          <ind:state state_ref="oval:ssg-state_uid_greater_than_or_equal_sys_uid_min:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test state_operator="OR" id="oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1" check="all" check_existence="any_exist" comment="&lt;SYS_UID_MIN, SYS_UID_MAX&gt; system UIDS having shell set" version="1">
          <ind:object object_ref="oval:ssg-object_etc_passwd_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_uid_less_than_sys_uid_min:ste:1"/>
          <ind:state state_ref="oval:ssg-state_uid_greater_than_or_equal_sys_uid_max:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="serial ports /etc/securetty" id="oval:ssg-test_serial_ports_etc_securetty:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_serial_ports_etc_securetty:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="virtual consoles /etc/securetty" id="oval:ssg-test_virtual_consoles_etc_securetty:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_virtual_consoles_etc_securetty:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check /etc/pam.d/su for correct setting" id="oval:ssg-test_use_pam_wheel_for_su:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_use_pam_wheel_for_su:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Check value of CREATE_HOME in /etc/login.defs" id="oval:ssg-test_accounts_have_homedir_login_defs:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_accounts_have_homedir_login_defs:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check FAIL_DELAY in /etc/login.defs" id="oval:ssg-test_accounts_logon_fail_delay:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_accounts_logon_fail_delay:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_logon_fail_delay:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="the value maxlogins should be set appropriately in /etc/security/limits.conf" id="oval:ssg-test_maxlogins:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_etc_security_limits_conf_maxlogins:obj:1"/>
          <ind:state state_ref="oval:ssg-state_maxlogins:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf" id="oval:ssg-test_limitsd_maxlogins:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_etc_security_limitsd_conf_maxlogins:obj:1"/>
          <ind:state state_ref="oval:ssg-state_maxlogins:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf" id="oval:ssg-test_limitsd_maxlogins_exists:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_etc_security_limitsd_conf_maxlogins_exists:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test comment="Check that /tmp/tmp-inst exists and has mode 000" check="all" check_existence="only_one_exists" id="oval:ssg-test_tmp_inst:tst:1" version="1">
          <unix:object object_ref="oval:ssg-obj_tmp_inst:obj:1"/>
          <unix:state state_ref="oval:ssg-state_tmp_inst:ste:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" comment="Check configuration of /tmp in /etc/security/namespace.conf file" id="oval:ssg-test_tmp_in_namespace_conf:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_tmp_in_namespace_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test comment="Check that /tmp-inst exists and has mode 000" check="all" check_existence="only_one_exists" id="oval:ssg-test_var_tmp_tmp_inst:tst:1" version="1">
          <unix:object object_ref="oval:ssg-obj_var_tmp_tmp_inst:obj:1"/>
          <unix:state state_ref="oval:ssg-state_var_tmp_tmp_inst:ste:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" comment="Check configuration of /tmp in /etc/security/namespace.conf file" id="oval:ssg-test_var_tmp_in_namespace_conf:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_var_tmp_in_namespace_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="TMOUT in /etc/profile" id="oval:ssg-test_etc_profile_tmout:tst:1" version="2">
          <ind:object object_ref="oval:ssg-object_etc_profile_tmout:obj:1"/>
          <ind:state state_ref="oval:ssg-state_etc_profile_tmout:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="TMOUT in /etc/profile.d/*.sh" id="oval:ssg-test_etc_profiled_tmout:tst:1" version="2">
          <ind:object object_ref="oval:ssg-object_etc_profiled_tmout:obj:1"/>
          <ind:state state_ref="oval:ssg-state_etc_profile_tmout:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_file_permissions_home_dirs:tst:1" check="all" check_existence="any_exist" version="1" comment="All home directories have proper permissions">
          <unix:object object_ref="oval:ssg-object_file_permissions_home_dirs_dirs:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_permissions_home_dirs_dirs:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Check if there aren't directories in root's path having write permission set for group or other" id="oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_accounts_root_path_dirs_no_group_other_write:obj:1"/>
        </unix:file_test>
        <ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH starts with : or ." id="oval:ssg-test_env_var_begins:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
          <ind:state state_ref="oval:ssg-state_begins_colon_period:ste:1"/>
        </ind:environmentvariable58_test>
        <ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH doesn't contain : twice in a row" id="oval:ssg-test_env_var_contains_doublecolon:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
          <ind:state state_ref="oval:ssg-state_contains_double_colon:ste:1"/>
        </ind:environmentvariable58_test>
        <ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH doesn't contain . twice in a row" id="oval:ssg-test_env_var_contains_doubleperiod:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
          <ind:state state_ref="oval:ssg-state_contains_double_period:ste:1"/>
        </ind:environmentvariable58_test>
        <ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH ends with : or ." id="oval:ssg-test_env_var_ends:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
          <ind:state state_ref="oval:ssg-state_ends_colon_period:ste:1"/>
        </ind:environmentvariable58_test>
        <ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH starts with an absolute path /" id="oval:ssg-test_env_var_begins_slash:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
          <ind:state state_ref="oval:ssg-state_begins_slash:ste:1"/>
        </ind:environmentvariable58_test>
        <ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH contains relative paths" id="oval:ssg-test_env_var_contains_relative_path:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
          <ind:state state_ref="oval:ssg-state_contains_relative_path:ste:1"/>
        </ind:environmentvariable58_test>
        <ind:variable_test id="oval:ssg-tst_accounts_umask_etc_login_defs:tst:1" version="1" check="all" comment="Test the retrieved /etc/login.defs umask value(s) match the var_accounts_user_umask requirement">
          <ind:object object_ref="oval:ssg-obj_accounts_umask_etc_login_defs:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_accounts_umask_etc_login_defs:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-tst_accounts_umask_etc_profile:tst:1" version="1" check="all" comment="Test the retrieved /etc/profile umask value(s) match the var_accounts_user_umask requirement">
          <ind:object object_ref="oval:ssg-obj_accounts_umask_etc_profile:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_accounts_umask_etc_profile:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check that no audit rule exists in /etc/audit/rules.d/*.rules that disables all syscall auditing" id="oval:ssg-test_enable_syscall_audit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_enable_syscall_audit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check that no audit rule exists in /etc/audit/audit.rules that disables all syscall auditing" id="oval:ssg-test_enable_syscall_audit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_enable_syscall_audit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules configuration locked" id="oval:ssg-test_ari_locked_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_ari_locked_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl configuration locked" id="oval:ssg-test_ari_locked_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_ari_locked_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit selinux changes augenrules" id="oval:ssg-test_armm_selinux_watch_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_armm_selinux_watch_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit selinux changes auditctl" id="oval:ssg-test_armm_selinux_watch_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_armm_selinux_watch_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/issue augenrules" id="oval:ssg-test_arnm_etc_issue_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arnm_etc_issue_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/issue.net augenrules" id="oval:ssg-test_arnm_etc_issue_net_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arnm_etc_issue_net_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/hosts augenrules" id="oval:ssg-test_arnm_etc_hosts_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arnm_etc_hosts_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/sysconfig/network augenrules" id="oval:ssg-test_arnm_etc_sysconfig_network_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arnm_etc_sysconfig_network_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/issue auditctl" id="oval:ssg-test_arnm_etc_issue_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arnm_etc_issue_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/issue.net auditctl" id="oval:ssg-test_arnm_etc_issue_net_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arnm_etc_issue_net_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/hosts auditctl" id="oval:ssg-test_arnm_etc_hosts_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arnm_etc_hosts_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/sysconfig/network auditctl" id="oval:ssg-test_arnm_etc_sysconfig_network_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arnm_etc_sysconfig_network_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules utmp" id="oval:ssg-test_arse_utmp_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arse_utmp_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules btmp" id="oval:ssg-test_arse_btmp_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arse_btmp_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules wtmp" id="oval:ssg-test_arse_wtmp_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arse_wtmp_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl utmp" id="oval:ssg-test_arse_utmp_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arse_utmp_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl btmp" id="oval:ssg-test_arse_btmp_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arse_btmp_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl wtmp" id="oval:ssg-test_arse_wtmp_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arse_wtmp_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules sudoers" id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules sudoers" id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_d_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl sudoers" id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl sudoers" id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_d_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules /etc/group" id="oval:ssg-test_audit_rules_usergroup_modification_etc_group_augen:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_group_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules /etc/passwd" id="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_augen:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules /etc/gshadow" id="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_augen:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules /etc/shadow" id="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_augen:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules /etc/security/opasswd" id="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_augen:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/group" id="oval:ssg-test_audit_rules_usergroup_modification_etc_group_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_group_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/passwd" id="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/gshadow" id="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/shadow" id="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/security/opasswd" id="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_directory_acccess_var_log_audit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_directory_acccess_var_log_audit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_directory_acccess_var_log_audit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_directory_acccess_var_log_audit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="/var/log/audit files mode 0750" id="oval:ssg-test_dir_permissions_var_log_audit-non_root:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_var_log_audit_directory-non_root:obj:1"/>
          <unix:state state_ref="oval:ssg-state_not_mode_0750:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="/var/log/audit files mode 0750" id="oval:ssg-test_dir_permissions_audit_log-non_root:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_audit_log_directory-non_root:obj:1"/>
          <unix:state state_ref="oval:ssg-state_not_mode_0750:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="/var/log/audit mode 0700" id="oval:ssg-test_dir_permissions_var_log_audit:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_var_log_audit_directory:obj:1"/>
          <unix:state state_ref="oval:ssg-state_not_mode_0700:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="/var/log/audit mode 0700" id="oval:ssg-test_dir_permissions_audit_log:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_audit_log_directory:obj:1"/>
          <unix:state state_ref="oval:ssg-state_not_mode_0700:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit directories uid root gid root" id="oval:ssg-test_ownership_var_log_audit_directories:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_directories:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit files uid root gid root" id="oval:ssg-test_ownership_var_log_audit_files:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_files:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="/var/log/audit directories uid root gid root" id="oval:ssg-test_ownership_var_log_audit_directories-non_root:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_directories-non_root:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="/var/log/audit files uid root gid root" id="oval:ssg-test_ownership_var_log_audit_files-non_root:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_files-non_root:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="audit log files mode 0640" id="oval:ssg-test_file_permissions_audit_log-non_root:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_audit_log_files-non_root:obj:1"/>
          <unix:state state_ref="oval:ssg-state_not_mode_0640:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="/var/log/audit files mode 0640" id="oval:ssg-test_file_permissions_var_log_audit-non_root:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_var_log_audit_files-non_root:obj:1"/>
          <unix:state state_ref="oval:ssg-state_not_mode_0640:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="audit log files mode 0600" id="oval:ssg-test_file_permissions_audit_log:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_audit_log_files:obj:1"/>
          <unix:state state_ref="oval:ssg-state_not_mode_0600:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="/var/log/audit files mode 0600" id="oval:ssg-test_file_permissions_var_log_audit:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_var_log_audit_files:obj:1"/>
          <unix:state state_ref="oval:ssg-state_not_mode_0600:ste:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit umount" id="oval:ssg-test_32bit_ardm_umount_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_umount_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit umount" id="oval:ssg-test_32bit_ardm_umount_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_umount_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit delete_module" id="oval:ssg-test_32bit_ardm_delete_module_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_delete_module_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit delete_module" id="oval:ssg-test_64bit_ardm_delete_module_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_delete_module_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit delete_module" id="oval:ssg-test_32bit_ardm_delete_module_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_delete_module_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit delete_module" id="oval:ssg-test_64bit_ardm_delete_module_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_delete_module_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit finit_module" id="oval:ssg-test_32bit_ardm_finit_module_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_finit_module_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit finit_module" id="oval:ssg-test_64bit_ardm_finit_module_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_finit_module_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit finit_module" id="oval:ssg-test_32bit_ardm_finit_module_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_finit_module_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit finit_module" id="oval:ssg-test_64bit_ardm_finit_module_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_finit_module_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit init_module" id="oval:ssg-test_32bit_ardm_init_module_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_init_module_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit init_module" id="oval:ssg-test_64bit_ardm_init_module_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_init_module_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit init_module" id="oval:ssg-test_32bit_ardm_init_module_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_init_module_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit init_module" id="oval:ssg-test_64bit_ardm_init_module_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_init_module_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="audit augenrules suid sgid" id="oval:ssg-test_arpc_suid_sgid_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arpc_suid_sgid_augenrules:obj:1"/>
          <ind:state state_ref="oval:ssg-state_audit_rules_privileged_commands:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" id="oval:ssg-test_arpc_bin_count_equals_rules_count_augenrules:tst:1" comment="audit augenrules binaries count matches rules count" version="1">
          <ind:object object_ref="oval:ssg-object_count_of_suid_sgid_binaries_on_system:obj:1"/>
          <ind:state state_ref="oval:ssg-state_count_of_privileged_commands_having_audit_definition_augenrules:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="audit auditctl suid sgid" id="oval:ssg-test_arpc_suid_sgid_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arpc_suid_sgid_auditctl:obj:1"/>
          <ind:state state_ref="oval:ssg-state_audit_rules_privileged_commands:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" id="oval:ssg-test_arpc_bin_count_equals_rules_count_auditctl:tst:1" comment="audit auditctl binaries count matches rules count" version="1">
          <ind:object object_ref="oval:ssg-object_count_of_suid_sgid_binaries_on_system:obj:1"/>
          <ind:state state_ref="oval:ssg-state_count_of_privileged_commands_having_audit_definition_auditctl:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit adjtimex" id="oval:ssg-test_32bit_art_adjtimex_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_art_adjtimex_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit adjtimex" id="oval:ssg-test_64bit_art_adjtimex_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_art_adjtimex_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit adjtimex" id="oval:ssg-test_32bit_art_adjtimex_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_art_adjtimex_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit adjtimex" id="oval:ssg-test_64bit_art_adjtimex_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_art_adjtimex_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit clock_settime" id="oval:ssg-test_32bit_art_clock_settime_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_art_clock_settime_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit clock_settime" id="oval:ssg-test_64bit_art_clock_settime_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_art_clock_settime_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit clock_settime" id="oval:ssg-test_32bit_art_clock_settime_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_art_clock_settime_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit clock_settime" id="oval:ssg-test_64bit_art_clock_settime_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_art_clock_settime_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit settimeofday" id="oval:ssg-test_32bit_art_settimeofday_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_art_settimeofday_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit settimeofday" id="oval:ssg-test_64bit_art_settimeofday_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_art_settimeofday_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit settimeofday" id="oval:ssg-test_32bit_art_settimeofday_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_art_settimeofday_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit settimeofday" id="oval:ssg-test_64bit_art_settimeofday_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_art_settimeofday_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit stime" id="oval:ssg-test_32bit_art_stime_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_art_stime_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit stime" id="oval:ssg-test_32bit_art_stime_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_art_stime_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/localtime watch augenrules" id="oval:ssg-test_artw_etc_localtime_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_artw_etc_localtime_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/localtime watch auditctl" id="oval:ssg-test_artw_etc_localtime_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_artw_etc_localtime_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="remote server to send audit records" id="oval:ssg-test_auditd_audispd_configure_remote_server:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_audispd_configure_remote_server:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_audispd_configure_remote_server:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="setting in audisp-remote.conf" id="oval:ssg-test_auditd_audispd_encrypt_sent_records:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_audispd_encrypt_sent_records:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audispd syslog plugin activated" id="oval:ssg-test_auditd_audispd_syslog_plugin_activated:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_audispd_syslog_plugin_activated:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="disk full action" id="oval:ssg-test_auditd_data_disk_error_action:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_data_disk_error_action:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_disk_error_action:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="disk error action" id="oval:ssg-test_auditd_data_disk_full_action:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_data_disk_full_action:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_disk_full_action:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="email account for actions" id="oval:ssg-test_auditd_data_retention_action_mail_acct:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_action_mail_acct:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_action_mail_acct:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="space left action" id="oval:ssg-test_auditd_data_retention_admin_space_left_action:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_admin_space_left_action:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_admin_space_left_action:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="test the value of flush parameter in /etc/audit/auditd.conf" id="oval:ssg-test_auditd_data_retention_flush:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_flush:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_flush:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="max log file size" id="oval:ssg-test_auditd_data_retention_max_log_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_max_log_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_max_log_file:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="admin space left action " id="oval:ssg-test_auditd_data_retention_max_log_file_action:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_max_log_file_action:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_max_log_file_action:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="admin space left action " id="oval:ssg-test_auditd_data_retention_num_logs:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_num_logs:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_num_logs:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="space left action" id="oval:ssg-test_auditd_data_retention_space_left_action:tst:1" version="2">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_space_left_action:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_space_left_action:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="admin space left action " id="oval:ssg-test_auditd_data_retention_space_left_percentage:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_space_left_percentage:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_space_left_percentage:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of overflow_action setting in the /etc/audit/auditd.conf file" id="oval:ssg-test_auditd_overflow_action:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_auditd_overflow_action:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_overflow_action:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="superuser           is defined in /boot/grub2/grub.cfg. Superuser is not           equal to other system account nor root, admin, administrator" id="oval:ssg-test_bootloader_superuser_differ_from_other_users:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_bootloader_unique_superuser:obj:1"/>
          <ind:state state_ref="oval:ssg-state_bootloader_superuser_differ_from_other_users:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="superuser is defined in /boot/grub2/grub.cfg files." id="oval:ssg-test_bootloader_superuser:tst:1" version="2">
          <ind:object object_ref="oval:ssg-object_bootloader_superuser:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="make sure a password is defined in /boot/grub2/user.cfg" id="oval:ssg-test_grub2_password_usercfg:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_password_usercfg:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="make sure a password is defined in /boot/grub2/grub.cfg" id="oval:ssg-test_grub2_password_grubcfg:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_password_grubcfg:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="superuser           is defined in /boot/grub2/grub.cfg. Superuser is not           equal to other system account nor root, admin, administrator" id="oval:ssg-test_bootloader_uefi_superuser_differ_from_other_users:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_bootloader_uefi_unique_superuser:obj:1"/>
          <ind:state state_ref="oval:ssg-state_bootloader_uefi_superuser_differ_from_other_users:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="make sure a password is defined in /boot/grub2/user.cfg" id="oval:ssg-test_grub2_uefi_password_usercfg:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_uefi_password_usercfg:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test HostLimit" id="oval:ssg-test_logwatch_configured_hostlimit:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_logwatch_configured_hostlimit:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test SplitHosts" id="oval:ssg-test_logwatch_configured_splithosts:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_logwatch_configured_splithosts:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="cron is configured in /etc/rsyslog.conf" id="oval:ssg-test_cron_logging_rsyslog:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_cron_logging_rsyslog:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="cron is configured in /etc/rsyslog.d" id="oval:ssg-test_cron_logging_rsyslog_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_cron_logging_rsyslog_dir:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf" id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf" id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf" id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf" id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf" id="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf" id="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="all_exist" id="oval:ssg-test_rsyslog_files_groupownership:tst:1" version="1" comment="System log files are owned by the appropriate group">
          <unix:object object_ref="oval:ssg-object_rsyslog_files_groupownership:obj:1"/>
          <unix:state state_ref="oval:ssg-state_rsyslog_files_groupownership:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" id="oval:ssg-test_rsyslog_files_ownership:tst:1" version="1" comment="System log files are owned by the appropriate user">
          <unix:object object_ref="oval:ssg-object_rsyslog_files_ownership:obj:1"/>
          <unix:state state_ref="oval:ssg-state_rsyslog_files_ownership:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" id="oval:ssg-test_rsyslog_files_permissions:tst:1" version="1" comment="Permissions of system log files are correct">
          <unix:object object_ref="oval:ssg-object_rsyslog_files_permissions:obj:1"/>
          <unix:state state_ref="oval:ssg-state_rsyslog_files_permissions:ste:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="remote method auth monitoring configured in rsyslog'" id="oval:ssg-test_remote_method_monitoring_auth:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_remote_method_monitoring_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="remote method authpriv monitoring configured in rsyslog'" id="oval:ssg-test_remote_method_monitoring_authpriv:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_remote_method_monitoring_authpriv:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="remote method daemon monitoring configured in rsyslog'" id="oval:ssg-test_remote_method_monitoring_daemon:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_remote_method_monitoring_daemon:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the presence of daily setting in /etc/logrotate.conf file" id="oval:ssg-test_logrotate_conf_daily_setting:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_logrotate_conf_daily_setting:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Test if there is no weekly/monthly/yearly keyword" id="oval:ssg-test_logrotate_conf_no_other_keyword:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_logrotate_conf_no_other_keyword:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the existence of /etc/cron.daily/logrotate file (and verify it actually calls logrotate utility)" id="oval:ssg-test_cron_daily_logrotate_existence:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_cron_daily_logrotate_existence:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Ensure that the /etc/rsyslog.conf does not contain $InputTCPServerRun | $UDPServerRun | $InputRELPServerRun | $ModLoad imtcp | $ModLoad imudp | $ModLoad imrelp" id="oval:ssg-test_rsyslog_nolisten:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_rsyslog_nolisten:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensures system configured to export logs to remote host" id="oval:ssg-test_remote_rsyslog_conf:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_remote_loghost_rsyslog_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensures system configured to export logs to remote host" id="oval:ssg-test_remote_rsyslog_d:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_remote_loghost_rsyslog_d:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rsyslog_remote_tls:tst:1" comment="tests the omfwd action configuration" check_existence="at_least_one_exists" check="all" version="1">
          <ind:object object_ref="oval:ssg-obj_rsyslog_remote_tls:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rsyslog_remote_tls:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rsyslog_remote_tls_cacert:tst:1" comment="tests the DefaultNetstreamDriverCAFile configuration" check_existence="at_least_one_exists" check="all" version="1">
          <ind:object object_ref="oval:ssg-obj_rsyslog_remote_tls_cacert:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check NOZEROCONF=yes in /etc/sysconfig/network" id="oval:ssg-test_sysconfig_nozeroconf_yes:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sysconfig_nozeroconf_yes:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_network_nmcli_permissions:tst:1" comment="polkit is properly configured to prevent non-privilged users from changing networking settings" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_network_nmcli_permissions:obj:1"/>
          <ind:state state_ref="oval:ssg-state_network_nmcli_permissions:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:interface_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_promisc_interfaces:tst:1" version="1" comment="check all network interfaces for PROMISC flag">
          <unix:object object_ref="oval:ssg-object_promisc_interfaces:obj:1"/>
          <unix:state state_ref="oval:ssg-state_promisc:ste:1"/>
        </unix:interface_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Check /etc/firewalld/firewalld.conf DefaultZone for drop" id="oval:ssg-test_firewalld_input_drop:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_firewalld_input_drop:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Define default gateways" id="oval:ssg-test_network_ipv6_default_gateway:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_network_ipv6_default_gateway:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Enable privacy extensions on each interface" id="oval:ssg-test_network_ipv6_privacy_extensions:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_network_ipv6_privacy_extensions:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Set static IPv6 address on each interface" id="oval:ssg-test_network_ipv6_static_address:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_network_ipv6_static_address:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_module_ipv6_option_disabled:tst:1" version="1" check="all" comment="ipv6 disabled any modprobe conf file">
          <ind:object object_ref="oval:ssg-object_kernel_module_ipv6_option_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Test for udp6 based rpc services" id="oval:ssg-test_network_ipv6_disable_rpc_udp6:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_network_ipv6_disable_rpc_udp6:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Test for tcp6 based rpc services" id="oval:ssg-test_network_ipv6_disable_rpc_tcp6:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_network_ipv6_disable_rpc_tcp6:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:interface_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_wireless_disable_interfaces:tst:1" version="1" comment="check if UP flag is present on wifi interfaces">
          <unix:object object_ref="oval:ssg-object_active_wifi_interfaces:obj:1"/>
          <unix:state state_ref="oval:ssg-state_wifi_up:ste:1"/>
        </unix:interface_test>
        <unix:file_test check="all" comment="check for local directories that are world writable and have uid greater than 0" id="oval:ssg-test_dir_world_writable_uid_gt_zero:tst:1" version="1">
          <unix:object object_ref="oval:ssg-all_local_directories_uid_zero:obj:1"/>
          <unix:state state_ref="oval:ssg-state_uid_is_not_root_and_world_writable:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="all local world-writable directories have sticky bit set" id="oval:ssg-test_dir_perms_world_writable_sticky_bits:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_only_local_directories:obj:1"/>
          <unix:state state_ref="oval:ssg-state_world_writable_and_not_sticky:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" comment="check for local directories that are world writable and have uid greater than or equal to 1000" id="oval:ssg-test_dir_world_writable_uid_gt_value:tst:1" version="1">
          <unix:object object_ref="oval:ssg-all_local_directories_uid:obj:1"/>
          <unix:state state_ref="oval:ssg-state_uid_is_user_and_world_writable:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" comment="check for local directories that are world writable and have gid greater than or equal to 1000" id="oval:ssg-test_dir_world_writable_gid_gt_value:tst:1" version="1">
          <unix:object object_ref="oval:ssg-all_local_directories_gid:obj:1"/>
          <unix:state state_ref="oval:ssg-state_gid_is_user_and_world_writable:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="system.map files readable only by root" id="oval:ssg-test_permissions_systemmap_files:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_permissions_systemmap_files:obj:1"/>
          <unix:state state_ref="oval:ssg-state_owner_systemmap:ste:1"/>
          <unix:state state_ref="oval:ssg-state_file_permissions_systemmap:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="sgid files outside system RPMs" id="oval:ssg-test_file_permissions_unauthorized_sgid:tst:1" version="1">
          <unix:object object_ref="oval:ssg-obj_file_permissions_unauthorized_sgid_unowned:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="suid files outside system RPMs" id="oval:ssg-test_file_permissions_unauthorized_suid:tst:1" version="1">
          <unix:object object_ref="oval:ssg-obj_file_permissions_unauthorized_suid_unowned:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="world writable files" id="oval:ssg-test_file_permissions_unauthorized_world_write:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_permissions_unauthorized_world_write:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" comment="files with no group owner" check_existence="none_exist" id="oval:ssg-test_file_permissions_ungroupowned:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_permissions_ungroupowned:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Check user ids on all files on the system" id="oval:ssg-no_files_unowned_by_user_test:tst:1" version="1">
          <unix:object object_ref="oval:ssg-file_permissions_unowned_object:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="system commands are owned by root" id="oval:ssg-test_groupownership_system_commands_dirs:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_groupownership_system_commands_dirs:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="binary directories uid root" id="oval:ssg-test_ownership_binary_directories:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_ownership_binary_directories:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="binary files uid root" id="oval:ssg-test_ownership_binary_files:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_ownership_binary_files:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="binary files go-w" id="oval:ssg-test_perms_binary_files:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_permissions_binary_files:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of GRUB_CMDLINE_LINUX setting in the /etc/default/grub file" id="oval:ssg-test_grub2_nousb_argument:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_grub2_nousb_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_nousb_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_nodev_nonroot_local_partitions:tst:1" version="1" comment="nodev on local filesystems">
          <linux:object object_ref="oval:ssg-object_non_root_partitions:obj:1"/>
          <linux:state state_ref="oval:ssg-state_local_nodev:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Ensure /var/tmp is configured to bind mount to /tmp" id="oval:ssg-test_configure_mount_option_var_tmp_bind_tmp:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_configure_mount_option_var_tmp_bind_tmp:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_mount_option_var_tmp:tst:1" version="1" comment="Ensure /var/tmp is mounted" check="all">
          <linux:object object_ref="oval:ssg-object_mount_option_var_tmp:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Ensure bind mount option is on /var/tmp" id="oval:ssg-test_mount_option_var_tmp_bind:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_mount_option_var_tmp_bind:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_mount_option_var_tmp_bind_compare_source:tst:1" version="1" comment="Ensure /var/tmp and /tmp have the same source device" check="all">
          <linux:object object_ref="oval:ssg-object_mount_option_var_tmp_bind_compare_source:obj:1"/>
          <linux:state state_ref="oval:ssg-state_mount_option_var_tmp_bind_compare_source:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of ProcessSizeMax setting in the /etc/systemd/coredump.conf file" id="oval:ssg-test_coredump_disable_backtraces:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_coredump_disable_backtraces:obj:1"/>
          <ind:state state_ref="oval:ssg-state_coredump_disable_backtraces:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of Storage setting in the /etc/systemd/coredump.conf file" id="oval:ssg-test_coredump_disable_storage:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_coredump_disable_storage:obj:1"/>
          <ind:state state_ref="oval:ssg-state_coredump_disable_storage:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="Tests the value of the ^[\s]*\*[\s]+(hard|-)[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.conf file" id="oval:ssg-test_core_dumps_limitsconf:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_core_dumps_limitsconf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_core_dumps_limitsconf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="Tests the value of the ^[\s]*\*[\s]+(hard|-)[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.d directory" id="oval:ssg-test_core_dumps_limits_d:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_core_dumps_limits_d:obj:1"/>
          <ind:state state_ref="oval:ssg-state_core_dumps_limits_d:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="Tests for existance of the ^[\s]*\*[\s]+(hard|-)[\s]+core setting in the /etc/security/limits.d directory" id="oval:ssg-test_core_dumps_limits_d_exists:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_core_dumps_limits_d_exists:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-tst_umask_for_daemons:tst:1" version="1" check="all" comment="Test the retrieved /etc/init.d/functions umask value(s) match the var_umask_for_daemons requirement">
          <ind:object object_ref="oval:ssg-obj_umask_for_daemons:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_umask_for_daemons:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.exec-shield set to 1" id="oval:ssg-test_runtime_sysctl_kernel_exec_shield:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_kernel_exec_shield:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_kernel_exec_shield:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.exec-shield static configuration" id="oval:ssg-test_static_sysctl_kernel_exec_shield:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_exec_shield:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="NX is disabled" id="oval:ssg-test_nx_disabled_grub:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_nx_disabled_grub:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="CPUs support for NX bit" id="oval:ssg-test_NX_cpu_support:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_NX_cpu_support:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" id="oval:ssg-test_messages_nx_active:tst:1" version="1" comment="No log messages about NX being disabled">
          <ind:object object_ref="oval:ssg-obj_messages_nx_active:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" id="oval:ssg-test_noexec_cmd_line:tst:1" version="1" comment="NX is not disabled in the kernel command line">
          <ind:object object_ref="oval:ssg-obj_noexec_cmd_line:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_kernel-PAE_installed:tst:1" version="1" comment="Package kernel-PAE is installed">
          <linux:object object_ref="oval:ssg-obj_package_kernel-PAE_installed:obj:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="CPUs support PAE kernel or NX bit" id="oval:ssg-test_PAE_NX_cpu_support:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_PAE_NX_cpu_support:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_defaultkernel_sysconfig_kernel:tst:1" comment="check for DEFAULTKERNEL set to kernel-PAE in /etc/sysconfig/kernel" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_defaultkernel_sysconfig_kernel:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check value selinux|enforcing=0 in /etc/default/grub, fail if found" id="oval:ssg-test_selinux_default_grub:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_selinux_default_grub:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check value selinux|enforcing=0 in /etc/grub2.cfg, fail if found" id="oval:ssg-test_selinux_grub2_cfg:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_selinux_grub2_cfg:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check value selinux|enforcing=0 in /etc/grub.d fail if found" id="oval:ssg-test_selinux_grub_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_selinux_grub_dir:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:selinuxsecuritycontext_test check="none satisfy" check_existence="any_exist" comment="device_t in /dev" id="oval:ssg-test_selinux_dev_device_t:tst:1" version="2">
          <linux:object object_ref="oval:ssg-object_selinux_dev_device_t:obj:1"/>
          <linux:state state_ref="oval:ssg-state_selinux_dev_device_t:ste:1"/>
        </linux:selinuxsecuritycontext_test>
        <linux:selinuxsecuritycontext_test check="none satisfy" check_existence="any_exist" comment="unlabeled_t in /dev" id="oval:ssg-test_selinux_dev_unlabeled_t:tst:1" version="2">
          <linux:object object_ref="oval:ssg-object_selinux_dev_unlabeled_t:obj:1"/>
          <linux:state state_ref="oval:ssg-state_selinux_dev_unlabeled_t:ste:1"/>
        </linux:selinuxsecuritycontext_test>
        <linux:selinuxsecuritycontext_test check="none satisfy" check_existence="any_exist" comment="none satisfy unconfined_service_t in /proc" id="oval:ssg-test_selinux_confinement_of_daemons:tst:1" version="2">
          <linux:object object_ref="oval:ssg-object_selinux_confinement_of_daemons:obj:1"/>
          <linux:state state_ref="oval:ssg-state_selinux_confinement_of_daemons:ste:1"/>
        </linux:selinuxsecuritycontext_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the ^[\s]*SELINUXTYPE[\s]*=[\s]*([^#]*) expression in the /etc/selinux/config file" id="oval:ssg-test_selinux_policy:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_selinux_policy:obj:1"/>
          <ind:state state_ref="oval:ssg-state_selinux_policy:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="/selinux/enforce is 1" id="oval:ssg-test_etc_selinux_config:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_etc_selinux_config:obj:1"/>
          <ind:state state_ref="oval:ssg-state_etc_selinux_config:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_proc_cpuinfo_64_bit:tst:1" comment="Check for CPU flag lm" check="all" version="1">
          <ind:object object_ref="oval:ssg-object_proc_cpuinfo_64_bit:obj:1"/>
          <ind:state state_ref="oval:ssg-state_proc_cpuinfo_64_bit:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="Check if kernel nvr arch is 64-bit" id="oval:ssg-test_proc_sys_kernel_osrelease_64_bit:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_proc_sys_kernel_osrelease_64_bit:obj:1"/>
          <ind:state state_ref="oval:ssg-state_proc_sys_kernel_osrelease_64_bit:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" id="oval:ssg-test_dconf_distro_up_to_date:tst:1" version="1" comment="Check if the distro dconf DB is up-to-date with keyfiles in the distro tree.">
          <ind:object object_ref="oval:ssg-object_distro_db_modified_time:obj:1"/>
          <ind:state state_ref="oval:ssg-state_distro_db_is_up_to_date:ste:1"/>
        </ind:variable_test>
        <unix:file_test id="oval:ssg-test_dconf_distro_no_keyfiles:tst:1" check="all" check_existence="none_exist" comment="no keyfiles applicable to the distro database" version="1">
          <unix:object object_ref="oval:ssg-obj_dconf_distro_config:obj:1"/>
        </unix:file_test>
        <ind:variable_test check="all" check_existence="all_exist" id="oval:ssg-test_dconf_local_up_to_date:tst:1" version="1" comment="Check if the local dconf DB is up-to-date with keyfiles in the local tree.">
          <ind:object object_ref="oval:ssg-object_local_db_modified_time:obj:1"/>
          <ind:state state_ref="oval:ssg-state_local_db_is_up_to_date:ste:1"/>
        </ind:variable_test>
        <unix:file_test id="oval:ssg-test_dconf_local_no_keyfiles:tst:1" check="all" check_existence="none_exist" comment="no keyfiles applicable to the local database" version="1">
          <unix:object object_ref="oval:ssg-obj_dconf_local_config:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="dconf user profile exists" id="oval:ssg-test_dconf_user_profile:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_dconf_user_profile:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="GUI restart and shutdown buttons are disabled" id="oval:ssg-test_disable_restart_buttons:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_restart_buttons:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="GUI restart and shutdown buttons cannot be enabled" id="oval:ssg-test_prevent_user_enable_restart_buttons:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_enable_restart_buttons:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="GUI user list is disabled" id="oval:ssg-test_disable_user_list:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_user_list:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="GUI user list cannot be enabled" id="oval:ssg-test_prevent_user_disable_user_list:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_disable_user_list:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Enable GUI Login Smartcard authentication" id="oval:ssg-test_enable_gnome_smartcard:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_enable_gnome_smartcard:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="GUI smartcard authentication cannot be disabled" id="oval:ssg-test_prevent_user_disable_smartcard:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_disable_smartcard:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Set number of login tries" id="oval:ssg-test_configure_allowed_failures:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_configure_allowed_failures:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="number of login attempts cannot be changed" id="oval:ssg-test_prevent_user_allowed-failures_change:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_allowed-failures_change:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable GDM Automatic Login" id="oval:ssg-test_disable_automatic_login:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_automatic_login:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable GDM Guest Login" id="oval:ssg-test_disable_guest_login:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_guest_login:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of Enable setting in the /etc/gdm/custom.conf file" id="oval:ssg-test_gnome_gdm_disable_xdmcp:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_gnome_gdm_disable_xdmcp:obj:1"/>
          <ind:state state_ref="oval:ssg-state_gnome_gdm_disable_xdmcp:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_gnome_gdm_disable_xdmcp_config_file_exists:tst:1" check="all" check_existence="all_exist" comment="The configuration file /etc/gdm/custom.conf exists for gnome_gdm_disable_xdmcp" version="1">
          <unix:object object_ref="oval:ssg-obj_gnome_gdm_disable_xdmcp_config_file:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable automount in GNOME3" id="oval:ssg-test_dconf_gnome_disable_automount:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_dconf_gnome_disable_automount:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent user from changing automount setting" id="oval:ssg-test_prevent_user_gnome_automount:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_gnome_automount:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable automount-open in GNOME" id="oval:ssg-test_dconf_gnome_disable_automount_open:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_dconf_gnome_disable_automount_open:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent user from changing automount-open setting" id="oval:ssg-test_prevent_user_gnome_automount_open:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_gnome_automount_open:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable autorun in GNOME" id="oval:ssg-test_dconf_gnome_disable_autorun:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_dconf_gnome_disable_autorun:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent user from changing autorun setting" id="oval:ssg-test_prevent_user_gnome_autorun:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_gnome_autorun:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable thumbnailers in GNOME3" id="oval:ssg-test_gnome_disable_thumbnailers:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_gnome_disable_thumbnailers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="user cannot enable thumbnailers " id="oval:ssg-test_prevent_user_change_gnome_thumbnailers:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_change_gnome_thumbnailers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable wifi creation" id="oval:ssg-test_disable_wifi_creation:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_wifi_creation:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent enabling of wifi creation capability" id="oval:ssg-test_prevent_user_enable_wifi_creation:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_enable_wifi_creation:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable wifi notification" id="oval:ssg-test_disable_wifi_notification:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_wifi_notification:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent enabling of wifi notification capability" id="oval:ssg-test_prevent_user_enable_wifi_notification:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_enable_wifi_notification:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="configure remote access credentials" id="oval:ssg-test_configure_remote_access_creds:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_configure_remote_access_creds:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="prevent user from disabling remote access credential requirements" id="oval:ssg-test_prevent_user_remote_access_creds:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_remote_access_creds:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="configure remote access encryption" id="oval:ssg-test_configure_remote_access_encryption:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_configure_remote_access_encryption:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="prevent user from disabling remote access encryption" id="oval:ssg-test_prevent_user_remote_access_encryption:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_remote_access_encryption:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="idle delay is configured" id="oval:ssg-test_screensaver_idle_activation_enabled:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_screensaver_idle_activation_enabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="user cannot change idle_activation_enabled" id="oval:ssg-test_prevent_user_change_idle_activation_enabled:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_change_idle_activation_enabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="user cannot change idle_activation_locked" id="oval:ssg-test_prevent_user_change_idle_activation_locked:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_change_idle_activation_locked:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver idle delay is configured" id="oval:ssg-test_screensaver_idle_delay:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_screensaver_idle_delay:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver idle delay setting is correct" id="oval:ssg-test_screensaver_idle_delay_setting:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_screensaver_idle_delay_setting:obj:1"/>
          <ind:state state_ref="oval:ssg-state_screensaver_idle_delay_setting:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver lock is set correctly" id="oval:ssg-test_screensaver_lock_delay:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_screensaver_lock_delay:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver lock delay setting is correct" id="oval:ssg-test_screensaver_lock_delay_setting:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_screensaver_lock_delay_setting:obj:1"/>
          <ind:state state_ref="oval:ssg-state_screensaver_lock_delay_setting:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver lock is enabled" id="oval:ssg-test_screensaver_lock_enabled:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_screensaver_lock_enabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver lock cannot be changed by user" id="oval:ssg-test_prevent_user_screensaver_lock:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_screensaver_lock:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver lock cannot be changed by user" id="oval:ssg-test_prevent_user_screensaver_lock_locked:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_screensaver_lock_locked:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver mode is blank" id="oval:ssg-test_screensaver_mode_blank:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_screensaver_mode_blank:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="blank screensaver cannot be changed by user" id="oval:ssg-test_prevent_user_screensaver_mode_change:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_screensaver_mode_change:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver user info is disabled" id="oval:ssg-test_screensaver_disable_user_info:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_screensaver_disable_user_info:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver prevent user from changing" id="oval:ssg-test_prevent_user_info_change:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_info_change:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver lock delay cannot be changed by user" id="oval:ssg-test_user_change_lock_delay_lock:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_user_change_lock_delay_lock:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="user cannot change screensaver idle delay" id="oval:ssg-test_user_change_idle_delay_lock:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_user_change_idle_delay_lock:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable Ctrl-Alt-Del" id="oval:ssg-test_disable_gnome_ctrlaltdel:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_gnome_ctrlaltdel:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent enabling of ctrl-alt-del keys" id="oval:ssg-test_prevent_user_enable_ctrlaltdel:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_enable_ctrlaltdel:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable system geolocation" id="oval:ssg-test_disable_sys_geolocation:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_sys_geolocation:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent enabling of system geolocation" id="oval:ssg-test_prevent_user_sys_geolocation:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_sys_geolocation:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable clock geolocation" id="oval:ssg-test_disable_clock_geolocation:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_clock_geolocation:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent enabling of clock geolocation" id="oval:ssg-test_prevent_user_clock_geolocation:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_clock_geolocation:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable power settings" id="oval:ssg-test_disable_gnome_power_setting:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_gnome_power_setting:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent enabling of power settings" id="oval:ssg-test_prevent_user_power_setting_change:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_power_setting_change:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_bind_crypto_policy:tst:1" comment="Check that the configuration includes the policy config file." check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_configure_bind_crypto_policy:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" id="oval:ssg-test_crypto_policies_updated:tst:1" version="1" comment="Check if update-crypto-policies has been run">
          <ind:object object_ref="oval:ssg-object_crypto_policies_config_file_modified_time:obj:1"/>
          <ind:state state_ref="oval:ssg-state_crypto_current_file_newer_than_config_file:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_crypto_policy:tst:1" comment="check for crypto policy correctly configured in /etc/crypto-policies/config" check="all" check_existence="only_one_exists" version="1">
          <ind:object object_ref="oval:ssg-object_configure_crypto_policy:obj:1"/>
          <ind:state state_ref="oval:ssg-state_configure_crypto_policy:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_crypto_policy_current:tst:1" comment="check for crypto policy correctly configured in /etc/crypto-policies/state/current" check="all" check_existence="only_one_exists" version="1">
          <ind:object object_ref="oval:ssg-object_configure_crypto_policy_current:obj:1"/>
          <ind:state state_ref="oval:ssg-state_configure_crypto_policy_current:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Check if /etc/crypto-policies/back-ends/nss.config exists" id="oval:ssg-test_crypto_policy_nss_config:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_crypto_policy_nss_config:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" comment="tests the presence of '+VERS-ALL:-VERS-DTLS0.9:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS1.0' setting in the /etc/crypto-policies/back-ends/gnutls.config file" id="oval:ssg-test_configure_gnutls_tls_crypto_policy:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_configure_gnutls_tls_crypto_policy:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_configure_kerberos_crypto_policy_symlink:tst:1" check="all" check_existence="all_exist" comment="Check if kerberos configuration symlink and crypto policy kerberos backend symlink point to same file" version="1">
          <ind:object object_ref="oval:ssg-object_symlink_kerberos_crypto_policy_configuration:obj:1"/>
          <ind:state state_ref="oval:ssg-state_symlink_kerberos_crypto_policy_backend:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_configure_kerberos_crypto_policy_nosymlink:tst:1" check="all" check_existence="all_exist" comment="Check if kerberos configuration symlink links to the crypto-policy backend file" version="1">
          <ind:object object_ref="oval:ssg-object_symlink_kerberos_crypto_policy_configuration:obj:1"/>
          <ind:state state_ref="oval:ssg-state_location_of_kerberos_crypto_policy_backend:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_libreswan_crypto_policy:tst:1" comment="Check that the libreswan configuration includes the crypto policy config file" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_configure_libreswan_crypto_policy:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_openssl_crypto_policy:tst:1" comment="Check that the configuration mandates usage of system-wide crypto policies." check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_configure_openssl_crypto_policy:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_ssh_crypto_policy:tst:1" comment="Check that the SSH configuration mandates usage of system-wide crypto policies." check="all" check_existence="none_exist" version="1">
          <ind:object object_ref="oval:ssg-object_configure_ssh_crypto_policy:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the absence of Match setting in the /etc/ssh/ssh_config.d/02-ospp.conf file" id="oval:ssg-test_harden_ssh_client_crypto_policy_Match:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_Match:obj:1"/>
          <ind:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_Match:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the absence of RekeyLimit setting in the /etc/ssh/ssh_config.d/02-ospp.conf file" id="oval:ssg-test_harden_ssh_client_crypto_policy_RekeyLimit:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_RekeyLimit:obj:1"/>
          <ind:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_RekeyLimit:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the absence of GSSAPIAuthentication setting in the /etc/ssh/ssh_config.d/02-ospp.conf file" id="oval:ssg-test_harden_ssh_client_crypto_policy_GSSAPIAuthentication:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_GSSAPIAuthentication:obj:1"/>
          <ind:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_GSSAPIAuthentication:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the absence of Ciphers setting in the /etc/ssh/ssh_config.d/02-ospp.conf file" id="oval:ssg-test_harden_ssh_client_crypto_policy_Ciphers:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_Ciphers:obj:1"/>
          <ind:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_Ciphers:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the absence of PubkeyAcceptedKeyTypes setting in the /etc/ssh/ssh_config.d/02-ospp.conf file" id="oval:ssg-test_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:obj:1"/>
          <ind:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the absence of MACs setting in the /etc/ssh/ssh_config.d/02-ospp.conf file" id="oval:ssg-test_harden_ssh_client_crypto_policy_MACs:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_MACs:obj:1"/>
          <ind:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_MACs:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the absence of KexAlgorithms setting in the /etc/ssh/ssh_config.d/02-ospp.conf file" id="oval:ssg-test_harden_ssh_client_crypto_policy_KexAlgorithms:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_KexAlgorithms:obj:1"/>
          <ind:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_KexAlgorithms:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="test the value of Ciphers setting in the /etc/crypto-policies/back-ends/openssh.config file" id="oval:ssg-test_harden_sshd_ciphers_openssh_conf_crypto_policy:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_harden_sshd_ciphers_openssh_conf_crypto_policy:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_harden_sshd_ciphers_openssh_conf_crypto_policy:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of CRYPTO_POLICY setting in the /etc/crypto-policies/back-ends/opensshserver.config file" id="oval:ssg-test_harden_sshd_crypto_policy:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_harden_sshd_crypto_policy:obj:1"/>
          <ind:state state_ref="oval:ssg-state_harden_sshd_crypto_policy:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="test the value of MACs setting in the /etc/crypto-policies/back-ends/openssh.config file" id="oval:ssg-test_harden_sshd_macs_openssh_conf_crypto_policy:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_harden_sshd_macs_openssh_conf_crypto_policy:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_harden_sshd_macs_openssh_conf_crypto_policy:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="/selinux/enforce is 1" id="oval:ssg-test_selinux_enforcing:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_selinux_enforcing:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_linuxshield_install_antivirus:tst:1" version="1" comment="AntiVirus package is installed">
          <linux:object object_ref="oval:ssg-obj_linuxshield_install_antivirus:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_mcafee_runtime_installed:tst:1" version="1" comment="Runtime Libraries package is installed">
          <linux:object object_ref="oval:ssg-obj_mcafee_runtime_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_mcafee_management_agent:tst:1" version="1" comment="Agent package is installed">
          <linux:object object_ref="oval:ssg-obj_mcafee_management_agent:obj:1"/>
        </linux:rpminfo_test>
        <unix:file_test check="all" check_existence="all_exist" comment="McAfee ACCM installed" id="oval:ssg-test_mcafee_accm_exists:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_mcafee_accm_exists:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="McAfee Policy Auditor installed" id="oval:ssg-test_mcafee_auditengine_exists:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_mcafee_auditengine_exists:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="add_dracutmodules contains fips" id="oval:ssg-test_enable_dracut_fips_module:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_enable_dracut_fips_module:obj:1"/>
          <ind:state state_ref="oval:ssg-state_enable_dracut_fips_module:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="at least one" comment="tests if var_system_crypto_policy is set to FIPS" id="oval:ssg-test_system_crypto_policy_value:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_system_crypto_policy_value:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_system_crypto_policy_value:ste:1"/>
        </ind:variable_test>
        <unix:file_test version="1" id="oval:ssg-test_etc_system_fips:tst:1" check="all" check_existence="all_exist" comment="/etc/system-fips exists">
          <unix:object object_ref="oval:ssg-object_etc_system_fips:obj:1"/>
        </unix:file_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter crypto.fips_enabled set to 1" id="oval:ssg-test_sysctl_crypto_fips_enabled:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_crypto_fips_enabled:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_crypto_fips_enabled:ste:1"/>
        </unix:sysctl_test>
        <unix:file_test id="oval:ssg-test_aide_build_new_database_absolute_path:tst:1" check="all" check_existence="all_exist" comment="Testing existence of new aide database file" version="1">
          <unix:object object_ref="oval:ssg-object_aide_build_new_database_absolute_path:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_aide_operational_database_absolute_path:tst:1" check="all" check_existence="all_exist" comment="Testing existence of operational aide database file" version="1">
          <unix:object object_ref="oval:ssg-object_aide_operational_database_absolute_path:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_auditctl:tst:1" comment="auditctl is checked in /etc/aide.conf" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_aide_verify_auditctl:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_auditd:tst:1" comment="auditd is checked in /etc/aide.conf" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_aide_verify_auditd:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_ausearch:tst:1" comment="ausearch is checked in /etc/aide.conf" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_aide_verify_ausearch:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_aureport:tst:1" comment="aureport is checked in /etc/aide.conf" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_aide_verify_aureport:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_autrace:tst:1" comment="autrace is checked in /etc/aide.conf" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_aide_verify_autrace:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_audispd:tst:1" comment="audispd is checked in /etc/aide.conf" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_aide_verify_audispd:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_rsyslogd:tst:1" comment="rsyslogd is checked in /etc/aide.conf" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_aide_verify_rsyslogd:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_augenrules:tst:1" comment="augenrules is checked in /etc/aide.conf" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_aide_verify_augenrules:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="run aide with cron" id="oval:ssg-test_aide_periodic_cron_checking:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_test_aide_periodic_cron_checking:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="run aide with cron" id="oval:ssg-test_aide_crond_checking:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_test_aide_crond_checking:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="run aide with cron" id="oval:ssg-test_aide_var_cron_checking:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_aide_var_cron_checking:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="run aide with cron.(daily|weekly)" id="oval:ssg-test_aide_crontabs_checking:tst:1" version="2">
          <ind:object object_ref="oval:ssg-object_aide_crontabs_checking:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:rpmverifyfile_test check_existence="none_exist" id="oval:ssg-test_files_fail_md5_hash:tst:1" version="1" check="all" comment="verify file md5 hashes">
          <linux:object object_ref="oval:ssg-object_files_fail_md5_hash:obj:1"/>
        </linux:rpmverifyfile_test>
        <linux:rpmverifyfile_test check_existence="none_exist" id="oval:ssg-test_verify_all_rpms_mode:tst:1" version="1" check="all" comment="mode of all files matches local rpm database">
          <linux:object object_ref="oval:ssg-object_files_fail_mode:obj:1"/>
        </linux:rpmverifyfile_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="!authenticate does not exist in /etc/sudoers" id="oval:ssg-test_no_authenticate_etc_sudoers:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_no_authenticate_etc_sudoers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="!authenticate does not exist in /etc/sudoers.d" id="oval:ssg-test_no_authenticate_etc_sudoers_d:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_no_authenticate_etc_sudoers_d:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="NOPASSWD does not exist /etc/sudoers" id="oval:ssg-test_nopasswd_etc_sudoers:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_nopasswd_etc_sudoers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="NOPASSWD does not exist in /etc/sudoers.d" id="oval:ssg-test_nopasswd_etc_sudoers_d:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_nopasswd_etc_sudoers_d:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="NOPASSWD only exists for vdsm user in /etc/sudoers" id="oval:ssg-test_vdsm_nopasswd_etc_sudoers:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_vdsm_nopasswd_etc_sudoers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="NOPASSWD only exists for vdsm user in /etc/sudoers.d" id="oval:ssg-test_vdsm_nopasswd_etc_sudoers_d:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_vdsm_nopasswd_etc_sudoers_d:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules rmmod" id="oval:ssg-test_sudoers_default_includedir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_sudoers_default_includedir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sudoers_default_includedir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="audit augenrules rmmod" id="oval:ssg-test_sudoers_without_include:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_sudoers_without_include:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="audit augenrules rmmod" id="oval:ssg-test_sudoersd_without_includes:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_sudoersd_without_includes:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Make sure that no command in user spec is without any argument" id="oval:ssg-test_sudoers_explicit_command_args:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_sudoers_explicit_command_args:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Make sure that no command in user spec contains negation" id="oval:ssg-test_sudoers_no_command_negation:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_sudoers_no_command_negation:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Make sure that no user spec in sudoers has a runas spec that includes root or ALL" id="oval:ssg-test_no_root_or_ALL_in_runas_spec:tst:1" version="1">
          <ind:object object_ref="oval:ssg-root_or_ALL_in_runas_spec:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="make sure that all user specs in sudoers feature a runas spec" id="oval:ssg-test_no_user_spec_rules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_no_runas_spec:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="Ensure invoking user's password for privilege escalation when using sudo" id="oval:ssg-test_sudoers_targetpw_config:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_test_sudoers_targetpw_config:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="Ensure invoking user's password for privilege escalation when using sudo" id="oval:ssg-test_sudoers_rootpw_config:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_test_sudoers_rootpw_config:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="Ensure invoking user's password for privilege escalation when using sudo" id="oval:ssg-test_sudoers_runaspw_config:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_test_sudoers_runaspw_config:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Verify that results come from only one file" id="oval:ssg-test_sudoers_passwd_n_files:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sudoers_passwd_n_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sudoers_passwd_n_files:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check value of clean_requirements_on_remove in /etc/dnf/dnf.conf" id="oval:ssg-test_yum_clean_components_post_updating:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_yum_clean_components_post_updating:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of apply_updates setting in the /etc/dnf/automatic.conf file" id="oval:ssg-test_dnf-automatic_apply_updates:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_dnf-automatic_apply_updates:obj:1"/>
          <ind:state state_ref="oval:ssg-state_dnf-automatic_apply_updates:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_dnf-automatic_apply_updates_config_file_exists:tst:1" check="all" check_existence="all_exist" comment="The configuration file /etc/dnf/automatic.conf exists for dnf-automatic_apply_updates" version="1">
          <unix:object object_ref="oval:ssg-obj_dnf-automatic_apply_updates_config_file:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of upgrade_type setting in the /etc/dnf/automatic.conf file" id="oval:ssg-test_dnf-automatic_security_updates_only:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_dnf-automatic_security_updates_only:obj:1"/>
          <ind:state state_ref="oval:ssg-state_dnf-automatic_security_updates_only:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_dnf-automatic_security_updates_only_config_file_exists:tst:1" check="all" check_existence="all_exist" comment="The configuration file /etc/dnf/automatic.conf exists for dnf-automatic_security_updates_only" version="1">
          <unix:object object_ref="oval:ssg-obj_dnf-automatic_security_updates_only_config_file:obj:1"/>
        </unix:file_test>
        <linux:rpminfo_test check="only one" check_existence="at_least_one_exists" id="oval:ssg-test_package_gpgkey-5323552a-6112bcdc_installed:tst:1" version="1" comment="Fedora 5323552a release key package is installed">
          <linux:object object_ref="oval:ssg-object_package_gpg-pubkey:obj:1"/>
          <linux:state state_ref="oval:ssg-state_package_gpg-pubkey-5323552a-6112bcdc:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="only one" check_existence="at_least_one_exists" id="oval:ssg-test_package_gpgkey-38ab71f4-60242b08_installed:tst:1" version="1" comment="Fedora 38ab71f4 release key package is installed">
          <linux:object object_ref="oval:ssg-object_package_gpg-pubkey:obj:1"/>
          <linux:state state_ref="oval:ssg-state_package_gpg-pubkey-38ab71f4-60242b08:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="only one" check_existence="at_least_one_exists" id="oval:ssg-test_package_gpgkey-9867c58f-601c49ca_installed:tst:1" version="1" comment="Fedora 9867c58f release key package is installed">
          <linux:object object_ref="oval:ssg-object_package_gpg-pubkey:obj:1"/>
          <linux:state state_ref="oval:ssg-state_package_gpg-pubkey-9867c58f-601c49ca:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="only one" check_existence="at_least_one_exists" id="oval:ssg-test_package_gpgkey-45719a39-5f2c0192_installed:tst:1" version="1" comment="Fedora 45719a39 release key package is installed">
          <linux:object object_ref="oval:ssg-object_package_gpg-pubkey:obj:1"/>
          <linux:state state_ref="oval:ssg-state_package_gpg-pubkey-45719a39-5f2c0192:ste:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check value of gpgcheck in /etc/dnf/dnf.conf" id="oval:ssg-test_ensure_gpgcheck_globally_activated:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_ensure_gpgcheck_globally_activated:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check value of localpkg_gpgcheck in /etc/dnf/dnf.conf" id="oval:ssg-test_yum_ensure_gpgcheck_local_packages:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_yum_ensure_gpgcheck_local_packages:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check for existence of gpgcheck=0 in /etc/yum.repos.d/ files" id="oval:ssg-test_ensure_gpgcheck_never_disabled:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ensure_gpgcheck_never_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check value of repo_gpgcheck in /etc/dnf/dnf.conf" id="oval:ssg-test_yum_ensure_gpgcheck_repo_metadata:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_yum_ensure_gpgcheck_repo_metadata:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" state_operator="AND" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_dcredit:tst:1" version="3">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_dcredit:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_dcredit:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" state_operator="AND" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_dictcheck:tst:1" version="3">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_dictcheck:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_dictcheck:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" state_operator="AND" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_difok:tst:1" version="3">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_difok:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_difok:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="tests the presence of 'local_users_only' setting in the /etc/security/pwquality.conf file" id="oval:ssg-test_accounts_password_pam_enforce_local:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_accounts_password_pam_enforce_local:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="tests the presence of 'enforce_for_root' setting in the /etc/security/pwquality.conf file" id="oval:ssg-test_accounts_password_pam_enforce_root:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_accounts_password_pam_enforce_root:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" state_operator="AND" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_lcredit:tst:1" version="3">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_lcredit:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_lcredit:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" state_operator="AND" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_maxclassrepeat:tst:1" version="3">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_maxclassrepeat:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_maxclassrepeat:ste:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_maxclassrepeat_zero_comparison:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" state_operator="AND" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_maxrepeat:tst:1" version="3">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_maxrepeat:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_maxrepeat:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" state_operator="AND" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_minclass:tst:1" version="3">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_minclass:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_minclass:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" state_operator="AND" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_minlen:tst:1" version="3">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_minlen:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_minlen:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" state_operator="AND" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_ocredit:tst:1" version="3">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_ocredit:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_ocredit:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" state_operator="AND" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_ucredit:tst:1" version="3">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_ucredit:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_ucredit:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit chmod" id="oval:ssg-test_32bit_ardm_chmod_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_chmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit chmod" id="oval:ssg-test_64bit_ardm_chmod_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_chmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit chmod" id="oval:ssg-test_32bit_ardm_chmod_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_chmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit chmod" id="oval:ssg-test_64bit_ardm_chmod_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_chmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit chown" id="oval:ssg-test_32bit_ardm_chown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_chown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit chown" id="oval:ssg-test_64bit_ardm_chown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_chown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit chown" id="oval:ssg-test_32bit_ardm_chown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_chown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit chown" id="oval:ssg-test_64bit_ardm_chown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_chown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit fchmod" id="oval:ssg-test_32bit_ardm_fchmod_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fchmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit fchmod" id="oval:ssg-test_64bit_ardm_fchmod_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fchmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit fchmod" id="oval:ssg-test_32bit_ardm_fchmod_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fchmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit fchmod" id="oval:ssg-test_64bit_ardm_fchmod_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fchmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit fchmodat" id="oval:ssg-test_32bit_ardm_fchmodat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fchmodat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit fchmodat" id="oval:ssg-test_64bit_ardm_fchmodat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fchmodat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit fchmodat" id="oval:ssg-test_32bit_ardm_fchmodat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fchmodat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit fchmodat" id="oval:ssg-test_64bit_ardm_fchmodat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fchmodat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit fchown" id="oval:ssg-test_32bit_ardm_fchown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit fchown" id="oval:ssg-test_64bit_ardm_fchown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit fchown" id="oval:ssg-test_32bit_ardm_fchown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit fchown" id="oval:ssg-test_64bit_ardm_fchown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit fchownat" id="oval:ssg-test_32bit_ardm_fchownat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fchownat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit fchownat" id="oval:ssg-test_64bit_ardm_fchownat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fchownat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit fchownat" id="oval:ssg-test_32bit_ardm_fchownat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fchownat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit fchownat" id="oval:ssg-test_64bit_ardm_fchownat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fchownat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit fremovexattr" id="oval:ssg-test_32bit_ardm_fremovexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit fremovexattr" id="oval:ssg-test_64bit_ardm_fremovexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit fremovexattr" id="oval:ssg-test_32bit_ardm_fremovexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit fremovexattr" id="oval:ssg-test_64bit_ardm_fremovexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit fsetxattr" id="oval:ssg-test_32bit_ardm_fsetxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit fsetxattr" id="oval:ssg-test_64bit_ardm_fsetxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit fsetxattr" id="oval:ssg-test_32bit_ardm_fsetxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit fsetxattr" id="oval:ssg-test_64bit_ardm_fsetxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit lchown" id="oval:ssg-test_32bit_ardm_lchown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_lchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit lchown" id="oval:ssg-test_64bit_ardm_lchown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_lchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit lchown" id="oval:ssg-test_32bit_ardm_lchown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_lchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit lchown" id="oval:ssg-test_64bit_ardm_lchown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_lchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit lremovexattr" id="oval:ssg-test_32bit_ardm_lremovexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_lremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit lremovexattr" id="oval:ssg-test_64bit_ardm_lremovexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_lremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit lremovexattr" id="oval:ssg-test_32bit_ardm_lremovexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_lremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit lremovexattr" id="oval:ssg-test_64bit_ardm_lremovexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_lremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit lsetxattr" id="oval:ssg-test_32bit_ardm_lsetxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_lsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit lsetxattr" id="oval:ssg-test_64bit_ardm_lsetxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_lsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit lsetxattr" id="oval:ssg-test_32bit_ardm_lsetxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_lsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit lsetxattr" id="oval:ssg-test_64bit_ardm_lsetxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_lsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit removexattr" id="oval:ssg-test_32bit_ardm_removexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_removexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit removexattr" id="oval:ssg-test_64bit_ardm_removexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_removexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit removexattr" id="oval:ssg-test_32bit_ardm_removexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_removexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit removexattr" id="oval:ssg-test_64bit_ardm_removexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_removexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit setxattr" id="oval:ssg-test_32bit_ardm_setxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_setxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit setxattr" id="oval:ssg-test_64bit_ardm_setxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_setxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit setxattr" id="oval:ssg-test_32bit_ardm_setxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_setxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit setxattr" id="oval:ssg-test_64bit_ardm_setxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_setxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit umount2" id="oval:ssg-test_32bit_ardm_umount2_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_umount2_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit umount2" id="oval:ssg-test_64bit_ardm_umount2_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_umount2_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit umount2" id="oval:ssg-test_32bit_ardm_umount2_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_umount2_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit umount2" id="oval:ssg-test_64bit_ardm_umount2_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_umount2_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_group_open_32bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_group_open_32bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_group_open_64bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_group_open_64bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_group_open_32bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_group_open_32bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_group_open_64bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_group_open_64bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_32bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_32bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_64bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_64bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_32bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_32bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_64bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_64bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_group_openat_32bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_group_openat_32bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_group_openat_64bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_group_openat_64bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_group_openat_32bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_group_openat_32bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_group_openat_64bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_group_openat_64bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_gshadow_open_32bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_32bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_gshadow_open_64bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_64bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_gshadow_open_32bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_32bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_gshadow_open_64bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_64bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_32bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_32bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_64bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_64bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_32bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_32bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_64bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_64bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_gshadow_openat_32bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_openat_32bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_gshadow_openat_64bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_openat_64bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_gshadow_openat_32bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_openat_32bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_gshadow_openat_64bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_openat_64bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_passwd_open_32bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_32bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_passwd_open_64bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_64bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_passwd_open_32bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_32bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_passwd_open_64bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_64bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_32bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_32bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_64bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_64bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_32bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_32bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_64bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_64bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_passwd_openat_32bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_passwd_openat_32bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_passwd_openat_64bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_passwd_openat_64bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_passwd_openat_32bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_passwd_openat_32bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_passwd_openat_64bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_passwd_openat_64bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_shadow_open_32bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_32bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_shadow_open_64bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_64bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_shadow_open_32bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_32bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_shadow_open_64bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_64bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_32bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_32bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_64bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_64bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_32bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_32bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_64bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_64bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_shadow_openat_32bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_shadow_openat_32bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_shadow_openat_64bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_shadow_openat_64bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_shadow_openat_32bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_shadow_openat_32bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_shadow_openat_64bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_shadow_openat_64bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules chcon" id="oval:ssg-test_audit_rules_execution_chcon_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_chcon_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl chcon" id="oval:ssg-test_audit_rules_execution_chcon_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_chcon_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules restorecon" id="oval:ssg-test_audit_rules_execution_restorecon_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_restorecon_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl restorecon" id="oval:ssg-test_audit_rules_execution_restorecon_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_restorecon_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules semanage" id="oval:ssg-test_audit_rules_execution_semanage_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_semanage_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl semanage" id="oval:ssg-test_audit_rules_execution_semanage_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_semanage_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules setsebool" id="oval:ssg-test_audit_rules_execution_setsebool_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_setsebool_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl setsebool" id="oval:ssg-test_audit_rules_execution_setsebool_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_setsebool_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules seunshare" id="oval:ssg-test_audit_rules_execution_seunshare_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_seunshare_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl seunshare" id="oval:ssg-test_audit_rules_execution_seunshare_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_seunshare_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit rename" id="oval:ssg-test_32bit_ardm_rename_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_rename_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit rename" id="oval:ssg-test_64bit_ardm_rename_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_rename_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit rename" id="oval:ssg-test_32bit_ardm_rename_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_rename_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit rename" id="oval:ssg-test_64bit_ardm_rename_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_rename_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit renameat" id="oval:ssg-test_32bit_ardm_renameat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_renameat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit renameat" id="oval:ssg-test_64bit_ardm_renameat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_renameat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit renameat" id="oval:ssg-test_32bit_ardm_renameat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_renameat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit renameat" id="oval:ssg-test_64bit_ardm_renameat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_renameat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit rmdir" id="oval:ssg-test_32bit_ardm_rmdir_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_rmdir_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit rmdir" id="oval:ssg-test_64bit_ardm_rmdir_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_rmdir_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit rmdir" id="oval:ssg-test_32bit_ardm_rmdir_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_rmdir_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit rmdir" id="oval:ssg-test_64bit_ardm_rmdir_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_rmdir_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit unlink" id="oval:ssg-test_32bit_ardm_unlink_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_unlink_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit unlink" id="oval:ssg-test_64bit_ardm_unlink_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_unlink_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit unlink" id="oval:ssg-test_32bit_ardm_unlink_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_unlink_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit unlink" id="oval:ssg-test_64bit_ardm_unlink_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_unlink_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit unlinkat" id="oval:ssg-test_32bit_ardm_unlinkat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_unlinkat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit unlinkat" id="oval:ssg-test_64bit_ardm_unlinkat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_unlinkat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit unlinkat" id="oval:ssg-test_32bit_ardm_unlinkat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_unlinkat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit unlinkat" id="oval:ssg-test_64bit_ardm_unlinkat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_unlinkat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules faillock" id="oval:ssg-test_arle_faillock_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arle_faillock_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl faillock" id="oval:ssg-test_arle_faillock_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arle_faillock_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules lastlog" id="oval:ssg-test_arle_lastlog_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arle_lastlog_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl lastlog" id="oval:ssg-test_arle_lastlog_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arle_lastlog_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules tallylog" id="oval:ssg-test_arle_tallylog_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arle_tallylog_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl tallylog" id="oval:ssg-test_arle_tallylog_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arle_tallylog_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit mount" id="oval:ssg-test_32bit_ardm_mount_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_mount_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit mount" id="oval:ssg-test_64bit_ardm_mount_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_mount_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit mount" id="oval:ssg-test_32bit_ardm_mount_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_mount_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit mount" id="oval:ssg-test_64bit_ardm_mount_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_mount_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules at" id="oval:ssg-test_audit_rules_privileged_commands_at_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_at_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl at" id="oval:ssg-test_audit_rules_privileged_commands_at_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_at_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules chage" id="oval:ssg-test_audit_rules_privileged_commands_chage_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_chage_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl chage" id="oval:ssg-test_audit_rules_privileged_commands_chage_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_chage_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules chsh" id="oval:ssg-test_audit_rules_privileged_commands_chsh_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_chsh_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl chsh" id="oval:ssg-test_audit_rules_privileged_commands_chsh_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_chsh_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules crontab" id="oval:ssg-test_audit_rules_privileged_commands_crontab_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_crontab_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl crontab" id="oval:ssg-test_audit_rules_privileged_commands_crontab_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_crontab_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules gpasswd" id="oval:ssg-test_audit_rules_privileged_commands_gpasswd_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_gpasswd_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl gpasswd" id="oval:ssg-test_audit_rules_privileged_commands_gpasswd_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_gpasswd_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules mount" id="oval:ssg-test_audit_rules_privileged_commands_mount_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_mount_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl mount" id="oval:ssg-test_audit_rules_privileged_commands_mount_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_mount_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules newgidmap" id="oval:ssg-test_audit_rules_privileged_commands_newgidmap_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newgidmap_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl newgidmap" id="oval:ssg-test_audit_rules_privileged_commands_newgidmap_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newgidmap_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules newgrp" id="oval:ssg-test_audit_rules_privileged_commands_newgrp_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newgrp_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl newgrp" id="oval:ssg-test_audit_rules_privileged_commands_newgrp_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newgrp_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules newuidmap" id="oval:ssg-test_audit_rules_privileged_commands_newuidmap_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newuidmap_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl newuidmap" id="oval:ssg-test_audit_rules_privileged_commands_newuidmap_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newuidmap_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules passwd" id="oval:ssg-test_audit_rules_privileged_commands_passwd_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_passwd_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl passwd" id="oval:ssg-test_audit_rules_privileged_commands_passwd_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_passwd_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules pt_chown" id="oval:ssg-test_audit_rules_privileged_commands_pt_chown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_pt_chown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl pt_chown" id="oval:ssg-test_audit_rules_privileged_commands_pt_chown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_pt_chown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules ssh_keysign" id="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_ssh_keysign_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl ssh_keysign" id="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_ssh_keysign_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules su" id="oval:ssg-test_audit_rules_privileged_commands_su_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_su_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl su" id="oval:ssg-test_audit_rules_privileged_commands_su_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_su_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules sudo" id="oval:ssg-test_audit_rules_privileged_commands_sudo_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_sudo_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl sudo" id="oval:ssg-test_audit_rules_privileged_commands_sudo_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_sudo_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules sudoedit" id="oval:ssg-test_audit_rules_privileged_commands_sudoedit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_sudoedit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl sudoedit" id="oval:ssg-test_audit_rules_privileged_commands_sudoedit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_sudoedit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules umount" id="oval:ssg-test_audit_rules_privileged_commands_umount_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_umount_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl umount" id="oval:ssg-test_audit_rules_privileged_commands_umount_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_umount_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules unix_chkpwd" id="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_unix_chkpwd_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl unix_chkpwd" id="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_unix_chkpwd_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules userhelper" id="oval:ssg-test_audit_rules_privileged_commands_userhelper_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_userhelper_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl userhelper" id="oval:ssg-test_audit_rules_privileged_commands_userhelper_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_userhelper_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules usernetctl" id="oval:ssg-test_audit_rules_privileged_commands_usernetctl_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_usernetctl_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl usernetctl" id="oval:ssg-test_audit_rules_privileged_commands_usernetctl_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_usernetctl_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_chmod_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_chmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_chmod_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_chmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_chmod_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_chmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_chmod_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_chmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_chmod_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_chmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_chmod_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_chmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_chmod_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_chmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_chmod_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_chmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_chown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_chown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_chown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_chown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_chown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_chown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_chown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_chown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_chown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_chown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_chown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_chown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_chown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_chown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_chown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_chown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_creat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_creat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_creat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_creat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_creat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_creat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_creat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_creat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_creat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_creat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_creat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_creat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_creat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_creat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_creat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_creat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_fchmod_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_fchmod_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_fchmod_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_fchmod_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_fchmod_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_fchmod_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_fchmod_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_fchmod_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_fchmodat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchmodat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_fchmodat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchmodat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_fchmodat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchmodat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_fchmodat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchmodat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_fchmodat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchmodat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_fchmodat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchmodat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_fchmodat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchmodat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_fchmodat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchmodat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_fchown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_fchown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_fchown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_fchown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_fchown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_fchown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_fchown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_fchown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_fchownat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchownat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_fchownat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchownat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_fchownat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchownat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_fchownat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchownat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_fchownat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchownat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_fchownat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchownat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_fchownat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchownat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_fchownat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchownat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_fremovexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_fremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_fremovexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_fremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_fremovexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_fremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_fremovexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_fremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_fremovexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_fremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_fremovexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_fremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_fremovexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_fremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_fremovexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_fremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_fsetxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_fsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_fsetxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_fsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_fsetxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_fsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_fsetxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_fsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_fsetxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_fsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_fsetxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_fsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_fsetxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_fsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_fsetxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_fsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_ftruncate_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_ftruncate_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_ftruncate_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_ftruncate_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_ftruncate_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_ftruncate_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_ftruncate_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_ftruncate_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_ftruncate_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_ftruncate_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_ftruncate_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_ftruncate_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_ftruncate_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_ftruncate_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_ftruncate_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_ftruncate_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_lchown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_lchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_lchown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_lchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_lchown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_lchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_lchown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_lchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_lchown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_lchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_lchown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_lchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_lchown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_lchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_lchown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_lchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_lremovexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_lremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_lremovexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_lremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_lremovexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_lremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_lremovexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_lremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_lremovexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_lremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_lremovexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_lremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_lremovexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_lremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_lremovexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_lremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_lsetxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_lsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_lsetxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_lsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_lsetxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_lsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_lsetxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_lsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_lsetxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_lsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_lsetxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_lsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_lsetxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_lsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_lsetxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_lsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_open_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_open_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_open_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_open_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_open_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_open_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_open_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_open_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_open_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_open_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_open_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_open_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_open_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_open_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_open_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_open_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_open_by_handle_at_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_open_by_handle_at_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_open_by_handle_at_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_open_by_handle_at_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_open_by_handle_at_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_open_by_handle_at_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_open_by_handle_at_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_open_by_handle_at_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="Test order of audit 32bit auditctl eperm rules order" id="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_order_32bit_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_order_32bit_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_order_32bit_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_order_32bit_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_order_64bit_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_order_64bit_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_order_64bit_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_order_64bit_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_order_32bit_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_order_32bit_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="Test order of audit 32bit auditctl eperm rules order" id="oval:ssg-test_arufm_open_order_32bit_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_order_32bit_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_order_64bit_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_order_64bit_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_order_64bit_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_order_64bit_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_openat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_openat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_openat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_openat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_openat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_openat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_openat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_openat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_openat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_openat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_openat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_openat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_openat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_openat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_openat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_openat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_order_32bit_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_order_32bit_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_order_32bit_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_order_32bit_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_order_64bit_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_order_64bit_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_order_64bit_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_order_64bit_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_order_32bit_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_order_32bit_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="Test order of audit 32bit auditctl eperm rules order" id="oval:ssg-test_arufm_openat_order_32bit_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_order_32bit_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_order_64bit_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_order_64bit_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_order_64bit_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_order_64bit_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_removexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_removexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_removexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_removexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_removexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_removexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_removexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_removexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_removexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_removexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_removexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_removexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_removexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_removexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_removexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_removexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_rename_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_rename_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_rename_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_rename_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_rename_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_rename_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_rename_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_rename_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_rename_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_rename_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_rename_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_rename_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_rename_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_rename_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_rename_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_rename_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_renameat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_renameat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_renameat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_renameat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_renameat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_renameat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_renameat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_renameat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_renameat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_renameat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_renameat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_renameat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_renameat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_renameat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_renameat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_renameat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_setxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_setxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_setxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_setxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_setxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_setxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_setxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_setxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_setxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_setxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_setxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_setxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_setxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_setxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_setxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_setxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_truncate_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_truncate_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_truncate_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_truncate_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_truncate_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_truncate_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_truncate_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_truncate_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_truncate_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_truncate_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_truncate_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_truncate_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_truncate_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_truncate_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_truncate_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_truncate_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_unlink_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_unlink_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_unlink_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_unlink_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_unlink_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_unlink_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_unlink_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_unlink_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_unlink_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_unlink_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_unlink_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_unlink_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_unlink_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_unlink_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_unlink_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_unlink_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_unlinkat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_unlinkat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_unlinkat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_unlinkat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_unlinkat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_unlinkat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_unlinkat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_unlinkat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_unlinkat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_unlinkat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_unlinkat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_unlinkat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_unlinkat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_unlinkat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_unlinkat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_unlinkat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules group" id="oval:ssg-test_audit_rules_usergroup_modification_group_augen:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_group_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit group" id="oval:ssg-test_audit_rules_usergroup_modification_group_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_group_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules gshadow" id="oval:ssg-test_audit_rules_usergroup_modification_gshadow_augen:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_gshadow_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit gshadow" id="oval:ssg-test_audit_rules_usergroup_modification_gshadow_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_gshadow_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules opasswd" id="oval:ssg-test_audit_rules_usergroup_modification_opasswd_augen:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_opasswd_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit opasswd" id="oval:ssg-test_audit_rules_usergroup_modification_opasswd_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_opasswd_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules passwd" id="oval:ssg-test_audit_rules_usergroup_modification_passwd_augen:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_passwd_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit passwd" id="oval:ssg-test_audit_rules_usergroup_modification_passwd_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_passwd_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules shadow" id="oval:ssg-test_audit_rules_usergroup_modification_shadow_augen:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_shadow_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit shadow" id="oval:ssg-test_audit_rules_usergroup_modification_shadow_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_shadow_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of freq setting in the /etc/audit/auditd.conf file" id="oval:ssg-test_auditd_freq:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_auditd_freq:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_freq:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of local_events setting in the /etc/audit/auditd.conf file" id="oval:ssg-test_auditd_local_events:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_auditd_local_events:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_local_events:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of local_events setting in the /etc/audit/auditd.conf file" id="oval:ssg-test_auditd_local_events_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_auditd_local_events_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of log_format setting in the /etc/audit/auditd.conf file" id="oval:ssg-test_auditd_log_format:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_auditd_log_format:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_log_format:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of name_format setting in the /etc/audit/auditd.conf file" id="oval:ssg-test_auditd_name_format:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_auditd_name_format:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_name_format:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of write_logs setting in the /etc/audit/auditd.conf file" id="oval:ssg-test_auditd_write_logs:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_auditd_write_logs:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_write_logs:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of write_logs setting in the /etc/audit/auditd.conf file" id="oval:ssg-test_auditd_write_logs_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_auditd_write_logs_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="none_exist" id="oval:ssg-test_coreos_enable_selinux_kernel_argument_file_boot_loader_entries_ostree_2_conf_absent:tst:1" comment="Check if /boot/loader/entries/ostree-2-.*.conf does not exist" version="1">
          <unix:object object_ref="oval:ssg-object_coreos_enable_selinux_kernel_argument_file_boot_loader_entries_ostree_2_conf_absent:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:tst:1" comment="Check if argument selinux=0 is present in the line starting with 'options ' in /boot/loader/entries/ostree-1-.*.conf" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:tst:1" comment="Check if argument selinux=0 is present in the line starting with 'options ' in /boot/loader/entries/ostree-2-.*.conf" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:tst:1" comment="Check if argument selinux=0 is present in the line starting with 'BOOT_IMAGE' in /proc/cmdline" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:obj:1"/>
          <ind:state state_ref="oval:ssg-state_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of user-administration-disabled setting in the /etc/dconf/db/local.d/ file" id="oval:ssg-test_dconf_gnome_disable_user_admin:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_dconf_gnome_disable_user_admin:obj:1"/>
          <ind:state state_ref="oval:ssg-state_dconf_gnome_disable_user_admin:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent user from modifying user-administration-disabled" id="oval:ssg-test_prevent_user_user-administration-disabled:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_user-administration-disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of removal-action setting in the /etc/dconf/db/local.d/ file" id="oval:ssg-test_dconf_gnome_lock_screen_on_smartcard_removal:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_dconf_gnome_lock_screen_on_smartcard_removal:obj:1"/>
          <ind:state state_ref="oval:ssg-state_dconf_gnome_lock_screen_on_smartcard_removal:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent user from modifying removal-action" id="oval:ssg-test_prevent_user_removal-action:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_removal-action:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /lib/" id="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /lib64/" id="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_1:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_1:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /usr/lib/" id="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_2:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_2:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /usr/lib64/" id="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_3:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_3:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /bin/" id="oval:ssg-test_file_ownerdir_ownership_binary_dirs_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_ownerdir_ownership_binary_dirs_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /sbin/" id="oval:ssg-test_file_ownerdir_ownership_binary_dirs_1:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_ownerdir_ownership_binary_dirs_1:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /usr/bin/" id="oval:ssg-test_file_ownerdir_ownership_binary_dirs_2:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_ownerdir_ownership_binary_dirs_2:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /usr/sbin/" id="oval:ssg-test_file_ownerdir_ownership_binary_dirs_3:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_ownerdir_ownership_binary_dirs_3:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /usr/local/bin/" id="oval:ssg-test_file_ownerdir_ownership_binary_dirs_4:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_ownerdir_ownership_binary_dirs_4:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /usr/local/sbin/" id="oval:ssg-test_file_ownerdir_ownership_binary_dirs_5:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_ownerdir_ownership_binary_dirs_5:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /lib/" id="oval:ssg-test_file_ownerdir_ownership_library_dirs_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_ownerdir_ownership_library_dirs_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /lib64/" id="oval:ssg-test_file_ownerdir_ownership_library_dirs_1:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_ownerdir_ownership_library_dirs_1:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /usr/lib/" id="oval:ssg-test_file_ownerdir_ownership_library_dirs_2:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_ownerdir_ownership_library_dirs_2:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /usr/lib64/" id="oval:ssg-test_file_ownerdir_ownership_library_dirs_3:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_ownerdir_ownership_library_dirs_3:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /bin/" id="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_0:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /sbin/" id="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_1:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_1:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /usr/bin/" id="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_2:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_2:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /usr/sbin/" id="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_3:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_3:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /usr/local/bin/" id="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_4:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_4:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /usr/local/sbin/" id="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_5:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_5:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /lib/" id="oval:ssg-test_file_permissionsdir_permissions_library_dirs_0:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissionsdir_permissions_library_dirs_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /lib64/" id="oval:ssg-test_file_permissionsdir_permissions_library_dirs_1:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissionsdir_permissions_library_dirs_1:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /usr/lib/" id="oval:ssg-test_file_permissionsdir_permissions_library_dirs_2:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissionsdir_permissions_library_dirs_2:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /usr/lib64/" id="oval:ssg-test_file_permissionsdir_permissions_library_dirs_3:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissionsdir_permissions_library_dirs_3:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of HostbasedAuthentication setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_disable_host_auth:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_host_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_disable_host_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of HostbasedAuthentication setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_disable_host_auth_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_host_auth_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_disable_host_auth_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_file_at_deny_not_exist:tst:1" check="all" check_existence="none_exist" version="1" comment="Test that that /etc/at.deny does not exist">
          <unix:object object_ref="oval:ssg-object_file_at_deny_not_exist:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_cron_deny_not_exist:tst:1" check="all" check_existence="none_exist" version="1" comment="Test that that /etc/cron.deny does not exist">
          <unix:object object_ref="oval:ssg-object_file_cron_deny_not_exist:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /etc/group-" id="oval:ssg-test_file_groupowner_backup_etc_group_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_backup_etc_group_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /etc/gshadow-" id="oval:ssg-test_file_groupowner_backup_etc_gshadow_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_backup_etc_gshadow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /etc/passwd-" id="oval:ssg-test_file_groupowner_backup_etc_passwd_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_backup_etc_passwd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /etc/shadow-" id="oval:ssg-test_file_groupowner_backup_etc_shadow_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_backup_etc_shadow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /boot/grub2/grub.cfg" id="oval:ssg-test_file_groupowner_efi_grub2_cfg_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_efi_grub2_cfg_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /etc/group" id="oval:ssg-test_file_groupowner_etc_group_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_group_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /etc/gshadow" id="oval:ssg-test_file_groupowner_etc_gshadow_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_gshadow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /etc/issue" id="oval:ssg-test_file_groupowner_etc_issue_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_issue_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /etc/motd" id="oval:ssg-test_file_groupowner_etc_motd_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_motd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /etc/passwd" id="oval:ssg-test_file_groupowner_etc_passwd_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_passwd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /etc/shadow" id="oval:ssg-test_file_groupowner_etc_shadow_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_shadow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /boot/grub2/grub.cfg" id="oval:ssg-test_file_groupowner_grub2_cfg_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_grub2_cfg_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /var/log/" id="oval:ssg-test_file_groupowner_var_log_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_var_log_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /var/log/messages" id="oval:ssg-test_file_groupowner_var_log_messages_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_var_log_messages_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /var/log/syslog" id="oval:ssg-test_file_groupowner_var_log_syslog_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_var_log_syslog_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /etc/audit/" id="oval:ssg-test_file_groupownership_audit_configuration_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupownership_audit_configuration_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /etc/audit/rules.d/" id="oval:ssg-test_file_groupownership_audit_configuration_1:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupownership_audit_configuration_1:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /etc/group-" id="oval:ssg-test_file_owner_backup_etc_group_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_backup_etc_group_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /etc/gshadow-" id="oval:ssg-test_file_owner_backup_etc_gshadow_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_backup_etc_gshadow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /etc/passwd-" id="oval:ssg-test_file_owner_backup_etc_passwd_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_backup_etc_passwd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /etc/shadow-" id="oval:ssg-test_file_owner_backup_etc_shadow_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_backup_etc_shadow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /boot/grub2/grub.cfg" id="oval:ssg-test_file_owner_efi_grub2_cfg_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_efi_grub2_cfg_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /etc/group" id="oval:ssg-test_file_owner_etc_group_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_etc_group_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /etc/gshadow" id="oval:ssg-test_file_owner_etc_gshadow_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_etc_gshadow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /etc/issue" id="oval:ssg-test_file_owner_etc_issue_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_etc_issue_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /etc/motd" id="oval:ssg-test_file_owner_etc_motd_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_etc_motd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /etc/passwd" id="oval:ssg-test_file_owner_etc_passwd_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_etc_passwd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /etc/shadow" id="oval:ssg-test_file_owner_etc_shadow_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_etc_shadow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /boot/grub2/grub.cfg" id="oval:ssg-test_file_owner_grub2_cfg_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_grub2_cfg_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /var/log/" id="oval:ssg-test_file_owner_var_log_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_var_log_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /var/log/messages" id="oval:ssg-test_file_owner_var_log_messages_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_var_log_messages_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /var/log/syslog" id="oval:ssg-test_file_owner_var_log_syslog_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_var_log_syslog_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /etc/audit/" id="oval:ssg-test_file_ownership_audit_configuration_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_ownership_audit_configuration_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /etc/audit/rules.d/" id="oval:ssg-test_file_ownership_audit_configuration_1:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_ownership_audit_configuration_1:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /lib/" id="oval:ssg-test_file_ownership_library_dirs_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_ownership_library_dirs_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /lib64/" id="oval:ssg-test_file_ownership_library_dirs_1:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_ownership_library_dirs_1:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /usr/lib/" id="oval:ssg-test_file_ownership_library_dirs_2:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_ownership_library_dirs_2:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing user ownership of /usr/lib64/" id="oval:ssg-test_file_ownership_library_dirs_3:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_ownership_library_dirs_3:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /etc/group-" id="oval:ssg-test_file_permissions_backup_etc_group_0:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissions_backup_etc_group_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /etc/gshadow-" id="oval:ssg-test_file_permissions_backup_etc_gshadow_0:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissions_backup_etc_gshadow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /etc/passwd-" id="oval:ssg-test_file_permissions_backup_etc_passwd_0:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissions_backup_etc_passwd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /etc/shadow-" id="oval:ssg-test_file_permissions_backup_etc_shadow_0:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissions_backup_etc_shadow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /boot/grub2/grub.cfg" id="oval:ssg-test_file_permissions_efi_grub2_cfg_0:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissions_efi_grub2_cfg_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /etc/audit/auditd.conf" id="oval:ssg-test_file_permissions_etc_audit_auditd_0:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_audit_auditd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /etc/audit/rules.d/" id="oval:ssg-test_file_permissions_etc_audit_rulesd_0:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_audit_rulesd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /etc/group" id="oval:ssg-test_file_permissions_etc_group_0:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_group_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /etc/gshadow" id="oval:ssg-test_file_permissions_etc_gshadow_0:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_gshadow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /etc/issue" id="oval:ssg-test_file_permissions_etc_issue_0:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_issue_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /etc/motd" id="oval:ssg-test_file_permissions_etc_motd_0:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_motd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /etc/passwd" id="oval:ssg-test_file_permissions_etc_passwd_0:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_passwd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /etc/shadow" id="oval:ssg-test_file_permissions_etc_shadow_0:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_shadow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /boot/grub2/grub.cfg" id="oval:ssg-test_file_permissions_grub2_cfg_0:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissions_grub2_cfg_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /lib/" id="oval:ssg-test_file_permissions_library_dirs_0:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissions_library_dirs_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /lib64/" id="oval:ssg-test_file_permissions_library_dirs_1:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissions_library_dirs_1:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /usr/lib/" id="oval:ssg-test_file_permissions_library_dirs_2:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissions_library_dirs_2:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /usr/lib64/" id="oval:ssg-test_file_permissions_library_dirs_3:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissions_library_dirs_3:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /etc/ssh/" id="oval:ssg-test_file_permissions_sshd_private_key_0:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissions_sshd_private_key_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /etc/ssh/" id="oval:ssg-test_file_permissions_sshd_pub_key_0:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissions_sshd_pub_key_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /var/log/" id="oval:ssg-test_file_permissions_var_log_0:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissions_var_log_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /var/log/messages" id="oval:ssg-test_file_permissions_var_log_messages_0:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissions_var_log_messages_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing mode of /var/log/syslog" id="oval:ssg-test_file_permissions_var_log_syslog_0:tst:1" version="3">
          <unix:object object_ref="oval:ssg-object_file_permissions_var_log_syslog_0:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_audit_argument:tst:1" comment="check for audit=1 in /etc/default/grub via GRUB_CMDLINE_LINUX" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_audit_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_audit_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_audit_argument_default:tst:1" comment="check for audit=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_audit_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_audit_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_audit_backlog_limit_argument:tst:1" comment="check for audit_backlog_limit=8192 in /etc/default/grub via GRUB_CMDLINE_LINUX" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_audit_backlog_limit_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_audit_backlog_limit_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_audit_backlog_limit_argument_default:tst:1" comment="check for audit_backlog_limit=8192 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_audit_backlog_limit_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_audit_backlog_limit_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_iommu_argument:tst:1" comment="check for iommu=force in /etc/default/grub via GRUB_CMDLINE_LINUX" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_iommu_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_iommu_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_iommu_argument_default:tst:1" comment="check for iommu=force in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_iommu_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_iommu_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_ipv6_disable_argument:tst:1" comment="check for ipv6.disable=1 in /etc/default/grub via GRUB_CMDLINE_LINUX" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_ipv6_disable_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_ipv6_disable_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_ipv6_disable_argument_default:tst:1" comment="check for ipv6.disable=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_ipv6_disable_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_ipv6_disable_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_l1tf_argument:tst:1" comment="check for l1tf in /etc/default/grub via GRUB_CMDLINE_LINUX" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_l1tf_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_l1tf_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_l1tf_argument_default:tst:1" comment="check for l1tf in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_l1tf_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_l1tf_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_mce_argument:tst:1" comment="check for mce=0 in /etc/default/grub via GRUB_CMDLINE_LINUX" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_mce_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_mce_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_mce_argument_default:tst:1" comment="check for mce=0 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_mce_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_mce_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_mds_argument:tst:1" comment="check for mds in /etc/default/grub via GRUB_CMDLINE_LINUX" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_mds_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_mds_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_mds_argument_default:tst:1" comment="check for mds in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_mds_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_mds_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_nosmap_argument_absent:tst:1" comment="check for absence nosmap in /etc/default/grub via GRUB_CMDLINE_LINUX" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_nosmap_argument_absent:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_nosmap_argument_absent_default:tst:1" comment="check for absence nosmap in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_nosmap_argument_absent_default:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_nosmep_argument_absent:tst:1" comment="check for absence nosmep in /etc/default/grub via GRUB_CMDLINE_LINUX" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_nosmep_argument_absent:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_nosmep_argument_absent_default:tst:1" comment="check for absence nosmep in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_nosmep_argument_absent_default:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_page_poison_argument:tst:1" comment="check for page_poison=1 in /etc/default/grub via GRUB_CMDLINE_LINUX" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_page_poison_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_page_poison_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_page_poison_argument_default:tst:1" comment="check for page_poison=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_page_poison_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_page_poison_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_pti_argument:tst:1" comment="check for pti=on in /etc/default/grub via GRUB_CMDLINE_LINUX" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_pti_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_pti_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_pti_argument_default:tst:1" comment="check for pti=on in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_pti_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_pti_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_rng_core_default_quality_argument:tst:1" comment="check for rng_core.default_quality in /etc/default/grub via GRUB_CMDLINE_LINUX" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_rng_core_default_quality_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_rng_core_default_quality_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_rng_core_default_quality_argument_default:tst:1" comment="check for rng_core.default_quality in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_rng_core_default_quality_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_rng_core_default_quality_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_slab_nomerge_argument:tst:1" comment="check for slab_nomerge=yes in /etc/default/grub via GRUB_CMDLINE_LINUX" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_slab_nomerge_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_slab_nomerge_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_slab_nomerge_argument_default:tst:1" comment="check for slab_nomerge=yes in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_slab_nomerge_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_slab_nomerge_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_slub_debug_argument:tst:1" comment="check for slub_debug in /etc/default/grub via GRUB_CMDLINE_LINUX" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_slub_debug_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_slub_debug_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_slub_debug_argument_default:tst:1" comment="check for slub_debug in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_slub_debug_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_slub_debug_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_spec_store_bypass_disable_argument:tst:1" comment="check for spec_store_bypass_disable in /etc/default/grub via GRUB_CMDLINE_LINUX" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_spec_store_bypass_disable_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_spec_store_bypass_disable_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_spec_store_bypass_disable_argument_default:tst:1" comment="check for spec_store_bypass_disable in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_spec_store_bypass_disable_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_spec_store_bypass_disable_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_spectre_v2_argument:tst:1" comment="check for spectre_v2=on in /etc/default/grub via GRUB_CMDLINE_LINUX" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_spectre_v2_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_spectre_v2_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_spectre_v2_argument_default:tst:1" comment="check for spectre_v2=on in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_spectre_v2_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_spectre_v2_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_vsyscall_argument:tst:1" comment="check for vsyscall=none in /etc/default/grub via GRUB_CMDLINE_LINUX" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_vsyscall_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_vsyscall_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_vsyscall_argument_default:tst:1" comment="check for vsyscall=none in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_vsyscall_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_vsyscall_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_openssl-pkcs11_installed:tst:1" version="1" comment="package openssl-pkcs11 is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_openssl-pkcs11_installed:obj:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_ACPI_CUSTOM_METHOD=n" id="oval:ssg-test_kernel_config_acpi_custom_method:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_acpi_custom_method:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_acpi_custom_method:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check /boot/config-.* files for absence of CONFIG_ACPI_CUSTOM_METHOD" id="oval:ssg-test_kernel_config_acpi_custom_method_absence:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_acpi_custom_method:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_acpi_custom_method_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_acpi_custom_method_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_acpi_custom_method:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_ARM64_SW_TTBR0_PAN=y" id="oval:ssg-test_kernel_config_arm64_sw_ttbr0_pan:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_arm64_sw_ttbr0_pan:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_arm64_sw_ttbr0_pan:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_arm64_sw_ttbr0_pan_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_arm64_sw_ttbr0_pan_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_arm64_sw_ttbr0_pan:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_BINFMT_MISC=n" id="oval:ssg-test_kernel_config_binfmt_misc:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_binfmt_misc:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_binfmt_misc:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check /boot/config-.* files for absence of CONFIG_BINFMT_MISC" id="oval:ssg-test_kernel_config_binfmt_misc_absence:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_binfmt_misc:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_binfmt_misc_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_binfmt_misc_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_binfmt_misc:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_BUG=y" id="oval:ssg-test_kernel_config_bug:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_bug:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_bug:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_bug_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_bug_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_bug:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_BUG_ON_DATA_CORRUPTION=y" id="oval:ssg-test_kernel_config_bug_on_data_corruption:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_bug_on_data_corruption:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_bug_on_data_corruption:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_bug_on_data_corruption_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_bug_on_data_corruption_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_bug_on_data_corruption:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_COMPAT_BRK=n" id="oval:ssg-test_kernel_config_compat_brk:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_compat_brk:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_compat_brk:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check /boot/config-.* files for absence of CONFIG_COMPAT_BRK" id="oval:ssg-test_kernel_config_compat_brk_absence:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_compat_brk:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_compat_brk_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_compat_brk_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_compat_brk:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_COMPAT_VDSO=n" id="oval:ssg-test_kernel_config_compat_vdso:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_compat_vdso:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_compat_vdso:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check /boot/config-.* files for absence of CONFIG_COMPAT_VDSO" id="oval:ssg-test_kernel_config_compat_vdso_absence:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_compat_vdso:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_compat_vdso_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_compat_vdso_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_compat_vdso:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_DEBUG_CREDENTIALS=y" id="oval:ssg-test_kernel_config_debug_credentials:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_debug_credentials:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_debug_credentials:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_debug_credentials_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_debug_credentials_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_debug_credentials:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_DEBUG_FS=n" id="oval:ssg-test_kernel_config_debug_fs:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_debug_fs:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_debug_fs:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check /boot/config-.* files for absence of CONFIG_DEBUG_FS" id="oval:ssg-test_kernel_config_debug_fs_absence:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_debug_fs:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_debug_fs_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_debug_fs_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_debug_fs:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_DEBUG_LIST=y" id="oval:ssg-test_kernel_config_debug_list:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_debug_list:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_debug_list:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_debug_list_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_debug_list_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_debug_list:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_DEBUG_NOTIFIERS=y" id="oval:ssg-test_kernel_config_debug_notifiers:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_debug_notifiers:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_debug_notifiers:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_debug_notifiers_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_debug_notifiers_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_debug_notifiers:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_DEBUG_SG=y" id="oval:ssg-test_kernel_config_debug_sg:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_debug_sg:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_debug_sg:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_debug_sg_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_debug_sg_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_debug_sg:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_DEBUG_WX=y" id="oval:ssg-test_kernel_config_debug_wx:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_debug_wx:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_debug_wx:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_debug_wx_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_debug_wx_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_debug_wx:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_DEFAULT_MMAP_MIN_ADDR=65536" id="oval:ssg-test_kernel_config_default_mmap_min_addr:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_default_mmap_min_addr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_default_mmap_min_addr:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_default_mmap_min_addr_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_default_mmap_min_addr_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_default_mmap_min_addr:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_DEVKMEM=n" id="oval:ssg-test_kernel_config_devkmem:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_devkmem:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_devkmem:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check /boot/config-.* files for absence of CONFIG_DEVKMEM" id="oval:ssg-test_kernel_config_devkmem_absence:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_devkmem:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_devkmem_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_devkmem_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_devkmem:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_FORTIFY_SOURCE=y" id="oval:ssg-test_kernel_config_fortify_source:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_fortify_source:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_fortify_source:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_fortify_source_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_fortify_source_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_fortify_source:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y" id="oval:ssg-test_kernel_config_gcc_plugin_latent_entropy:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_gcc_plugin_latent_entropy:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_gcc_plugin_latent_entropy:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_gcc_plugin_latent_entropy_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_gcc_plugin_latent_entropy_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_gcc_plugin_latent_entropy:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_GCC_PLUGIN_RANDSTRUCT=y" id="oval:ssg-test_kernel_config_gcc_plugin_randstruct:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_gcc_plugin_randstruct:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_gcc_plugin_randstruct:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_gcc_plugin_randstruct_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_gcc_plugin_randstruct_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_gcc_plugin_randstruct:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_GCC_PLUGIN_STACKLEAK=y" id="oval:ssg-test_kernel_config_gcc_plugin_stackleak:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_gcc_plugin_stackleak:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_gcc_plugin_stackleak:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_gcc_plugin_stackleak_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_gcc_plugin_stackleak_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_gcc_plugin_stackleak:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_GCC_PLUGIN_STRUCTLEAK=y" id="oval:ssg-test_kernel_config_gcc_plugin_structleak:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_gcc_plugin_structleak:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_gcc_plugin_structleak:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_gcc_plugin_structleak_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_gcc_plugin_structleak_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_gcc_plugin_structleak:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y" id="oval:ssg-test_kernel_config_gcc_plugin_structleak_byref_all:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_gcc_plugin_structleak_byref_all:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_gcc_plugin_structleak_byref_all:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_gcc_plugin_structleak_byref_all_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_gcc_plugin_structleak_byref_all_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_gcc_plugin_structleak_byref_all:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_HARDENED_USERCOPY=y" id="oval:ssg-test_kernel_config_hardened_usercopy:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_hardened_usercopy:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_hardened_usercopy:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_hardened_usercopy_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_hardened_usercopy_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_hardened_usercopy:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_HARDENED_USERCOPY_FALLBACK=n" id="oval:ssg-test_kernel_config_hardened_usercopy_fallback:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_hardened_usercopy_fallback:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_hardened_usercopy_fallback:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check /boot/config-.* files for absence of CONFIG_HARDENED_USERCOPY_FALLBACK" id="oval:ssg-test_kernel_config_hardened_usercopy_fallback_absence:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_hardened_usercopy_fallback:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_hardened_usercopy_fallback_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_hardened_usercopy_fallback_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_hardened_usercopy_fallback:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_HIBERNATION=n" id="oval:ssg-test_kernel_config_hibernation:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_hibernation:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_hibernation:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check /boot/config-.* files for absence of CONFIG_HIBERNATION" id="oval:ssg-test_kernel_config_hibernation_absence:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_hibernation:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_hibernation_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_hibernation_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_hibernation:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_IA32_EMULATION=n" id="oval:ssg-test_kernel_config_ia32_emulation:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_ia32_emulation:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_ia32_emulation:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check /boot/config-.* files for absence of CONFIG_IA32_EMULATION" id="oval:ssg-test_kernel_config_ia32_emulation_absence:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_ia32_emulation:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_ia32_emulation_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_ia32_emulation_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_ia32_emulation:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_IPV6=n" id="oval:ssg-test_kernel_config_ipv6:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_ipv6:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_ipv6:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check /boot/config-.* files for absence of CONFIG_IPV6" id="oval:ssg-test_kernel_config_ipv6_absence:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_ipv6:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_ipv6_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_ipv6_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_ipv6:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_KEXEC=n" id="oval:ssg-test_kernel_config_kexec:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_kexec:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_kexec:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check /boot/config-.* files for absence of CONFIG_KEXEC" id="oval:ssg-test_kernel_config_kexec_absence:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_kexec:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_kexec_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_kexec_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_kexec:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_LEGACY_PTYS=n" id="oval:ssg-test_kernel_config_legacy_ptys:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_legacy_ptys:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_legacy_ptys:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check /boot/config-.* files for absence of CONFIG_LEGACY_PTYS" id="oval:ssg-test_kernel_config_legacy_ptys_absence:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_legacy_ptys:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_legacy_ptys_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_legacy_ptys_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_legacy_ptys:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_LEGACY_VSYSCALL_EMULATE=n" id="oval:ssg-test_kernel_config_legacy_vsyscall_emulate:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_emulate:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_legacy_vsyscall_emulate:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check /boot/config-.* files for absence of CONFIG_LEGACY_VSYSCALL_EMULATE" id="oval:ssg-test_kernel_config_legacy_vsyscall_emulate_absence:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_emulate:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_legacy_vsyscall_emulate_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_legacy_vsyscall_emulate_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_legacy_vsyscall_emulate:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_LEGACY_VSYSCALL_NONE=y" id="oval:ssg-test_kernel_config_legacy_vsyscall_none:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_none:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_legacy_vsyscall_none:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_legacy_vsyscall_none_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_legacy_vsyscall_none_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_legacy_vsyscall_none:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_LEGACY_VSYSCALL_XONLY=n" id="oval:ssg-test_kernel_config_legacy_vsyscall_xonly:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_xonly:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_legacy_vsyscall_xonly:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check /boot/config-.* files for absence of CONFIG_LEGACY_VSYSCALL_XONLY" id="oval:ssg-test_kernel_config_legacy_vsyscall_xonly_absence:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_xonly:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_legacy_vsyscall_xonly_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_legacy_vsyscall_xonly_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_legacy_vsyscall_xonly:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_MODIFY_LDT_SYSCALL=n" id="oval:ssg-test_kernel_config_modify_ldt_syscall:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_modify_ldt_syscall:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_modify_ldt_syscall:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check /boot/config-.* files for absence of CONFIG_MODIFY_LDT_SYSCALL" id="oval:ssg-test_kernel_config_modify_ldt_syscall_absence:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_modify_ldt_syscall:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_modify_ldt_syscall_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_modify_ldt_syscall_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_modify_ldt_syscall:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_MODULE_SIG=y" id="oval:ssg-test_kernel_config_module_sig:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_module_sig:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_module_sig:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_module_sig_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_module_sig_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_module_sig:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_MODULE_SIG_ALL=y" id="oval:ssg-test_kernel_config_module_sig_all:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_module_sig_all:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_module_sig_all:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_module_sig_all_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_module_sig_all_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_module_sig_all:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_MODULE_SIG_FORCE=y" id="oval:ssg-test_kernel_config_module_sig_force:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_module_sig_force:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_module_sig_force:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_module_sig_force_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_module_sig_force_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_module_sig_force:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_MODULE_SIG_HASH according to var_kernel_config_module_sig_hash" id="oval:ssg-test_kernel_config_module_sig_hash:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_module_sig_hash:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_module_sig_hash:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_module_sig_hash_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_module_sig_hash_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_module_sig_hash:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_MODULE_SIG_KEY according to var_kernel_config_module_sig_key" id="oval:ssg-test_kernel_config_module_sig_key:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_module_sig_key:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_module_sig_key:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_module_sig_key_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_module_sig_key_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_module_sig_key:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_MODULE_SIG_SHA512=y" id="oval:ssg-test_kernel_config_module_sig_sha512:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_module_sig_sha512:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_module_sig_sha512:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_module_sig_sha512_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_module_sig_sha512_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_module_sig_sha512:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_PAGE_POISONING=y" id="oval:ssg-test_kernel_config_page_poisoning:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_page_poisoning:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_page_poisoning:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_page_poisoning_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_page_poisoning_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_page_poisoning:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_PAGE_POISONING_NO_SANITY=y" id="oval:ssg-test_kernel_config_page_poisoning_no_sanity:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_page_poisoning_no_sanity:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_page_poisoning_no_sanity:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_page_poisoning_no_sanity_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_page_poisoning_no_sanity_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_page_poisoning_no_sanity:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_PAGE_POISONING_ZERO=y" id="oval:ssg-test_kernel_config_page_poisoning_zero:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_page_poisoning_zero:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_page_poisoning_zero:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_page_poisoning_zero_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_page_poisoning_zero_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_page_poisoning_zero:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_PAGE_TABLE_ISOLATION=y" id="oval:ssg-test_kernel_config_page_table_isolation:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_page_table_isolation:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_page_table_isolation:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_page_table_isolation_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_page_table_isolation_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_page_table_isolation:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_PANIC_ON_OOPS=y" id="oval:ssg-test_kernel_config_panic_on_oops:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_panic_on_oops:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_panic_on_oops:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_panic_on_oops_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_panic_on_oops_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_panic_on_oops:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_PANIC_TIMEOUT according to var_kernel_config_panic_timeout" id="oval:ssg-test_kernel_config_panic_timeout:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_panic_timeout:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_panic_timeout:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_panic_timeout_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_panic_timeout_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_panic_timeout:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_PROC_KCORE=n" id="oval:ssg-test_kernel_config_proc_kcore:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_proc_kcore:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_proc_kcore:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check /boot/config-.* files for absence of CONFIG_PROC_KCORE" id="oval:ssg-test_kernel_config_proc_kcore_absence:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_proc_kcore:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_proc_kcore_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_proc_kcore_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_proc_kcore:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_RANDOMIZE_BASE=y" id="oval:ssg-test_kernel_config_randomize_base:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_randomize_base:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_randomize_base:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_randomize_base_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_randomize_base_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_randomize_base:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_RANDOMIZE_MEMORY=y" id="oval:ssg-test_kernel_config_randomize_memory:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_randomize_memory:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_randomize_memory:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_randomize_memory_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_randomize_memory_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_randomize_memory:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_REFCOUNT_FULL=y" id="oval:ssg-test_kernel_config_refcount_full:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_refcount_full:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_refcount_full:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_refcount_full_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_refcount_full_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_refcount_full:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_RETPOLINE=y" id="oval:ssg-test_kernel_config_retpoline:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_retpoline:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_retpoline:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_retpoline_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_retpoline_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_retpoline:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_SCHED_STACK_END_CHECK=y" id="oval:ssg-test_kernel_config_sched_stack_end_check:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_sched_stack_end_check:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_sched_stack_end_check:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_sched_stack_end_check_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_sched_stack_end_check_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_sched_stack_end_check:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_SECCOMP=y" id="oval:ssg-test_kernel_config_seccomp:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_seccomp:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_seccomp:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_seccomp_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_seccomp_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_seccomp:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_SECCOMP_FILTER=y" id="oval:ssg-test_kernel_config_seccomp_filter:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_seccomp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_seccomp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_seccomp_filter_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_seccomp_filter_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_seccomp_filter:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_SECURITY=y" id="oval:ssg-test_kernel_config_security:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_security:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_security:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_security_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_security_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_security:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_SECURITY_DMESG_RESTRICT=n" id="oval:ssg-test_kernel_config_security_dmesg_restrict:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_security_dmesg_restrict:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_security_dmesg_restrict:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check /boot/config-.* files for absence of CONFIG_SECURITY_DMESG_RESTRICT" id="oval:ssg-test_kernel_config_security_dmesg_restrict_absence:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_security_dmesg_restrict:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_security_dmesg_restrict_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_security_dmesg_restrict_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_security_dmesg_restrict:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_SECURITY_WRITABLE_HOOKS=y" id="oval:ssg-test_kernel_config_security_writable_hooks:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_security_writable_hooks:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_security_writable_hooks:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_security_writable_hooks_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_security_writable_hooks_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_security_writable_hooks:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_SECURITY_YAMA=y" id="oval:ssg-test_kernel_config_security_yama:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_security_yama:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_security_yama:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_security_yama_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_security_yama_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_security_yama:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_SLAB_FREELIST_HARDENED=y" id="oval:ssg-test_kernel_config_slab_freelist_hardened:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_slab_freelist_hardened:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_slab_freelist_hardened:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_slab_freelist_hardened_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_slab_freelist_hardened_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_slab_freelist_hardened:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_SLAB_FRELIST_RANDOM=y" id="oval:ssg-test_kernel_config_slab_frelist_random:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_slab_frelist_random:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_slab_frelist_random:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_slab_frelist_random_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_slab_frelist_random_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_slab_frelist_random:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_SLAB_MERGE_DEFAULT=n" id="oval:ssg-test_kernel_config_slab_merge_default:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_slab_merge_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_slab_merge_default:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check /boot/config-.* files for absence of CONFIG_SLAB_MERGE_DEFAULT" id="oval:ssg-test_kernel_config_slab_merge_default_absence:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_slab_merge_default:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_slab_merge_default_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_slab_merge_default_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_slab_merge_default:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_SLUB_DEBUG=y" id="oval:ssg-test_kernel_config_slub_debug:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_slub_debug:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_slub_debug:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_slub_debug_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_slub_debug_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_slub_debug:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_STACKPROTECTOR=y" id="oval:ssg-test_kernel_config_stackprotector:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_stackprotector:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_stackprotector:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_stackprotector_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_stackprotector_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_stackprotector:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_STACKPROTECTOR_STRONG=y" id="oval:ssg-test_kernel_config_stackprotector_strong:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_stackprotector_strong:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_stackprotector_strong:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_stackprotector_strong_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_stackprotector_strong_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_stackprotector_strong:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_STRICT_KERNEL_RWX=y" id="oval:ssg-test_kernel_config_strict_kernel_rwx:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_strict_kernel_rwx:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_strict_kernel_rwx:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_strict_kernel_rwx_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_strict_kernel_rwx_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_strict_kernel_rwx:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_STRICT_MODULE_RWX=y" id="oval:ssg-test_kernel_config_strict_module_rwx:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_strict_module_rwx:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_strict_module_rwx:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_strict_module_rwx_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_strict_module_rwx_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_strict_module_rwx:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_SYN_COOKIES=y" id="oval:ssg-test_kernel_config_syn_cookies:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_syn_cookies:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_syn_cookies:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_syn_cookies_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_syn_cookies_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_syn_cookies:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_UNMAP_KERNEL_AT_EL0=y" id="oval:ssg-test_kernel_config_unmap_kernel_at_el0:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_unmap_kernel_at_el0:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_unmap_kernel_at_el0:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_unmap_kernel_at_el0_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_unmap_kernel_at_el0_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_unmap_kernel_at_el0:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_VMAP_STACK=y" id="oval:ssg-test_kernel_config_vmap_stack:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_vmap_stack:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_vmap_stack:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_vmap_stack_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_vmap_stack_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_vmap_stack:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="Check /boot/config-.* files for CONFIG_X86_VSYSCALL_EMULATION=n" id="oval:ssg-test_kernel_config_x86_vsyscall_emulation:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_x86_vsyscall_emulation:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_x86_vsyscall_emulation:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check /boot/config-.* files for absence of CONFIG_X86_VSYSCALL_EMULATION" id="oval:ssg-test_kernel_config_x86_vsyscall_emulation_absence:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_kernel_config_x86_vsyscall_emulation:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check if all installed kernels are compliant" id="oval:ssg-test_all_kernels_config_x86_vsyscall_emulation_compliant:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_x86_vsyscall_emulation_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_x86_vsyscall_emulation:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_atm_disabled:tst:1" version="1" check="all" comment="kernel module atm disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_atm_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_atm_modprobeconf:tst:1" version="1" check="all" comment="kernel module atm disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_atm_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_atm_etcmodules-load:tst:1" version="1" check="all" comment="kernel module atm disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_atm_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_atm_runmodules-load:tst:1" version="1" check="all" comment="kernel module atm disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_atm_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_atm_libmodules-load:tst:1" version="1" check="all" comment="kernel module atm disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_atm_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_atm_runmodprobed:tst:1" version="1" check="all" comment="kernel module atm disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_atm_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_atm_libmodprobed:tst:1" version="1" check="all" comment="kernel module atm disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_atm_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_disabled:tst:1" version="1" check="all" comment="kernel module bluetooth disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_bluetooth_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_modprobeconf:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_bluetooth_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_etcmodules-load:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_bluetooth_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_runmodules-load:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_bluetooth_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_libmodules-load:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_bluetooth_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_runmodprobed:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_bluetooth_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_libmodprobed:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_bluetooth_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_can_disabled:tst:1" version="1" check="all" comment="kernel module can disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_can_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_can_modprobeconf:tst:1" version="1" check="all" comment="kernel module can disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_can_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_can_etcmodules-load:tst:1" version="1" check="all" comment="kernel module can disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_can_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_can_runmodules-load:tst:1" version="1" check="all" comment="kernel module can disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_can_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_can_libmodules-load:tst:1" version="1" check="all" comment="kernel module can disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_can_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_can_runmodprobed:tst:1" version="1" check="all" comment="kernel module can disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_can_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_can_libmodprobed:tst:1" version="1" check="all" comment="kernel module can disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_can_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cfg80211_disabled:tst:1" version="1" check="all" comment="kernel module cfg80211 disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_cfg80211_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cfg80211_modprobeconf:tst:1" version="1" check="all" comment="kernel module cfg80211 disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_cfg80211_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cfg80211_etcmodules-load:tst:1" version="1" check="all" comment="kernel module cfg80211 disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_cfg80211_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cfg80211_runmodules-load:tst:1" version="1" check="all" comment="kernel module cfg80211 disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_cfg80211_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cfg80211_libmodules-load:tst:1" version="1" check="all" comment="kernel module cfg80211 disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_cfg80211_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cfg80211_runmodprobed:tst:1" version="1" check="all" comment="kernel module cfg80211 disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_cfg80211_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cfg80211_libmodprobed:tst:1" version="1" check="all" comment="kernel module cfg80211 disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_cfg80211_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_disabled:tst:1" version="1" check="all" comment="kernel module cramfs disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_cramfs_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_modprobeconf:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_cramfs_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_etcmodules-load:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_cramfs_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_runmodules-load:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_cramfs_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_libmodules-load:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_cramfs_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_runmodprobed:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_cramfs_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_libmodprobed:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_cramfs_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_disabled:tst:1" version="1" check="all" comment="kernel module dccp disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_dccp_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_modprobeconf:tst:1" version="1" check="all" comment="kernel module dccp disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_dccp_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_etcmodules-load:tst:1" version="1" check="all" comment="kernel module dccp disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_dccp_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_runmodules-load:tst:1" version="1" check="all" comment="kernel module dccp disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_dccp_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_libmodules-load:tst:1" version="1" check="all" comment="kernel module dccp disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_dccp_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_runmodprobed:tst:1" version="1" check="all" comment="kernel module dccp disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_dccp_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_libmodprobed:tst:1" version="1" check="all" comment="kernel module dccp disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_dccp_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_disabled:tst:1" version="1" check="all" comment="kernel module firewire-core disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_firewire-core_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_modprobeconf:tst:1" version="1" check="all" comment="kernel module firewire-core disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_firewire-core_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_etcmodules-load:tst:1" version="1" check="all" comment="kernel module firewire-core disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_firewire-core_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_runmodules-load:tst:1" version="1" check="all" comment="kernel module firewire-core disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_firewire-core_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_libmodules-load:tst:1" version="1" check="all" comment="kernel module firewire-core disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_firewire-core_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_runmodprobed:tst:1" version="1" check="all" comment="kernel module firewire-core disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_firewire-core_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_libmodprobed:tst:1" version="1" check="all" comment="kernel module firewire-core disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_firewire-core_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_disabled:tst:1" version="1" check="all" comment="kernel module freevxfs disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_freevxfs_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_modprobeconf:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_freevxfs_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_etcmodules-load:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_freevxfs_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_runmodules-load:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_freevxfs_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_libmodules-load:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_freevxfs_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_runmodprobed:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_freevxfs_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_libmodprobed:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_freevxfs_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_disabled:tst:1" version="1" check="all" comment="kernel module hfs disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfs_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_modprobeconf:tst:1" version="1" check="all" comment="kernel module hfs disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfs_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_etcmodules-load:tst:1" version="1" check="all" comment="kernel module hfs disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfs_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_runmodules-load:tst:1" version="1" check="all" comment="kernel module hfs disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfs_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_libmodules-load:tst:1" version="1" check="all" comment="kernel module hfs disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfs_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_runmodprobed:tst:1" version="1" check="all" comment="kernel module hfs disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfs_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_libmodprobed:tst:1" version="1" check="all" comment="kernel module hfs disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfs_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_disabled:tst:1" version="1" check="all" comment="kernel module hfsplus disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfsplus_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_modprobeconf:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfsplus_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_etcmodules-load:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfsplus_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_runmodules-load:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfsplus_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_libmodules-load:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfsplus_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_runmodprobed:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfsplus_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_libmodprobed:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfsplus_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_iwlmvm_disabled:tst:1" version="1" check="all" comment="kernel module iwlmvm disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_iwlmvm_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_iwlmvm_modprobeconf:tst:1" version="1" check="all" comment="kernel module iwlmvm disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_iwlmvm_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_iwlmvm_etcmodules-load:tst:1" version="1" check="all" comment="kernel module iwlmvm disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_iwlmvm_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_iwlmvm_runmodules-load:tst:1" version="1" check="all" comment="kernel module iwlmvm disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_iwlmvm_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_iwlmvm_libmodules-load:tst:1" version="1" check="all" comment="kernel module iwlmvm disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_iwlmvm_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_iwlmvm_runmodprobed:tst:1" version="1" check="all" comment="kernel module iwlmvm disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_iwlmvm_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_iwlmvm_libmodprobed:tst:1" version="1" check="all" comment="kernel module iwlmvm disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_iwlmvm_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_iwlwifi_disabled:tst:1" version="1" check="all" comment="kernel module iwlwifi disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_iwlwifi_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_iwlwifi_modprobeconf:tst:1" version="1" check="all" comment="kernel module iwlwifi disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_iwlwifi_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_iwlwifi_etcmodules-load:tst:1" version="1" check="all" comment="kernel module iwlwifi disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_iwlwifi_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_iwlwifi_runmodules-load:tst:1" version="1" check="all" comment="kernel module iwlwifi disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_iwlwifi_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_iwlwifi_libmodules-load:tst:1" version="1" check="all" comment="kernel module iwlwifi disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_iwlwifi_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_iwlwifi_runmodprobed:tst:1" version="1" check="all" comment="kernel module iwlwifi disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_iwlwifi_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_iwlwifi_libmodprobed:tst:1" version="1" check="all" comment="kernel module iwlwifi disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_iwlwifi_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_disabled:tst:1" version="1" check="all" comment="kernel module jffs2 disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_jffs2_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_modprobeconf:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_jffs2_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_etcmodules-load:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_jffs2_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_runmodules-load:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_jffs2_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_libmodules-load:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_jffs2_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_runmodprobed:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_jffs2_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_libmodprobed:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_jffs2_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_mac80211_disabled:tst:1" version="1" check="all" comment="kernel module mac80211 disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_mac80211_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_mac80211_modprobeconf:tst:1" version="1" check="all" comment="kernel module mac80211 disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_mac80211_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_mac80211_etcmodules-load:tst:1" version="1" check="all" comment="kernel module mac80211 disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_mac80211_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_mac80211_runmodules-load:tst:1" version="1" check="all" comment="kernel module mac80211 disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_mac80211_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_mac80211_libmodules-load:tst:1" version="1" check="all" comment="kernel module mac80211 disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_mac80211_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_mac80211_runmodprobed:tst:1" version="1" check="all" comment="kernel module mac80211 disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_mac80211_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_mac80211_libmodprobed:tst:1" version="1" check="all" comment="kernel module mac80211 disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_mac80211_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_rds_disabled:tst:1" version="1" check="all" comment="kernel module rds disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_rds_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_rds_modprobeconf:tst:1" version="1" check="all" comment="kernel module rds disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_rds_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_rds_etcmodules-load:tst:1" version="1" check="all" comment="kernel module rds disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_rds_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_rds_runmodules-load:tst:1" version="1" check="all" comment="kernel module rds disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_rds_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_rds_libmodules-load:tst:1" version="1" check="all" comment="kernel module rds disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_rds_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_rds_runmodprobed:tst:1" version="1" check="all" comment="kernel module rds disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_rds_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_rds_libmodprobed:tst:1" version="1" check="all" comment="kernel module rds disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_rds_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_disabled:tst:1" version="1" check="all" comment="kernel module squashfs disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_squashfs_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_modprobeconf:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_squashfs_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_etcmodules-load:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_squashfs_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_runmodules-load:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_squashfs_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_libmodules-load:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_squashfs_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_runmodprobed:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_squashfs_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_libmodprobed:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_squashfs_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_disabled:tst:1" version="1" check="all" comment="kernel module tipc disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_tipc_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_modprobeconf:tst:1" version="1" check="all" comment="kernel module tipc disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_tipc_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_etcmodules-load:tst:1" version="1" check="all" comment="kernel module tipc disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_tipc_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_runmodules-load:tst:1" version="1" check="all" comment="kernel module tipc disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_tipc_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_libmodules-load:tst:1" version="1" check="all" comment="kernel module tipc disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_tipc_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_runmodprobed:tst:1" version="1" check="all" comment="kernel module tipc disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_tipc_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_libmodprobed:tst:1" version="1" check="all" comment="kernel module tipc disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_tipc_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_udf_disabled:tst:1" version="1" check="all" comment="kernel module udf disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_udf_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_udf_modprobeconf:tst:1" version="1" check="all" comment="kernel module udf disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_udf_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_udf_etcmodules-load:tst:1" version="1" check="all" comment="kernel module udf disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_udf_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_udf_runmodules-load:tst:1" version="1" check="all" comment="kernel module udf disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_udf_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_udf_libmodules-load:tst:1" version="1" check="all" comment="kernel module udf disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_udf_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_udf_runmodprobed:tst:1" version="1" check="all" comment="kernel module udf disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_udf_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_udf_libmodprobed:tst:1" version="1" check="all" comment="kernel module udf disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_udf_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_disabled:tst:1" version="1" check="all" comment="kernel module usb-storage disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_usb-storage_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_modprobeconf:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_usb-storage_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_etcmodules-load:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_usb-storage_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_runmodules-load:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_usb-storage_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_libmodules-load:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_usb-storage_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_runmodprobed:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_usb-storage_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_libmodprobed:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_usb-storage_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_disabled:tst:1" version="1" check="all" comment="kernel module vfat disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_vfat_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_modprobeconf:tst:1" version="1" check="all" comment="kernel module vfat disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_vfat_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_etcmodules-load:tst:1" version="1" check="all" comment="kernel module vfat disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_vfat_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_runmodules-load:tst:1" version="1" check="all" comment="kernel module vfat disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_vfat_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_libmodules-load:tst:1" version="1" check="all" comment="kernel module vfat disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_vfat_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_runmodprobed:tst:1" version="1" check="all" comment="kernel module vfat disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_vfat_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_libmodprobed:tst:1" version="1" check="all" comment="kernel module vfat disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_vfat_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test check="all" check_existence="all_exist" version="2" comment="noauto on /boot optional yes" id="oval:ssg-test_boot_partition_noauto_optional_yes:tst:1">
          <linux:object object_ref="oval:ssg-object_boot_partition_noauto_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_boot_partition_noauto_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="2" comment="nodev on /boot optional yes" id="oval:ssg-test_boot_partition_nodev_optional_yes:tst:1">
          <linux:object object_ref="oval:ssg-object_boot_partition_nodev_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_boot_partition_nodev_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="2" comment="noexec on /boot optional yes" id="oval:ssg-test_boot_partition_noexec_optional_yes:tst:1">
          <linux:object object_ref="oval:ssg-object_boot_partition_noexec_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_boot_partition_noexec_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="2" comment="nosuid on /boot optional yes" id="oval:ssg-test_boot_partition_nosuid_optional_yes:tst:1">
          <linux:object object_ref="oval:ssg-object_boot_partition_nosuid_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_boot_partition_nosuid_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="2" comment="nodev on /dev/shm optional no" id="oval:ssg-test_dev_shm_partition_nodev_optional_no:tst:1">
          <linux:object object_ref="oval:ssg-object_dev_shm_partition_nodev_optional_no:obj:1"/>
          <linux:state state_ref="oval:ssg-state_dev_shm_partition_nodev_optional_no:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="1" comment="/dev/shm exists" id="oval:ssg-test_dev_shm_no_partition_nodev_optional_no:tst:1">
          <linux:object object_ref="oval:ssg-object_dev_shm_partition_nodev_optional_no:obj:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="2" comment="noexec on /dev/shm optional no" id="oval:ssg-test_dev_shm_partition_noexec_optional_no:tst:1">
          <linux:object object_ref="oval:ssg-object_dev_shm_partition_noexec_optional_no:obj:1"/>
          <linux:state state_ref="oval:ssg-state_dev_shm_partition_noexec_optional_no:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="1" comment="/dev/shm exists" id="oval:ssg-test_dev_shm_no_partition_noexec_optional_no:tst:1">
          <linux:object object_ref="oval:ssg-object_dev_shm_partition_noexec_optional_no:obj:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="2" comment="nosuid on /dev/shm optional no" id="oval:ssg-test_dev_shm_partition_nosuid_optional_no:tst:1">
          <linux:object object_ref="oval:ssg-object_dev_shm_partition_nosuid_optional_no:obj:1"/>
          <linux:state state_ref="oval:ssg-state_dev_shm_partition_nosuid_optional_no:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="1" comment="/dev/shm exists" id="oval:ssg-test_dev_shm_no_partition_nosuid_optional_no:tst:1">
          <linux:object object_ref="oval:ssg-object_dev_shm_partition_nosuid_optional_no:obj:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="2" comment="noexec on /home optional yes" id="oval:ssg-test_home_partition_noexec_optional_yes:tst:1">
          <linux:object object_ref="oval:ssg-object_home_partition_noexec_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_home_partition_noexec_optional_yes:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_nodev_etc_fstab_cd_dvd_drive:tst:1" check_existence="any_exist" check="all" comment="'nodev' mount option used for at least one CD / DVD drive alternative names in /etc/fstab" version="1">
          <ind:object object_ref="oval:ssg-object_nodev_etc_fstab_cd_dvd_drive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_nodev_etc_fstab_cd_dvd_drive:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_nodev_etc_fstab_not_cd_dvd_drive:tst:1" check="at least one" check_existence="all_exist" comment="Check if removable partition is configured with 'nodev' mount option in /etc/fstab" version="1">
          <ind:object object_ref="oval:ssg-object_nodev_etc_fstab_not_cd_dvd_drive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_nodev_etc_fstab_not_cd_dvd_drive:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_noexec_etc_fstab_cd_dvd_drive:tst:1" check_existence="any_exist" check="all" comment="'noexec' mount option used for at least one CD / DVD drive alternative names in /etc/fstab" version="1">
          <ind:object object_ref="oval:ssg-object_noexec_etc_fstab_cd_dvd_drive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_noexec_etc_fstab_cd_dvd_drive:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_noexec_etc_fstab_not_cd_dvd_drive:tst:1" check="at least one" check_existence="all_exist" comment="Check if removable partition is configured with 'noexec' mount option in /etc/fstab" version="1">
          <ind:object object_ref="oval:ssg-object_noexec_etc_fstab_not_cd_dvd_drive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_noexec_etc_fstab_not_cd_dvd_drive:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_nosuid_etc_fstab_cd_dvd_drive:tst:1" check_existence="any_exist" check="all" comment="'nosuid' mount option used for at least one CD / DVD drive alternative names in /etc/fstab" version="1">
          <ind:object object_ref="oval:ssg-object_nosuid_etc_fstab_cd_dvd_drive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_nosuid_etc_fstab_cd_dvd_drive:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_nosuid_etc_fstab_not_cd_dvd_drive:tst:1" check="at least one" check_existence="all_exist" comment="Check if removable partition is configured with 'nosuid' mount option in /etc/fstab" version="1">
          <ind:object object_ref="oval:ssg-object_nosuid_etc_fstab_not_cd_dvd_drive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_nosuid_etc_fstab_not_cd_dvd_drive:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test check="all" check_existence="all_exist" version="2" comment="nosuid on /opt optional yes" id="oval:ssg-test_opt_partition_nosuid_optional_yes:tst:1">
          <linux:object object_ref="oval:ssg-object_opt_partition_nosuid_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_opt_partition_nosuid_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="2" comment="hidepid on /proc optional no" id="oval:ssg-test_proc_partition_hidepid_optional_no:tst:1">
          <linux:object object_ref="oval:ssg-object_proc_partition_hidepid_optional_no:obj:1"/>
          <linux:state state_ref="oval:ssg-state_proc_partition_hidepid_optional_no:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="1" comment="/proc exists" id="oval:ssg-test_proc_no_partition_hidepid_optional_no:tst:1">
          <linux:object object_ref="oval:ssg-object_proc_partition_hidepid_optional_no:obj:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="2" comment="nosuid on /srv optional yes" id="oval:ssg-test_srv_partition_nosuid_optional_yes:tst:1">
          <linux:object object_ref="oval:ssg-object_srv_partition_nosuid_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_srv_partition_nosuid_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="2" comment="nodev on /tmp optional yes" id="oval:ssg-test_tmp_partition_nodev_optional_yes:tst:1">
          <linux:object object_ref="oval:ssg-object_tmp_partition_nodev_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_tmp_partition_nodev_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="2" comment="noexec on /tmp optional yes" id="oval:ssg-test_tmp_partition_noexec_optional_yes:tst:1">
          <linux:object object_ref="oval:ssg-object_tmp_partition_noexec_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_tmp_partition_noexec_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="2" comment="nosuid on /tmp optional yes" id="oval:ssg-test_tmp_partition_nosuid_optional_yes:tst:1">
          <linux:object object_ref="oval:ssg-object_tmp_partition_nosuid_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_tmp_partition_nosuid_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="2" comment="nodev on /var/log/audit optional yes" id="oval:ssg-test_var_log_audit_partition_nodev_optional_yes:tst:1">
          <linux:object object_ref="oval:ssg-object_var_log_audit_partition_nodev_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_log_audit_partition_nodev_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="2" comment="noexec on /var/log/audit optional yes" id="oval:ssg-test_var_log_audit_partition_noexec_optional_yes:tst:1">
          <linux:object object_ref="oval:ssg-object_var_log_audit_partition_noexec_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_log_audit_partition_noexec_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="2" comment="nosuid on /var/log/audit optional yes" id="oval:ssg-test_var_log_audit_partition_nosuid_optional_yes:tst:1">
          <linux:object object_ref="oval:ssg-object_var_log_audit_partition_nosuid_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_log_audit_partition_nosuid_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="2" comment="nodev on /var/log optional yes" id="oval:ssg-test_var_log_partition_nodev_optional_yes:tst:1">
          <linux:object object_ref="oval:ssg-object_var_log_partition_nodev_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_log_partition_nodev_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="2" comment="noexec on /var/log optional yes" id="oval:ssg-test_var_log_partition_noexec_optional_yes:tst:1">
          <linux:object object_ref="oval:ssg-object_var_log_partition_noexec_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_log_partition_noexec_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="2" comment="nosuid on /var/log optional yes" id="oval:ssg-test_var_log_partition_nosuid_optional_yes:tst:1">
          <linux:object object_ref="oval:ssg-object_var_log_partition_nosuid_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_log_partition_nosuid_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="2" comment="nodev on /var optional yes" id="oval:ssg-test_var_partition_nodev_optional_yes:tst:1">
          <linux:object object_ref="oval:ssg-object_var_partition_nodev_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_partition_nodev_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="2" comment="noexec on /var optional yes" id="oval:ssg-test_var_partition_noexec_optional_yes:tst:1">
          <linux:object object_ref="oval:ssg-object_var_partition_noexec_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_partition_noexec_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" version="2" comment="nosuid on /var optional yes" id="oval:ssg-test_var_partition_nosuid_optional_yes:tst:1">
          <linux:object object_ref="oval:ssg-object_var_partition_nosuid_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_partition_nosuid_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_GConf2_installed:tst:1" version="1" comment="package GConf2 is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_GConf2_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_MFEhiplsm_installed:tst:1" version="1" comment="package MFEhiplsm is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_MFEhiplsm_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_abrt-addon-ccpp_removed:tst:1" version="1" comment="package abrt-addon-ccpp is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_abrt-addon-ccpp_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_abrt-addon-kerneloops_removed:tst:1" version="1" comment="package abrt-addon-kerneloops is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_abrt-addon-kerneloops_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_abrt-cli_removed:tst:1" version="1" comment="package abrt-cli is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_abrt-cli_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_abrt-plugin-logger_removed:tst:1" version="1" comment="package abrt-plugin-logger is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_abrt-plugin-logger_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_abrt-plugin-rhtsupport_removed:tst:1" version="1" comment="package abrt-plugin-rhtsupport is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_abrt-plugin-rhtsupport_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_abrt-plugin-sosreport_removed:tst:1" version="1" comment="package abrt-plugin-sosreport is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_abrt-plugin-sosreport_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_abrt_removed:tst:1" version="1" comment="package abrt is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_abrt_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_aide_installed:tst:1" version="1" comment="package aide is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_aide_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_audispd-plugins_installed:tst:1" version="1" comment="package audispd-plugins is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_audispd-plugins_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_audit-audispd-plugins_installed:tst:1" version="1" comment="package audit-audispd-plugins is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_audit-audispd-plugins_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_audit_installed:tst:1" version="1" comment="package audit is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_audit_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_avahi_installed:tst:1" version="1" comment="package avahi is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_avahi_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_bind_removed:tst:1" version="1" comment="package bind is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_bind_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_binutils_installed:tst:1" version="1" comment="package binutils is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_binutils_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_chrony_installed:tst:1" version="1" comment="package chrony is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_chrony_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_cron_installed:tst:1" version="1" comment="package cron is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_cron_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_cryptsetup-luks_installed:tst:1" version="1" comment="package cryptsetup-luks is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_cryptsetup-luks_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_dconf_installed:tst:1" version="1" comment="package dconf is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_dconf_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_dnf-automatic_installed:tst:1" version="1" comment="package dnf-automatic is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_dnf-automatic_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_esc_installed:tst:1" version="1" comment="package esc is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_esc_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_fapolicyd_installed:tst:1" version="1" comment="package fapolicyd is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_fapolicyd_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_gdm_installed:tst:1" version="1" comment="package gdm is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_gdm_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_gdm_removed:tst:1" version="1" comment="package gdm is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_gdm_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_geolite2-city_removed:tst:1" version="1" comment="package geolite2-city is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_geolite2-city_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_geolite2-country_removed:tst:1" version="1" comment="package geolite2-country is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_geolite2-country_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_gnutls-utils_installed:tst:1" version="1" comment="package gnutls-utils is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_gnutls-utils_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_gssproxy_removed:tst:1" version="1" comment="package gssproxy is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_gssproxy_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_inetutils-telnetd_removed:tst:1" version="1" comment="package inetutils-telnetd is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_inetutils-telnetd_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_iprutils_removed:tst:1" version="1" comment="package iprutils is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_iprutils_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_iptables_installed:tst:1" version="1" comment="package iptables is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_iptables_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_krb5-workstation_removed:tst:1" version="1" comment="package krb5-workstation is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_krb5-workstation_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_libcap-ng-utils_installed:tst:1" version="1" comment="package libcap-ng-utils is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_libcap-ng-utils_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_libreport-plugin-logger_removed:tst:1" version="1" comment="package libreport-plugin-logger is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_libreport-plugin-logger_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_libreport-plugin-rhtsupport_removed:tst:1" version="1" comment="package libreport-plugin-rhtsupport is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_libreport-plugin-rhtsupport_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_libreswan_installed:tst:1" version="1" comment="package libreswan is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_libreswan_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_libselinux_installed:tst:1" version="1" comment="package libselinux is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_libselinux_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_mcstrans_removed:tst:1" version="1" comment="package mcstrans is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_mcstrans_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_net-snmp_removed:tst:1" version="1" comment="package net-snmp is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_net-snmp_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_nfs-utils_removed:tst:1" version="1" comment="package nfs-utils is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_nfs-utils_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_nis_removed:tst:1" version="1" comment="package nis is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_nis_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_nss-tools_installed:tst:1" version="1" comment="package nss-tools is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_nss-tools_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_ntp_installed:tst:1" version="1" comment="package ntp is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_ntp_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_ntpdate_removed:tst:1" version="1" comment="package ntpdate is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_ntpdate_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_openldap-clients_removed:tst:1" version="1" comment="package openldap-clients is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_openldap-clients_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_opensc_installed:tst:1" version="1" comment="package opensc is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_opensc_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_openscap-scanner_installed:tst:1" version="1" comment="package openscap-scanner is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_openscap-scanner_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_openssh-server_installed:tst:1" version="1" comment="package openssh-server is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_openssh-server_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_openssh-server_removed:tst:1" version="1" comment="package openssh-server is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_openssh-server_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_pam_ldap_removed:tst:1" version="1" comment="package pam_ldap is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_pam_ldap_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_pcsc-lite_installed:tst:1" version="1" comment="package pcsc-lite is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_pcsc-lite_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_policycoreutils_installed:tst:1" version="1" comment="package policycoreutils is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_policycoreutils_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_prelink_removed:tst:1" version="1" comment="package prelink is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_prelink_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_python3-abrt-addon_removed:tst:1" version="1" comment="package python3-abrt-addon is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_python3-abrt-addon_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_rear_installed:tst:1" version="1" comment="package rear is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_rear_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_rng-tools_installed:tst:1" version="1" comment="package rng-tools is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_rng-tools_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_rsyslog-gnutls_installed:tst:1" version="1" comment="package rsyslog-gnutls is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_rsyslog-gnutls_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_rsyslog_installed:tst:1" version="1" comment="package rsyslog is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_rsyslog_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_samba-common_removed:tst:1" version="1" comment="package samba-common is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_samba-common_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_scap-security-guide_installed:tst:1" version="1" comment="package scap-security-guide is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_scap-security-guide_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_screen_installed:tst:1" version="1" comment="package screen is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_screen_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_sendmail_removed:tst:1" version="1" comment="package sendmail is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_sendmail_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_setroubleshoot-plugins_removed:tst:1" version="1" comment="package setroubleshoot-plugins is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_setroubleshoot-plugins_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_setroubleshoot-server_removed:tst:1" version="1" comment="package setroubleshoot-server is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_setroubleshoot-server_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_setroubleshoot_removed:tst:1" version="1" comment="package setroubleshoot is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_setroubleshoot_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_sssd-ipa_installed:tst:1" version="1" comment="package sssd-ipa is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_sssd-ipa_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_sudo_installed:tst:1" version="1" comment="package sudo is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_sudo_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_syslog-ng_installed:tst:1" version="1" comment="package syslog-ng is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_syslog-ng_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_tar_installed:tst:1" version="1" comment="package tar is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_tar_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_telnetd-ssl_removed:tst:1" version="1" comment="package telnetd-ssl is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_telnetd-ssl_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_telnetd_removed:tst:1" version="1" comment="package telnetd is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_telnetd_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_tmux_installed:tst:1" version="1" comment="package tmux is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_tmux_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_tuned_removed:tst:1" version="1" comment="package tuned is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_tuned_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_usbguard_installed:tst:1" version="1" comment="package usbguard is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_usbguard_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_vim-enhanced_installed:tst:1" version="1" comment="package vim-enhanced is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_vim-enhanced_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_vsftpd_installed:tst:1" version="1" comment="package vsftpd is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_vsftpd_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_vsftpd_removed:tst:1" version="1" comment="package vsftpd is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_vsftpd_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_xorg-x11-server-common_removed:tst:1" version="1" comment="package xorg-x11-server-common is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_xorg-x11-server-common_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-testboot_partition:tst:1" version="1" comment="/boot on own partition">
          <linux:object object_ref="oval:ssg-object_mountboot_own_partition:obj:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-testhome_partition:tst:1" version="1" comment="/home on own partition">
          <linux:object object_ref="oval:ssg-object_mounthome_own_partition:obj:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-testopt_partition:tst:1" version="1" comment="/opt on own partition">
          <linux:object object_ref="oval:ssg-object_mountopt_own_partition:obj:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-testsrv_partition:tst:1" version="1" comment="/srv on own partition">
          <linux:object object_ref="oval:ssg-object_mountsrv_own_partition:obj:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-testtmp_partition:tst:1" version="1" comment="/tmp on own partition">
          <linux:object object_ref="oval:ssg-object_mounttmp_own_partition:obj:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-testusr_partition:tst:1" version="1" comment="/usr on own partition">
          <linux:object object_ref="oval:ssg-object_mountusr_own_partition:obj:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-testvar_partition:tst:1" version="1" comment="/var on own partition">
          <linux:object object_ref="oval:ssg-object_mountvar_own_partition:obj:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-testvar_log_partition:tst:1" version="1" comment="/var/log on own partition">
          <linux:object object_ref="oval:ssg-object_mountvar_log_own_partition:obj:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-testvar_log_audit_partition:tst:1" version="1" comment="/var/log/audit on own partition">
          <linux:object object_ref="oval:ssg-object_mountvar_log_audit_own_partition:obj:1"/>
        </linux:partition_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /lib/" id="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_0:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_0:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /lib64/" id="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_1:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_1:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /usr/lib/" id="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_2:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_2:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of /usr/lib64/" id="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_3:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_3:obj:1"/>
        </unix:file_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_atd:tst:1" check="all" check_existence="any_exist" comment="Test that the atd service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_atd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_atd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_atd:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service atd is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_atd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_atd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_atd_package_at_removed:tst:1" version="1" comment="package at is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_atd_package_at_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_auditd:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_auditd_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_auditd_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_auditd_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_auditd_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_auditd_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_auditd:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the auditd service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_auditd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_auditd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_auditd_package_audit_installed:tst:1" version="1" comment="package audit is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_auditd_package_audit_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_autofs:tst:1" check="all" check_existence="any_exist" comment="Test that the autofs service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_autofs:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_autofs:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_autofs:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service autofs is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_autofs:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_autofs:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_autofs_package_autofs_removed:tst:1" version="1" comment="package autofs is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_autofs_package_autofs_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_bluetooth:tst:1" check="all" check_existence="any_exist" comment="Test that the bluetooth service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_bluetooth:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_bluetooth:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_bluetooth:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service bluetooth is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_bluetooth:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_bluetooth:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_bluetooth_package_bluez_removed:tst:1" version="1" comment="package bluez is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_bluetooth_package_bluez_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_chronyd:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_chronyd_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_chronyd_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_chronyd_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_chronyd_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_chronyd_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_chronyd:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the chronyd service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_chronyd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_chronyd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_chronyd_package_chrony_installed:tst:1" version="1" comment="package chrony is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_chronyd_package_chrony_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_cron:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_cron_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_cron_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_cron_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_cron_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_cron_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_cron:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the cron service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_cron:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_cron:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_cron_package_cron_installed:tst:1" version="1" comment="package cron is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_cron_package_cron_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_crond:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_crond_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_crond_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_crond_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_crond_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_crond_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_crond:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the crond service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_crond:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_crond:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_crond_package_cronie_installed:tst:1" version="1" comment="package cronie is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_crond_package_cronie_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_debug-shell:tst:1" check="all" check_existence="any_exist" comment="Test that the debug-shell service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_debug-shell:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_debug-shell:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_debug-shell:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service debug-shell is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_debug-shell:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_debug-shell:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_debug-shell_package_systemd_removed:tst:1" version="1" comment="package systemd is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_debug-shell_package_systemd_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_firewalld:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_firewalld_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_firewalld_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_firewalld_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_firewalld_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_firewalld_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_firewalld:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the firewalld service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_firewalld:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_firewalld:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_firewalld_package_firewalld_installed:tst:1" version="1" comment="package firewalld is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_firewalld_package_firewalld_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_ip6tables:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_ip6tables_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_ip6tables_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_ip6tables_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_ip6tables_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_ip6tables_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_ip6tables:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the ip6tables service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_ip6tables:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_ip6tables:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_ip6tables_package_iptables-ipv6_installed:tst:1" version="1" comment="package iptables-ipv6 is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_ip6tables_package_iptables-ipv6_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_iptables:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_iptables_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_iptables_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_iptables_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_iptables_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_iptables_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_iptables:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the iptables service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_iptables:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_iptables:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_iptables_package_iptables_installed:tst:1" version="1" comment="package iptables is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_iptables_package_iptables_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_netfs:tst:1" check="all" check_existence="any_exist" comment="Test that the netfs service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_netfs:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_netfs:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_netfs:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service netfs is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_netfs:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_netfs:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_netfs_package_netfs_removed:tst:1" version="1" comment="package netfs is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_netfs_package_netfs_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_nfs-server:tst:1" check="all" check_existence="any_exist" comment="Test that the nfs-server service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_nfs-server:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_nfs-server:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_nfs-server:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service nfs-server is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_nfs-server:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_nfs-server:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_nfs-server_package_nfs-utils_removed:tst:1" version="1" comment="package nfs-utils is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_nfs-server_package_nfs-utils_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_nfslock:tst:1" check="all" check_existence="any_exist" comment="Test that the nfslock service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_nfslock:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_nfslock:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_nfslock:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service nfslock is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_nfslock:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_nfslock:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_nfslock_package_nfs-utils_removed:tst:1" version="1" comment="package nfs-utils is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_nfslock_package_nfs-utils_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_ntp:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_ntp_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_ntp_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_ntp_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_ntp_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_ntp_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_ntp:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the ntp service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_ntp:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_ntp:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_ntp_package_ntp_installed:tst:1" version="1" comment="package ntp is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_ntp_package_ntp_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_ntpd:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_ntpd_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_ntpd_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_ntpd_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_ntpd_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_ntpd_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_ntpd:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the ntpd service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_ntpd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_ntpd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_ntpd_package_ntp_installed:tst:1" version="1" comment="package ntp is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_ntpd_package_ntp_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_pcscd:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_pcscd_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_pcscd_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_pcscd_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_pcscd_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_pcscd_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_pcscd:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the pcscd service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_pcscd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_pcscd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_pcscd_package_pcsc-lite_installed:tst:1" version="1" comment="package pcsc-lite is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_pcscd_package_pcsc-lite_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_rngd:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_rngd_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_rngd_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_rngd_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_rngd_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_rngd_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_rngd:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the rngd service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_rngd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_rngd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_rngd_package_rng-tools_installed:tst:1" version="1" comment="package rng-tools is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_rngd_package_rng-tools_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_rpcgssd:tst:1" check="all" check_existence="any_exist" comment="Test that the rpcgssd service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_rpcgssd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_rpcgssd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_rpcgssd:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service rpcgssd is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_rpcgssd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_rpcgssd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_rpcgssd_package_nfs-utils_removed:tst:1" version="1" comment="package nfs-utils is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_rpcgssd_package_nfs-utils_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_rpcidmapd:tst:1" check="all" check_existence="any_exist" comment="Test that the rpcidmapd service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_rpcidmapd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_rpcidmapd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_rpcidmapd:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service rpcidmapd is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_rpcidmapd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_rpcidmapd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_rpcidmapd_package_nfs-utils_removed:tst:1" version="1" comment="package nfs-utils is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_rpcidmapd_package_nfs-utils_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_rpcsvcgssd:tst:1" check="all" check_existence="any_exist" comment="Test that the rpcsvcgssd service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_rpcsvcgssd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_rpcsvcgssd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_rpcsvcgssd:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service rpcsvcgssd is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_rpcsvcgssd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_rpcsvcgssd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_rpcsvcgssd_package_nfs-utils_removed:tst:1" version="1" comment="package nfs-utils is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_rpcsvcgssd_package_nfs-utils_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_rsyncd:tst:1" check="all" check_existence="any_exist" comment="Test that the rsyncd service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_rsyncd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_rsyncd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_rsyncd:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service rsyncd is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_rsyncd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_rsyncd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_rsyncd_package_rsync-daemon_removed:tst:1" version="1" comment="package rsync-daemon is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_rsyncd_package_rsync-daemon_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_rsyslog:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_rsyslog_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_rsyslog_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_rsyslog_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_rsyslog_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_rsyslog_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_rsyslog:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the rsyslog service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_rsyslog:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_rsyslog:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_rsyslog_package_rsyslog_installed:tst:1" version="1" comment="package rsyslog is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_rsyslog_package_rsyslog_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_sshd:tst:1" check="all" check_existence="any_exist" comment="Test that the sshd service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_sshd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_sshd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_sshd:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service sshd is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_sshd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_sshd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_sshd_package_openssh-server_removed:tst:1" version="1" comment="package openssh-server is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_sshd_package_openssh-server_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_sssd:tst:1" check="all" check_existence="any_exist" comment="Test that the sssd service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_sssd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_sssd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_sssd:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service sssd is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_sssd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_sssd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_sssd_package_sssd-common_removed:tst:1" version="1" comment="package sssd-common is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_sssd_package_sssd-common_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_syslog:tst:1" check="all" check_existence="any_exist" comment="Test that the syslog service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_syslog:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_syslog:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_syslog:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service syslog is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_syslog:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_syslog:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_syslog_package_rsyslog_removed:tst:1" version="1" comment="package rsyslog is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_syslog_package_rsyslog_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_syslog-ng:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_syslog-ng_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_syslog-ng_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_syslog-ng_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_syslog-ng_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_syslog-ng_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_syslog-ng:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the syslog-ng service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_syslog-ng:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_syslog-ng:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_syslog-ng_package_syslog-ng_installed:tst:1" version="1" comment="package syslog-ng is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_syslog-ng_package_syslog-ng_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_systemd-coredump:tst:1" check="all" check_existence="any_exist" comment="Test that the systemd-coredump service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_systemd-coredump:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_systemd-coredump:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_systemd-coredump:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service systemd-coredump is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_systemd-coredump:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_systemd-coredump:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_systemd-coredump_package_systemd_removed:tst:1" version="1" comment="package systemd is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_systemd-coredump_package_systemd_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_usbguard:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_usbguard_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_usbguard_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_usbguard_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_usbguard_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_usbguard_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_usbguard:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the usbguard service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_usbguard:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_usbguard:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_usbguard_package_usbguard_installed:tst:1" version="1" comment="package usbguard is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_usbguard_package_usbguard_installed:obj:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PermitEmptyPasswords setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_empty_passwords:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_empty_passwords:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_empty_passwords:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PermitEmptyPasswords setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_disable_empty_passwords_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_empty_passwords_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_empty_passwords_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of GSSAPIAuthentication setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_gssapi_auth:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_gssapi_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_gssapi_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of GSSAPIAuthentication setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_disable_gssapi_auth_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_gssapi_auth_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_gssapi_auth_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of KerberosAuthentication setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_kerb_auth:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_kerb_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_kerb_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of KerberosAuthentication setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_disable_kerb_auth_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_kerb_auth_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_kerb_auth_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PubkeyAuthentication setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_pubkey_auth:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_pubkey_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_pubkey_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PubkeyAuthentication setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_disable_pubkey_auth_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_pubkey_auth_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_pubkey_auth_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of IgnoreRhosts setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_rhosts:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_rhosts:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_rhosts:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of IgnoreRhosts setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_disable_rhosts_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_rhosts_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_rhosts_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_root_login:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_root_login:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_root_login:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_disable_root_login_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_root_login_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_root_login_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_root_password_login:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_root_password_login:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_root_password_login:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_disable_root_password_login_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_root_password_login_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_root_password_login_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of AllowTcpForwarding setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_tcp_forwarding:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_tcp_forwarding:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_tcp_forwarding:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of AllowTcpForwarding setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_disable_tcp_forwarding_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_tcp_forwarding_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_tcp_forwarding_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of IgnoreUserKnownHosts setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_user_known_hosts:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_user_known_hosts:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_user_known_hosts:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of IgnoreUserKnownHosts setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_disable_user_known_hosts_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_user_known_hosts_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_user_known_hosts_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of X11Forwarding setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_x11_forwarding:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_x11_forwarding:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_x11_forwarding:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of X11Forwarding setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_disable_x11_forwarding_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_x11_forwarding_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_x11_forwarding_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PermitUserEnvironment setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_do_not_permit_user_env:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_do_not_permit_user_env:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_do_not_permit_user_env:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PermitUserEnvironment setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_do_not_permit_user_env_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_do_not_permit_user_env_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_do_not_permit_user_env_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of GSSAPIAuthentication setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_enable_gssapi_auth:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_gssapi_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_gssapi_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of GSSAPIAuthentication setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_enable_gssapi_auth_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_gssapi_auth_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_gssapi_auth_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of UsePAM setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_enable_pam:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_pam:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_pam:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of UsePAM setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_enable_pam_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_pam_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_pam_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PubkeyAuthentication setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_enable_pubkey_auth:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_pubkey_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_pubkey_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PubkeyAuthentication setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_enable_pubkey_auth_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_pubkey_auth_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_pubkey_auth_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of StrictModes setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_enable_strictmodes:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_strictmodes:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_strictmodes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of StrictModes setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_enable_strictmodes_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_strictmodes_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_strictmodes_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of Banner setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_enable_warning_banner:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_warning_banner:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_warning_banner:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of Banner setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_enable_warning_banner_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_warning_banner_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_warning_banner_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of Banner setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_enable_warning_banner_net:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_warning_banner_net:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_warning_banner_net:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of Banner setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_enable_warning_banner_net_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_warning_banner_net_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_warning_banner_net_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of X11Forwarding setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_enable_x11_forwarding:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_x11_forwarding:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_x11_forwarding:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of X11Forwarding setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_enable_x11_forwarding_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_x11_forwarding_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_x11_forwarding_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="tests the presence of 'Include /etc/ssh/sshd_config.d/*.conf' setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_includes_config_files:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_includes_config_files:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PrintLastLog setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_print_last_log:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_print_last_log:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_print_last_log:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PrintLastLog setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_print_last_log_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_print_last_log_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_print_last_log_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of ClientAliveCountMax setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_set_keepalive_0:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_set_keepalive_0:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_set_keepalive_0:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of ClientAliveCountMax setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_set_keepalive_0_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_set_keepalive_0_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_set_keepalive_0_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of LogLevel setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_set_loglevel_info:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_set_loglevel_info:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_set_loglevel_info:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of LogLevel setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_set_loglevel_info_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_set_loglevel_info_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_set_loglevel_info_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of LogLevel setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_set_loglevel_verbose:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_set_loglevel_verbose:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_set_loglevel_verbose:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of LogLevel setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_set_loglevel_verbose_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_set_loglevel_verbose_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_set_loglevel_verbose_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of X11UseLocalhost setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_x11_use_localhost:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_x11_use_localhost:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_x11_use_localhost:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of X11UseLocalhost setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_x11_use_localhost_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_x11_use_localhost_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_x11_use_localhost_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="tests the presence of '^\[certmap\/.+\/.+\]$' setting in the /etc/sssd/sssd.conf file" id="oval:ssg-test_sssd_enable_certmap:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sssd_enable_certmap:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_noexec_sudoers:tst:1" comment="noexec exists in /etc/sudoers or /etc/sudoers.d/" version="1">
          <ind:object object_ref="oval:ssg-object_noexec_sudoers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_requiretty_sudoers:tst:1" comment="requiretty exists in /etc/sudoers or /etc/sudoers.d/" version="1">
          <ind:object object_ref="oval:ssg-object_requiretty_sudoers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_use_pty_sudoers:tst:1" comment="use_pty exists in /etc/sudoers or /etc/sudoers.d/" version="1">
          <ind:object object_ref="oval:ssg-object_use_pty_sudoers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_logfile_sudoers:tst:1" comment="logfile exists in /etc/sudoers or /etc/sudoers.d/" version="1">
          <ind:object object_ref="oval:ssg-object_logfile_sudoers:obj:1"/>
          <ind:state state_ref="oval:ssg-state_logfile_sudoers:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_fs_protected_fifos:tst:1" version="1" comment="kernel runtime parameter fs.protected_fifos set to 2" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_fs_protected_fifos:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_fs_protected_fifos:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_fs_protected_fifos:tst:1" version="1" check="all" check_existence="all_exist" comment="fs.protected_fifos static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_fs_protected_fifos:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_fs_protected_fifos:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_fs_protected_fifos:tst:1" version="1" check="all" comment="fs.protected_fifos static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_fs_protected_fifos:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_fs_protected_fifos:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_fs_protected_fifos:tst:1" version="1" check="all" comment="fs.protected_fifos static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_fs_protected_fifos:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_fs_protected_fifos:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_fs_protected_fifos:tst:1" version="1" check="all" comment="fs.protected_fifos static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_fs_protected_fifos:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_fs_protected_fifos:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains fs_protected_fifos" id="oval:ssg-test_sysctl_fs_protected_fifos_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_fs_protected_fifos_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_fs_protected_fifos_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_fs_protected_hardlinks:tst:1" version="1" comment="kernel runtime parameter fs.protected_hardlinks set to 1" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_fs_protected_hardlinks:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_fs_protected_hardlinks:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_fs_protected_hardlinks:tst:1" version="1" check="all" check_existence="all_exist" comment="fs.protected_hardlinks static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_fs_protected_hardlinks:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_fs_protected_hardlinks:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_fs_protected_hardlinks:tst:1" version="1" check="all" comment="fs.protected_hardlinks static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_fs_protected_hardlinks:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_fs_protected_hardlinks:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_fs_protected_hardlinks:tst:1" version="1" check="all" comment="fs.protected_hardlinks static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_fs_protected_hardlinks:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_fs_protected_hardlinks:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_fs_protected_hardlinks:tst:1" version="1" check="all" comment="fs.protected_hardlinks static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_fs_protected_hardlinks:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_fs_protected_hardlinks:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains fs_protected_hardlinks" id="oval:ssg-test_sysctl_fs_protected_hardlinks_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_fs_protected_hardlinks_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_fs_protected_hardlinks_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_fs_protected_regular:tst:1" version="1" comment="kernel runtime parameter fs.protected_regular set to 2" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_fs_protected_regular:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_fs_protected_regular:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_fs_protected_regular:tst:1" version="1" check="all" check_existence="all_exist" comment="fs.protected_regular static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_fs_protected_regular:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_fs_protected_regular:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_fs_protected_regular:tst:1" version="1" check="all" comment="fs.protected_regular static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_fs_protected_regular:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_fs_protected_regular:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_fs_protected_regular:tst:1" version="1" check="all" comment="fs.protected_regular static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_fs_protected_regular:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_fs_protected_regular:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_fs_protected_regular:tst:1" version="1" check="all" comment="fs.protected_regular static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_fs_protected_regular:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_fs_protected_regular:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains fs_protected_regular" id="oval:ssg-test_sysctl_fs_protected_regular_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_fs_protected_regular_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_fs_protected_regular_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_fs_protected_symlinks:tst:1" version="1" comment="kernel runtime parameter fs.protected_symlinks set to 1" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_fs_protected_symlinks:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_fs_protected_symlinks:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_fs_protected_symlinks:tst:1" version="1" check="all" check_existence="all_exist" comment="fs.protected_symlinks static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_fs_protected_symlinks:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_fs_protected_symlinks:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_fs_protected_symlinks:tst:1" version="1" check="all" comment="fs.protected_symlinks static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_fs_protected_symlinks:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_fs_protected_symlinks:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_fs_protected_symlinks:tst:1" version="1" check="all" comment="fs.protected_symlinks static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_fs_protected_symlinks:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_fs_protected_symlinks:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_fs_protected_symlinks:tst:1" version="1" check="all" comment="fs.protected_symlinks static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_fs_protected_symlinks:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_fs_protected_symlinks:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains fs_protected_symlinks" id="oval:ssg-test_sysctl_fs_protected_symlinks_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_fs_protected_symlinks_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_fs_protected_symlinks_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_fs_suid_dumpable:tst:1" version="1" comment="kernel runtime parameter fs.suid_dumpable set to 0" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_fs_suid_dumpable:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_fs_suid_dumpable:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_fs_suid_dumpable:tst:1" version="1" check="all" check_existence="all_exist" comment="fs.suid_dumpable static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_fs_suid_dumpable:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_fs_suid_dumpable:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_fs_suid_dumpable:tst:1" version="1" check="all" comment="fs.suid_dumpable static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_fs_suid_dumpable:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_fs_suid_dumpable:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_fs_suid_dumpable:tst:1" version="1" check="all" comment="fs.suid_dumpable static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_fs_suid_dumpable:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_fs_suid_dumpable:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_fs_suid_dumpable:tst:1" version="1" check="all" comment="fs.suid_dumpable static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_fs_suid_dumpable:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_fs_suid_dumpable:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains fs_suid_dumpable" id="oval:ssg-test_sysctl_fs_suid_dumpable_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_fs_suid_dumpable_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_fs_suid_dumpable_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_core_pattern:tst:1" version="1" comment="kernel runtime parameter kernel.core_pattern set to |/bin/false" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_core_pattern:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_core_pattern:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_core_pattern:tst:1" version="1" check="all" check_existence="all_exist" comment="kernel.core_pattern static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_core_pattern:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_core_pattern:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_core_pattern:tst:1" version="1" check="all" comment="kernel.core_pattern static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_core_pattern:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_core_pattern:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_core_pattern:tst:1" version="1" check="all" comment="kernel.core_pattern static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_core_pattern:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_core_pattern:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_core_pattern:tst:1" version="1" check="all" comment="kernel.core_pattern static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_core_pattern:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_core_pattern:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains kernel_core_pattern" id="oval:ssg-test_sysctl_kernel_core_pattern_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_kernel_core_pattern_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_kernel_core_pattern_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_dmesg_restrict:tst:1" version="1" comment="kernel runtime parameter kernel.dmesg_restrict set to 1" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_dmesg_restrict:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_dmesg_restrict:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_dmesg_restrict:tst:1" version="1" check="all" check_existence="all_exist" comment="kernel.dmesg_restrict static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_dmesg_restrict:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_dmesg_restrict:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_dmesg_restrict:tst:1" version="1" check="all" comment="kernel.dmesg_restrict static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_dmesg_restrict:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_dmesg_restrict:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_dmesg_restrict:tst:1" version="1" check="all" comment="kernel.dmesg_restrict static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_dmesg_restrict:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_dmesg_restrict:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_dmesg_restrict:tst:1" version="1" check="all" comment="kernel.dmesg_restrict static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_dmesg_restrict:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_dmesg_restrict:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains kernel_dmesg_restrict" id="oval:ssg-test_sysctl_kernel_dmesg_restrict_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_kernel_dmesg_restrict_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_kernel_dmesg_restrict_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_kexec_load_disabled:tst:1" version="1" comment="kernel runtime parameter kernel.kexec_load_disabled set to 1" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_kexec_load_disabled:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_kexec_load_disabled:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_kexec_load_disabled:tst:1" version="1" check="all" check_existence="all_exist" comment="kernel.kexec_load_disabled static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_kexec_load_disabled:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_kexec_load_disabled:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_kexec_load_disabled:tst:1" version="1" check="all" comment="kernel.kexec_load_disabled static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_kexec_load_disabled:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_kexec_load_disabled:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_kexec_load_disabled:tst:1" version="1" check="all" comment="kernel.kexec_load_disabled static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_kexec_load_disabled:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_kexec_load_disabled:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_kexec_load_disabled:tst:1" version="1" check="all" comment="kernel.kexec_load_disabled static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_kexec_load_disabled:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_kexec_load_disabled:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains kernel_kexec_load_disabled" id="oval:ssg-test_sysctl_kernel_kexec_load_disabled_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_kernel_kexec_load_disabled_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_kernel_kexec_load_disabled_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_kptr_restrict:tst:1" version="1" comment="kernel runtime parameter kernel.kptr_restrict set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_kptr_restrict:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_kptr_restrict:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_kptr_restrict:tst:1" version="1" check="all" check_existence="all_exist" comment="kernel.kptr_restrict static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_kptr_restrict:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_kptr_restrict:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_kptr_restrict:tst:1" version="1" check="all" comment="kernel.kptr_restrict static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_kptr_restrict:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_kptr_restrict:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_kptr_restrict:tst:1" version="1" check="all" comment="kernel.kptr_restrict static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_kptr_restrict:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_kptr_restrict:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_kptr_restrict:tst:1" version="1" check="all" comment="kernel.kptr_restrict static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_kptr_restrict:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_kptr_restrict:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains kernel_kptr_restrict" id="oval:ssg-test_sysctl_kernel_kptr_restrict_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_kernel_kptr_restrict_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_kernel_kptr_restrict_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_modules_disabled:tst:1" version="1" comment="kernel runtime parameter kernel.modules_disabled set to 1" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_modules_disabled:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_modules_disabled:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_modules_disabled:tst:1" version="1" check="all" check_existence="all_exist" comment="kernel.modules_disabled static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_modules_disabled:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_modules_disabled:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_modules_disabled:tst:1" version="1" check="all" comment="kernel.modules_disabled static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_modules_disabled:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_modules_disabled:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_modules_disabled:tst:1" version="1" check="all" comment="kernel.modules_disabled static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_modules_disabled:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_modules_disabled:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_modules_disabled:tst:1" version="1" check="all" comment="kernel.modules_disabled static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_modules_disabled:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_modules_disabled:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains kernel_modules_disabled" id="oval:ssg-test_sysctl_kernel_modules_disabled_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_kernel_modules_disabled_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_kernel_modules_disabled_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_panic_on_oops:tst:1" version="1" comment="kernel runtime parameter kernel.panic_on_oops set to 1" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_panic_on_oops:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_panic_on_oops:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_panic_on_oops:tst:1" version="1" check="all" check_existence="all_exist" comment="kernel.panic_on_oops static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_panic_on_oops:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_panic_on_oops:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_panic_on_oops:tst:1" version="1" check="all" comment="kernel.panic_on_oops static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_panic_on_oops:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_panic_on_oops:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_panic_on_oops:tst:1" version="1" check="all" comment="kernel.panic_on_oops static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_panic_on_oops:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_panic_on_oops:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_panic_on_oops:tst:1" version="1" check="all" comment="kernel.panic_on_oops static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_panic_on_oops:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_panic_on_oops:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains kernel_panic_on_oops" id="oval:ssg-test_sysctl_kernel_panic_on_oops_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_kernel_panic_on_oops_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_kernel_panic_on_oops_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_perf_cpu_time_max_percent:tst:1" version="1" comment="kernel runtime parameter kernel.perf_cpu_time_max_percent set to 1" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_perf_cpu_time_max_percent:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_perf_cpu_time_max_percent:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_perf_cpu_time_max_percent:tst:1" version="1" check="all" check_existence="all_exist" comment="kernel.perf_cpu_time_max_percent static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_perf_cpu_time_max_percent:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_perf_cpu_time_max_percent:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1" check="all" comment="kernel.perf_cpu_time_max_percent static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_perf_cpu_time_max_percent:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_perf_cpu_time_max_percent:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1" check="all" comment="kernel.perf_cpu_time_max_percent static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_perf_cpu_time_max_percent:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_perf_cpu_time_max_percent:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1" check="all" comment="kernel.perf_cpu_time_max_percent static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_perf_cpu_time_max_percent:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains kernel_perf_cpu_time_max_percent" id="oval:ssg-test_sysctl_kernel_perf_cpu_time_max_percent_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_kernel_perf_cpu_time_max_percent_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_kernel_perf_cpu_time_max_percent_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_perf_event_max_sample_rate:tst:1" version="1" comment="kernel runtime parameter kernel.perf_event_max_sample_rate set to 1" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_perf_event_max_sample_rate:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_perf_event_max_sample_rate:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_perf_event_max_sample_rate:tst:1" version="1" check="all" check_existence="all_exist" comment="kernel.perf_event_max_sample_rate static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_perf_event_max_sample_rate:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_perf_event_max_sample_rate:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1" check="all" comment="kernel.perf_event_max_sample_rate static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_perf_event_max_sample_rate:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_perf_event_max_sample_rate:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1" check="all" comment="kernel.perf_event_max_sample_rate static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_perf_event_max_sample_rate:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_perf_event_max_sample_rate:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1" check="all" comment="kernel.perf_event_max_sample_rate static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_perf_event_max_sample_rate:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains kernel_perf_event_max_sample_rate" id="oval:ssg-test_sysctl_kernel_perf_event_max_sample_rate_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_kernel_perf_event_max_sample_rate_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_kernel_perf_event_max_sample_rate_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_perf_event_paranoid:tst:1" version="1" comment="kernel runtime parameter kernel.perf_event_paranoid set to 2" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_perf_event_paranoid:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_perf_event_paranoid:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_perf_event_paranoid:tst:1" version="1" check="all" check_existence="all_exist" comment="kernel.perf_event_paranoid static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_perf_event_paranoid:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_perf_event_paranoid:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_perf_event_paranoid:tst:1" version="1" check="all" comment="kernel.perf_event_paranoid static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_perf_event_paranoid:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_perf_event_paranoid:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_perf_event_paranoid:tst:1" version="1" check="all" comment="kernel.perf_event_paranoid static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_perf_event_paranoid:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_perf_event_paranoid:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_paranoid:tst:1" version="1" check="all" comment="kernel.perf_event_paranoid static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_paranoid:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_perf_event_paranoid:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains kernel_perf_event_paranoid" id="oval:ssg-test_sysctl_kernel_perf_event_paranoid_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_kernel_perf_event_paranoid_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_kernel_perf_event_paranoid_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_pid_max:tst:1" version="1" comment="kernel runtime parameter kernel.pid_max set to 65536" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_pid_max:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_pid_max:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_pid_max:tst:1" version="1" check="all" check_existence="all_exist" comment="kernel.pid_max static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_pid_max:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_pid_max:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_pid_max:tst:1" version="1" check="all" comment="kernel.pid_max static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_pid_max:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_pid_max:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_pid_max:tst:1" version="1" check="all" comment="kernel.pid_max static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_pid_max:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_pid_max:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_pid_max:tst:1" version="1" check="all" comment="kernel.pid_max static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_pid_max:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_pid_max:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains kernel_pid_max" id="oval:ssg-test_sysctl_kernel_pid_max_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_kernel_pid_max_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_kernel_pid_max_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_randomize_va_space:tst:1" version="1" comment="kernel runtime parameter kernel.randomize_va_space set to 2" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_randomize_va_space:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_randomize_va_space:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_randomize_va_space:tst:1" version="1" check="all" check_existence="all_exist" comment="kernel.randomize_va_space static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_randomize_va_space:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_randomize_va_space:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_randomize_va_space:tst:1" version="1" check="all" comment="kernel.randomize_va_space static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_randomize_va_space:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_randomize_va_space:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_randomize_va_space:tst:1" version="1" check="all" comment="kernel.randomize_va_space static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_randomize_va_space:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_randomize_va_space:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_randomize_va_space:tst:1" version="1" check="all" comment="kernel.randomize_va_space static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_randomize_va_space:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_randomize_va_space:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains kernel_randomize_va_space" id="oval:ssg-test_sysctl_kernel_randomize_va_space_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_kernel_randomize_va_space_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_kernel_randomize_va_space_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_sysrq:tst:1" version="1" comment="kernel runtime parameter kernel.sysrq set to 0" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_sysrq:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_sysrq:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_sysrq:tst:1" version="1" check="all" check_existence="all_exist" comment="kernel.sysrq static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_sysrq:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_sysrq:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_sysrq:tst:1" version="1" check="all" comment="kernel.sysrq static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_sysrq:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_sysrq:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_sysrq:tst:1" version="1" check="all" comment="kernel.sysrq static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_sysrq:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_sysrq:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_sysrq:tst:1" version="1" check="all" comment="kernel.sysrq static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_sysrq:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_sysrq:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains kernel_sysrq" id="oval:ssg-test_sysctl_kernel_sysrq_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_kernel_sysrq_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_kernel_sysrq_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_unprivileged_bpf_disabled:tst:1" version="1" comment="kernel runtime parameter kernel.unprivileged_bpf_disabled set to 1" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_unprivileged_bpf_disabled:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_unprivileged_bpf_disabled:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_unprivileged_bpf_disabled:tst:1" version="1" check="all" check_existence="all_exist" comment="kernel.unprivileged_bpf_disabled static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_unprivileged_bpf_disabled:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_unprivileged_bpf_disabled:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_unprivileged_bpf_disabled:tst:1" version="1" check="all" comment="kernel.unprivileged_bpf_disabled static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_unprivileged_bpf_disabled:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_unprivileged_bpf_disabled:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_unprivileged_bpf_disabled:tst:1" version="1" check="all" comment="kernel.unprivileged_bpf_disabled static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_unprivileged_bpf_disabled:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_unprivileged_bpf_disabled:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:tst:1" version="1" check="all" comment="kernel.unprivileged_bpf_disabled static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_unprivileged_bpf_disabled:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains kernel_unprivileged_bpf_disabled" id="oval:ssg-test_sysctl_kernel_unprivileged_bpf_disabled_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_kernel_unprivileged_bpf_disabled_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_kernel_unprivileged_bpf_disabled_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_yama_ptrace_scope:tst:1" version="1" comment="kernel runtime parameter kernel.yama.ptrace_scope set to 1" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_yama_ptrace_scope:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_yama_ptrace_scope:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_yama_ptrace_scope:tst:1" version="1" check="all" check_existence="all_exist" comment="kernel.yama.ptrace_scope static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_yama_ptrace_scope:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_yama_ptrace_scope:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_yama_ptrace_scope:tst:1" version="1" check="all" comment="kernel.yama.ptrace_scope static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_yama_ptrace_scope:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_yama_ptrace_scope:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_yama_ptrace_scope:tst:1" version="1" check="all" comment="kernel.yama.ptrace_scope static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_yama_ptrace_scope:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_yama_ptrace_scope:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_yama_ptrace_scope:tst:1" version="1" check="all" comment="kernel.yama.ptrace_scope static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_yama_ptrace_scope:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_yama_ptrace_scope:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains kernel_yama_ptrace_scope" id="oval:ssg-test_sysctl_kernel_yama_ptrace_scope_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_kernel_yama_ptrace_scope_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_kernel_yama_ptrace_scope_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_core_bpf_jit_harden:tst:1" version="1" comment="kernel runtime parameter net.core.bpf_jit_harden set to 2" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_core_bpf_jit_harden:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_core_bpf_jit_harden:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_core_bpf_jit_harden:tst:1" version="1" check="all" check_existence="all_exist" comment="net.core.bpf_jit_harden static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_core_bpf_jit_harden:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_core_bpf_jit_harden:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_core_bpf_jit_harden:tst:1" version="1" check="all" comment="net.core.bpf_jit_harden static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_core_bpf_jit_harden:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_core_bpf_jit_harden:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_core_bpf_jit_harden:tst:1" version="1" check="all" comment="net.core.bpf_jit_harden static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_core_bpf_jit_harden:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_core_bpf_jit_harden:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_core_bpf_jit_harden:tst:1" version="1" check="all" comment="net.core.bpf_jit_harden static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_core_bpf_jit_harden:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_core_bpf_jit_harden:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_core_bpf_jit_harden" id="oval:ssg-test_sysctl_net_core_bpf_jit_harden_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_core_bpf_jit_harden_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_core_bpf_jit_harden_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_local:tst:1" version="1" comment="kernel runtime parameter net.ipv4.conf.all.accept_local set to 0" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_accept_local:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_accept_local:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_local:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv4.conf.all.accept_local static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_local:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_local:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_local:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_local static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_local:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_local:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_local:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_local static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_local:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_local:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_local:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_local static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_local:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_local:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv4_conf_all_accept_local" id="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_local_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_all_accept_local_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_accept_local_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_redirects:tst:1" version="1" comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_accept_redirects:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_accept_redirects:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_redirects:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv4.conf.all.accept_redirects static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv4_conf_all_accept_redirects" id="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_all_accept_redirects_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_accept_redirects_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_source_route:tst:1" version="1" comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_accept_source_route:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_accept_source_route:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_source_route:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv4.conf.all.accept_source_route static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_source_route:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_source_route:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv4_conf_all_accept_source_route" id="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_all_accept_source_route_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_accept_source_route_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_arp_filter:tst:1" version="1" comment="kernel runtime parameter net.ipv4.conf.all.arp_filter set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_arp_filter:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_arp_filter:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_arp_filter:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv4.conf.all.arp_filter static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_arp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_arp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_arp_filter:tst:1" version="1" check="all" comment="net.ipv4.conf.all.arp_filter static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_arp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_arp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_arp_filter:tst:1" version="1" check="all" comment="net.ipv4.conf.all.arp_filter static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_arp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_arp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_arp_filter:tst:1" version="1" check="all" comment="net.ipv4.conf.all.arp_filter static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_arp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_arp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv4_conf_all_arp_filter" id="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_filter_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_all_arp_filter_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_arp_filter_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_arp_ignore:tst:1" version="1" comment="kernel runtime parameter net.ipv4.conf.all.arp_ignore set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_arp_ignore:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_arp_ignore:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_arp_ignore:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv4.conf.all.arp_ignore static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_arp_ignore:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_arp_ignore:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_arp_ignore:tst:1" version="1" check="all" comment="net.ipv4.conf.all.arp_ignore static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_arp_ignore:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_arp_ignore:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_arp_ignore:tst:1" version="1" check="all" comment="net.ipv4.conf.all.arp_ignore static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_arp_ignore:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_arp_ignore:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_arp_ignore:tst:1" version="1" check="all" comment="net.ipv4.conf.all.arp_ignore static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_arp_ignore:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_arp_ignore:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv4_conf_all_arp_ignore" id="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_ignore_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_all_arp_ignore_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_arp_ignore_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" version="1" comment="kernel runtime parameter net.ipv4.conf.all.drop_gratuitous_arp set to 1" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_drop_gratuitous_arp:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_drop_gratuitous_arp:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv4.conf.all.drop_gratuitous_arp static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" version="1" check="all" comment="net.ipv4.conf.all.drop_gratuitous_arp static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" version="1" check="all" comment="net.ipv4.conf.all.drop_gratuitous_arp static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" version="1" check="all" comment="net.ipv4.conf.all.drop_gratuitous_arp static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv4_conf_all_drop_gratuitous_arp" id="oval:ssg-test_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_log_martians:tst:1" version="1" comment="kernel runtime parameter net.ipv4.conf.all.log_martians set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_log_martians:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_log_martians:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_log_martians:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv4.conf.all.log_martians static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_log_martians:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1" check="all" comment="net.ipv4.conf.all.log_martians static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_log_martians:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1" check="all" comment="net.ipv4.conf.all.log_martians static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_log_martians:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1" check="all" comment="net.ipv4.conf.all.log_martians static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv4_conf_all_log_martians" id="oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_all_log_martians_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_log_martians_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_route_localnet:tst:1" version="1" comment="kernel runtime parameter net.ipv4.conf.all.route_localnet set to 0" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_route_localnet:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_route_localnet:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_route_localnet:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv4.conf.all.route_localnet static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_route_localnet:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_route_localnet:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_route_localnet:tst:1" version="1" check="all" comment="net.ipv4.conf.all.route_localnet static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_route_localnet:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_route_localnet:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_route_localnet:tst:1" version="1" check="all" comment="net.ipv4.conf.all.route_localnet static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_route_localnet:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_route_localnet:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_route_localnet:tst:1" version="1" check="all" comment="net.ipv4.conf.all.route_localnet static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_route_localnet:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_route_localnet:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv4_conf_all_route_localnet" id="oval:ssg-test_sysctl_net_ipv4_conf_all_route_localnet_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_all_route_localnet_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_route_localnet_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_rp_filter:tst:1" version="1" comment="kernel runtime parameter net.ipv4.conf.all.rp_filter set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_rp_filter:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_rp_filter:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_rp_filter:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv4.conf.all.rp_filter static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_rp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1" check="all" comment="net.ipv4.conf.all.rp_filter static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_rp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1" check="all" comment="net.ipv4.conf.all.rp_filter static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_rp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1" check="all" comment="net.ipv4.conf.all.rp_filter static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv4_conf_all_rp_filter" id="oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_all_rp_filter_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_rp_filter_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_secure_redirects:tst:1" version="1" comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_secure_redirects:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_secure_redirects:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_secure_redirects:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv4.conf.all.secure_redirects static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_secure_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.secure_redirects static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.secure_redirects static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_secure_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.secure_redirects static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv4_conf_all_secure_redirects" id="oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_all_secure_redirects_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_secure_redirects_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_send_redirects:tst:1" version="1" comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_send_redirects:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_send_redirects:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_send_redirects:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv4.conf.all.send_redirects static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_send_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_send_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.send_redirects static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_send_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_send_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.send_redirects static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_send_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_send_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.send_redirects static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_send_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv4_conf_all_send_redirects" id="oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_all_send_redirects_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_send_redirects_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_shared_media:tst:1" version="1" comment="kernel runtime parameter net.ipv4.conf.all.shared_media set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_shared_media:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_shared_media:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_shared_media:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv4.conf.all.shared_media static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_shared_media:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_shared_media:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_shared_media:tst:1" version="1" check="all" comment="net.ipv4.conf.all.shared_media static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_shared_media:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_shared_media:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_shared_media:tst:1" version="1" check="all" comment="net.ipv4.conf.all.shared_media static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_shared_media:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_shared_media:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_shared_media:tst:1" version="1" check="all" comment="net.ipv4.conf.all.shared_media static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_shared_media:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_shared_media:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv4_conf_all_shared_media" id="oval:ssg-test_sysctl_net_ipv4_conf_all_shared_media_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_all_shared_media_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_shared_media_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_redirects:tst:1" version="1" comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_accept_redirects:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_accept_redirects:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_redirects:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv4.conf.default.accept_redirects static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv4_conf_default_accept_redirects" id="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_default_accept_redirects_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_accept_redirects_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_source_route:tst:1" version="1" comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_accept_source_route:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_accept_source_route:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_source_route:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv4.conf.default.accept_source_route static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_accept_source_route:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1" check="all" comment="net.ipv4.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1" check="all" comment="net.ipv4.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_source_route:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1" check="all" comment="net.ipv4.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv4_conf_default_accept_source_route" id="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_default_accept_source_route_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_accept_source_route_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_log_martians:tst:1" version="1" comment="kernel runtime parameter net.ipv4.conf.default.log_martians set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_log_martians:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_log_martians:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_log_martians:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv4.conf.default.log_martians static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_log_martians:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1" check="all" comment="net.ipv4.conf.default.log_martians static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_log_martians:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1" check="all" comment="net.ipv4.conf.default.log_martians static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_log_martians:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1" check="all" comment="net.ipv4.conf.default.log_martians static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv4_conf_default_log_martians" id="oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_default_log_martians_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_log_martians_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_rp_filter:tst:1" version="1" comment="kernel runtime parameter net.ipv4.conf.default.rp_filter set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_rp_filter:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_rp_filter:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_rp_filter:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv4.conf.default.rp_filter static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_rp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1" check="all" comment="net.ipv4.conf.default.rp_filter static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_rp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1" check="all" comment="net.ipv4.conf.default.rp_filter static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_rp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1" check="all" comment="net.ipv4.conf.default.rp_filter static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv4_conf_default_rp_filter" id="oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_default_rp_filter_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_rp_filter_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_secure_redirects:tst:1" version="1" comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_secure_redirects:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_secure_redirects:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_secure_redirects:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv4.conf.default.secure_redirects static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_secure_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.secure_redirects static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.secure_redirects static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_secure_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.secure_redirects static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv4_conf_default_secure_redirects" id="oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_default_secure_redirects_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_secure_redirects_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_send_redirects:tst:1" version="1" comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_send_redirects:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_send_redirects:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_send_redirects:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv4.conf.default.send_redirects static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_send_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_send_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.send_redirects static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_send_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_send_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.send_redirects static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_send_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_send_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.send_redirects static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_send_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv4_conf_default_send_redirects" id="oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_default_send_redirects_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_send_redirects_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_shared_media:tst:1" version="1" comment="kernel runtime parameter net.ipv4.conf.default.shared_media set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_shared_media:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_shared_media:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_shared_media:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv4.conf.default.shared_media static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_shared_media:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_shared_media:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_shared_media:tst:1" version="1" check="all" comment="net.ipv4.conf.default.shared_media static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_shared_media:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_shared_media:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_shared_media:tst:1" version="1" check="all" comment="net.ipv4.conf.default.shared_media static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_shared_media:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_shared_media:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_shared_media:tst:1" version="1" check="all" comment="net.ipv4.conf.default.shared_media static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_shared_media:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_shared_media:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv4_conf_default_shared_media" id="oval:ssg-test_sysctl_net_ipv4_conf_default_shared_media_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_default_shared_media_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_shared_media_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" comment="kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" check="all" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" check="all" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" check="all" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv4_icmp_echo_ignore_broadcasts" id="oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" comment="kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" check="all" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" check="all" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" check="all" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv4_icmp_ignore_bogus_error_responses" id="oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_ip_forward:tst:1" version="1" comment="kernel runtime parameter net.ipv4.ip_forward set to 0" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_ip_forward:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_ip_forward:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_ip_forward:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv4.ip_forward static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_ip_forward:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_forward:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_forward:tst:1" version="1" check="all" comment="net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_ip_forward:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_forward:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_ip_forward:tst:1" version="1" check="all" comment="net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_ip_forward:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_forward:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_forward:tst:1" version="1" check="all" comment="net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_forward:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_forward:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv4_ip_forward" id="oval:ssg-test_sysctl_net_ipv4_ip_forward_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv4_ip_forward_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv4_ip_forward_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_ip_local_port_range:tst:1" version="1" comment="kernel runtime parameter net.ipv4.ip_local_port_range set to 32768 65535" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_ip_local_port_range:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_ip_local_port_range:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_ip_local_port_range:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv4.ip_local_port_range static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_ip_local_port_range:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_local_port_range:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_local_port_range:tst:1" version="1" check="all" comment="net.ipv4.ip_local_port_range static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_ip_local_port_range:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_local_port_range:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_ip_local_port_range:tst:1" version="1" check="all" comment="net.ipv4.ip_local_port_range static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_ip_local_port_range:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_local_port_range:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_local_port_range:tst:1" version="1" check="all" comment="net.ipv4.ip_local_port_range static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_local_port_range:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_local_port_range:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv4_ip_local_port_range" id="oval:ssg-test_sysctl_net_ipv4_ip_local_port_range_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv4_ip_local_port_range_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv4_ip_local_port_range_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_tcp_syncookies:tst:1" version="1" comment="kernel runtime parameter net.ipv4.tcp_syncookies set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_tcp_syncookies:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_tcp_syncookies:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_tcp_syncookies:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv4.tcp_syncookies static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_tcp_syncookies:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1" check="all" comment="net.ipv4.tcp_syncookies static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_tcp_syncookies:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1" check="all" comment="net.ipv4.tcp_syncookies static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_tcp_syncookies:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1" check="all" comment="net.ipv4.tcp_syncookies static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv4_tcp_syncookies" id="oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv4_tcp_syncookies_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv4_tcp_syncookies_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv6.conf.all.accept_ra_defrtr static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_defrtr:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_defrtr static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_defrtr:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_defrtr static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_defrtr:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_defrtr static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_defrtr:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv6_conf_all_accept_ra_defrtr" id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_defrtr_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_all_accept_ra_defrtr_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_ra_defrtr_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv6.conf.all.accept_ra_pinfo static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_pinfo:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_pinfo static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_pinfo:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_pinfo static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_pinfo:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_pinfo static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_pinfo:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv6_conf_all_accept_ra_pinfo" id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_pinfo_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_all_accept_ra_pinfo_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_ra_pinfo_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv6.conf.all.accept_ra_rtr_pref static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_rtr_pref static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_rtr_pref static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_rtr_pref static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv6_conf_all_accept_ra_rtr_pref" id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_autoconf:tst:1" version="1" comment="kernel runtime parameter net.ipv6.conf.all.autoconf set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_autoconf:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_autoconf:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_autoconf:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv6.conf.all.autoconf static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_autoconf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_autoconf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_autoconf:tst:1" version="1" check="all" comment="net.ipv6.conf.all.autoconf static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_autoconf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_autoconf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_autoconf:tst:1" version="1" check="all" comment="net.ipv6.conf.all.autoconf static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_autoconf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_autoconf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_autoconf:tst:1" version="1" check="all" comment="net.ipv6.conf.all.autoconf static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_autoconf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_autoconf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv6_conf_all_autoconf" id="oval:ssg-test_sysctl_net_ipv6_conf_all_autoconf_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_all_autoconf_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_autoconf_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv6.conf.all.disable_ipv6 static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_disable_ipv6:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" check="all" comment="net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_disable_ipv6:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" check="all" comment="net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_disable_ipv6:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" check="all" comment="net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_disable_ipv6:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv6_conf_all_disable_ipv6" id="oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_all_disable_ipv6_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_disable_ipv6_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_max_addresses:tst:1" version="1" comment="kernel runtime parameter net.ipv6.conf.all.max_addresses set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_max_addresses:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_max_addresses:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_max_addresses:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv6.conf.all.max_addresses static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_max_addresses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_max_addresses:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_max_addresses:tst:1" version="1" check="all" comment="net.ipv6.conf.all.max_addresses static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_max_addresses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_max_addresses:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_max_addresses:tst:1" version="1" check="all" comment="net.ipv6.conf.all.max_addresses static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_max_addresses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_max_addresses:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_max_addresses:tst:1" version="1" check="all" comment="net.ipv6.conf.all.max_addresses static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_max_addresses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_max_addresses:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv6_conf_all_max_addresses" id="oval:ssg-test_sysctl_net_ipv6_conf_all_max_addresses_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_all_max_addresses_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_max_addresses_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_router_solicitations:tst:1" version="1" comment="kernel runtime parameter net.ipv6.conf.all.router_solicitations set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_router_solicitations:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_router_solicitations:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_router_solicitations:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv6.conf.all.router_solicitations static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_router_solicitations:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_router_solicitations:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" version="1" check="all" comment="net.ipv6.conf.all.router_solicitations static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_router_solicitations:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_router_solicitations:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" version="1" check="all" comment="net.ipv6.conf.all.router_solicitations static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_router_solicitations:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_router_solicitations:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" version="1" check="all" comment="net.ipv6.conf.all.router_solicitations static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_router_solicitations:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_router_solicitations:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv6_conf_all_router_solicitations" id="oval:ssg-test_sysctl_net_ipv6_conf_all_router_solicitations_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_all_router_solicitations_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_router_solicitations_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra:tst:1" version="1" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv6.conf.default.accept_ra static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv6_conf_default_accept_ra" id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_default_accept_ra_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv6.conf.default.accept_ra_defrtr static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_defrtr:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_defrtr static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_defrtr:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_defrtr static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_defrtr:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_defrtr static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_defrtr:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv6_conf_default_accept_ra_defrtr" id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_defrtr_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_default_accept_ra_defrtr_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_defrtr_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv6.conf.default.accept_ra_pinfo static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_pinfo:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_pinfo static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_pinfo:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_pinfo static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_pinfo:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_pinfo static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_pinfo:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv6_conf_default_accept_ra_pinfo" id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_pinfo_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_default_accept_ra_pinfo_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_pinfo_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv6.conf.default.accept_ra_rtr_pref static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_rtr_pref static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_rtr_pref static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_rtr_pref static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv6_conf_default_accept_ra_rtr_pref" id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_redirects:tst:1" version="1" comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_redirects:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_redirects:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_redirects:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv6.conf.default.accept_redirects static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv6_conf_default_accept_redirects" id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_default_accept_redirects_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_redirects_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_autoconf:tst:1" version="1" comment="kernel runtime parameter net.ipv6.conf.default.autoconf set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_autoconf:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_autoconf:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_autoconf:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv6.conf.default.autoconf static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_autoconf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_autoconf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_autoconf:tst:1" version="1" check="all" comment="net.ipv6.conf.default.autoconf static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_autoconf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_autoconf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_autoconf:tst:1" version="1" check="all" comment="net.ipv6.conf.default.autoconf static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_autoconf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_autoconf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_autoconf:tst:1" version="1" check="all" comment="net.ipv6.conf.default.autoconf static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_autoconf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_autoconf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv6_conf_default_autoconf" id="oval:ssg-test_sysctl_net_ipv6_conf_default_autoconf_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_default_autoconf_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_autoconf_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" comment="kernel runtime parameter net.ipv6.conf.default.disable_ipv6 set to 1" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv6.conf.default.disable_ipv6 static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_disable_ipv6:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" check="all" comment="net.ipv6.conf.default.disable_ipv6 static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_disable_ipv6:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" check="all" comment="net.ipv6.conf.default.disable_ipv6 static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_disable_ipv6:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" check="all" comment="net.ipv6.conf.default.disable_ipv6 static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_disable_ipv6:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv6_conf_default_disable_ipv6" id="oval:ssg-test_sysctl_net_ipv6_conf_default_disable_ipv6_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_default_disable_ipv6_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_disable_ipv6_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_max_addresses:tst:1" version="1" comment="kernel runtime parameter net.ipv6.conf.default.max_addresses set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_max_addresses:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_max_addresses:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_max_addresses:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv6.conf.default.max_addresses static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_max_addresses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_max_addresses:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_max_addresses:tst:1" version="1" check="all" comment="net.ipv6.conf.default.max_addresses static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_max_addresses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_max_addresses:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_max_addresses:tst:1" version="1" check="all" comment="net.ipv6.conf.default.max_addresses static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_max_addresses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_max_addresses:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_max_addresses:tst:1" version="1" check="all" comment="net.ipv6.conf.default.max_addresses static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_max_addresses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_max_addresses:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv6_conf_default_max_addresses" id="oval:ssg-test_sysctl_net_ipv6_conf_default_max_addresses_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_default_max_addresses_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_max_addresses_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_router_solicitations:tst:1" version="1" comment="kernel runtime parameter net.ipv6.conf.default.router_solicitations set to the appropriate value" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_router_solicitations:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_router_solicitations:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_router_solicitations:tst:1" version="1" check="all" check_existence="all_exist" comment="net.ipv6.conf.default.router_solicitations static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_router_solicitations:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_router_solicitations:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" version="1" check="all" comment="net.ipv6.conf.default.router_solicitations static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_router_solicitations:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_router_solicitations:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" version="1" check="all" comment="net.ipv6.conf.default.router_solicitations static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_router_solicitations:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_router_solicitations:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" version="1" check="all" comment="net.ipv6.conf.default.router_solicitations static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_router_solicitations:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_router_solicitations:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains net_ipv6_conf_default_router_solicitations" id="oval:ssg-test_sysctl_net_ipv6_conf_default_router_solicitations_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_default_router_solicitations_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_router_solicitations_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_user_max_user_namespaces:tst:1" version="1" comment="kernel runtime parameter user.max_user_namespaces set to 0" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_user_max_user_namespaces:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_user_max_user_namespaces:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_user_max_user_namespaces:tst:1" version="1" check="all" check_existence="all_exist" comment="user.max_user_namespaces static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_user_max_user_namespaces:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_user_max_user_namespaces:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_user_max_user_namespaces:tst:1" version="1" check="all" comment="user.max_user_namespaces static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_user_max_user_namespaces:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_user_max_user_namespaces:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_user_max_user_namespaces:tst:1" version="1" check="all" comment="user.max_user_namespaces static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_user_max_user_namespaces:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_user_max_user_namespaces:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_user_max_user_namespaces:tst:1" version="1" check="all" comment="user.max_user_namespaces static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_user_max_user_namespaces:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_user_max_user_namespaces:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains user_max_user_namespaces" id="oval:ssg-test_sysctl_user_max_user_namespaces_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_user_max_user_namespaces_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_user_max_user_namespaces_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_runtime_vm_mmap_min_addr:tst:1" version="1" comment="kernel runtime parameter vm.mmap_min_addr set to 65536" check="all" check_existence="all_exist">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_vm_mmap_min_addr:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_vm_mmap_min_addr:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_sysctl_vm_mmap_min_addr:tst:1" version="1" check="all" check_existence="all_exist" comment="vm.mmap_min_addr static configuration">
          <ind:object object_ref="oval:ssg-object_static_sysctl_vm_mmap_min_addr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_vm_mmap_min_addr:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_vm_mmap_min_addr:tst:1" version="1" check="all" comment="vm.mmap_min_addr static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_vm_mmap_min_addr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_vm_mmap_min_addr:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_vm_mmap_min_addr:tst:1" version="1" check="all" comment="vm.mmap_min_addr static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_vm_mmap_min_addr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_vm_mmap_min_addr:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_vm_mmap_min_addr:tst:1" version="1" check="all" comment="vm.mmap_min_addr static configuration in /etc/sysctl.d/*.conf">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_vm_mmap_min_addr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_vm_mmap_min_addr:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" comment="Check that only one file contains vm_mmap_min_addr" id="oval:ssg-test_sysctl_vm_mmap_min_addr_defined_in_one_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-oject_sysctl_vm_mmap_min_addr_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_vm_mmap_min_addr_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_dnf-automatic:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_dnf-automatic_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_dnf-automatic_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_timer_running_dnf-automatic:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the dnf-automatic timer is running" version="1">
          <linux:object object_ref="oval:ssg-obj_timer_running_dnf-automatic:obj:1"/>
          <linux:state state_ref="oval:ssg-state_timer_running_dnf-automatic:ste:1"/>
        </linux:systemdunitproperty_test>
        <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth" id="oval:ssg-test_accounts_password_pam_faillock:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_accounts_password_pam_faillock:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth" id="oval:ssg-test_password_pam_pwquality:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_audit_rules_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_audit_rules_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit setdomainname" id="oval:ssg-test_32bit_ardm_setdomainname_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_setdomainname_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit setdomainname" id="oval:ssg-test_64bit_ardm_setdomainname_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_setdomainname_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit setdomainname" id="oval:ssg-test_32bit_ardm_setdomainname_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_setdomainname_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit setdomainname" id="oval:ssg-test_64bit_ardm_setdomainname_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_setdomainname_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit sethostname" id="oval:ssg-test_32bit_ardm_sethostname_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_sethostname_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit sethostname" id="oval:ssg-test_64bit_ardm_sethostname_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_sethostname_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit sethostname" id="oval:ssg-test_32bit_ardm_sethostname_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_sethostname_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit sethostname" id="oval:ssg-test_64bit_ardm_sethostname_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_sethostname_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_conf_log_file_not_set:tst:1" check="all" check_existence="none_exist" comment="log_file not set" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_conf_log_file:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_conf_log_group_not_root:tst:1" check="all" check_existence="none_exist" comment="log_group = root" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_conf_log_group_root:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_conf_log_group_is_set:tst:1" check="all" check_existence="all_exist" comment="log_group is set" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_conf_log_group_is_set:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_bootloader_disable_recovery_set_to_true:tst:1" comment="Check for GRUB_DISABLE_RECOVERY=true in /etc/default/grub" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_bootloader_disable_recovery_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_bootloader_disable_recovery_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensure more than one chronyd NTP server is set" id="oval:ssg-test_chronyd_multiple_servers:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_chronyd_multiple_servers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_default_exists:tst:1" comment="check for GRUB_CMDLINE_LINUX_DEFAULT in /etc/default/grub" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_default_exists:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_entries_reference_kernelopts:tst:1" comment="check kernel command line parameters for referenced boot entries reference the $kernelopts variable." check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_entries_reference_kernelopts:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="centos-release is version 6" id="oval:ssg-test_centos6:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_centos6:obj:1"/>
          <linux:state state_ref="oval:ssg-state_centos6:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="centos-release is version 7" id="oval:ssg-test_centos7:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_centos7:obj:1"/>
          <linux:state state_ref="oval:ssg-state_centos7:ste:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check os-release ID" id="oval:ssg-test_centos8_name:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_name_centos8:obj:1"/>
          <ind:state state_ref="oval:ssg-state_name_centos8:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="Check os-release VERSION_ID" id="oval:ssg-test_centos8_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_version_centos8:obj:1"/>
          <ind:state state_ref="oval:ssg-state_version_centos8:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check os-release ID" id="oval:ssg-test_centos9_name:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_name_centos9:obj:1"/>
          <ind:state state_ref="oval:ssg-state_name_centos9:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="Check os-release VERSION_ID" id="oval:ssg-test_centos9_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_version_centos9:obj:1"/>
          <ind:state state_ref="oval:ssg-state_version_centos9:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="all_exist" comment="/etc/debian_version exists" id="oval:ssg-test_debian:tst:1" version="1">
          <unix:object object_ref="oval:ssg-obj_debian:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Debian version" id="oval:ssg-test_debian_10:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_debian_10:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Debian version" id="oval:ssg-test_debian_11:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_debian_11:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Debian version" id="oval:ssg-test_debian_9:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_debian_9:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="fedora-release RPM packages are installed" id="oval:ssg-test_fedora_release_rpm:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_fedora_release_rpm:obj:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" comment="CPE vendor is 'fedoraproject' and 'product' is fedora" id="oval:ssg-test_fedora_vendor_product:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_fedora_vendor_product:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="oraclelinux-release is version 7" id="oval:ssg-test_ol7_system:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_ol7_system:obj:1"/>
          <linux:state state_ref="oval:ssg-state_ol7_system:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="oraclelinux-release is version 8" id="oval:ssg-test_ol8_system:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_ol8_system:obj:1"/>
          <linux:state state_ref="oval:ssg-state_ol8_system:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="oraclelinux-release is version 9" id="oval:ssg-test_ol9_system:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_ol9_system:obj:1"/>
          <linux:state state_ref="oval:ssg-state_ol9_system:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="openSUSE is installed" id="oval:ssg-test_opensuse_installed:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_opensuse_installed:obj:1"/>
          <linux:state state_ref="oval:ssg-state_opensuse_installed:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="openSUSE Leap 15 is installed" id="oval:ssg-test_opensuse_leap15_installed:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_opensuse_leap15_installed:obj:1"/>
          <linux:state state_ref="oval:ssg-state_opensuse_leap15_installed:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="openSUSE Leap 42 is installed" id="oval:ssg-test_opensuse_leap42_installed:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_opensuse_leap42_installed:obj:1"/>
          <linux:state state_ref="oval:ssg-state_opensuse_leap42_installed:ste:1"/>
        </linux:rpminfo_test>
        <ind:family_test id="oval:ssg-test_unix_family:tst:1" check="all" check_existence="at_least_one_exists" comment="Test installed OS is part of the unix family" version="1">
          <ind:object object_ref="oval:ssg-object_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_unix_family:ste:1"/>
        </ind:family_test>
        <ind:textfilecontent54_test check="all" comment="os-release is rhcos" id="oval:ssg-test_rhcos:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhcos:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhcos:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="rhcoreos is version 4" id="oval:ssg-test_rhcos4:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhcos4:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhcos4:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_rhel7_unix_family:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhel7_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhel7_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-client is version 7" id="oval:ssg-test_rhel7_client:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel7_client:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel7_client:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-workstation is version 7" id="oval:ssg-test_rhel7_workstation:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel7_workstation:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel7_workstation:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-server is version 7" id="oval:ssg-test_rhel7_server:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel7_server:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel7_server:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-computenode is version 7" id="oval:ssg-test_rhel7_computenode:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel7_computenode:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel7_computenode:ste:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" comment="RHEVH base RHEL is version 7" id="oval:ssg-test_rhevh_rhel7_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhevh_rhel7_version:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhevh_rhel7_version:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_rhel8_unix_family:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhel8_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhel8_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8" id="oval:ssg-test_rhel8:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.0" id="oval:ssg-test_rhel8_0:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_0:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_0:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.1" id="oval:ssg-test_rhel8_1:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_1:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_1:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.2" id="oval:ssg-test_rhel8_2:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_2:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_2:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.3" id="oval:ssg-test_rhel8_3:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_3:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_3:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.4" id="oval:ssg-test_rhel8_4:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_4:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_4:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.5" id="oval:ssg-test_rhel8_5:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_5:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_5:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.6" id="oval:ssg-test_rhel8_6:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_6:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_6:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.7" id="oval:ssg-test_rhel8_7:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_7:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_7:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.8" id="oval:ssg-test_rhel8_8:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_8:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_8:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.9" id="oval:ssg-test_rhel8_9:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_9:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_9:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.10" id="oval:ssg-test_rhel8_10:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_10:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_10:ste:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" comment="RHEVH base RHEL is version 8" id="oval:ssg-test_rhevh_rhel8_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhevh_rhel8_version:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhevh_rhel8_version:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_rhel9_unix_family:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhel9_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhel9_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 9" id="oval:ssg-test_rhel9:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel9:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel9:ste:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" comment="RHEVH base RHEL is version 9" id="oval:ssg-test_rhevh_rhel9_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhevh_rhel9_version:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhevh_rhel9_version:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test check="all" check_existence="only_one_exists" comment="redhat-release-virtualization-host RPM package is installed" id="oval:ssg-test_rhvh4_version:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhvh4_version:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhvh4_version:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sl-release is version 6" id="oval:ssg-test_sl6:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sl6:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sl6:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sl-release is version 7" id="oval:ssg-test_sl7:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sl7:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sl7:ste:1"/>
        </linux:rpminfo_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_sle12_unix_family:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sle12_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sle12_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sled-release is version 6" id="oval:ssg-test_sle12_desktop:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sle12_desktop:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sle12_desktop:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sles-release is version 6" id="oval:ssg-test_sle12_server:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sle12_server:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sle12_server:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="SLES_SAP-release is version 12" id="oval:ssg-test_sles_12_for_sap:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sles_12_for_sap:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sles_12_for_sap:ste:1"/>
        </linux:rpminfo_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_sle15_unix_family:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sle15_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sle15_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sled-release is version 15" id="oval:ssg-test_sle15_desktop:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sle15_desktop:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sle15_desktop:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sles-release is version 15" id="oval:ssg-test_sle15_server:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sle15_server:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sle15_server:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="SLES_SAP-release is version 15" id="oval:ssg-test_sles_15_for_sap:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sles_15_for_sap:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sles_15_for_sap:ste:1"/>
        </linux:rpminfo_test>
        <unix:file_test check="all" check_existence="all_exist" comment="/etc/lsb-release exists" id="oval:ssg-test_lsb:tst:1" version="1">
          <unix:object object_ref="oval:ssg-obj_lsb:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Ubuntu" id="oval:ssg-test_ubuntu:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ubuntu:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Ubuntu version" id="oval:ssg-test_ubuntu_xenial:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ubuntu_xenial:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Ubuntu version" id="oval:ssg-test_ubuntu_bionic:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ubuntu_bionic:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Ubuntu version" id="oval:ssg-test_ubuntu_focal:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ubuntu_focal:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_unix_wrlinux1019:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_unix_wrlinux1019:obj:1"/>
          <ind:state state_ref="oval:ssg-state_unix_wrlinux1019:ste:1"/>
        </ind:family_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check WRLinux10.19 version" id="oval:ssg-test_wrlinux1019_name:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_name_wrlinux1019:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check WRLinux10.19 version" id="oval:ssg-test_wrlinux1019_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_version_wrlinux1019:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_unix_wrlinux8:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_unix_wrlinux8:obj:1"/>
          <ind:state state_ref="oval:ssg-state_unix_wrlinux8:ste:1"/>
        </ind:family_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check WRLinux8 version" id="oval:ssg-test_wrlinux8_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_version_wrlinux8:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="rhevm4-appliance is installed" id="oval:ssg-test_rhevm4_version:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhevm4_version:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhevm4_version:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_audit_installed:tst:1" version="1" comment="system has package audit installed">
          <linux:object object_ref="oval:ssg-obj_env_has_audit_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_env_has_chrony_installed:tst:1" version="1" comment="package chrony is installed">
          <linux:object object_ref="oval:ssg-obj_test_env_has_chrony_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_gdm_installed:tst:1" version="1" comment="system has package gdm installed">
          <linux:object object_ref="oval:ssg-obj_env_has_gdm_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_grub2_installed:tst:1" version="1" comment="system has package grub2-common installed">
          <linux:object object_ref="oval:ssg-obj_env_has_grub2_installed:obj:1"/>
        </linux:rpminfo_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Check if /sys/firmware/opal exists" id="oval:ssg-test_system_using_opal:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_system_using_opal:obj:1"/>
        </unix:file_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_libuser_installed:tst:1" version="1" comment="system has package libuser installed">
          <linux:object object_ref="oval:ssg-obj_env_has_libuser_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_login_defs_installed:tst:1" version="1" comment="system has package shadow-utils installed, which provides the /etc/login.defs file.">
          <linux:object object_ref="oval:ssg-obj_env_has_login_defs_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_net-snmp_installed:tst:1" version="1" comment="system has package net-snmp installed">
          <linux:object object_ref="oval:ssg-obj_env_has_net-snmp_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_nss-pam-ldapd_installed:tst:1" version="1" comment="system has package nss-pam-ldapd installed">
          <linux:object object_ref="oval:ssg-obj_env_has_nss-pam-ldapd_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_env_has_ntp_installed:tst:1" version="1" comment="package ntp is installed">
          <linux:object object_ref="oval:ssg-obj_test_env_has_ntp_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_ovirt-host_installed:tst:1" version="1" comment="system has package ovirt-host installed">
          <linux:object object_ref="oval:ssg-obj_env_has_ovirt-host_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_ovirt-engine_installed:tst:1" version="1" comment="system has package ovirt-engine installed">
          <linux:object object_ref="oval:ssg-obj_env_has_ovirt-engine_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_pam_installed:tst:1" version="1" comment="system has package pam installed">
          <linux:object object_ref="oval:ssg-obj_env_has_pam_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_env_has_polkit_installed:tst:1" version="1" comment="package polkit is installed">
          <linux:object object_ref="oval:ssg-obj_test_env_has_polkit_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_env_has_postfix_installed:tst:1" version="1" comment="package postfix is installed">
          <linux:object object_ref="oval:ssg-obj_test_env_has_postfix_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_sssd-common_installed:tst:1" version="1" comment="system has package sssd-common installed">
          <linux:object object_ref="oval:ssg-obj_env_has_sssd-common_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_sudo_installed:tst:1" version="1" comment="system has package sudo installed">
          <linux:object object_ref="oval:ssg-obj_env_has_sudo_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_systemd_installed:tst:1" version="1" comment="system has package systemd installed">
          <linux:object object_ref="oval:ssg-obj_env_has_systemd_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_tftp_server_installed:tst:1" version="1" comment="system has package tftp-server installed">
          <linux:object object_ref="oval:ssg-obj_env_has_tftp_server_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_usbguard_installed:tst:1" version="1" comment="system has package usbguard installed">
          <linux:object object_ref="oval:ssg-obj_env_has_usbguard_installed:obj:1"/>
        </linux:rpminfo_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Test if /proc/net/wireless exists" id="oval:ssg-test_proc_net_wireless_exists:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_proc_net_wireless_exists:obj:1"/>
        </unix:file_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_yum_installed:tst:1" version="1" comment="system has package yum installed">
          <linux:object object_ref="oval:ssg-obj_env_has_yum_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_zipl_installed:tst:1" version="1" comment="system has package zipl installed">
          <linux:object object_ref="oval:ssg-obj_env_has_zipl_installed:obj:1"/>
        </linux:rpminfo_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Check if /.dockerenv exists" id="oval:ssg-test_installed_env_is_a_docker_container:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_installed_env_is_a_docker_container:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Check if /run/.containerenv exists" id="oval:ssg-test_installed_env_is_a_podman_container:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_installed_env_is_a_podman_container:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_no_cd_dvd_drive_in_etc_fstab:tst:1" check_existence="none_exist" check="all" comment="'CD/DVD drive is not listed in /etc/fstab" version="1">
          <ind:object object_ref="oval:ssg-object_no_cd_dvd_drive_in_etc_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="proc_sys_kernel is for aarch64 architecture" id="oval:ssg-test_proc_sys_kernel_osrelease_arch_aarch64:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_proc_sys_kernel_osrelease_arch_aarch64:obj:1"/>
          <ind:state state_ref="oval:ssg-state_proc_sys_kernel_osrelease_arch_aarch64:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="proc_sys_kernel is for s390x architecture" id="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_proc_sys_kernel_osrelease_arch_s390x:obj:1"/>
          <ind:state state_ref="oval:ssg-state_proc_sys_kernel_osrelease_arch_s390x:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_removable_partition_doesnt_exist:tst:1" check="all" check_existence="none_exist" comment="Check if expected removable partitions truly exist on the system" version="1">
          <unix:object object_ref="oval:ssg-object_removable_partition_doesnt_exist:obj:1"/>
        </unix:file_test>
        <ind:variable_test id="oval:ssg-test_sshd_not_required:tst:1" comment="Verify if Profile set Value sshd_required as not required" check="all" check_existence="at_least_one_exists" version="1">
          <ind:object object_ref="oval:ssg-object_sshd_not_required:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_not_required:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_sshd_required:tst:1" comment="Verify if Profile set Value sshd_required as required" check="all" check_existence="at_least_one_exists" version="1">
          <ind:object object_ref="oval:ssg-object_sshd_required:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_required:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_sshd_requirement_unset:tst:1" comment="Verify if Value of sshd_required is the default" check="all" check_existence="at_least_one_exists" version="1">
          <ind:object object_ref="oval:ssg-object_sshd_requirement_unknown:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_requirement_unset:ste:1"/>
        </ind:variable_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="OpenSSH is version 7.4 or higher" id="oval:ssg-test_openssh-server_version:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_openssh-server_version:obj:1"/>
          <linux:state state_ref="oval:ssg-state_openssh-server_version:ste:1"/>
        </linux:rpminfo_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Testing if /etc/sssd/sssd.conf exists" id="oval:ssg-test_sssd_conf_exists:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sssd_conf_exists:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="SSSD Configuration is set to use Active Directory" id="oval:ssg-test_id_provider_is_set_to_ad:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_id_provider_is_set_to_ad:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="Verify if /sys/firmware/efi folder exists" id="oval:ssg-test_efi_dir_existence:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_sys_firmware_efi:obj:1"/>
        </unix:file_test>
        <unix:uname_test check="all" comment="64 bit architecture" id="oval:ssg-test_system_info_architecture_aarch_64:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_system_info_architecture_aarch_64:obj:1"/>
          <unix:state state_ref="oval:ssg-state_system_info_architecture_aarch_64:ste:1"/>
        </unix:uname_test>
        <unix:uname_test check="all" comment="64 bit architecture" id="oval:ssg-test_system_info_architecture_ppc_64:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_system_info_architecture_ppc_64:obj:1"/>
          <unix:state state_ref="oval:ssg-state_system_info_architecture_ppc_64:ste:1"/>
        </unix:uname_test>
        <unix:uname_test check="all" comment="64 bit architecture" id="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_system_info_architecture_ppcle_64:obj:1"/>
          <unix:state state_ref="oval:ssg-state_system_info_architecture_ppcle_64:ste:1"/>
        </unix:uname_test>
        <unix:uname_test check="all" comment="64 bit architecture" id="oval:ssg-test_system_info_architecture_s390_64:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_system_info_architecture_s390_64:obj:1"/>
          <unix:state state_ref="oval:ssg-state_system_info_architecture_s390_64:ste:1"/>
        </unix:uname_test>
        <unix:uname_test check="all" comment="32 bit architecture" id="oval:ssg-test_system_info_architecture_x86:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_system_info_architecture_x86:obj:1"/>
          <unix:state state_ref="oval:ssg-state_system_info_architecture_x86:ste:1"/>
        </unix:uname_test>
        <unix:uname_test check="all" comment="64 bit architecture" id="oval:ssg-test_system_info_architecture_x86_64:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_system_info_architecture_x86_64:obj:1"/>
          <unix:state state_ref="oval:ssg-state_system_info_architecture_x86_64:ste:1"/>
        </unix:uname_test>
        <ind:textfilecontent54_test check_existence="at_least_one_exists" check="all" comment="Check the usbguard rules in either /etc/usbguard/rules.conf or /etc/usbguard/rules.d/ contain at least one non whitespace character and exists" id="oval:ssg-test_usbguard_rules_nonempty:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_usbguard_rules_nonempty:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1" comment="Verify the existence of var_accounts_user_umask_as_number variable" check="all" check_existence="at_least_one_exists" version="1">
          <ind:object object_ref="oval:ssg-object_var_accounts_user_umask_umask_as_number:obj:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_var_removable_partition_is_cd_dvd_drive:tst:1" check="all" comment="Check if removable partition variable value represents CD/DVD drive" version="1">
          <ind:object object_ref="oval:ssg-object_var_removable_partition_is_cd_dvd_drive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_removable_partition_is_cd_dvd_drive:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_existence_of_var_umask_for_daemons_as_number_variable:tst:1" comment="Verify the existence of var_umask_for_daemons_as_number variable" check="all" check_existence="at_least_one_exists" version="1">
          <ind:object object_ref="oval:ssg-object_var_umask_for_daemons_umask_as_number:obj:1"/>
        </ind:variable_test>
      </oval-def:tests>
      <oval-def:objects>
        <ind:textfilecontent54_object comment="log ftp transactions" id="oval:ssg-object_test_ftp_log_transactions_enable:obj:1" version="1">
          <ind:filepath>/etc/vsftpd/vsftpd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*xferlog_enable[\s]*=[\s]*YES$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="log ftp transactions" id="oval:ssg-object_test_ftp_log_transactions_format:obj:1" version="1">
          <ind:filepath>/etc/vsftpd/vsftpd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*xferlog_std_format[\s]*=[\s]*NO$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="log ftp transactions" id="oval:ssg-object_test_ftp_log_transactions_protocol:obj:1" version="1">
          <ind:filepath>/etc/vsftpd/vsftpd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*log_ftp_protocol[\s]*=[\s]*YES$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="Banner for FTP Users" id="oval:ssg-object_test_ftp_present_banner:obj:1" version="1">
          <ind:filepath>/etc/vsftpd/vsftpd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*banner_file=/etc/issue[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_kerberos_disable_no_keytab:obj:1" version="1" comment="Default Kerberos keytab file">
          <unix:filepath operation="pattern match">^/etc/.+\.keytab$</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_root_mail_alias:obj:1" version="1">
          <ind:filepath operation="equals">/etc/aliases</ind:filepath>
          <ind:pattern operation="pattern match">^(?:[rR][oO][oO][tT]|"[rR][oO][oO][tT]")\s*:\s*(.+)$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_no_insecure_locks_exports:obj:1" version="2">
          <ind:filepath>/etc/exports</ind:filepath>
          <ind:pattern operation="pattern match">^(.*?(\binsecure_locks\b)[^$]*)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_chronyd_port_value:obj:1" version="1">
          <ind:filepath>/etc/chrony.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*port[\s]+(\S+)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_chronyd_cmdport_value:obj:1" version="1">
          <ind:filepath>/etc/chrony.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*cmdport[\s]+(\S+)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ntp_set_maxpoll:obj:1" version="1">
          <ind:filepath>/etc/ntp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^server[\s]+[\S]+.*maxpoll[\s]+(\d+)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_chrony_set_maxpoll:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^(?:server|pool|peer)[\s]+[\S]+.*maxpoll[\s]+(\d+)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ntp_all_server_has_maxpoll:obj:1" version="1">
          <ind:filepath>/etc/ntp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^server[\s]+[\S]+[\s]+(.*)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_chrony_all_server_has_maxpoll:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^(?:server|pool|peer)[\s]+[\S]+[\s]+(.*)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_chrony_no_server_nor_pool:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^(?:server|pool).*</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ntp_no_server_nor_pool:obj:1" version="1">
          <ind:filepath>/etc/ntp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^server.*</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_chronyd_run_as_chrony_user:obj:1" version="1">
          <ind:filepath>/etc/sysconfig/chronyd</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*OPTIONS=(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_chronyd_run_as_chrony_user_config_file:obj:1" comment="The configuration file /etc/sysconfig/chronyd for chronyd_run_as_chrony_user" version="1">
          <unix:filepath operation="pattern match">^/etc/sysconfig/chronyd</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object comment="Matches server entries in Chrony conf files" id="oval:ssg-object_chronyd_server_directive:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*server.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="Matches pool entires in Chrony conf files" id="oval:ssg-object_chronyd_no_pool_directive:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]+pool.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="Ensure at least one NTP server is set" id="oval:ssg-object_chronyd_remote_server:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?:server|pool)[\s]+.+$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="ensure ipv4 restrictions" id="oval:ssg-obj_ntpd_configure_restrictions_ipv4:obj:1" version="1">
          <ind:filepath>/etc/ntp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*restrict[\s]+(-4[\s]*)?default(?=.*kod)(?=.*nomodify)(?=.*notrap)(?=.*nopeer)(?=.*noquery).*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="ensure ipv6 restrictions" id="oval:ssg-obj_ntpd_configure_restrictions_ipv6:obj:1" version="1">
          <ind:filepath>/etc/ntp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*restrict[\s]+-6[\s]+default(?=.*kod)(?=.*nomodify)(?=.*notrap)(?=.*nopeer)(?=.*noquery).*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ntpd_run_as_ntp_user_etc_sysconfig_ntpd:obj:1" version="1" comment="check /etc/sysconfig/ntpd">
          <ind:filepath>/etc/sysconfig/ntpd</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*OPTIONS=.*-u ntp:ntp.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ntpd_run_as_ntp_user_systemd:obj:1" version="1" comment="check /usr/lib/systemd/system/ntpd.service">
          <ind:filepath>/usr/lib/systemd/system/ntpd.service</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*ExecStart=.*-u ntp:ntp.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="Ensure more than one ntpd NTP server is set" id="oval:ssg-obj_ntpd_multiple_servers:obj:1" version="1">
          <ind:filepath>/etc/ntp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^([\s]*server[\s]+.+$){2,}$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="Ensure at least one ntpd NTP server is set" id="oval:ssg-obj_ntp_remote_server:obj:1" version="1">
          <ind:filepath>/etc/ntp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*server[\s]+.+$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object comment="look for .rhosts in /root" id="oval:ssg-object_no_rsh_trust_files_root:obj:1" version="1">
          <unix:path operation="equals">/root</unix:path>
          <unix:filename operation="pattern match">^\.rhosts$</unix:filename>
        </unix:file_object>
        <unix:file_object comment="look for .rhosts in /home" id="oval:ssg-object_no_rsh_trust_files_home:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all"/>
          <unix:path operation="equals">/home</unix:path>
          <unix:filename operation="pattern match">^\.rhosts$</unix:filename>
        </unix:file_object>
        <unix:file_object comment="look for /etc/hosts.equiv" id="oval:ssg-object_no_rsh_trust_files_etc:obj:1" version="1">
          <unix:path operation="equals">/etc</unix:path>
          <unix:filename operation="pattern match">^hosts\.equiv$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_snmp_default_communities:obj:1" version="1">
          <ind:filepath>/etc/snmp/snmpd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^((?!#).)*(public|private).*</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_snmp_versions:obj:1" version="1">
          <ind:filepath>/etc/snmp/snmpd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(com2se|rocommunity|rwcommunity)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sshd_allow_only_protocol2:obj:1" version="3">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)Protocol[\s]+2[\s]*(?:|(?:#.*))?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_compression:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)Compression(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_rhosts_rsa:obj:1" version="2">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)RhostsRSAAuthentication(?-i)[\s]+no[\s]*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_rekey_limit:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern var_ref="oval:ssg-sshd_line_regex:var:1" operation="pattern match"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_rekey_limit_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern var_ref="oval:ssg-sshd_line_regex:var:1" operation="pattern match"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sshd_idle_timeout:obj:1" version="2">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveInterval[\s]+(\d+)[\s]*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sshd_idle_timeout_config_dir:obj:1" version="2">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveInterval[\s]+(\d+)[\s]*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_clientalivecountmax:obj:1" version="2">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveCountMax[\s]+([\d]+)[\s]*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_clientalivecountmax_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveCountMax[\s]+([\d]+)[\s]*(?:#.*)?$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sshd_login_grace_time:obj:1" version="2">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)LoginGraceTime[\s]+(\d+)[\s]*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sshd_max_auth_tries:obj:1" version="2">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)MaxAuthTries[\s]+(\d+)[\s]*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sshd_max_sessions:obj:1" version="2">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)MaxSessions[\s]+(\d+)[\s]*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_config_maxstartups_first_parameter:obj:1" version="1">
          <ind:filepath operation="equals">/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string">(?i)^\s*MaxStartups\s+(\d+):\d+:\d+\s*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_config_maxstartups_second_parameter:obj:1" version="1">
          <ind:filepath operation="equals">/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string">(?i)^\s*MaxStartups\s+\d+:(\d+):\d+\s*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_config_maxstartups_third_parameter:obj:1" version="1">
          <ind:filepath operation="equals">/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string">(?i)^\s*MaxStartups\s+\d+:\d+:(\d+)\s*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_use_directory_configuration_default_not_overriden:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)match(?-i)\s+\S+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_use_priv_separation:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)UsePrivilegeSeparation(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sssd_certificate_verification:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sssd/(sssd|conf\.d/.*)\.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\[sssd](?:[^\n\[]*\n+)+?[\s]*certificate_verification\s*=\s*ocsp_dgst\s*=\s*(\w+)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sssd_enable_smartcards:obj:1" version="1">
          <ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\[pam](?:[^\n\[]*\n+)+?[\s]*pam_cert_auth[\s]*=[\s]*true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sssd_memcache_timeout:obj:1" version="1">
          <ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\[nss](?:[^\n\[]*\n+)+?[\s]*memcache_timeout[\s]*=[\s]*(\d+)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sssd_offline_cred_expiration:obj:1" version="1">
          <ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\[pam](?:[^\n\[]*\n+)+?[\s]*offline_credentials_expiration[\s]*=[\s]*1$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sssd_user_value:obj:1" comment="get last user value from each [sssd] section" version="1">
          <ind:filepath operation="pattern match">^/etc/sssd/(sssd|conf\.d/.*)\.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[sssd\].*(?:\n\s*[^[\s].*)*\n\s*user[ \t]*=[ \t]*(\S*)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sssd_ssh_known_hosts_timeout:obj:1" version="1">
          <ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\[ssh](?:[^\n\[]*\n+)+?[\s]*ssh_known_hosts_timeout[\s]*=[\s]*(\d+)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_configure_usbguard_auditbackend:obj:1" version="1">
          <ind:filepath>/etc/usbguard/usbguard-daemon.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*AuditBackend=(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_configure_usbguard_auditbackend_config_file:obj:1" comment="The configuration file /etc/usbguard/usbguard-daemon.conf for configure_usbguard_auditbackend" version="1">
          <unix:filepath operation="pattern match">^/etc/usbguard/usbguard-daemon.conf</unix:filepath>
        </unix:file_object>
        <unix:symlink_object comment="default.target systemd softlink exists" id="oval:ssg-object_disable_xwindows_runlevel_target:obj:1" version="1">
          <unix:filepath>/etc/systemd/system/default.target</unix:filepath>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_banner_etc_issue:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath operation="pattern match">^/etc/issue(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_banner_etc_motd:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath>/etc/motd</ind:filepath>
          <ind:pattern operation="pattern match">^(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_banner_gui_enabled:obj:1" version="1">
          <ind:path>/etc/dconf/db/distro.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?banner-message-enable=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_banner_gui_enabled_change:obj:1" version="1">
          <ind:path>/etc/dconf/db/distro.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/login-screen/banner-message-enable$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_banner_change:obj:1" version="1">
          <ind:path>/etc/dconf/db/distro.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/login-screen/banner-message-text$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_gdm_login_banner_text_setting:obj:1" version="1">
          <ind:path>/etc/dconf/db/distro.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^banner-message-text=[\s]*'*(.*?)'$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disallow_bypass_password_sudo:obj:1" version="1">
          <ind:filepath>/etc/pam.d/sudo</ind:filepath>
          <ind:pattern operation="pattern match">^.*pam_succeed_if.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_display_login_attempts:obj:1" version="1">
          <ind:filepath>/etc/pam.d/postlogin</ind:filepath>
          <ind:pattern operation="pattern match">^\s*session\s+required\s+pam_lastlog\.so(?:\s+[\w=]+)*\s+showfailed(\s|$)</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_display_login_attempts_silent:obj:1" version="1">
          <ind:filepath>/etc/pam.d/postlogin</ind:filepath>
          <ind:pattern operation="pattern match">^\s*session\s+required\s+pam_lastlog\.so(?:\s+[\w=]+)*\s+silent(\s|$)</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_enable_pam_namespace:obj:1" version="1">
          <ind:filepath>/etc/pam.d/login</ind:filepath>
          <ind:pattern operation="pattern match">^\s*session\s+required\s+pam_namespace\.so\s*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_accounts_password_pam_pwhistory_remember_password_auth:obj:1" version="1">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern var_ref="oval:ssg-pwhistory_line_regex_password_auth:var:1" operation="pattern match"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_accounts_password_pam_pwhistory_remember_system_auth:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern var_ref="oval:ssg-pwhistory_line_regex_system_auth:var:1" operation="pattern match"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_unix_remember:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password\s+(?:(?:sufficient)|(?:required))\s+pam_unix\.so.*remember=([0-9]*).*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_pwhistory_remember:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password\s+(?:(?:requisite)|(?:required))\s+pam_pwhistory\.so.*remember=([0-9]*).*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_unix_auth:obj:1" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of system-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_unix_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_unix_auth:obj:1" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of password-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_unix_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_faillock_auth:obj:1" comment="Check common definition of pam_faillock.so in auth section of system-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_auth_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_faillock_account:obj:1" comment="Check common definition of pam_faillock.so in account section of system-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_account_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_faillock_auth:obj:1" comment="Check common definition of pam_faillock.so in auth section of password-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_auth_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_faillock_account:obj:1" comment="Check common definition of pam_faillock.so in account section of password-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_account_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_system:obj:1" comment="Get the pam_faillock.so deny parameter from system-auth file">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_deny_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_password:obj:1" comment="Get the pam_faillock.so deny parameter from password-auth file">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_deny_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_faillock_conf:obj:1" comment="Check the expected pam_faillock.so deny parameter in /etc/security/faillock.conf">
          <ind:filepath operation="pattern match">^/etc/security/faillock.conf$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_faillock_conf_deny_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_system_pam_unix_auth:obj:1" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of system-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_unix_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_password_pam_unix_auth:obj:1" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of password-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_unix_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_auth:obj:1" comment="Check common definition of pam_faillock.so in auth section of system-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_auth_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_account:obj:1" comment="Check common definition of pam_faillock.so in account section of system-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_account_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_auth:obj:1" comment="Check common definition of pam_faillock.so in auth section of password-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_auth_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_account:obj:1" comment="Check common definition of pam_faillock.so in account section of password-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_account_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_pamd_system:obj:1" comment="Get the pam_faillock.so even_deny_root parameter from system-auth file">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_pamd_password:obj:1" comment="Get the pam_faillock.so even_deny_root parameter from password-auth file">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_faillock_conf:obj:1" comment="Try to get the even_deny_root parameter from /etc/security/faillock.conf">
          <ind:filepath operation="pattern match">^/etc/security/faillock.conf$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_faillock_conf_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_system_pam_unix_auth:obj:1" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of system-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_enforce_local_pam_unix_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_password_pam_unix_auth:obj:1" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of password-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_enforce_local_pam_unix_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_system_pam_faillock_auth:obj:1" comment="Check common definition of pam_faillock.so in auth section of system-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_enforce_local_pam_faillock_auth_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_system_pam_faillock_account:obj:1" comment="Check common definition of pam_faillock.so in account section of system-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_enforce_local_pam_faillock_account_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_password_pam_faillock_auth:obj:1" comment="Check common definition of pam_faillock.so in auth section of password-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_enforce_local_pam_faillock_auth_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_password_pam_faillock_account:obj:1" comment="Check common definition of pam_faillock.so in account section of password-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_enforce_local_pam_faillock_account_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_parameter_faillock_conf:obj:1" comment="Try to get the local_users_only parameter from /etc/security/faillock.conf">
          <ind:filepath operation="pattern match">^/etc/security/faillock.conf$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_enforce_local_faillock_conf_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_interval_system_pam_unix_auth:obj:1" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of system-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_unix_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_interval_password_pam_unix_auth:obj:1" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of password-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_unix_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_interval_system_pam_faillock_auth:obj:1" comment="Check common definition of pam_faillock.so in auth section of system-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_auth_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_interval_system_pam_faillock_account:obj:1" comment="Check common definition of pam_faillock.so in account section of system-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_account_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_interval_password_pam_faillock_auth:obj:1" comment="Check common definition of pam_faillock.so in auth section of password-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_auth_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_interval_password_pam_faillock_account:obj:1" comment="Check common definition of pam_faillock.so in account section of password-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_account_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_pamd_system:obj:1" comment="Get the pam_faillock.so fail_interval parameter from system-auth file">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_fail_interval_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_pamd_password:obj:1" comment="Get the pam_faillock.so fail_interval parameter from password-auth file">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_fail_interval_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_faillock_conf:obj:1" comment="Check the expected pam_faillock.so fail_interval parameter in /etc/security/faillock.conf">
          <ind:filepath operation="pattern match">^/etc/security/faillock.conf$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_interval_faillock_conf_fail_interval_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_unix_auth:obj:1" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of system-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_unix_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_unix_auth:obj:1" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of password-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_unix_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_auth:obj:1" comment="Check common definition of pam_faillock.so in auth section of system-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_auth_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_account:obj:1" comment="Check common definition of pam_faillock.so in account section of system-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_account_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_auth:obj:1" comment="Check common definition of pam_faillock.so in auth section of password-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_auth_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_account:obj:1" comment="Check common definition of pam_faillock.so in account section of password-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_account_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_system:obj:1" comment="Get the pam_faillock.so unlock_time parameter from system-auth file">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_unlock_time_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_password:obj:1" comment="Get the pam_faillock.so unlock_time parameter from password-auth file">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_unlock_time_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object version="1" id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_faillock_conf:obj:1" comment="Check the expected pam_faillock.so unlock_time parameter in /etc/security/faillock.conf">
          <ind:filepath operation="pattern match">^/etc/security/faillock.conf$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_faillock_conf_unlock_time_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_pwquality_password_auth:obj:1" version="1">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match">^password[\s]*requisite[\s]*pam_pwquality\.so</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_pwquality_system_auth:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^password[\s]*requisite[\s]*pam_pwquality\.so</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_retry_system_auth:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*retry=([0-9]*).*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_retry_pwquality_conf:obj:1" version="1">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^retry[\s]*=[\s]*(\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="The password hashing algorithm should be set correctly in /etc/libuser.conf" id="oval:ssg-object_etc_libuser_conf_cryptstyle:obj:1" version="1">
          <ind:filepath>/etc/libuser.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*crypt_style[\s]+=[\s]+(?i)sha512[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_last_encrypt_method_from_etc_login_defs:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">.*\n[^#]*(ENCRYPT_METHOD\s+\w+)\s*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_last_encrypt_method_instance_value:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_last_encrypt_method_instance_value:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object comment="check /etc/pam.d/password-auth for correct settings" id="oval:ssg-object_pam_unix_passwordauth_sha512:obj:1" version="1">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*password[\s]+(?:(?:required)|(?:sufficient))[\s]+pam_unix\.so[\s]+.*sha512.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="check /etc/pam.d/system-auth for correct settings" id="oval:ssg-object_pam_unix_sha512:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*password[\s]+(?:(?:required)|(?:sufficient))[\s]+pam_unix\.so[\s]+.*sha512.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:symlink_object comment="Disable Ctrl-Alt-Del key sequence override exists" id="oval:ssg-object_disable_ctrlaltdel_exists:obj:1" version="1">
          <unix:filepath>/etc/systemd/system/ctrl-alt-del.target</unix:filepath>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_disable_interactive_boot_grub_cmdline_linux:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX=".*systemd.confirm_spawn=(?:1|yes|true|on).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_disable_interactive_boot_grub_cmdline_linux_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT=".*systemd.confirm_spawn=(?:1|yes|true|on).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_require_emergency_service:obj:1" version="1">
          <ind:filepath>/usr/lib/systemd/system/emergency.service</ind:filepath>
          <ind:pattern operation="pattern match">^ExecStart=\-/usr/lib/systemd/systemd-sulogin-shell[\s]+emergency</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_require_emergency_service_emergency:obj:1" version="1">
          <ind:filepath>/usr/lib/systemd/system/emergency.target</ind:filepath>
          <ind:pattern operation="pattern match">^Requires=.*emergency.service</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object comment="look for emergency.service in /etc/systemd/system" id="oval:ssg-object_no_custom_emergency_service:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="all"/>
          <unix:path operation="equals">/etc/systemd/system</unix:path>
          <unix:filename operation="pattern match">^emergency.service$</unix:filename>
        </unix:file_object>
        <unix:file_object comment="look for emergency.target in /etc/systemd/system" id="oval:ssg-object_no_custom_emergency_target:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="all"/>
          <unix:path operation="equals">/etc/systemd/system</unix:path>
          <unix:filename operation="pattern match">^emergency.target$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_require_rescue_service:obj:1" version="1">
          <ind:filepath>/usr/lib/systemd/system/rescue.service</ind:filepath>
          <ind:pattern operation="pattern match">^ExecStart=\-.*/usr/lib/systemd/systemd-sulogin-shell[ ]+rescue</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_require_rescue_service_runlevel1:obj:1" version="1">
          <ind:filepath>/usr/lib/systemd/system/runlevel1.target</ind:filepath>
          <ind:pattern operation="pattern match">^Requires=.*rescue.service</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object comment="look for rescue.service in /etc/systemd/system" id="oval:ssg-object_no_custom_rescue_service:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="all"/>
          <unix:path operation="equals">/etc/systemd/system</unix:path>
          <unix:filename operation="pattern match">^rescue.service$</unix:filename>
        </unix:file_object>
        <unix:file_object comment="look for runlevel1.target in /etc/systemd/system" id="oval:ssg-object_no_custom_runlevel1_target:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="all"/>
          <unix:path operation="equals">/etc/systemd/system</unix:path>
          <unix:filename operation="pattern match">^runlevel1.target$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_configure_bashrc_exec_tmux:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath operation="pattern match">^/etc/bashrc$|^/etc/profile\.d/.*$</ind:filepath>
          <ind:pattern operation="pattern match">if \[ "\$PS1" \]; then\n\s+parent=\$\(ps -o ppid= -p \$\$\)\n\s+name=\$\(ps -o comm= -p \$parent\)\n\s+case "\$name" in sshd\|login\) exec tmux ;; esac\nfi</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_configure_tmux_lock_after_time:obj:1" version="1">
          <ind:filepath>/etc/tmux.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*set\s+-g\s+lock-after-time\s+900\s*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_configure_tmux_lock_command:obj:1" version="1">
          <ind:filepath>/etc/tmux.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*set\s+-g\s+lock-command\s+vlock\s*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_no_tmux_in_shells:obj:1" version="1">
          <ind:filepath>/etc/shells</ind:filepath>
          <ind:pattern operation="pattern match">tmux\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_configure_opensc_card_drivers:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/opensc.*.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]+card_drivers[\s]+=[\s]+(\S+);$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_configure_opensc_nss_db:obj:1" version="1">
          <ind:filepath>/etc/pki/nssdb/pkcs11.txt</ind:filepath>
          <ind:pattern operation="pattern match">^library=opensc.*.so$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_force_opensc_card_drivers:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/opensc.*.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]+force_card_driver[\s]+=[\s]+(\S+);$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_pam_pkcs11_cert_policy_ocsp_on:obj:1" version="1">
          <ind:filepath>/etc/pam_pkcs11/pam_pkcs11.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*cert_policy[ ]=(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_smart_card_enabled_system_auth:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_smart_card_enabled_system_auth:var:1" var_check="at least one"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_smart_card_required_system_auth:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_smart_card_required_system_auth:var:1" var_check="at least one"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_smart_card_required_smartcard_auth:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/pam.d/smartcard-auth</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_smart_card_required_smartcard_auth:var:1" var_check="at least one"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:password_object id="oval:ssg-obj_all_uids:obj:1" version="1">
          <unix:username operation="pattern match">.*</unix:username>
        </unix:password_object>
        <ind:variable_object id="oval:ssg-obj_count_of_all_uids:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_count_of_all_uids:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_authorized_local_users:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^([a-zA-Z0-9_.-]+?):</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_default_os_user:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_all_group_ids:obj:1" version="1" comment="Get all group ids">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^.+:.+:(\d+):.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-obj_count_of_all_group_ids:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_count_of_all_group_ids:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_all_group_names:obj:1" version="1" comment="Get all group names">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^(.+):.+</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-obj_count_of_all_group_names:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_count_of_all_group_names:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_default_useradd_inactive:obj:1" version="1">
          <ind:filepath>/etc/default/useradd</ind:filepath>
          <ind:pattern operation="pattern match">^\s*INACTIVE\s*=\s*(\d+)\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_passwd_content:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^([^:]+):.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_count_of_all_usernames_from_etc_passwd:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_last_pass_max_days_from_etc_login_defs:obj:1" version="1">
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">^(?:.*\n)*\s*[^#]*(PASS_MAX_DAYS\s+\d+)\s*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_last_pass_max_days_instance_value:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_last_pass_max_days_instance_value:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_last_pass_min_days_from_etc_login_defs:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">.*\n[^#]*(PASS_MIN_DAYS\s+\d+)\s*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_last_pass_min_days_instance_value:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_last_pass_min_days_instance_value:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_last_pass_min_len_from_etc_login_defs:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">.*\n[^#]*(PASS_MIN_LEN\s+\d+)\s*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_last_pass_min_len_instance_value:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_last_pass_min_len_instance_value:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_last_pass_warn_age_from_etc_login_defs:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">.*\n[^#]*(PASS_WARN_AGE\s+\d+)\s*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_last_pass_warn_age_instance_value:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_last_pass_warn_age_instance_value:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:password_object id="oval:ssg-object_accounts_password_all_shadowed:obj:1" version="1">
          <unix:username operation="pattern match">.*</unix:username>
        </unix:password_object>
        <unix:shadow_object id="oval:ssg-object_accounts_password_all_shadowed_sha512:obj:1" version="1">
          <unix:username operation="pattern match">.*</unix:username>
          <oval-def:filter action="exclude">oval:ssg-state_accounts_password_all_shadowed_has_no_password:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_accounts_password_all_shadowed_sha512:ste:1</oval-def:filter>
        </unix:shadow_object>
        <ind:textfilecontent54_object id="oval:ssg-object_password_auth_pam_unix_rounds:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password\s+(?:(?:sufficient)|(?:required))\s+pam_unix\.so.*rounds=([0-9]*).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object comment="All modified times of all keyfiles" id="oval:ssg-object_password_auth_default_pam_unix_rounds_var:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_password_pam_unix_rounds:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_system_auth_pam_unix_rounds:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password\s+(?:(?:sufficient)|(?:required))\s+pam_unix\.so.*rounds=([0-9]*).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object comment="All modified times of all keyfiles" id="oval:ssg-object_system_auth_default_pam_unix_rounds_var:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_password_pam_unix_rounds:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_gid_passwd_group_same_var:obj:1" version="1">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^[^:]+:[^:]+:([0-9]+):</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_gid_passwd_group_same:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^[^:]+:[^:]+:[0-9]+:([0-9]+):</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_no_empty_passwords:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^[^#]*\bnullok\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_no_empty_passwords_etc_shadow:obj:1" version="1">
          <ind:filepath>/etc/shadow</ind:filepath>
          <ind:pattern operation="pattern match">^[^:]+::.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="lines starting with +" id="oval:ssg-object_no_legacy_plus_entries_etc_group:obj:1" version="1">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^\+.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="lines starting with +" id="oval:ssg-object_no_legacy_plus_entries_etc_passwd:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^\+.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="lines starting with +" id="oval:ssg-object_no_legacy_plus_entries_etc_shadow:obj:1" version="1">
          <ind:filepath>/etc/shadow</ind:filepath>
          <ind:pattern operation="pattern match">^\+.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object comment="look for .netrc in /home" id="oval:ssg-object_no_netrc_files_home:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all"/>
          <unix:path operation="equals">/home</unix:path>
          <unix:filename operation="pattern match">^\.netrc$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_no_uid_except_root:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^(?!root:)[^:]*:[^:]*:0</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_root_gid_zero:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^root:.+:\d+:(\d+).+</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="/etc/securetty file exists" id="oval:ssg-object_etc_securetty_exists:obj:1" version="1">
          <ind:filepath>/etc/securetty</ind:filepath>
          <ind:pattern operation="pattern match">^.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="no entries /etc/securetty" id="oval:ssg-object_no_direct_root_logins:obj:1" version="1">
          <ind:filepath>/etc/securetty</ind:filepath>
          <ind:pattern operation="pattern match">^$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_last_uid_min_from_etc_login_defs:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">.*(?:^|\n)\s*(UID_MIN[\s]+[\d]+)\s*(?:$|\n)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">.*(?:^|\n)\s*(SYS_UID_MIN[\s]+[\d]+)\s*(?:$|\n)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">.*(?:^|\n)\s*(SYS_UID_MAX[\s]+[\d]+)\s*(?:$|\n)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_passwd_entries:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^(?!root).*:x:([\d]+):[\d]+:[^:]*:[^:]*:(?!\/usr\/sbin\/nologin|\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt|\/bin\/false|\/usr\/bin\/false).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="serial ports /etc/securetty" id="oval:ssg-object_serial_ports_etc_securetty:obj:1" version="1">
          <ind:filepath>/etc/securetty</ind:filepath>
          <ind:pattern operation="pattern match">^ttyS[0-9]+$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="virtual consoles /etc/securetty" id="oval:ssg-object_virtual_consoles_etc_securetty:obj:1" version="1">
          <ind:filepath>/etc/securetty</ind:filepath>
          <ind:pattern operation="pattern match">^vc/[0-9]+$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="check /etc/pam.d/su for correct setting" id="oval:ssg-object_use_pam_wheel_for_su:obj:1" version="1">
          <ind:filepath>/etc/pam.d/su</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*auth[\s]+required[\s]+pam_wheel\.so[\s]+use_uid$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_accounts_have_homedir_login_defs:obj:1" version="2">
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)CREATE_HOME(?-i)[\s]+yes[\s]*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_logon_fail_delay:obj:1" comment="FAIL_DELAY value from /etc/login.defs" version="1">
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)FAIL_DELAY(?-i)[\s]+([^#\s]*)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_security_limits_conf_maxlogins:obj:1" version="1">
          <ind:filepath>/etc/security/limits.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_security_limitsd_conf_maxlogins:obj:1" version="1">
          <ind:path>/etc/security/limits.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_security_limitsd_conf_maxlogins_exists:obj:1" version="1">
          <ind:path>/etc/security/limits.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_tmp_inst:obj:1" version="1">
          <unix:path>/tmp/tmp-inst</unix:path>
          <unix:filename xsi:nil="true"/>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_tmp_in_namespace_conf:obj:1" version="1">
          <ind:filepath>/etc/security/namespace.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*/tmp\s+/tmp/tmp-inst/\s+level\s+root,adm$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_var_tmp_tmp_inst:obj:1" version="1">
          <unix:path>/var/tmp/tmp-inst</unix:path>
          <unix:filename xsi:nil="true"/>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_var_tmp_in_namespace_conf:obj:1" version="1">
          <ind:filepath>/etc/security/namespace.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*/var/tmp\s+/var/tmp/tmp-inst/\s+level\s+root,adm$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_profile_tmout:obj:1" version="3">
          <ind:filepath>/etc/profile</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*TMOUT=([\w$]+).*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_profiled_tmout:obj:1" version="3">
          <ind:path>/etc/profile.d</ind:path>
          <ind:filename operation="pattern match">^.*\.sh$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*TMOUT=([\w$]+).*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:password_object id="oval:ssg-object_file_permissions_home_dirs_objects:obj:1" version="1">
          <unix:username datatype="string" operation="not equal">nobody</unix:username>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_home_dirs_interactive_uids:ste:1</oval-def:filter>
        </unix:password_object>
        <unix:file_object id="oval:ssg-object_file_permissions_home_dirs_dirs:obj:1" version="1">
          <unix:path var_ref="oval:ssg-var_file_permissions_home_dirs_dirs:var:1" var_check="at least one"/>
          <unix:filename xsi:nil="true"/>
        </unix:file_object>
        <ind:environmentvariable58_object id="oval:ssg-object_accounts_root_path_dirs_no_write_pathenv:obj:1" version="1">
          <ind:pid xsi:nil="true" datatype="int"/>
          <ind:name>PATH</ind:name>
        </ind:environmentvariable58_object>
        <unix:file_object comment="root's path directories with wrong group / other write permissions" id="oval:ssg-object_accounts_root_path_dirs_no_group_other_write:obj:1" version="1">
          <unix:path var_ref="oval:ssg-var_accounts_root_path_dirs_no_write:var:1" var_check="at least one"/>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_accounts_root_path_dirs_wrong_perms:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_accounts_root_path_dirs_symlink:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:environmentvariable58_object id="oval:ssg-object_root_path_no_dot:obj:1" version="1">
          <ind:pid xsi:nil="true" datatype="int"/>
          <ind:name>PATH</ind:name>
        </ind:environmentvariable58_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_login_defs:obj:1" comment="Umask value from /etc/login.defs" version="1">
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*UMASK[\s]+([^#\s]*)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-obj_accounts_umask_etc_login_defs:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_etc_login_defs_umask_as_number:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_profile:obj:1" comment="Umask value from /etc/profile" version="1">
          <ind:filepath>/etc/profile</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*umask[\s]+([^#\s]*)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-obj_accounts_umask_etc_profile:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_etc_profile_umask_as_number:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_enable_syscall_audit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+task,never[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_enable_syscall_audit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+task,never[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_ari_locked_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-e\s+2\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_ari_locked_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-e\s+2\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_armm_selinux_watch_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/selinux/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_armm_selinux_watch_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/selinux/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_issue_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/issue[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_issue_net_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/issue\.net[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_hosts_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/hosts[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_sysconfig_network_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/sysconfig/network[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_issue_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/issue[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_issue_net_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/issue\.net[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_hosts_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/hosts[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_sysconfig_network_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/sysconfig/network[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arse_utmp_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w\s+/var/run/utmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arse_btmp_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w\s+/var/log/btmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arse_wtmp_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w\s+/var/log/wtmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arse_utmp_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w\s+/var/run/utmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arse_btmp_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w\s+/var/log/btmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arse_wtmp_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w\s+/var/log/wtmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/sudoers[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_d_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/sudoers\.d/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/sudoers[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_d_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/sudoers\.d/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_group_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s+]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/security/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_group_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/security/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_directory_acccess_var_log_audit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_access_var_log_audit_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_directory_acccess_var_log_audit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_access_var_log_audit_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_var_log_audit_directory-non_root:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_not_mode_0750:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="audit log files" id="oval:ssg-object_audit_log_directory-non_root:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals" var_ref="oval:ssg-audit_log_dir:var:1"/>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_not_mode_0750:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_var_log_audit_directory:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_not_mode_0700:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="audit log files" id="oval:ssg-object_audit_log_directory:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals" var_ref="oval:ssg-audit_log_dir:var:1"/>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_not_mode_0700:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/audit directories" id="oval:ssg-object_ownership_var_log_audit_directories:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_owner_not_root_root_var_log_audit:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_ownership_var_log_audit_files:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_owner_not_root_root_var_log_audit:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/audit directories" id="oval:ssg-object_ownership_var_log_audit_directories-non_root:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_ownership_var_log_audit_files-non_root:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="audit log files" id="oval:ssg-object_audit_log_files-non_root:obj:1" version="1">
          <unix:filepath operation="pattern match" var_ref="oval:ssg-audit_log_file_path:var:1"/>
          <oval-def:filter action="include">oval:ssg-state_not_mode_0640:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_var_log_audit_files-non_root:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_not_mode_0640:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_audit_log_files:obj:1" version="1">
          <unix:filepath operation="pattern match" var_ref="oval:ssg-audit_log_file_path:var:1"/>
          <oval-def:filter action="include">oval:ssg-state_not_mode_0600:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_var_log_audit_files:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_not_mode_0600:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_umount_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+umount[\s]+|([\s]+|[,])umount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_umount_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+umount[\s]+|([\s]+|[,])umount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_delete_module_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_delete_module_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_delete_module_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_delete_module_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_finit_module_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_finit_module_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_finit_module_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_finit_module_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_init_module_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_init_module_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_init_module_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_init_module_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_system_privileged_commands:obj:1" comment="system files with setuid or setgid permission set" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="local" max_depth="-1"/>
          <unix:path operation="equals">/</unix:path>
          <unix:filename operation="pattern match">[a-z]+</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_setuid_or_setgid_set:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_dev_proc_sys_dirs:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:variable_object id="oval:ssg-object_count_of_suid_sgid_binaries_on_system:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_count_of_suid_sgid_binaries_on_system:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arpc_suid_sgid_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a always,exit (?:-F path=([\S]+) )+-F auid&gt;=1000 -F auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_proper_audit_rule_but_for_unprivileged_command:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arpc_suid_sgid_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a always,exit (?:-F path=([\S]+) )+-F auid&gt;=1000 -F auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_proper_audit_rule_but_for_unprivileged_command:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_adjtimex_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+adjtimex[\s]+|([\s]+|[,])adjtimex([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_art_adjtimex_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*(-S[\s]+adjtimex[\s]+|([\s]+|[,])adjtimex([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_adjtimex_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+adjtimex[\s]+|([\s]+|[,])adjtimex([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_art_adjtimex_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*(-S[\s]+adjtimex[\s]+|([\s]+|[,])adjtimex([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_clock_settime_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+(-S[\s]+clock_settime[\s]+|([\s]+|[,])clock_settime([\s]+|[,]))-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_art_clock_settime_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+(-S[\s]+clock_settime[\s]+|([\s]+|[,])clock_settime([\s]+|[,]))-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_clock_settime_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+(-S[\s]+clock_settime[\s]+|([\s]+|[,])clock_settime([\s]+|[,]))-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_art_clock_settime_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+(-S[\s]+clock_settime[\s]+|([\s]+|[,])clock_settime([\s]+|[,]))-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_settimeofday_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+settimeofday[\s]+|([\s]+|[,])settimeofday([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_art_settimeofday_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*(-S[\s]+settimeofday[\s]+|([\s]+|[,])settimeofday([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_settimeofday_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+settimeofday[\s]+|([\s]+|[,])settimeofday([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_art_settimeofday_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*(-S[\s]+settimeofday[\s]+|([\s]+|[,])settimeofday([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_stime_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+stime[\s]+|([\s]+|[,])stime([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_stime_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+stime[\s]+|([\s]+|[,])stime([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_artw_etc_localtime_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-w[\s]+\/etc\/localtime[\s]+-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_artw_etc_localtime_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-w[\s]+\/etc\/localtime[\s]+-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_audispd_configure_remote_server:obj:1" version="1">
          <ind:filepath>/etc/audit/audisp-remote.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*remote_server[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_audispd_encrypt_sent_records:obj:1" version="1">
          <ind:filepath>/etc/audit/audisp-remote.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*transport[ ]+=[ ]+KRB5[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_audispd_syslog_plugin_activated:obj:1" version="1">
          <ind:filepath>/etc/audit/plugins.d/syslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*active[ ]+=[ ]+yes[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_disk_error_action:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*disk_error_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_disk_full_action:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*disk_full_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_action_mail_acct:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*action_mail_acct[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_admin_space_left_action:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*admin_space_left_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_flush:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*flush[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_max_log_file:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*max_log_file[ ]+=[ ]+(\d+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_max_log_file_action:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*max_log_file_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_num_logs:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*num_logs[ ]+=[ ]+(\d+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_space_left_action:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*space_left_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_space_left_percentage:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*space_left[\s]+=[\s]+(\d+)%[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_auditd_overflow_action:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)overflow_action(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:password_object id="oval:ssg-object_user_accounts:obj:1" version="1">
          <unix:username datatype="string" operation="pattern match">.*</unix:username>
        </unix:password_object>
        <ind:textfilecontent54_object id="oval:ssg-object_bootloader_unique_superuser:obj:1" version="1">
          <ind:filepath>/boot/grub2/grub.cfg</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*set[\s]+superusers="(?i)\b(?!(?:root|admin|administrator)\b)(\w+)"$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_bootloader_superuser:obj:1" version="2">
          <ind:filepath>/boot/grub2/grub.cfg</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*set[\s]+superusers=("?)[a-zA-Z_]+\1$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_password_usercfg:obj:1" version="1">
          <ind:filepath>/boot/grub2/user.cfg</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*GRUB2_PASSWORD=grub\.pbkdf2\.sha512.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_password_grubcfg:obj:1" version="1">
          <ind:filepath>/boot/grub2/grub.cfg</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*password_pbkdf2[\s]+.*[\s]+grub\.pbkdf2\.sha512.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:password_object id="oval:ssg-object_uefi_user_accounts:obj:1" version="1">
          <unix:username datatype="string" operation="pattern match">.*</unix:username>
        </unix:password_object>
        <ind:textfilecontent54_object id="oval:ssg-object_bootloader_uefi_unique_superuser:obj:1" version="1">
          <ind:filepath>/boot/grub2/grub.cfg</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*set[\s]+superusers="(?i)\b(?!(?:root|admin|administrator)\b)(\w+)"$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_uefi_password_usercfg:obj:1" version="1">
          <ind:filepath>/boot/grub2/user.cfg</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*GRUB2_PASSWORD=grub\.pbkdf2\.sha512.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_logwatch_configured_hostlimit:obj:1" version="1">
          <ind:filepath>/etc/logwatch/conf/logwatch.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]HostLimit[\s]*=[\s]*no[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_logwatch_configured_splithosts:obj:1" version="1">
          <ind:filepath>/etc/logwatch/conf/logwatch.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]SplitHosts[\s]*=[\s]*yes[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_cron_logging_rsyslog:obj:1" version="1">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*cron\.\*[\s]+/var/log/cron$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_cron_logging_rsyslog_dir:obj:1" version="1">
          <ind:path>/etc/rsyslog.d</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*cron\.\*[\s]+/var/log/cron$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:obj:1" comment="Check if  $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf" version="1">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\$ActionSendStreamDriverAuthMode x509/name$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:obj:1" comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.d" version="1">
          <ind:path>/etc/rsyslog.d</ind:path>
          <ind:filename operation="pattern match">^.*conf$</ind:filename>
          <ind:pattern operation="pattern match">^\$ActionSendStreamDriverAuthMode x509/name$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:obj:1" comment="Check if  $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf" version="1">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\$ActionSendStreamDriverMode 1$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:obj:1" comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.d" version="1">
          <ind:path>/etc/rsyslog.d</ind:path>
          <ind:filename operation="pattern match">^.*conf$</ind:filename>
          <ind:pattern operation="pattern match">^\$ActionSendStreamDriverMode 1$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:obj:1" comment="Check if  $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf" version="1">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\$DefaultNetstreamDriver gtls$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:obj:1" comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.d" version="1">
          <ind:path>/etc/rsyslog.d</ind:path>
          <ind:filename operation="pattern match">^.*conf$</ind:filename>
          <ind:pattern operation="pattern match">^\$DefaultNetstreamDriver gtls$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_rfg_rsyslog_include_config_value:obj:1" comment="rsyslog's $IncludeConfig directive and include() object values" version="1">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_rfg_include_config_regex:obj:1" comment="Make variable object from regex variable" version="1">
          <ind:var_ref>oval:ssg-var_rfg_include_config_regex:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_var_rfg_syslog_config:obj:1" comment="Make variable object for use" version="1">
          <ind:var_ref>oval:ssg-var_rfg_syslog_config:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_var_rfg_all_log_files:obj:1" comment="Filter out empty string" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_var_rfg_include_config_regex:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_var_rfg_syslog_config:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_rfg_log_files_paths:obj:1" comment="All rsyslog configuration files" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_rfg_all_log_files:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_groupownership_ignore_include_paths:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_rsyslog_files_groupownership:obj:1" comment="Various system log files" version="1">
          <unix:filepath datatype="string" var_ref="oval:ssg-var_rfg_log_files_paths:var:1" var_check="at least one"/>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_rfo_rsyslog_include_config_value:obj:1" comment="rsyslog's $IncludeConfig directive and include() object values" version="1">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_rfo_include_config_regex:obj:1" comment="Make variable object from regex variable" version="1">
          <ind:var_ref>oval:ssg-var_rfo_include_config_regex:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_var_rfo_syslog_config:obj:1" comment="Make variable object for use" version="1">
          <ind:var_ref>oval:ssg-var_rfo_syslog_config:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_var_rfo_all_log_files:obj:1" comment="Filter out empty string" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_var_rfo_include_config_regex:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_var_rfo_syslog_config:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_rfo_log_files_paths:obj:1" comment="All rsyslog configuration files" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_rfo_all_log_files:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[^(#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_owner_ignore_include_paths:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_rsyslog_files_ownership:obj:1" comment="Various system log files" version="1">
          <unix:filepath datatype="string" var_ref="oval:ssg-var_rfo_log_files_paths:var:1" var_check="at least one"/>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_rfp_rsyslog_include_config_value:obj:1" comment="rsyslog's $IncludeConfig directive and include() object values" version="1">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_rfp_include_config_regex:obj:1" comment="Make variable object from regex variable" version="1">
          <ind:var_ref>oval:ssg-var_rfp_include_config_regex:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_var_rfp_syslog_config:obj:1" comment="Make variable object for use" version="1">
          <ind:var_ref>oval:ssg-var_rfp_syslog_config:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_var_rfp_all_log_files:obj:1" comment="Filter out empty string" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_var_rfp_include_config_regex:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_var_rfp_syslog_config:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_rfp_log_files_paths:obj:1" comment="All rsyslog configuration files" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_rfp_all_log_files:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_permissions_ignore_include_paths:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_rsyslog_files_permissions:obj:1" comment="Various system log files" version="1">
          <unix:filepath datatype="string" var_ref="oval:ssg-var_rfp_log_files_paths:var:1" var_check="at least one"/>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_remote_method_monitoring_auth:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^.*auth\.\*.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_remote_method_monitoring_authpriv:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^.*authpriv\.\*.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_remote_method_monitoring_daemon:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^.*daemon\.\*.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_logrotate_conf_daily_setting:obj:1" version="2">
          <ind:filepath>/etc/logrotate.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*daily[\s#]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_logrotate_conf_no_other_keyword:obj:1" version="2">
          <ind:filepath>/etc/logrotate.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*(weekly|monthly|yearly)[\s#]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_cron_daily_logrotate_existence:obj:1" version="1">
          <ind:filepath>/etc/cron.daily/logrotate</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*/usr/sbin/logrotate[\s\S]*/etc/logrotate.conf$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_rsyslog_nolisten:obj:1" version="2">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\$((?:Input(?:TCP|RELP)|UDP)ServerRun|ModLoad[\s]+(imtcp|imudp|imrelp))</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_remote_loghost_rsyslog_conf:obj:1" version="1">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_remote_loghost_rsyslog_d:obj:1" version="1">
          <ind:path>/etc/rsyslog.d</ind:path>
          <ind:filename operation="pattern match">^.+\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_remote_tls:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*action\((?i)type(?-i)="omfwd"(.+?)\)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">0</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_remote_tls_cacert:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*global\(DefaultNetstreamDriverCAFile="(.+?)"\)\s*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">0</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sysconfig_nozeroconf_yes:obj:1" version="1">
          <ind:filepath>/etc/sysconfig/network</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*NOZEROCONF[\s]*=[\s]*yes</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_network_nmcli_permissions:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/polkit-1/localauthority/20-org.d/.*$</ind:filepath>
          <ind:pattern operation="pattern match">^\[.*\]\n\s*Identity=default\n\s*Action=org\.freedesktop\.NetworkManager\.\*\n\s*ResultAny=no\n\s*ResultInactive=no\n\s*(ResultActive=auth_admin)\n*\s*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:interface_object id="oval:ssg-object_promisc_interfaces:obj:1" version="1">
          <unix:name operation="pattern match">^.*$</unix:name>
          <oval-def:filter action="include">oval:ssg-state_promisc:ste:1</oval-def:filter>
        </unix:interface_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_firewalld_input_drop:obj:1" version="1">
          <ind:filepath>/etc/firewalld/firewalld.conf</ind:filepath>
          <ind:pattern operation="pattern match">^DefaultZone=drop$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="Define default gateways" id="oval:ssg-obj_network_ipv6_default_gateway:obj:1" version="1">
          <ind:path>/etc/sysconfig/network-scripts</ind:path>
          <ind:filename operation="pattern match">ifcfg-.*</ind:filename>
          <ind:pattern operation="pattern match">^IPV6_DEFAULTGW=.+$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="Enable privacy extensions on each interface" id="oval:ssg-obj_network_ipv6_privacy_extensions:obj:1" version="1">
          <ind:path>/etc/sysconfig/network-scripts</ind:path>
          <ind:filename operation="pattern match">ifcfg-.*</ind:filename>
          <ind:pattern operation="pattern match">^IPV6_PRIVACY=rfc3041$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="Set static IPv6 address on each interface" id="oval:ssg-obj_network_ipv6_static_address:obj:1" version="1">
          <ind:path>/etc/sysconfig/network-scripts</ind:path>
          <ind:filename operation="pattern match">ifcfg-.*</ind:filename>
          <ind:pattern operation="pattern match">^IPV6ADDR=.+$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_module_ipv6_option_disabled:obj:1" version="1" comment="ipv6 disabled any modprobe conf file">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*options\s+ipv6\s+.*disable=1.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="Test for udp6 based rpc services" id="oval:ssg-obj_network_ipv6_disable_rpc_udp6:obj:1" version="1">
          <ind:filepath>/etc/netconfig</ind:filepath>
          <ind:pattern operation="pattern match">^udp6\s+tpi_clts\s+v\s+inet6\s+udp\s+-\s+-$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="Test for tcp6 based rpc services" id="oval:ssg-obj_network_ipv6_disable_rpc_tcp6:obj:1" version="1">
          <ind:filepath>/etc/netconfig</ind:filepath>
          <ind:pattern operation="pattern match">^tcp6\s+tpi_cots_ord\s+v\s+inet6\s+tcp\s+-\s+-$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:interface_object id="oval:ssg-object_active_wifi_interfaces:obj:1" version="1">
          <unix:name operation="pattern match">^wl.*$</unix:name>
        </unix:interface_object>
        <unix:file_object comment="all local directories" id="oval:ssg-all_local_directories_uid_zero:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_uid_is_not_root_and_world_writable:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="only local directories" id="oval:ssg-object_only_local_directories:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_world_writable_and_not_sticky:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="all local directories" id="oval:ssg-all_local_directories_uid:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_uid_is_user_and_world_writable:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="all local directories" id="oval:ssg-all_local_directories_gid:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_gid_is_user_and_world_writable:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="system.mapfiles" id="oval:ssg-object_file_permissions_systemmap_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^System\.map.*$</unix:filename>
        </unix:file_object>
        <unix:file_object comment="files with sgid set which are not owned by any RPM package" id="oval:ssg-obj_file_permissions_unauthorized_sgid_unowned:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_unauthorized_sgid_sgid_set:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_unauthorized_sgid_filepaths:ste:1</oval-def:filter>
        </unix:file_object>
        <linux:rpmverifyfile_object id="oval:ssg-obj_file_permissions_unauthorized_sgid_rpms:obj:1" version="1" comment="all files with sgid set that come from a RPM package">
          <linux:behaviors nolinkto="true" nomd5="true" nosize="true" nouser="true" nogroup="true" nomtime="true" nomode="true" nordev="true"/>
          <linux:name operation="pattern match">.*</linux:name>
          <linux:epoch operation="pattern match">.*</linux:epoch>
          <linux:version operation="pattern match">.*</linux:version>
          <linux:release operation="pattern match">.*</linux:release>
          <linux:arch operation="pattern match">.*</linux:arch>
          <linux:filepath var_ref="oval:ssg-var_file_permissions_unauthorized_sgid_all:var:1" operation="equals" var_check="all"/>
        </linux:rpmverifyfile_object>
        <unix:file_object comment="all files with sgid set" id="oval:ssg-obj_file_permissions_unauthorized_sgid_files:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_unauthorized_sgid_sgid_set:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="files with suid set which are not owned by any RPM package" id="oval:ssg-obj_file_permissions_unauthorized_suid_unowned:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_unauthorized_suid_suid_set:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_unauthorized_suid_filepaths:ste:1</oval-def:filter>
        </unix:file_object>
        <linux:rpmverifyfile_object id="oval:ssg-obj_file_permissions_unauthorized_suid_rpms:obj:1" version="1" comment="all files with suid set that come from a RPM package">
          <linux:behaviors nolinkto="true" nomd5="true" nosize="true" nouser="true" nogroup="true" nomtime="true" nomode="true" nordev="true"/>
          <linux:name operation="pattern match">.*</linux:name>
          <linux:epoch operation="pattern match">.*</linux:epoch>
          <linux:version operation="pattern match">.*</linux:version>
          <linux:release operation="pattern match">.*</linux:release>
          <linux:arch operation="pattern match">.*</linux:arch>
          <linux:filepath var_ref="oval:ssg-var_file_permissions_unauthorized_suid_all:var:1" operation="equals" var_check="all"/>
        </linux:rpmverifyfile_object>
        <unix:file_object comment="all files with suid set" id="oval:ssg-obj_file_permissions_unauthorized_suid_files:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_unauthorized_suid_suid_set:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="world writable" id="oval:ssg-object_file_permissions_unauthorized_world_write:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_unauthorized_world_write:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_unauthorized_world_write_exclude_special_selinux_files:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_unauthorized_world_write_exclude_proc:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_unauthorized_world_write_exclude_sys:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="all local files" id="oval:ssg-object_file_permissions_ungroupowned:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="local"/>
          <unix:path>/</unix:path>
          <unix:filename operation="pattern match">.*</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_ungroupowned:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-etc_group_object:obj:1" version="1">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^[^:]+:[^:]*:([\d]+):[^:]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:password_object id="oval:ssg-file_permissions_unowned_userid_list_object:obj:1" version="1">
          <unix:username datatype="string" operation="pattern match">.*</unix:username>
        </unix:password_object>
        <unix:file_object comment="all local files" id="oval:ssg-file_permissions_unowned_object:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="local"/>
          <unix:path>/</unix:path>
          <unix:filename operation="pattern match">.*</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-file_permissions_unowned_userid_list_match:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="system commands files" id="oval:ssg-object_groupownership_system_commands_dirs:obj:1" version="1">
          <unix:path operation="pattern match">^\/s?bin|^\/usr\/s?bin|^\/usr\/local\/s?bin</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_groupowner_system_commands_dirs_not_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="binary directories" id="oval:ssg-object_file_ownership_binary_directories:obj:1" version="1">
          <unix:path operation="pattern match">^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_owner_binaries_not_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="binary files" id="oval:ssg-object_file_ownership_binary_files:obj:1" version="1">
          <unix:path operation="pattern match">^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_owner_binaries_not_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="binary files" id="oval:ssg-object_file_permissions_binary_files:obj:1" version="1">
          <unix:path operation="pattern match">^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_perms_binary_files_nogroupwrite_noworldwrite:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_perms_binary_files_symlink:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_grub2_nousb_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*GRUB_CMDLINE_LINUX=([^#]*).*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_non_root_partitions:obj:1" version="1">
          <linux:mount_point operation="pattern match">^/\w.*$</linux:mount_point>
          <oval-def:filter action="include">oval:ssg-state_local_nodev:ste:1</oval-def:filter>
        </linux:partition_object>
        <ind:textfilecontent54_object comment="look for the partition mount point in /etc/mtab" id="oval:ssg-object_configure_mount_option_var_tmp_bind_tmp:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_mount_option_var_tmp:obj:1" version="1">
          <linux:mount_point operation="pattern match">^/var/tmp$</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object comment="look for the partition mount point in /etc/mtab" id="oval:ssg-object_mount_option_var_tmp_bind:obj:1" version="1">
          <ind:filepath>/etc/mtab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_mount_option_var_tmp_bind_compare_source:obj:1" version="1">
          <linux:mount_point operation="pattern match">^/tmp$</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_coredump_disable_backtraces:obj:1" version="1">
          <ind:filepath>/etc/systemd/coredump.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[Coredump\].*(?:\n\s*[^[\s].*)*\n^[ \t]*(?i)ProcessSizeMax(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_coredump_disable_storage:obj:1" version="1">
          <ind:filepath>/etc/systemd/coredump.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[Coredump\].*(?:\n\s*[^[\s].*)*\n^[ \t]*(?i)Storage(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_core_dumps_limitsconf:obj:1" version="1">
          <ind:filepath>/etc/security/limits.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:hard|-)[\s]+core[\s]+([\d]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_core_dumps_limits_d:obj:1" version="1">
          <ind:path>/etc/security/limits.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:hard|-)[\s]+core[\s]+([\d]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_core_dumps_limits_d_exists:obj:1" version="1">
          <ind:path>/etc/security/limits.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:hard|-)[\s]+core</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_init_d_functions:obj:1" comment="Umask value from /etc/init.d/functions" version="1">
          <ind:filepath>/etc/init.d/functions</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)UMASK(?-i)[\s]+([^#\s]*)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-obj_umask_for_daemons:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_etc_init_d_functions_umask_as_number:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_exec_shield:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.exec-shield[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_exec_shield:obj:1" version="1">
          <unix:name>kernel.exec-shield</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nx_disabled_grub:obj:1" version="1">
          <ind:filepath>/boot/grub2/grub.cfg</ind:filepath>
          <ind:pattern operation="pattern match">[\s]*noexec[\s]*=[\s]*off</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_NX_cpu_support:obj:1" version="1">
          <ind:filepath>/proc/cpuinfo</ind:filepath>
          <ind:pattern operation="pattern match">^flags[\s]+:.*[\s]+nx[\s]+.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_messages_nx_active:obj:1" version="1">
          <ind:filepath>/var/log/messages</ind:filepath>
          <ind:pattern operation="pattern match">^.+protection: disabled.+</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_noexec_cmd_line:obj:1" version="1">
          <ind:filepath>/proc/cmdline</ind:filepath>
          <ind:pattern operation="pattern match">.+noexec[0-9]*=off.+</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_package_kernel-PAE_installed:obj:1" version="1">
          <linux:name>kernel-PAE</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_PAE_NX_cpu_support:obj:1" version="1">
          <ind:filepath>/proc/cpuinfo</ind:filepath>
          <ind:pattern operation="pattern match">^flags[\s]+:.*[\s]+pae[\s]+.*[\s]+nx[\s]+.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_defaultkernel_sysconfig_kernel:obj:1" version="1">
          <ind:filepath>/etc/sysconfig/kernel</ind:filepath>
          <ind:pattern operation="pattern match">^\s*DEFAULTKERNEL[\s]*=[\s]*kernel-PAE$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_selinux_default_grub:obj:1" comment="check value selinux|enforcing=0 in /etc/default/grub, fail if found" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*GRUB_CMDLINE_LINUX.*(selinux|enforcing)=0.*$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_selinux_grub2_cfg:obj:1" comment="check value selinux|enforcing=0 in /etc/grub2.cfg, fail if found" version="1">
          <ind:filepath>/etc/grub2.cfg</ind:filepath>
          <ind:pattern operation="pattern match">^.*(selinux|enforcing)=0.*$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_selinux_grub_dir:obj:1" comment="check value selinux|enforcing=0 in /etc/grub.d, fail if found" version="1">
          <ind:path>/etc/grub.d</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^.*(selinux|enforcing)=0.*$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_dev_device_files:obj:1" comment="device files within /dev directory" version="1">
          <unix:behaviors recurse_direction="down"/>
          <unix:path operation="equals">/dev</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_block_or_char_device_file:ste:1</oval-def:filter>
        </unix:file_object>
        <linux:selinuxsecuritycontext_object comment="device_t in /dev" id="oval:ssg-object_selinux_dev_device_t:obj:1" version="1">
          <linux:filepath operation="equals" var_ref="oval:ssg-variable_dev_device_files:var:1" var_check="at least one"/>
          <oval-def:filter action="include">oval:ssg-state_selinux_dev_device_t:ste:1</oval-def:filter>
        </linux:selinuxsecuritycontext_object>
        <linux:selinuxsecuritycontext_object comment="unlabeled_t in /dev" id="oval:ssg-object_selinux_dev_unlabeled_t:obj:1" version="1">
          <linux:filepath operation="equals" var_ref="oval:ssg-variable_dev_device_files:var:1" var_check="at least one"/>
          <oval-def:filter action="include">oval:ssg-state_selinux_dev_unlabeled_t:ste:1</oval-def:filter>
        </linux:selinuxsecuritycontext_object>
        <linux:selinuxsecuritycontext_object comment="find unconfined_service_t in /proc" id="oval:ssg-object_selinux_confinement_of_daemons:obj:1" version="1">
          <linux:behaviors max_depth="1" recurse_direction="down"/>
          <linux:path>/proc</linux:path>
          <linux:filename operation="pattern match">^.*$</linux:filename>
          <oval-def:filter action="include">oval:ssg-state_selinux_confinement_of_daemons:ste:1</oval-def:filter>
        </linux:selinuxsecuritycontext_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_selinux_policy:obj:1" version="1">
          <ind:filepath>/etc/selinux/config</ind:filepath>
          <ind:pattern operation="pattern match">^SELINUXTYPE=([\w]*)[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_selinux_config:obj:1" version="1">
          <ind:filepath>/etc/selinux/config</ind:filepath>
          <ind:pattern operation="pattern match">^SELINUX=(.*)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_proc_cpuinfo_64_bit:obj:1" version="1">
          <ind:filepath>/proc/cpuinfo</ind:filepath>
          <ind:pattern operation="pattern match">^flags\s+:\s+(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_proc_sys_kernel_osrelease_64_bit:obj:1" version="1">
          <ind:filepath>/proc/sys/kernel/osrelease</ind:filepath>
          <ind:pattern operation="pattern match">^.*\.(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_dconf_distro_db:obj:1" comment="The binary system-wide dconf database with 'distro' settings" version="1">
          <unix:filepath>/etc/dconf/db/distro</unix:filepath>
        </unix:file_object>
        <unix:file_object id="oval:ssg-obj_dconf_distro_config:obj:1" comment="The dconf keyfile with 'distro' settings" version="1">
          <unix:filepath operation="pattern match">^/etc/dconf/db/distro.d/.*</unix:filepath>
        </unix:file_object>
        <ind:variable_object comment="All modified times of all keyfiles" id="oval:ssg-object_distro_db_modified_time:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_dconf_distro_db_modified_time:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-obj_dconf_local_db:obj:1" comment="The binary system-wide dconf database with 'local' settings" version="1">
          <unix:filepath>/etc/dconf/db/local</unix:filepath>
        </unix:file_object>
        <unix:file_object id="oval:ssg-obj_dconf_local_config:obj:1" comment="The dconf keyfile with 'local' settings" version="1">
          <unix:filepath operation="pattern match">^/etc/dconf/db/local.d/.*</unix:filepath>
        </unix:file_object>
        <ind:variable_object comment="All modified times of all keyfiles" id="oval:ssg-object_local_db_modified_time:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_dconf_local_db_modified_time:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dconf_user_profile:obj:1" version="2">
          <ind:filepath>/etc/dconf/profile/user</ind:filepath>
          <ind:pattern operation="pattern match">^user-db:user\nsystem-db:local$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_restart_buttons:obj:1" version="1">
          <ind:path>/etc/dconf/db/distro.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?disable-restart-buttons=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_enable_restart_buttons:obj:1" version="1">
          <ind:path>/etc/dconf/db/distro.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/login-screen/disable-restart-buttons$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_user_list:obj:1" version="1">
          <ind:path>/etc/dconf/db/distro.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?disable-user-list=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_disable_user_list:obj:1" version="1">
          <ind:path>/etc/dconf/db/distro.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/login-screen/disable-user-list$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_enable_gnome_smartcard:obj:1" version="1">
          <ind:path>/etc/dconf/db/distro.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?enable-smartcard-authentication=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_disable_smartcard:obj:1" version="1">
          <ind:path>/etc/dconf/db/distro.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/login-screen/enable-smartcard-authentication$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_configure_allowed_failures:obj:1" version="1">
          <ind:path>/etc/dconf/db/distro.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?allowed-failures=3$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_allowed-failures_change:obj:1" version="1">
          <ind:path>/etc/dconf/db/distro.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/login-screen/allowed-failures$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_automatic_login:obj:1" version="1">
          <ind:filepath>/etc/gdm/custom.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\[daemon]([^\n]*\n+)+?AutomaticLoginEnable=[Ff]alse$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_guest_login:obj:1" version="1">
          <ind:filepath>/etc/gdm/custom.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\[daemon]([^\n]*\n+)+?TimedLoginEnable=[Ff]alse$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_gnome_gdm_disable_xdmcp:obj:1" version="1">
          <ind:filepath>/etc/gdm/custom.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[xdmcp\].*(?:\n\s*[^[\s].*)*\n^\s*Enable[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_gnome_gdm_disable_xdmcp_config_file:obj:1" comment="The configuration file /etc/gdm/custom.conf for gnome_gdm_disable_xdmcp" version="1">
          <unix:filepath operation="pattern match">^/etc/gdm/custom.conf</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_disable_automount:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/media-handling\]([^\n]*\n+)+?automount=false$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_gnome_automount:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/media-handling/automount$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_disable_automount_open:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/media-handling\]([^\n]*\n+)+?automount-open=false$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_gnome_automount_open:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/media-handling/automount-open$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_disable_autorun:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/media-handling\]([^\n]*\n+)+?autorun-never=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_gnome_autorun:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/media-handling/autorun-never$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_gnome_disable_thumbnailers:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/thumbnailers]([^\n]*\n+)+?disable-all=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_change_gnome_thumbnailers:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/thumbnailers/disable-all$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_wifi_creation:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/nm-applet]([^\n]*\n+)+?disable-wifi-create=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_enable_wifi_creation:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/nm-applet/disable-wifi-create$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_wifi_notification:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/nm-applet]([^\n]*\n+)+?suppress-wireless-networks-available=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_enable_wifi_notification:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/nm-applet/suppress-wireless-networks-available$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_configure_remote_access_creds:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/Vino]([^\n]*\n+)+?authentication-methods=\['vnc'\]$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_remote_access_creds:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/Vino/authentication-methods$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_configure_remote_access_encryption:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/Vino]([^\n]*\n+)+?require-encryption=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_remote_access_encryption:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/Vino/require-encryption$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_idle_activation_enabled:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?idle-activation-enabled=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_change_idle_activation_enabled:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/idle-activation-enabled$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_change_idle_activation_locked:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/idle-activation-enabled$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_idle_delay:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/session]([^\n]*\n+)+?idle-delay=uint32[\s][0-9]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_idle_delay_setting:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^idle-delay[\s=]*uint32[\s]([^=\s]*)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_lock_delay:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?lock-delay=uint32[\s][0-9]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_lock_delay_setting:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^lock-delay[\s=]*uint32[\s]([^=\s]*)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_lock_enabled:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?lock-enabled=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_screensaver_lock:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/lock-enabled$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_screensaver_lock_locked:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/lock-enabled$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_mode_blank:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?picture-uri=(string[\s])?\'\'$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_screensaver_mode_change:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/picture-uri$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_disable_user_info:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?show-full-name-in-top-bar=false$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_info_change:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/show-full-name-in-top-bar$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_user_change_lock_delay_lock:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/lock-delay$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_user_change_idle_delay_lock:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/session/idle-delay$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_gnome_ctrlaltdel:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/settings-daemon/plugins/media-keys]([^\n]*\n+)+?logout[\s]*=[\s]*''$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_enable_ctrlaltdel:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/settings-daemon/plugins/media-keys/logout$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_sys_geolocation:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/system/location]([^\n]*\n+)+?enabled=false$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_sys_geolocation:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/system/location/enabled$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_clock_geolocation:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/clocks]([^\n]*\n+)+?geolocation=false$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_clock_geolocation:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/clocks/geolocation$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_gnome_power_setting:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/settings-daemon/plugins/power]([^\n]*\n+)+?active=false$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_power_setting_change:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/settings-daemon/plugins/power/active$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_configure_bind_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/named.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*include\s+"/etc/crypto-policies/back-ends/bind.config"\s*;\s*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-crypto_policies_current_file:obj:1" comment="crypto-policies current state" version="1">
          <unix:filepath>/etc/crypto-policies/state/current</unix:filepath>
        </unix:file_object>
        <unix:file_object id="oval:ssg-crypto_policies_config_file:obj:1" comment="crypto-policies config state" version="1">
          <unix:filepath datatype="string">/etc/crypto-policies/config</unix:filepath>
        </unix:file_object>
        <ind:variable_object comment="Crypto policy current file timestamp" id="oval:ssg-object_crypto_policies_config_file_modified_time:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_crypto_policies_config_file_timestamp:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_configure_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/crypto-policies/config</ind:filepath>
          <ind:pattern operation="pattern match">^(?!#)(\S+)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_configure_crypto_policy_current:obj:1" version="1">
          <ind:filepath>/etc/crypto-policies/state/current</ind:filepath>
          <ind:pattern operation="pattern match">^(?!#)(\S+)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_crypto_policy_nss_config:obj:1" version="1">
          <unix:filepath>/etc/crypto-policies/back-ends/nss.config</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_configure_gnutls_tls_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/crypto-policies/back-ends/gnutls.config</ind:filepath>
          <ind:pattern operation="pattern match">\+VERS-ALL:-VERS-DTLS0\.9:-VERS-SSL3\.0:-VERS-TLS1\.0:-VERS-TLS1\.1:-VERS-DTLS1\.0</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_symlink_kerberos_crypto_policy_configuration:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_symlink_kerberos_crypto_policy_configuration:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="kerberos crypto-policy configuration softlink" id="oval:ssg-object_kerberos_crypto_policy_configuration:obj:1" version="1">
          <unix:filepath>/etc/krb5.conf.d/crypto-policies</unix:filepath>
        </unix:symlink_object>
        <unix:symlink_object comment="kerberos crypto-policy backend softlink" id="oval:ssg-object_kerberos_crypto_policy_backend:obj:1" version="1">
          <unix:filepath>/etc/crypto-policies/back-ends/krb5.config</unix:filepath>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_configure_libreswan_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/ipsec.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*include\s+/etc/crypto-policies/back-ends/libreswan.config\s*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_configure_openssl_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/pki/tls/openssl.cnf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[\s*crypto_policy\s*\]\s*\n*\s*\.include\s*(?:=\s*)?/etc/crypto-policies/back-ends/opensslcnf.config\s*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_configure_ssh_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/sysconfig/sshd</ind:filepath>
          <ind:pattern operation="pattern match">^\s*(?i)CRYPTO_POLICY\s*=.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_Match:obj:1" version="1">
          <ind:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*Match[\s]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_RekeyLimit:obj:1" version="1">
          <ind:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^Match final all(?:.*
)*?\s*RekeyLimit[\s]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_GSSAPIAuthentication:obj:1" version="1">
          <ind:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^Match final all(?:.*
)*?\s*GSSAPIAuthentication[\s]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_Ciphers:obj:1" version="1">
          <ind:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^Match final all(?:.*
)*?\s*Ciphers[\s]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:obj:1" version="1">
          <ind:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^Match final all(?:.*
)*?\s*PubkeyAcceptedKeyTypes[\s]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_MACs:obj:1" version="1">
          <ind:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^Match final all(?:.*
)*?\s*MACs[\s]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_KexAlgorithms:obj:1" version="1">
          <ind:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^Match final all(?:.*
)*?\s*KexAlgorithms[\s]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_sshd_ciphers_openssh_conf_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/crypto-policies/back-ends/openssh.config</ind:filepath>
          <ind:pattern operation="pattern match">^Ciphers.*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_sshd_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/crypto-policies/back-ends/opensshserver.config</ind:filepath>
          <ind:pattern operation="pattern match">^(?:.*\n)*\s*CRYPTO_POLICY=(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_sshd_macs_openssh_conf_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/crypto-policies/back-ends/openssh.config</ind:filepath>
          <ind:pattern operation="pattern match">^MACs.*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_selinux_enforcing:obj:1" version="1">
          <ind:filepath>/etc/selinux/config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*SELINUX[\s]*=[\s]*enforcing[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_linuxshield_install_antivirus:obj:1" version="1">
          <linux:name>McAfeeVSEForLinux</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_mcafee_runtime_installed:obj:1" version="1">
          <linux:name>MFErt</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_mcafee_management_agent:obj:1" version="1">
          <linux:name>MFEcma</linux:name>
        </linux:rpminfo_object>
        <unix:file_object id="oval:ssg-object_mcafee_accm_exists:obj:1" version="1">
          <unix:path>/opt/McAfee/accm/bin</unix:path>
          <unix:filename>accm</unix:filename>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_mcafee_auditengine_exists:obj:1" version="1">
          <unix:path>/opt/McAfee/auditengine/bin</unix:path>
          <unix:filename>auditmanager</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_enable_dracut_fips_module:obj:1" version="1">
          <ind:filepath>/etc/dracut.conf.d/40-fips.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*add_dracutmodules\+="\s*(\w*)\s*"\s*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-obj_system_crypto_policy_value:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_system_crypto_policy:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object version="1" id="oval:ssg-object_etc_system_fips:obj:1">
          <unix:filepath>/etc/system-fips</unix:filepath>
        </unix:file_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_crypto_fips_enabled:obj:1" version="1">
          <unix:name>crypto.fips_enabled</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_build_database_dirpath:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^@@define[\s]DBDIR[\s]+(/.*)$</ind:pattern>
          <ind:instance operation="equals" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_build_new_database_filename:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^database_out=file:@@{DBDIR}/([a-z.]+)$</ind:pattern>
          <ind:instance operation="equals" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_operational_database_filename:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^database=file:@@{DBDIR}/([a-z.]+)$</ind:pattern>
          <ind:instance operation="equals" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_aide_build_new_database_absolute_path:obj:1" version="1">
          <unix:filepath var_ref="oval:ssg-variable_aide_build_new_database_absolute_path:var:1" var_check="at least one"/>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_aide_operational_database_absolute_path:obj:1" version="1">
          <unix:filepath var_ref="oval:ssg-variable_aide_operational_database_absolute_path:var:1" var_check="at least one"/>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_auditctl:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\/usr\/sbin\/auditctl\s+([^\n]+)$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_auditd:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^/usr/sbin/auditd\s+([^\n]+)$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_ausearch:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^/usr/sbin/ausearch\s+([^\n]+)$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_aureport:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^/usr/sbin/aureport\s+([^\n]+)$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_autrace:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^/usr/sbin/autrace\s+([^\n]+)$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_audispd:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^/usr/sbin/audispd\s+([^\n]+)$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_rsyslogd:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^/usr/sbin/rsyslogd\s+([^\n]+)$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_augenrules:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^/usr/sbin/augenrules\s+([^\n]+)$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="run aide with cron" id="oval:ssg-object_test_aide_periodic_cron_checking:obj:1" version="1">
          <ind:filepath>/etc/crontab</ind:filepath>
          <ind:pattern operation="pattern match">^(([0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*(\*|([0-7]|mon|tue|wed|thu|fri|sat|sun)|[0-7]-[0-7]))|@(hourly|daily|weekly))[\s]*root[\s]*\/usr\/sbin\/aide[\s]*\-\-check.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="run aide with cron" id="oval:ssg-object_test_aide_crond_checking:obj:1" version="1">
          <ind:path>/etc/cron.d</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^(([0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*(\*|([0-7]|mon|tue|wed|thu|fri|sat|sun)|[0-7]-[0-7]))|@(hourly|daily|weekly))[\s]*root[\s]*\/usr\/sbin\/aide[\s]*\-\-check.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="run aide with cron" id="oval:ssg-object_aide_var_cron_checking:obj:1" version="1">
          <ind:filepath>/var/spool/cron/root</ind:filepath>
          <ind:pattern operation="pattern match">^(([0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*(\*|([0-7]|mon|tue|wed|thu|fri|sat|sun)|[0-7]-[0-7]))|@(hourly|daily|weekly))[\s]*(root)?[\s]*\/usr\/sbin\/aide[\s]*\-\-check.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="run aide with cron.(daily|weekly)" id="oval:ssg-object_aide_crontabs_checking:obj:1" version="1">
          <ind:path operation="pattern match">^/etc/cron.(daily|weekly)$</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\s*\/usr\/sbin\/aide[\s]*\-\-check.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpmverifyfile_object id="oval:ssg-object_files_fail_md5_hash:obj:1" version="1" comment="rpm verify of all files">
          <linux:behaviors nomd5="false"/>
          <linux:name operation="pattern match">.*</linux:name>
          <linux:epoch operation="pattern match">.*</linux:epoch>
          <linux:version operation="pattern match">.*</linux:version>
          <linux:release operation="pattern match">.*</linux:release>
          <linux:arch operation="pattern match">.*</linux:arch>
          <linux:filepath operation="pattern match">^/(bin|sbin|lib|lib64|usr)/.+$</linux:filepath>
          <oval-def:filter action="include">oval:ssg-state_files_fail_md5_hash:ste:1</oval-def:filter>
        </linux:rpmverifyfile_object>
        <linux:rpmverifyfile_object id="oval:ssg-object_files_fail_mode:obj:1" version="1" comment="rpm verify of all files">
          <linux:behaviors nomd5="true" noghostfiles="true"/>
          <linux:name operation="pattern match">.*</linux:name>
          <linux:epoch operation="pattern match">.*</linux:epoch>
          <linux:version operation="pattern match">.*</linux:version>
          <linux:release operation="pattern match">.*</linux:release>
          <linux:arch operation="pattern match">.*</linux:arch>
          <linux:filepath operation="pattern match">.*</linux:filepath>
          <oval-def:filter action="include">oval:ssg-state_files_fail_mode:ste:1</oval-def:filter>
        </linux:rpmverifyfile_object>
        <ind:textfilecontent54_object id="oval:ssg-object_no_authenticate_etc_sudoers:obj:1" version="1">
          <ind:filepath>/etc/sudoers</ind:filepath>
          <ind:pattern operation="pattern match">^(?!#).*[\s]+\!authenticate.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_no_authenticate_etc_sudoers_d:obj:1" version="1">
          <ind:path>/etc/sudoers.d</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^(?!#).*[\s]+\!authenticate.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nopasswd_etc_sudoers:obj:1" version="1">
          <ind:filepath>/etc/sudoers</ind:filepath>
          <ind:pattern operation="pattern match">^(?!#).*[\s]+NOPASSWD[\s]*\:.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nopasswd_etc_sudoers_d:obj:1" version="1">
          <ind:path>/etc/sudoers.d</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^(?!#).*[\s]+NOPASSWD[\s]*\:.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_vdsm_nopasswd_etc_sudoers:obj:1" version="1">
          <ind:filepath>/etc/sudoers</ind:filepath>
          <ind:pattern operation="pattern match">^(?!(#|vdsm.*)).*[\s]+NOPASSWD[\s]*\:.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_vdsm_nopasswd_etc_sudoers_d:obj:1" version="1">
          <ind:path>/etc/sudoers.d</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^(?!(#|vdsm.*)).*[\s]+NOPASSWD[\s]*\:.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sudoers_default_includedir:obj:1" version="1">
          <ind:filepath>/etc/sudoers</ind:filepath>
          <ind:pattern operation="pattern match">^#includedir[\s]+(.*)$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sudoers_without_include:obj:1" version="1">
          <ind:filepath>/etc/sudoers</ind:filepath>
          <ind:pattern operation="pattern match">^#include[\s]+.*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sudoersd_without_includes:obj:1" version="1">
          <ind:path>/etc/sudoers.d/</ind:path>
          <ind:filename operation="pattern match">.*</ind:filename>
          <ind:pattern operation="pattern match">^#include(dir)?[\s]+.*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sudoers_explicit_command_args:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^(?:\s*[^#=]+)=(?:\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,\s]+(?:[ \t]+[^,\s]+)+[ \t]*,)*(\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,\s]+[ \t]*(?:,|$))</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sudoers_no_command_negation:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^(?:\s*[^#=]+)=(?:\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,!\n][^,\n]+,)*\s*(?:\([^\)]+\))?\s*(?!\s*\()(!\S+).*</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-root_or_ALL_in_runas_spec:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*((?!root\b)[\w]+)\s*(\w+)\s*=\s*(.*,)?\s*\([\w\s]*\b(root|ALL)\b[\w\s]*\)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_no_runas_spec:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*((?!root\b)[\w]+)\s*(\w+)\s*=\s*(.*,)?\s*[^\(\s]</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_test_sudoers_targetpw_config:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^Defaults !targetpw$\r?\n</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_test_sudoers_rootpw_config:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^Defaults !rootpw$\r?\n</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_test_sudoers_runaspw_config:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^Defaults !runaspw$\r?\n</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-obj_sudoers_passwd_n_files:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_variable_counter_sudoers_passwd_n_files:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_yum_clean_components_post_updating:obj:1" comment="clean_requirements_on_remove set in /etc/dnf/dnf.conf" version="1">
          <ind:filepath>/etc/dnf/dnf.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*clean_requirements_on_remove\s*=\s*(1|True|yes)\s*$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dnf-automatic_apply_updates:obj:1" version="1">
          <ind:filepath>/etc/dnf/automatic.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[commands\].*(?:\n\s*[^[\s].*)*\n^\s*apply_updates[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_dnf-automatic_apply_updates_config_file:obj:1" comment="The configuration file /etc/dnf/automatic.conf for dnf-automatic_apply_updates" version="1">
          <unix:filepath operation="pattern match">^/etc/dnf/automatic.conf</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dnf-automatic_security_updates_only:obj:1" version="1">
          <ind:filepath>/etc/dnf/automatic.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[commands\].*(?:\n\s*[^[\s].*)*\n^\s*upgrade_type[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_dnf-automatic_security_updates_only_config_file:obj:1" comment="The configuration file /etc/dnf/automatic.conf for dnf-automatic_security_updates_only" version="1">
          <unix:filepath operation="pattern match">^/etc/dnf/automatic.conf</unix:filepath>
        </unix:file_object>
        <linux:rpminfo_object id="oval:ssg-object_package_gpg-pubkey:obj:1" version="1">
          <linux:name>gpg-pubkey</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-object_ensure_gpgcheck_globally_activated:obj:1" comment="gpgcheck set in /etc/dnf/dnf.conf" version="1">
          <ind:filepath>/etc/dnf/dnf.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*gpgcheck\s*=\s*1\s*$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_yum_ensure_gpgcheck_local_packages:obj:1" comment="localpkg_gpgcheck set in /etc/dnf/dnf.conf" version="1">
          <ind:filepath>/etc/dnf/dnf.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*localpkg_gpgcheck\s*=\s*(1|True|yes)\s*$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ensure_gpgcheck_never_disabled:obj:1" version="1">
          <ind:path>/etc/yum.repos.d</ind:path>
          <ind:filename operation="pattern match">.*</ind:filename>
          <ind:pattern operation="pattern match">^\s*gpgcheck\s*=\s*0\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_yum_ensure_gpgcheck_repo_metadata:obj:1" comment="repo_gpgcheck set in /etc/dnf/dnf.conf" version="1">
          <ind:filepath>/etc/dnf/dnf.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*repo_gpgcheck\s*=\s*(1|True|yes)\s*$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_dcredit:obj:1" version="3">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*dcredit[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_dictcheck:obj:1" version="3">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*dictcheck[\s]*=[\s]*(\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_difok:obj:1" version="3">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*difok[\s]*=[\s]*(\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_accounts_password_pam_enforce_local:obj:1" version="1">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*local_users_only[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_accounts_password_pam_enforce_root:obj:1" version="1">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*enforce_for_root[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_lcredit:obj:1" version="3">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*lcredit[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_maxclassrepeat:obj:1" version="3">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*maxclassrepeat[\s]*=[\s]*(\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_maxrepeat:obj:1" version="3">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*maxrepeat[\s]*=[\s]*(\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_minclass:obj:1" version="3">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*minclass[\s]*=[\s]*(\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_minlen:obj:1" version="3">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*minlen[\s]*=[\s]*(\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_ocredit:obj:1" version="3">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*ocredit[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_ucredit:obj:1" version="3">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*ucredit[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_chmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_chmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_chmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_chmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_chown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_chown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_chown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_chown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchmodat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchmodat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchmodat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchmodat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchownat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchownat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchownat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchownat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_removexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_removexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_removexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_removexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_setxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_setxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_setxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_setxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_umount2_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+umount2[\s]+|([\s]+|[,])umount2([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_umount2_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+umount2[\s]+|([\s]+|[,])umount2([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_umount2_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+umount2[\s]+|([\s]+|[,])umount2([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_umount2_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+umount2[\s]+|([\s]+|[,])umount2([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_32bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_64bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_32bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_64bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_32bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_64bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_32bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_64bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_openat_32bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_openat_64bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_openat_32bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_openat_64bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_32bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_gshadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_64bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_gshadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_32bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_gshadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_64bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_gshadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_32bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_gshadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_64bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_gshadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_32bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_gshadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_64bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_gshadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_openat_32bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_gshadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_openat_64bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_gshadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_openat_32bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_gshadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_openat_64bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_gshadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_32bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_passwd_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_64bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_passwd_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_32bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_passwd_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_64bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_passwd_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_32bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_passwd_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_64bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_passwd_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_32bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_passwd_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_64bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_passwd_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_openat_32bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_passwd_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_openat_64bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_passwd_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_openat_32bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_passwd_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_openat_64bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_passwd_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_32bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_shadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_64bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_shadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_32bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_shadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_64bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_shadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_32bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_shadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_64bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_shadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_32bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_shadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_64bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_shadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_openat_32bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_shadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_openat_64bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_shadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_openat_32bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_shadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_openat_64bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_shadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_chcon_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chcon(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_chcon_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chcon(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_restorecon_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/restorecon(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_restorecon_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/restorecon(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_semanage_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/semanage(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_semanage_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/semanage(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_setsebool_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/setsebool(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_setsebool_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/setsebool(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_seunshare_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/seunshare(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_seunshare_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/seunshare(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_rename_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_rename_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_rename_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_rename_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_renameat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_renameat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_renameat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_renameat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_rmdir_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_rmdir_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_rmdir_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_rmdir_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_unlink_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_unlink_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_unlink_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_unlink_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_unlinkat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_unlinkat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_unlinkat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_unlinkat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arle_faillock_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/var\/run\/faillock[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arle_faillock_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/var\/run\/faillock[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arle_lastlog_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/var\/log\/lastlog[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arle_lastlog_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/var\/log\/lastlog[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arle_tallylog_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/var\/log\/tallylog[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arle_tallylog_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/var\/log\/tallylog[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_mount_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+mount[\s]+|([\s]+|[,])mount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_mount_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+mount[\s]+|([\s]+|[,])mount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_mount_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+mount[\s]+|([\s]+|[,])mount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_mount_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+mount[\s]+|([\s]+|[,])mount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_at_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/at(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_at_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/at(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_chage_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chage(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_chage_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chage(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_chsh_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chsh(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_chsh_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chsh(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_crontab_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/crontab(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_crontab_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/crontab(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_gpasswd_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/gpasswd(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_gpasswd_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/gpasswd(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_mount_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/mount(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_mount_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/mount(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newgidmap_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newgidmap(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newgidmap_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newgidmap(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newgrp_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newgrp(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newgrp_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newgrp(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newuidmap_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newuidmap(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newuidmap_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newuidmap(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_passwd_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/passwd(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_passwd_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/passwd(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_pt_chown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/libexec\/pt_chown(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_pt_chown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/libexec\/pt_chown(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_ssh_keysign_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/libexec\/openssh\/ssh-keysign(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_ssh_keysign_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/libexec\/openssh\/ssh-keysign(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_su_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/su(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_su_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/su(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_sudo_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/sudo(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_sudo_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/sudo(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_sudoedit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/sudoedit(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_sudoedit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/sudoedit(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_umount_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/umount(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_umount_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/umount(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_unix_chkpwd_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/unix_chkpwd(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_unix_chkpwd_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/unix_chkpwd(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_userhelper_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/userhelper(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_userhelper_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/userhelper(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_usernetctl_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/usernetctl(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_usernetctl_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/usernetctl(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_chmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_chmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_chmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_chmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_chmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_chmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_chmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_chmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_chmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_chmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_chmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_chmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_chmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_chmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_chmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_chmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_chown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_chown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_chown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_chown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_chown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_chown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_chown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_chown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_chown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_chown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_chown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_chown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_chown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_chown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_chown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_chown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_creat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_creat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_creat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_creat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_creat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_creat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_creat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_creat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_creat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_creat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_creat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_creat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_creat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_creat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_creat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_creat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchmodat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchmodat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchmodat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchmodat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchmodat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchmodat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchmodat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchmodat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchmodat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchmodat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchmodat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchmodat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchmodat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchmodat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchmodat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchmodat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchownat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchownat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchownat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchownat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchownat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchownat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchownat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchownat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchownat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchownat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchownat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchownat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchownat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchownat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchownat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchownat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_ftruncate_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_ftruncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_ftruncate_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_ftruncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_ftruncate_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_ftruncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_ftruncate_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_ftruncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_ftruncate_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_ftruncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_ftruncate_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_ftruncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_ftruncate_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_ftruncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_ftruncate_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_ftruncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_lchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_lchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_lchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_lchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_lchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_lchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_lchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_lchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_lchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_lchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_lchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_lchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_lchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_lchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_lchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_lchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_lremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_lremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_lremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_lremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_lremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_lremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_lremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_lremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_lremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_lremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_lremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_lremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_lremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_lremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_lremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_lremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_lsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_lsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_lsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_lsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_lsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_lsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_lsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_lsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_lsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_lsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_lsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_lsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_lsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_lsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_lsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_lsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_open_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_open_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_open_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_open_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_open_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_open_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_open_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_open_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_open_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_open_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_open_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_open_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_open_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_open_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_open_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_open_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_open_by_handle_at_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_open_by_handle_at_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_open_by_handle_at_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_open_by_handle_at_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_open_by_handle_at_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_open_by_handle_at_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_open_by_handle_at_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_open_by_handle_at_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_open_by_handle_at_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_open_by_handle_at_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_open_by_handle_at_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_open_by_handle_at_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_open_by_handle_at_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_open_by_handle_at_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_open_by_handle_at_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_open_by_handle_at_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_eacces_augenrules_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_eperm_augenrules_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_eacces_augenrules_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_eperm_augenrules_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_auditctl_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_auditctl_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_open_by_handle_at_order_64bit_auditctl_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_auditctl_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_eacces_augenrules_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_eperm_augenrules_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_open_eacces_augenrules_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_open_eperm_augenrules_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_auditctl_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_auditctl_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_open_order_64bit_auditctl_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_open_auditctl_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_openat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_openat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_openat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_openat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_openat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_openat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_openat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_openat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_openat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_openat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_openat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_openat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_openat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_openat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_openat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_openat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_openat_eacces_augenrules_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_openat_eperm_augenrules_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_openat_eacces_augenrules_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_openat_eperm_augenrules_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_openat_auditctl_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_openat_auditctl_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_openat_order_64bit_auditctl_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_openat_auditctl_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_removexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_removexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_removexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_removexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_removexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_removexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_removexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_removexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_removexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_removexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_removexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_removexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_removexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_removexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_removexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_removexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_rename_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_rename_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_rename_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_rename_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_rename_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_rename_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_rename_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_rename_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_rename_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_rename_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_rename_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_rename_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_rename_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_rename_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_rename_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_rename_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_renameat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_renameat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_renameat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_renameat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_renameat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_renameat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_renameat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_renameat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_renameat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_renameat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_renameat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_renameat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_renameat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_renameat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_renameat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_renameat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_setxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_setxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_setxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_setxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_setxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_setxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_setxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_setxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_setxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_setxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_setxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_setxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_setxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_setxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_setxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_setxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_truncate_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_truncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_truncate_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_truncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_truncate_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_truncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_truncate_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_truncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_truncate_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_truncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_truncate_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_truncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_truncate_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_truncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_truncate_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_truncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_unlink_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_unlink_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_unlink_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_unlink_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_unlink_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_unlink_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_unlink_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_unlink_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_unlink_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_unlink_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_unlink_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_unlink_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_unlink_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_unlink_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_unlink_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_unlink_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_unlinkat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_unlinkat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_unlinkat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_unlinkat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_unlinkat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_unlinkat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_unlinkat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_unlinkat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_unlinkat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_unlinkat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_unlinkat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_unlinkat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_unlinkat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_unlinkat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_unlinkat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_unlinkat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_group_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_group_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_gshadow_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_gshadow_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_opasswd_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/security\/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_opasswd_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/security\/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_passwd_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_passwd_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_shadow_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_shadow_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_auditd_freq:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)freq(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_auditd_local_events:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)local_events(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_auditd_local_events_default_not_overriden:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)local_events(?-i)[ \t]*=[ \t]*</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_auditd_log_format:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)log_format(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_auditd_name_format:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)name_format(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_auditd_write_logs:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)write_logs(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_auditd_write_logs_default_not_overriden:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)write_logs(?-i)[ \t]*=[ \t]*</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_coreos_enable_selinux_kernel_argument_file_boot_loader_entries_ostree_2_conf_absent:obj:1" version="1">
          <unix:filepath operation="pattern match">^/boot/loader/entries/ostree-2-.*.conf</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/loader/entries/ostree-1-.*.conf</ind:filepath>
          <ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/loader/entries/ostree-2-.*.conf</ind:filepath>
          <ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:obj:1" version="1">
          <ind:filepath operation="pattern match">^/proc/cmdline</ind:filepath>
          <ind:pattern operation="pattern match">^BOOT_IMAGE(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_disable_user_admin:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\s*\[org/gnome/desktop/lockdown\].*(?:\n\s*[^[\s].*)*\n^\s*user-administration-disabled[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_user-administration-disabled:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/lockdown/user-administration-disabled$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_lock_screen_on_smartcard_removal:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\s*\[org/gnome/settings-daemon/peripherals/smartcard\].*(?:\n\s*[^[\s].*)*\n^\s*removal-action[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_removal-action:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/settings-daemon/peripherals/smartcard/removal-action$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object comment="/lib/" id="oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_0:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/lib</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerdir_group_ownership_library_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/lib64/" id="oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_1:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/lib64</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerdir_group_ownership_library_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_gid_0_1:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/usr/lib/" id="oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_2:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/lib</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerdir_group_ownership_library_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_gid_0_2:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/usr/lib64/" id="oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_3:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/lib64</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerdir_group_ownership_library_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_gid_0_3:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/bin/" id="oval:ssg-object_file_ownerdir_ownership_binary_dirs_0:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/bin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/sbin/" id="oval:ssg-object_file_ownerdir_ownership_binary_dirs_1:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/sbin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_1:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/usr/bin/" id="oval:ssg-object_file_ownerdir_ownership_binary_dirs_2:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/bin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_2:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/usr/sbin/" id="oval:ssg-object_file_ownerdir_ownership_binary_dirs_3:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/sbin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_3:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/usr/local/bin/" id="oval:ssg-object_file_ownerdir_ownership_binary_dirs_4:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/local/bin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_4:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/usr/local/sbin/" id="oval:ssg-object_file_ownerdir_ownership_binary_dirs_5:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/local/sbin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_5:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/lib/" id="oval:ssg-object_file_ownerdir_ownership_library_dirs_0:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/lib</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdir_ownership_library_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/lib64/" id="oval:ssg-object_file_ownerdir_ownership_library_dirs_1:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/lib64</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdir_ownership_library_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_1:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/usr/lib/" id="oval:ssg-object_file_ownerdir_ownership_library_dirs_2:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/lib</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdir_ownership_library_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_2:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/usr/lib64/" id="oval:ssg-object_file_ownerdir_ownership_library_dirs_3:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/lib64</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdir_ownership_library_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_3:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/bin/" id="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_0:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/bin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdir_permissions_binary_dirs_0_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/sbin/" id="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_1:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/sbin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdir_permissions_binary_dirs_1_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/usr/bin/" id="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_2:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/bin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdir_permissions_binary_dirs_2_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/usr/sbin/" id="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_3:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/sbin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdir_permissions_binary_dirs_3_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/usr/local/bin/" id="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_4:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/local/bin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdir_permissions_binary_dirs_4_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/usr/local/sbin/" id="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_5:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/local/sbin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdir_permissions_binary_dirs_5_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/lib/" id="oval:ssg-object_file_permissionsdir_permissions_library_dirs_0:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/lib</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_dir_permissions_library_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdir_permissions_library_dirs_0_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/lib64/" id="oval:ssg-object_file_permissionsdir_permissions_library_dirs_1:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/lib64</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_dir_permissions_library_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdir_permissions_library_dirs_1_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/usr/lib/" id="oval:ssg-object_file_permissionsdir_permissions_library_dirs_2:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/lib</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_dir_permissions_library_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdir_permissions_library_dirs_2_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/usr/lib64/" id="oval:ssg-object_file_permissionsdir_permissions_library_dirs_3:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/lib64</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_dir_permissions_library_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdir_permissions_library_dirs_3_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_host_auth:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)HostbasedAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_host_auth_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)HostbasedAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object comment="/etc/at.deny" id="oval:ssg-object_file_at_deny_not_exist:obj:1" version="1">
          <unix:filepath>/etc/at.deny</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/etc/cron.deny" id="oval:ssg-object_file_cron_deny_not_exist:obj:1" version="1">
          <unix:filepath>/etc/cron.deny</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/etc/group-" id="oval:ssg-object_file_groupowner_backup_etc_group_0:obj:1" version="1">
          <unix:filepath>/etc/group-</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_backup_etc_group_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_backup_etc_group_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/gshadow-" id="oval:ssg-object_file_groupowner_backup_etc_gshadow_0:obj:1" version="1">
          <unix:filepath>/etc/gshadow-</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_backup_etc_gshadow_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_backup_etc_gshadow_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/passwd-" id="oval:ssg-object_file_groupowner_backup_etc_passwd_0:obj:1" version="1">
          <unix:filepath>/etc/passwd-</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_backup_etc_passwd_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_backup_etc_passwd_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/shadow-" id="oval:ssg-object_file_groupowner_backup_etc_shadow_0:obj:1" version="1">
          <unix:filepath>/etc/shadow-</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_backup_etc_shadow_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_backup_etc_shadow_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/boot/grub2/grub.cfg" id="oval:ssg-object_file_groupowner_efi_grub2_cfg_0:obj:1" version="1">
          <unix:filepath>/boot/grub2/grub.cfg</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_efi_grub2_cfg_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_efi_grub2_cfg_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/group" id="oval:ssg-object_file_groupowner_etc_group_0:obj:1" version="1">
          <unix:filepath>/etc/group</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_etc_group_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_etc_group_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/gshadow" id="oval:ssg-object_file_groupowner_etc_gshadow_0:obj:1" version="1">
          <unix:filepath>/etc/gshadow</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_etc_gshadow_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_etc_gshadow_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/issue" id="oval:ssg-object_file_groupowner_etc_issue_0:obj:1" version="1">
          <unix:filepath>/etc/issue</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_etc_issue_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_etc_issue_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/motd" id="oval:ssg-object_file_groupowner_etc_motd_0:obj:1" version="1">
          <unix:filepath>/etc/motd</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_etc_motd_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_etc_motd_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/passwd" id="oval:ssg-object_file_groupowner_etc_passwd_0:obj:1" version="1">
          <unix:filepath>/etc/passwd</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_etc_passwd_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_etc_passwd_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/shadow" id="oval:ssg-object_file_groupowner_etc_shadow_0:obj:1" version="1">
          <unix:filepath>/etc/shadow</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_etc_shadow_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_etc_shadow_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/boot/grub2/grub.cfg" id="oval:ssg-object_file_groupowner_grub2_cfg_0:obj:1" version="1">
          <unix:filepath>/boot/grub2/grub.cfg</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_grub2_cfg_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_grub2_cfg_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/" id="oval:ssg-object_file_groupowner_var_log_0:obj:1" version="1">
          <unix:path>/var/log</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_var_log_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_var_log_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/messages" id="oval:ssg-object_file_groupowner_var_log_messages_0:obj:1" version="1">
          <unix:filepath>/var/log/messages</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_var_log_messages_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_var_log_messages_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/syslog" id="oval:ssg-object_file_groupowner_var_log_syslog_0:obj:1" version="1">
          <unix:filepath>/var/log/syslog</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_var_log_syslog_uid_4:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_var_log_syslog_gid_4_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/audit/" id="oval:ssg-object_file_groupownership_audit_configuration_0:obj:1" version="1">
          <unix:path>/etc/audit</unix:path>
          <unix:filename operation="pattern match">^audit(\.rules|d\.conf)$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownership_audit_configuration_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownership_audit_configuration_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/audit/rules.d/" id="oval:ssg-object_file_groupownership_audit_configuration_1:obj:1" version="1">
          <unix:path>/etc/audit/rules.d</unix:path>
          <unix:filename operation="pattern match">^.*\.rules$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownership_audit_configuration_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownership_audit_configuration_gid_0_1:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/group-" id="oval:ssg-object_file_owner_backup_etc_group_0:obj:1" version="1">
          <unix:filepath>/etc/group-</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_backup_etc_group_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_backup_etc_group_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/gshadow-" id="oval:ssg-object_file_owner_backup_etc_gshadow_0:obj:1" version="1">
          <unix:filepath>/etc/gshadow-</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_backup_etc_gshadow_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_backup_etc_gshadow_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/passwd-" id="oval:ssg-object_file_owner_backup_etc_passwd_0:obj:1" version="1">
          <unix:filepath>/etc/passwd-</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_backup_etc_passwd_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_backup_etc_passwd_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/shadow-" id="oval:ssg-object_file_owner_backup_etc_shadow_0:obj:1" version="1">
          <unix:filepath>/etc/shadow-</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_backup_etc_shadow_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_backup_etc_shadow_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/boot/grub2/grub.cfg" id="oval:ssg-object_file_owner_efi_grub2_cfg_0:obj:1" version="1">
          <unix:filepath>/boot/grub2/grub.cfg</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_efi_grub2_cfg_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_efi_grub2_cfg_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/group" id="oval:ssg-object_file_owner_etc_group_0:obj:1" version="1">
          <unix:filepath>/etc/group</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_etc_group_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_etc_group_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/gshadow" id="oval:ssg-object_file_owner_etc_gshadow_0:obj:1" version="1">
          <unix:filepath>/etc/gshadow</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_etc_gshadow_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_etc_gshadow_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/issue" id="oval:ssg-object_file_owner_etc_issue_0:obj:1" version="1">
          <unix:filepath>/etc/issue</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_etc_issue_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_etc_issue_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/motd" id="oval:ssg-object_file_owner_etc_motd_0:obj:1" version="1">
          <unix:filepath>/etc/motd</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_etc_motd_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_etc_motd_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/passwd" id="oval:ssg-object_file_owner_etc_passwd_0:obj:1" version="1">
          <unix:filepath>/etc/passwd</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_etc_passwd_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_etc_passwd_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/shadow" id="oval:ssg-object_file_owner_etc_shadow_0:obj:1" version="1">
          <unix:filepath>/etc/shadow</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_etc_shadow_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_etc_shadow_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/boot/grub2/grub.cfg" id="oval:ssg-object_file_owner_grub2_cfg_0:obj:1" version="1">
          <unix:filepath>/boot/grub2/grub.cfg</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_grub2_cfg_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_grub2_cfg_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/" id="oval:ssg-object_file_owner_var_log_0:obj:1" version="1">
          <unix:path>/var/log</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_var_log_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_var_log_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/messages" id="oval:ssg-object_file_owner_var_log_messages_0:obj:1" version="1">
          <unix:filepath>/var/log/messages</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_var_log_messages_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_var_log_messages_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/syslog" id="oval:ssg-object_file_owner_var_log_syslog_0:obj:1" version="1">
          <unix:filepath>/var/log/syslog</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_var_log_syslog_uid_104:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_var_log_syslog_uid_104_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/audit/" id="oval:ssg-object_file_ownership_audit_configuration_0:obj:1" version="1">
          <unix:path>/etc/audit</unix:path>
          <unix:filename operation="pattern match">^audit(\.rules|d\.conf)$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownership_audit_configuration_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownership_audit_configuration_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/audit/rules.d/" id="oval:ssg-object_file_ownership_audit_configuration_1:obj:1" version="1">
          <unix:path>/etc/audit/rules.d</unix:path>
          <unix:filename operation="pattern match">^.*\.rules$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownership_audit_configuration_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownership_audit_configuration_uid_0_1:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/lib/" id="oval:ssg-object_file_ownership_library_dirs_0:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/lib</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownership_library_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownership_library_dirs_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/lib64/" id="oval:ssg-object_file_ownership_library_dirs_1:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/lib64</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownership_library_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownership_library_dirs_uid_0_1:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/usr/lib/" id="oval:ssg-object_file_ownership_library_dirs_2:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/lib</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownership_library_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownership_library_dirs_uid_0_2:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/usr/lib64/" id="oval:ssg-object_file_ownership_library_dirs_3:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/lib64</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownership_library_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownership_library_dirs_uid_0_3:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/group-" id="oval:ssg-object_file_permissions_backup_etc_group_0:obj:1" version="1">
          <unix:filepath>/etc/group-</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__backup_etc_group:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_backup_etc_group_0_mode_0644or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/gshadow-" id="oval:ssg-object_file_permissions_backup_etc_gshadow_0:obj:1" version="1">
          <unix:filepath>/etc/gshadow-</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__backup_etc_gshadow:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_backup_etc_gshadow_0_mode_0000or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/passwd-" id="oval:ssg-object_file_permissions_backup_etc_passwd_0:obj:1" version="1">
          <unix:filepath>/etc/passwd-</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__backup_etc_passwd:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_backup_etc_passwd_0_mode_0644or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/shadow-" id="oval:ssg-object_file_permissions_backup_etc_shadow_0:obj:1" version="1">
          <unix:filepath>/etc/shadow-</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__backup_etc_shadow:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_backup_etc_shadow_0_mode_0000or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/boot/grub2/grub.cfg" id="oval:ssg-object_file_permissions_efi_grub2_cfg_0:obj:1" version="1">
          <unix:filepath>/boot/grub2/grub.cfg</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__efi_grub2_cfg:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_efi_grub2_cfg_0_mode_0700or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/audit/auditd.conf" id="oval:ssg-object_file_permissions_etc_audit_auditd_0:obj:1" version="1">
          <unix:filepath>/etc/audit/auditd.conf</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__etc_audit_auditd:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_etc_audit_auditd_0_mode_0640or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/audit/rules.d/" id="oval:ssg-object_file_permissions_etc_audit_rulesd_0:obj:1" version="1">
          <unix:path>/etc/audit/rules.d</unix:path>
          <unix:filename operation="pattern match">^.*rules$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__etc_audit_rulesd:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_etc_audit_rulesd_0_mode_0640or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/group" id="oval:ssg-object_file_permissions_etc_group_0:obj:1" version="1">
          <unix:filepath>/etc/group</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__etc_group:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_etc_group_0_mode_0644or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/gshadow" id="oval:ssg-object_file_permissions_etc_gshadow_0:obj:1" version="1">
          <unix:filepath>/etc/gshadow</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__etc_gshadow:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_etc_gshadow_0_mode_0000or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/issue" id="oval:ssg-object_file_permissions_etc_issue_0:obj:1" version="1">
          <unix:filepath>/etc/issue</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__etc_issue:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_etc_issue_0_mode_0644or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/motd" id="oval:ssg-object_file_permissions_etc_motd_0:obj:1" version="1">
          <unix:filepath>/etc/motd</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__etc_motd:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_etc_motd_0_mode_0644or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/passwd" id="oval:ssg-object_file_permissions_etc_passwd_0:obj:1" version="1">
          <unix:filepath>/etc/passwd</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__etc_passwd:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_etc_passwd_0_mode_0644or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/shadow" id="oval:ssg-object_file_permissions_etc_shadow_0:obj:1" version="1">
          <unix:filepath>/etc/shadow</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__etc_shadow:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_etc_shadow_0_mode_0000or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/boot/grub2/grub.cfg" id="oval:ssg-object_file_permissions_grub2_cfg_0:obj:1" version="1">
          <unix:filepath>/boot/grub2/grub.cfg</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__grub2_cfg:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_grub2_cfg_0_mode_0600or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/lib/" id="oval:ssg-object_file_permissions_library_dirs_0:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/lib</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__library_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_library_dirs_0_mode_7755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/lib64/" id="oval:ssg-object_file_permissions_library_dirs_1:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/lib64</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__library_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_library_dirs_1_mode_7755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/usr/lib/" id="oval:ssg-object_file_permissions_library_dirs_2:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/lib</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__library_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_library_dirs_2_mode_7755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/usr/lib64/" id="oval:ssg-object_file_permissions_library_dirs_3:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/lib64</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__library_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_library_dirs_3_mode_7755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/ssh/" id="oval:ssg-object_file_permissions_sshd_private_key_0:obj:1" version="1">
          <unix:path>/etc/ssh</unix:path>
          <unix:filename operation="pattern match">^.*_key$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__sshd_private_key:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_sshd_private_key_0_mode_0600or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/ssh/" id="oval:ssg-object_file_permissions_sshd_pub_key_0:obj:1" version="1">
          <unix:path>/etc/ssh</unix:path>
          <unix:filename operation="pattern match">^.*.pub$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__sshd_pub_key:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_sshd_pub_key_0_mode_0644or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/" id="oval:ssg-object_file_permissions_var_log_0:obj:1" version="1">
          <unix:path>/var/log</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__var_log:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_var_log_0_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/messages" id="oval:ssg-object_file_permissions_var_log_messages_0:obj:1" version="1">
          <unix:filepath>/var/log/messages</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__var_log_messages:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_var_log_messages_0_mode_0640or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/syslog" id="oval:ssg-object_file_permissions_var_log_syslog_0:obj:1" version="1">
          <unix:filepath>/var/log/syslog</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__var_log_syslog:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_var_log_syslog_0_mode_0640or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_audit_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_audit_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_audit_backlog_limit_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_audit_backlog_limit_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_iommu_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_iommu_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_ipv6_disable_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_ipv6_disable_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_l1tf_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_l1tf_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_mce_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_mce_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_mds_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_mds_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_nosmap_argument_absent:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(?!.*\bnosmap\b.*).*"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_nosmap_argument_absent_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(?!.*\bnosmap\b).*"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_nosmep_argument_absent:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(?!.*\bnosmep\b.*).*"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_nosmep_argument_absent_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(?!.*\bnosmep\b).*"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_page_poison_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_page_poison_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_pti_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_pti_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_rng_core_default_quality_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_rng_core_default_quality_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_slab_nomerge_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_slab_nomerge_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_slub_debug_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_slub_debug_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_spec_store_bypass_disable_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_spec_store_bypass_disable_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_spectre_v2_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_spectre_v2_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_vsyscall_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_vsyscall_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_openssl-pkcs11_installed:obj:1" version="1">
          <linux:name>openssl-pkcs11</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_acpi_custom_method:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_ACPI_CUSTOM_METHOD="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_acpi_custom_method_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_acpi_custom_method_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_acpi_custom_method_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_arm64_sw_ttbr0_pan:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_ARM64_SW_TTBR0_PAN="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_arm64_sw_ttbr0_pan_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_arm64_sw_ttbr0_pan_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_arm64_sw_ttbr0_pan_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_binfmt_misc:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_BINFMT_MISC="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_binfmt_misc_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_binfmt_misc_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_binfmt_misc_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_bug:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_BUG="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_bug_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_bug_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_bug_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_bug_on_data_corruption:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_BUG_ON_DATA_CORRUPTION="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_bug_on_data_corruption_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_bug_on_data_corruption_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_bug_on_data_corruption_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_compat_brk:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_COMPAT_BRK="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_compat_brk_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_compat_brk_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_compat_brk_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_compat_vdso:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_COMPAT_VDSO="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_compat_vdso_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_compat_vdso_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_compat_vdso_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_debug_credentials:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_DEBUG_CREDENTIALS="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_debug_credentials_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_debug_credentials_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_debug_credentials_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_debug_fs:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_DEBUG_FS="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_debug_fs_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_debug_fs_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_debug_fs_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_debug_list:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_DEBUG_LIST="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_debug_list_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_debug_list_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_debug_list_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_debug_notifiers:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_DEBUG_NOTIFIERS="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_debug_notifiers_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_debug_notifiers_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_debug_notifiers_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_debug_sg:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_DEBUG_SG="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_debug_sg_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_debug_sg_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_debug_sg_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_debug_wx:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_DEBUG_WX="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_debug_wx_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_debug_wx_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_debug_wx_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_default_mmap_min_addr:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_DEFAULT_MMAP_MIN_ADDR="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_default_mmap_min_addr_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_default_mmap_min_addr_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_default_mmap_min_addr_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_devkmem:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_DEVKMEM="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_devkmem_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_devkmem_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_devkmem_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_fortify_source:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_FORTIFY_SOURCE="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_fortify_source_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_fortify_source_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_fortify_source_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_gcc_plugin_latent_entropy:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_GCC_PLUGIN_LATENT_ENTROPY="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_gcc_plugin_latent_entropy_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_gcc_plugin_latent_entropy_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_gcc_plugin_latent_entropy_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_gcc_plugin_randstruct:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_GCC_PLUGIN_RANDSTRUCT="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_gcc_plugin_randstruct_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_gcc_plugin_randstruct_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_gcc_plugin_randstruct_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_gcc_plugin_stackleak:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_GCC_PLUGIN_STACKLEAK="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_gcc_plugin_stackleak_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_gcc_plugin_stackleak_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_gcc_plugin_stackleak_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_gcc_plugin_structleak:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_GCC_PLUGIN_STRUCTLEAK="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_gcc_plugin_structleak_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_gcc_plugin_structleak_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_gcc_plugin_structleak_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_gcc_plugin_structleak_byref_all:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_gcc_plugin_structleak_byref_all_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_gcc_plugin_structleak_byref_all_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_gcc_plugin_structleak_byref_all_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_hardened_usercopy:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_HARDENED_USERCOPY="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_hardened_usercopy_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_hardened_usercopy_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_hardened_usercopy_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_hardened_usercopy_fallback:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_HARDENED_USERCOPY_FALLBACK="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_hardened_usercopy_fallback_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_hardened_usercopy_fallback_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_hardened_usercopy_fallback_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_hibernation:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_HIBERNATION="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_hibernation_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_hibernation_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_hibernation_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_ia32_emulation:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_IA32_EMULATION="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_ia32_emulation_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_ia32_emulation_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_ia32_emulation_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_ipv6:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_IPV6="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_ipv6_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_ipv6_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_ipv6_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_kexec:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_KEXEC="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_kexec_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_kexec_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_kexec_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_legacy_ptys:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_LEGACY_PTYS="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_legacy_ptys_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_legacy_ptys_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_legacy_ptys_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_legacy_vsyscall_emulate:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_LEGACY_VSYSCALL_EMULATE="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_legacy_vsyscall_emulate_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_legacy_vsyscall_emulate_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_legacy_vsyscall_emulate_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_legacy_vsyscall_none:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_LEGACY_VSYSCALL_NONE="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_legacy_vsyscall_none_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_legacy_vsyscall_none_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_legacy_vsyscall_none_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_legacy_vsyscall_xonly:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_LEGACY_VSYSCALL_XONLY="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_legacy_vsyscall_xonly_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_legacy_vsyscall_xonly_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_legacy_vsyscall_xonly_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_modify_ldt_syscall:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_MODIFY_LDT_SYSCALL="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_modify_ldt_syscall_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_modify_ldt_syscall_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_modify_ldt_syscall_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_module_sig:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_MODULE_SIG="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_module_sig_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_module_sig_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_module_sig_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_module_sig_all:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_MODULE_SIG_ALL="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_module_sig_all_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_module_sig_all_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_module_sig_all_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_module_sig_force:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_MODULE_SIG_FORCE="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_module_sig_force_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_module_sig_force_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_module_sig_force_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_module_sig_hash:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_MODULE_SIG_HASH="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_module_sig_hash_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_module_sig_hash_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_module_sig_hash_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_module_sig_key:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_MODULE_SIG_KEY="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_module_sig_key_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_module_sig_key_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_module_sig_key_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_module_sig_sha512:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_MODULE_SIG_SHA512="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_module_sig_sha512_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_module_sig_sha512_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_module_sig_sha512_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_page_poisoning:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_PAGE_POISONING="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_page_poisoning_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_page_poisoning_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_page_poisoning_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_page_poisoning_no_sanity:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_PAGE_POISONING_NO_SANITY="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_page_poisoning_no_sanity_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_page_poisoning_no_sanity_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_page_poisoning_no_sanity_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_page_poisoning_zero:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_PAGE_POISONING_ZERO="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_page_poisoning_zero_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_page_poisoning_zero_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_page_poisoning_zero_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_page_table_isolation:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_PAGE_TABLE_ISOLATION="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_page_table_isolation_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_page_table_isolation_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_page_table_isolation_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_panic_on_oops:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_PANIC_ON_OOPS="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_panic_on_oops_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_panic_on_oops_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_panic_on_oops_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_panic_timeout:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_PANIC_TIMEOUT="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_panic_timeout_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_panic_timeout_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_panic_timeout_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_proc_kcore:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_PROC_KCORE="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_proc_kcore_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_proc_kcore_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_proc_kcore_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_randomize_base:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_RANDOMIZE_BASE="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_randomize_base_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_randomize_base_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_randomize_base_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_randomize_memory:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_RANDOMIZE_MEMORY="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_randomize_memory_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_randomize_memory_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_randomize_memory_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_refcount_full:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_REFCOUNT_FULL="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_refcount_full_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_refcount_full_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_refcount_full_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_retpoline:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_RETPOLINE="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_retpoline_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_retpoline_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_retpoline_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_sched_stack_end_check:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_SCHED_STACK_END_CHECK="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_sched_stack_end_check_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_sched_stack_end_check_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_sched_stack_end_check_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_seccomp:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_SECCOMP="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_seccomp_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_seccomp_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_seccomp_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_seccomp_filter:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_SECCOMP_FILTER="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_seccomp_filter_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_seccomp_filter_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_seccomp_filter_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_security:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_SECURITY="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_security_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_security_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_security_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_security_dmesg_restrict:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_SECURITY_DMESG_RESTRICT="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_security_dmesg_restrict_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_security_dmesg_restrict_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_security_dmesg_restrict_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_security_writable_hooks:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_SECURITY_WRITABLE_HOOKS="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_security_writable_hooks_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_security_writable_hooks_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_security_writable_hooks_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_security_yama:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_SECURITY_YAMA="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_security_yama_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_security_yama_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_security_yama_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_slab_freelist_hardened:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_SLAB_FREELIST_HARDENED="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_slab_freelist_hardened_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_slab_freelist_hardened_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_slab_freelist_hardened_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_slab_frelist_random:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_SLAB_FRELIST_RANDOM="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_slab_frelist_random_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_slab_frelist_random_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_slab_frelist_random_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_slab_merge_default:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_SLAB_MERGE_DEFAULT="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_slab_merge_default_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_slab_merge_default_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_slab_merge_default_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_slub_debug:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_SLUB_DEBUG="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_slub_debug_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_slub_debug_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_slub_debug_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_stackprotector:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_STACKPROTECTOR="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_stackprotector_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_stackprotector_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_stackprotector_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_stackprotector_strong:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_STACKPROTECTOR_STRONG="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_stackprotector_strong_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_stackprotector_strong_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_stackprotector_strong_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_strict_kernel_rwx:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_STRICT_KERNEL_RWX="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_strict_kernel_rwx_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_strict_kernel_rwx_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_strict_kernel_rwx_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_strict_module_rwx:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_STRICT_MODULE_RWX="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_strict_module_rwx_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_strict_module_rwx_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_strict_module_rwx_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_syn_cookies:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_SYN_COOKIES="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_syn_cookies_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_syn_cookies_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_syn_cookies_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_unmap_kernel_at_el0:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_UNMAP_KERNEL_AT_EL0="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_unmap_kernel_at_el0_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_unmap_kernel_at_el0_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_unmap_kernel_at_el0_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_vmap_stack:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_VMAP_STACK="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_vmap_stack_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_vmap_stack_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_vmap_stack_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_x86_vsyscall_emulation:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_X86_VSYSCALL_EMULATION="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_x86_vsyscall_emulation_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_x86_vsyscall_emulation_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object comment="Collect the kernel config files" id="oval:ssg-object_kernel_config_x86_vsyscall_emulation_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_disabled:obj:1" version="1" comment="kernel module atm disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of atm">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_etcmodules-load:obj:1" version="1" comment="kernel module atm disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_runmodules-load:obj:1" version="1" comment="kernel module atm disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_libmodules-load:obj:1" version="1" comment="kernel module atm disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_runmodprobed:obj:1" version="1" comment="kernel module atm disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_libmodprobed:obj:1" version="1" comment="kernel module atm disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_disabled:obj:1" version="1" comment="kernel module bluetooth disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of bluetooth">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_etcmodules-load:obj:1" version="1" comment="kernel module bluetooth disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_runmodules-load:obj:1" version="1" comment="kernel module bluetooth disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_libmodules-load:obj:1" version="1" comment="kernel module bluetooth disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_runmodprobed:obj:1" version="1" comment="kernel module bluetooth disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_libmodprobed:obj:1" version="1" comment="kernel module bluetooth disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_can_disabled:obj:1" version="1" comment="kernel module can disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_can_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of can">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_can_etcmodules-load:obj:1" version="1" comment="kernel module can disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_can_runmodules-load:obj:1" version="1" comment="kernel module can disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_can_libmodules-load:obj:1" version="1" comment="kernel module can disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_can_runmodprobed:obj:1" version="1" comment="kernel module can disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_can_libmodprobed:obj:1" version="1" comment="kernel module can disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cfg80211_disabled:obj:1" version="1" comment="kernel module cfg80211 disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+cfg80211\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cfg80211_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of cfg80211">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+cfg80211\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cfg80211_etcmodules-load:obj:1" version="1" comment="kernel module cfg80211 disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+cfg80211\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cfg80211_runmodules-load:obj:1" version="1" comment="kernel module cfg80211 disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+cfg80211\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cfg80211_libmodules-load:obj:1" version="1" comment="kernel module cfg80211 disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+cfg80211\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cfg80211_runmodprobed:obj:1" version="1" comment="kernel module cfg80211 disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+cfg80211\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cfg80211_libmodprobed:obj:1" version="1" comment="kernel module cfg80211 disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+cfg80211\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_disabled:obj:1" version="1" comment="kernel module cramfs disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of cramfs">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_etcmodules-load:obj:1" version="1" comment="kernel module cramfs disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_runmodules-load:obj:1" version="1" comment="kernel module cramfs disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_libmodules-load:obj:1" version="1" comment="kernel module cramfs disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_runmodprobed:obj:1" version="1" comment="kernel module cramfs disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_libmodprobed:obj:1" version="1" comment="kernel module cramfs disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_disabled:obj:1" version="1" comment="kernel module dccp disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of dccp">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_etcmodules-load:obj:1" version="1" comment="kernel module dccp disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_runmodules-load:obj:1" version="1" comment="kernel module dccp disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_libmodules-load:obj:1" version="1" comment="kernel module dccp disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_runmodprobed:obj:1" version="1" comment="kernel module dccp disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_libmodprobed:obj:1" version="1" comment="kernel module dccp disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_disabled:obj:1" version="1" comment="kernel module firewire-core disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of firewire-core">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_etcmodules-load:obj:1" version="1" comment="kernel module firewire-core disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_runmodules-load:obj:1" version="1" comment="kernel module firewire-core disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_libmodules-load:obj:1" version="1" comment="kernel module firewire-core disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_runmodprobed:obj:1" version="1" comment="kernel module firewire-core disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_libmodprobed:obj:1" version="1" comment="kernel module firewire-core disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_disabled:obj:1" version="1" comment="kernel module freevxfs disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of freevxfs">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_etcmodules-load:obj:1" version="1" comment="kernel module freevxfs disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_runmodules-load:obj:1" version="1" comment="kernel module freevxfs disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_libmodules-load:obj:1" version="1" comment="kernel module freevxfs disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_runmodprobed:obj:1" version="1" comment="kernel module freevxfs disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_libmodprobed:obj:1" version="1" comment="kernel module freevxfs disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_disabled:obj:1" version="1" comment="kernel module hfs disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of hfs">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_etcmodules-load:obj:1" version="1" comment="kernel module hfs disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_runmodules-load:obj:1" version="1" comment="kernel module hfs disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_libmodules-load:obj:1" version="1" comment="kernel module hfs disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_runmodprobed:obj:1" version="1" comment="kernel module hfs disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_libmodprobed:obj:1" version="1" comment="kernel module hfs disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_disabled:obj:1" version="1" comment="kernel module hfsplus disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of hfsplus">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_etcmodules-load:obj:1" version="1" comment="kernel module hfsplus disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_runmodules-load:obj:1" version="1" comment="kernel module hfsplus disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_libmodules-load:obj:1" version="1" comment="kernel module hfsplus disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_runmodprobed:obj:1" version="1" comment="kernel module hfsplus disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_libmodprobed:obj:1" version="1" comment="kernel module hfsplus disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlmvm_disabled:obj:1" version="1" comment="kernel module iwlmvm disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+iwlmvm\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlmvm_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of iwlmvm">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+iwlmvm\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlmvm_etcmodules-load:obj:1" version="1" comment="kernel module iwlmvm disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+iwlmvm\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlmvm_runmodules-load:obj:1" version="1" comment="kernel module iwlmvm disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+iwlmvm\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlmvm_libmodules-load:obj:1" version="1" comment="kernel module iwlmvm disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+iwlmvm\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlmvm_runmodprobed:obj:1" version="1" comment="kernel module iwlmvm disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+iwlmvm\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlmvm_libmodprobed:obj:1" version="1" comment="kernel module iwlmvm disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+iwlmvm\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlwifi_disabled:obj:1" version="1" comment="kernel module iwlwifi disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+iwlwifi\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlwifi_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of iwlwifi">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+iwlwifi\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlwifi_etcmodules-load:obj:1" version="1" comment="kernel module iwlwifi disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+iwlwifi\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlwifi_runmodules-load:obj:1" version="1" comment="kernel module iwlwifi disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+iwlwifi\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlwifi_libmodules-load:obj:1" version="1" comment="kernel module iwlwifi disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+iwlwifi\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlwifi_runmodprobed:obj:1" version="1" comment="kernel module iwlwifi disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+iwlwifi\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlwifi_libmodprobed:obj:1" version="1" comment="kernel module iwlwifi disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+iwlwifi\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_disabled:obj:1" version="1" comment="kernel module jffs2 disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of jffs2">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_etcmodules-load:obj:1" version="1" comment="kernel module jffs2 disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_runmodules-load:obj:1" version="1" comment="kernel module jffs2 disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_libmodules-load:obj:1" version="1" comment="kernel module jffs2 disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_runmodprobed:obj:1" version="1" comment="kernel module jffs2 disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_libmodprobed:obj:1" version="1" comment="kernel module jffs2 disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_mac80211_disabled:obj:1" version="1" comment="kernel module mac80211 disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+mac80211\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_mac80211_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of mac80211">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+mac80211\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_mac80211_etcmodules-load:obj:1" version="1" comment="kernel module mac80211 disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+mac80211\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_mac80211_runmodules-load:obj:1" version="1" comment="kernel module mac80211 disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+mac80211\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_mac80211_libmodules-load:obj:1" version="1" comment="kernel module mac80211 disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+mac80211\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_mac80211_runmodprobed:obj:1" version="1" comment="kernel module mac80211 disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+mac80211\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_mac80211_libmodprobed:obj:1" version="1" comment="kernel module mac80211 disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+mac80211\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_disabled:obj:1" version="1" comment="kernel module rds disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of rds">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_etcmodules-load:obj:1" version="1" comment="kernel module rds disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_runmodules-load:obj:1" version="1" comment="kernel module rds disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_libmodules-load:obj:1" version="1" comment="kernel module rds disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_runmodprobed:obj:1" version="1" comment="kernel module rds disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_libmodprobed:obj:1" version="1" comment="kernel module rds disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_disabled:obj:1" version="1" comment="kernel module squashfs disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of squashfs">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_etcmodules-load:obj:1" version="1" comment="kernel module squashfs disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_runmodules-load:obj:1" version="1" comment="kernel module squashfs disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_libmodules-load:obj:1" version="1" comment="kernel module squashfs disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_runmodprobed:obj:1" version="1" comment="kernel module squashfs disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_libmodprobed:obj:1" version="1" comment="kernel module squashfs disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_disabled:obj:1" version="1" comment="kernel module tipc disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of tipc">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_etcmodules-load:obj:1" version="1" comment="kernel module tipc disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_runmodules-load:obj:1" version="1" comment="kernel module tipc disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_libmodules-load:obj:1" version="1" comment="kernel module tipc disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_runmodprobed:obj:1" version="1" comment="kernel module tipc disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_libmodprobed:obj:1" version="1" comment="kernel module tipc disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_disabled:obj:1" version="1" comment="kernel module udf disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of udf">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_etcmodules-load:obj:1" version="1" comment="kernel module udf disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_runmodules-load:obj:1" version="1" comment="kernel module udf disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_libmodules-load:obj:1" version="1" comment="kernel module udf disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_runmodprobed:obj:1" version="1" comment="kernel module udf disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_libmodprobed:obj:1" version="1" comment="kernel module udf disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_disabled:obj:1" version="1" comment="kernel module usb-storage disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of usb-storage">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_etcmodules-load:obj:1" version="1" comment="kernel module usb-storage disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_runmodules-load:obj:1" version="1" comment="kernel module usb-storage disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_libmodules-load:obj:1" version="1" comment="kernel module usb-storage disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_runmodprobed:obj:1" version="1" comment="kernel module usb-storage disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_libmodprobed:obj:1" version="1" comment="kernel module usb-storage disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_disabled:obj:1" version="1" comment="kernel module vfat disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of vfat">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_etcmodules-load:obj:1" version="1" comment="kernel module vfat disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_runmodules-load:obj:1" version="1" comment="kernel module vfat disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_libmodules-load:obj:1" version="1" comment="kernel module vfat disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_runmodprobed:obj:1" version="1" comment="kernel module vfat disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_libmodprobed:obj:1" version="1" comment="kernel module vfat disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object version="1" id="oval:ssg-object_boot_partition_noauto_optional_yes:obj:1">
          <linux:mount_point>/boot</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object version="1" id="oval:ssg-object_boot_partition_nodev_optional_yes:obj:1">
          <linux:mount_point>/boot</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object version="1" id="oval:ssg-object_boot_partition_noexec_optional_yes:obj:1">
          <linux:mount_point>/boot</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object version="1" id="oval:ssg-object_boot_partition_nosuid_optional_yes:obj:1">
          <linux:mount_point>/boot</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object version="1" id="oval:ssg-object_dev_shm_partition_nodev_optional_no:obj:1">
          <linux:mount_point>/dev/shm</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object version="1" id="oval:ssg-object_dev_shm_partition_noexec_optional_no:obj:1">
          <linux:mount_point>/dev/shm</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object version="1" id="oval:ssg-object_dev_shm_partition_nosuid_optional_no:obj:1">
          <linux:mount_point>/dev/shm</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object version="1" id="oval:ssg-object_home_partition_noexec_optional_yes:obj:1">
          <linux:mount_point>/home</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nodev_etc_fstab_cd_dvd_drive:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_cd_dvd_drive_regex_pattern_nodev:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nodev_etc_fstab_not_cd_dvd_drive:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_nodev:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_noexec_etc_fstab_cd_dvd_drive:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_cd_dvd_drive_regex_pattern_noexec:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_noexec_etc_fstab_not_cd_dvd_drive:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_noexec:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nosuid_etc_fstab_cd_dvd_drive:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_cd_dvd_drive_regex_pattern_nosuid:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nosuid_etc_fstab_not_cd_dvd_drive:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_nosuid:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object version="1" id="oval:ssg-object_opt_partition_nosuid_optional_yes:obj:1">
          <linux:mount_point>/opt</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object version="1" id="oval:ssg-object_proc_partition_hidepid_optional_no:obj:1">
          <linux:mount_point>/proc</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object version="1" id="oval:ssg-object_srv_partition_nosuid_optional_yes:obj:1">
          <linux:mount_point>/srv</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object version="1" id="oval:ssg-object_tmp_partition_nodev_optional_yes:obj:1">
          <linux:mount_point>/tmp</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object version="1" id="oval:ssg-object_tmp_partition_noexec_optional_yes:obj:1">
          <linux:mount_point>/tmp</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object version="1" id="oval:ssg-object_tmp_partition_nosuid_optional_yes:obj:1">
          <linux:mount_point>/tmp</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object version="1" id="oval:ssg-object_var_log_audit_partition_nodev_optional_yes:obj:1">
          <linux:mount_point>/var/log/audit</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object version="1" id="oval:ssg-object_var_log_audit_partition_noexec_optional_yes:obj:1">
          <linux:mount_point>/var/log/audit</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object version="1" id="oval:ssg-object_var_log_audit_partition_nosuid_optional_yes:obj:1">
          <linux:mount_point>/var/log/audit</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object version="1" id="oval:ssg-object_var_log_partition_nodev_optional_yes:obj:1">
          <linux:mount_point>/var/log</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object version="1" id="oval:ssg-object_var_log_partition_noexec_optional_yes:obj:1">
          <linux:mount_point>/var/log</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object version="1" id="oval:ssg-object_var_log_partition_nosuid_optional_yes:obj:1">
          <linux:mount_point>/var/log</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object version="1" id="oval:ssg-object_var_partition_nodev_optional_yes:obj:1">
          <linux:mount_point>/var</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object version="1" id="oval:ssg-object_var_partition_noexec_optional_yes:obj:1">
          <linux:mount_point>/var</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object version="1" id="oval:ssg-object_var_partition_nosuid_optional_yes:obj:1">
          <linux:mount_point>/var</linux:mount_point>
        </linux:partition_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_GConf2_installed:obj:1" version="1">
          <linux:name>GConf2</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_MFEhiplsm_installed:obj:1" version="1">
          <linux:name>MFEhiplsm</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_abrt-addon-ccpp_removed:obj:1" version="1">
          <linux:name>abrt-addon-ccpp</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_abrt-addon-kerneloops_removed:obj:1" version="1">
          <linux:name>abrt-addon-kerneloops</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_abrt-cli_removed:obj:1" version="1">
          <linux:name>abrt-cli</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_abrt-plugin-logger_removed:obj:1" version="1">
          <linux:name>abrt-plugin-logger</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_abrt-plugin-rhtsupport_removed:obj:1" version="1">
          <linux:name>abrt-plugin-rhtsupport</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_abrt-plugin-sosreport_removed:obj:1" version="1">
          <linux:name>abrt-plugin-sosreport</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_abrt_removed:obj:1" version="1">
          <linux:name>abrt</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_aide_installed:obj:1" version="1">
          <linux:name>aide</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_audispd-plugins_installed:obj:1" version="1">
          <linux:name>audispd-plugins</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_audit-audispd-plugins_installed:obj:1" version="1">
          <linux:name>audit-audispd-plugins</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_audit_installed:obj:1" version="1">
          <linux:name>audit</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_avahi_installed:obj:1" version="1">
          <linux:name>avahi</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_bind_removed:obj:1" version="1">
          <linux:name>bind</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_binutils_installed:obj:1" version="1">
          <linux:name>binutils</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_chrony_installed:obj:1" version="1">
          <linux:name>chrony</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_cron_installed:obj:1" version="1">
          <linux:name>cron</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_cryptsetup-luks_installed:obj:1" version="1">
          <linux:name>cryptsetup-luks</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_dconf_installed:obj:1" version="1">
          <linux:name>dconf</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_dnf-automatic_installed:obj:1" version="1">
          <linux:name>dnf-automatic</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_esc_installed:obj:1" version="1">
          <linux:name>esc</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_fapolicyd_installed:obj:1" version="1">
          <linux:name>fapolicyd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_gdm_installed:obj:1" version="1">
          <linux:name>gdm</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_gdm_removed:obj:1" version="1">
          <linux:name>gdm</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_geolite2-city_removed:obj:1" version="1">
          <linux:name>geolite2-city</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_geolite2-country_removed:obj:1" version="1">
          <linux:name>geolite2-country</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_gnutls-utils_installed:obj:1" version="1">
          <linux:name>gnutls-utils</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_gssproxy_removed:obj:1" version="1">
          <linux:name>gssproxy</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_inetutils-telnetd_removed:obj:1" version="1">
          <linux:name>inetutils-telnetd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_iprutils_removed:obj:1" version="1">
          <linux:name>iprutils</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_iptables_installed:obj:1" version="1">
          <linux:name>iptables</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_krb5-workstation_removed:obj:1" version="1">
          <linux:name>krb5-workstation</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_libcap-ng-utils_installed:obj:1" version="1">
          <linux:name>libcap-ng-utils</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_libreport-plugin-logger_removed:obj:1" version="1">
          <linux:name>libreport-plugin-logger</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_libreport-plugin-rhtsupport_removed:obj:1" version="1">
          <linux:name>libreport-plugin-rhtsupport</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_libreswan_installed:obj:1" version="1">
          <linux:name>libreswan</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_libselinux_installed:obj:1" version="1">
          <linux:name>libselinux</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_mcstrans_removed:obj:1" version="1">
          <linux:name>mcstrans</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_net-snmp_removed:obj:1" version="1">
          <linux:name>net-snmp</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_nfs-utils_removed:obj:1" version="1">
          <linux:name>nfs-utils</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_nis_removed:obj:1" version="1">
          <linux:name>nis</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_nss-tools_installed:obj:1" version="1">
          <linux:name>nss-tools</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_ntp_installed:obj:1" version="1">
          <linux:name>ntp</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_ntpdate_removed:obj:1" version="1">
          <linux:name>ntpdate</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_openldap-clients_removed:obj:1" version="1">
          <linux:name>openldap-clients</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_opensc_installed:obj:1" version="1">
          <linux:name>opensc</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_openscap-scanner_installed:obj:1" version="1">
          <linux:name>openscap-scanner</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_openssh-server_installed:obj:1" version="1">
          <linux:name>openssh-server</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_openssh-server_removed:obj:1" version="1">
          <linux:name>openssh-server</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_pam_ldap_removed:obj:1" version="1">
          <linux:name>pam_ldap</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_pcsc-lite_installed:obj:1" version="1">
          <linux:name>pcsc-lite</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_policycoreutils_installed:obj:1" version="1">
          <linux:name>policycoreutils</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_prelink_removed:obj:1" version="1">
          <linux:name>prelink</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_python3-abrt-addon_removed:obj:1" version="1">
          <linux:name>python3-abrt-addon</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_rear_installed:obj:1" version="1">
          <linux:name>rear</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_rng-tools_installed:obj:1" version="1">
          <linux:name>rng-tools</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_rsyslog-gnutls_installed:obj:1" version="1">
          <linux:name>rsyslog-gnutls</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_rsyslog_installed:obj:1" version="1">
          <linux:name>rsyslog</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_samba-common_removed:obj:1" version="1">
          <linux:name>samba-common</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_scap-security-guide_installed:obj:1" version="1">
          <linux:name>scap-security-guide</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_screen_installed:obj:1" version="1">
          <linux:name>screen</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_sendmail_removed:obj:1" version="1">
          <linux:name>sendmail</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_setroubleshoot-plugins_removed:obj:1" version="1">
          <linux:name>setroubleshoot-plugins</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_setroubleshoot-server_removed:obj:1" version="1">
          <linux:name>setroubleshoot-server</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_setroubleshoot_removed:obj:1" version="1">
          <linux:name>setroubleshoot</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_sssd-ipa_installed:obj:1" version="1">
          <linux:name>sssd-ipa</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_sudo_installed:obj:1" version="1">
          <linux:name>sudo</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_syslog-ng_installed:obj:1" version="1">
          <linux:name>syslog-ng</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_tar_installed:obj:1" version="1">
          <linux:name>tar</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_telnetd-ssl_removed:obj:1" version="1">
          <linux:name>telnetd-ssl</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_telnetd_removed:obj:1" version="1">
          <linux:name>telnetd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_tmux_installed:obj:1" version="1">
          <linux:name>tmux</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_tuned_removed:obj:1" version="1">
          <linux:name>tuned</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_usbguard_installed:obj:1" version="1">
          <linux:name>usbguard</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_vim-enhanced_installed:obj:1" version="1">
          <linux:name>vim-enhanced</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_vsftpd_installed:obj:1" version="1">
          <linux:name>vsftpd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_vsftpd_removed:obj:1" version="1">
          <linux:name>vsftpd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_xorg-x11-server-common_removed:obj:1" version="1">
          <linux:name>xorg-x11-server-common</linux:name>
        </linux:rpminfo_object>
        <linux:partition_object id="oval:ssg-object_mountboot_own_partition:obj:1" version="1">
          <linux:mount_point>/boot</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_mounthome_own_partition:obj:1" version="1">
          <linux:mount_point>/home</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_mountopt_own_partition:obj:1" version="1">
          <linux:mount_point>/opt</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_mountsrv_own_partition:obj:1" version="1">
          <linux:mount_point>/srv</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_mounttmp_own_partition:obj:1" version="1">
          <linux:mount_point>/tmp</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_mountusr_own_partition:obj:1" version="1">
          <linux:mount_point>/usr</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_mountvar_own_partition:obj:1" version="1">
          <linux:mount_point>/var</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_mountvar_log_own_partition:obj:1" version="1">
          <linux:mount_point>/var/log</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_mountvar_log_audit_own_partition:obj:1" version="1">
          <linux:mount_point>/var/log/audit</linux:mount_point>
        </linux:partition_object>
        <unix:file_object comment="/lib/" id="oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_0:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/lib</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerroot_permissions_syslibrary_files_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/lib64/" id="oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_1:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/lib64</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerroot_permissions_syslibrary_files_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_gid_0_1:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/usr/lib/" id="oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_2:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/lib</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerroot_permissions_syslibrary_files_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_gid_0_2:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/usr/lib64/" id="oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_3:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/lib64</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerroot_permissions_syslibrary_files_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_gid_0_3:ste:1</oval-def:filter>
        </unix:file_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_atd:obj:1" comment="Retrieve the ActiveState property of atd" version="1">
          <linux:unit operation="pattern match">^atd\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_atd:obj:1" comment="Retrieve the LoadState property of atd" version="1">
          <linux:unit operation="pattern match">^atd\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_atd_package_at_removed:obj:1" version="1">
          <linux:name>at</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_auditd_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_auditd_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_auditd:obj:1" comment="Retrieve the ActiveState property of auditd" version="1">
          <linux:unit operation="pattern match">^auditd\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_auditd_package_audit_installed:obj:1" version="1">
          <linux:name>audit</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_autofs:obj:1" comment="Retrieve the ActiveState property of autofs" version="1">
          <linux:unit operation="pattern match">^autofs\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_autofs:obj:1" comment="Retrieve the LoadState property of autofs" version="1">
          <linux:unit operation="pattern match">^autofs\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_autofs_package_autofs_removed:obj:1" version="1">
          <linux:name>autofs</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_bluetooth:obj:1" comment="Retrieve the ActiveState property of bluetooth" version="1">
          <linux:unit operation="pattern match">^bluetooth\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_bluetooth:obj:1" comment="Retrieve the LoadState property of bluetooth" version="1">
          <linux:unit operation="pattern match">^bluetooth\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_bluetooth_package_bluez_removed:obj:1" version="1">
          <linux:name>bluez</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_chronyd_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_chronyd_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_chronyd:obj:1" comment="Retrieve the ActiveState property of chronyd" version="1">
          <linux:unit operation="pattern match">^chronyd\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_chronyd_package_chrony_installed:obj:1" version="1">
          <linux:name>chrony</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_cron_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_cron_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_cron:obj:1" comment="Retrieve the ActiveState property of cron" version="1">
          <linux:unit operation="pattern match">^cron\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_cron_package_cron_installed:obj:1" version="1">
          <linux:name>cron</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_crond_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_crond_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_crond:obj:1" comment="Retrieve the ActiveState property of crond" version="1">
          <linux:unit operation="pattern match">^crond\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_crond_package_cronie_installed:obj:1" version="1">
          <linux:name>cronie</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_debug-shell:obj:1" comment="Retrieve the ActiveState property of debug-shell" version="1">
          <linux:unit operation="pattern match">^debug-shell\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_debug-shell:obj:1" comment="Retrieve the LoadState property of debug-shell" version="1">
          <linux:unit operation="pattern match">^debug-shell\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_debug-shell_package_systemd_removed:obj:1" version="1">
          <linux:name>systemd</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_firewalld_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_firewalld_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_firewalld:obj:1" comment="Retrieve the ActiveState property of firewalld" version="1">
          <linux:unit operation="pattern match">^firewalld\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_firewalld_package_firewalld_installed:obj:1" version="1">
          <linux:name>firewalld</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ip6tables_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ip6tables_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_ip6tables:obj:1" comment="Retrieve the ActiveState property of ip6tables" version="1">
          <linux:unit operation="pattern match">^ip6tables\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_ip6tables_package_iptables-ipv6_installed:obj:1" version="1">
          <linux:name>iptables-ipv6</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_iptables_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_iptables_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_iptables:obj:1" comment="Retrieve the ActiveState property of iptables" version="1">
          <linux:unit operation="pattern match">^iptables\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_iptables_package_iptables_installed:obj:1" version="1">
          <linux:name>iptables</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_netfs:obj:1" comment="Retrieve the ActiveState property of netfs" version="1">
          <linux:unit operation="pattern match">^netfs\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_netfs:obj:1" comment="Retrieve the LoadState property of netfs" version="1">
          <linux:unit operation="pattern match">^netfs\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_netfs_package_netfs_removed:obj:1" version="1">
          <linux:name>netfs</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_nfs-server:obj:1" comment="Retrieve the ActiveState property of nfs-server" version="1">
          <linux:unit operation="pattern match">^nfs-server\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_nfs-server:obj:1" comment="Retrieve the LoadState property of nfs-server" version="1">
          <linux:unit operation="pattern match">^nfs-server\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_nfs-server_package_nfs-utils_removed:obj:1" version="1">
          <linux:name>nfs-utils</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_nfslock:obj:1" comment="Retrieve the ActiveState property of nfslock" version="1">
          <linux:unit operation="pattern match">^nfslock\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_nfslock:obj:1" comment="Retrieve the LoadState property of nfslock" version="1">
          <linux:unit operation="pattern match">^nfslock\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_nfslock_package_nfs-utils_removed:obj:1" version="1">
          <linux:name>nfs-utils</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ntp_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ntp_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_ntp:obj:1" comment="Retrieve the ActiveState property of ntp" version="1">
          <linux:unit operation="pattern match">^ntp\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_ntp_package_ntp_installed:obj:1" version="1">
          <linux:name>ntp</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ntpd_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ntpd_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_ntpd:obj:1" comment="Retrieve the ActiveState property of ntpd" version="1">
          <linux:unit operation="pattern match">^ntpd\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_ntpd_package_ntp_installed:obj:1" version="1">
          <linux:name>ntp</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_pcscd_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_pcscd_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_pcscd:obj:1" comment="Retrieve the ActiveState property of pcscd" version="1">
          <linux:unit operation="pattern match">^pcscd\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_pcscd_package_pcsc-lite_installed:obj:1" version="1">
          <linux:name>pcsc-lite</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rngd_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rngd_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_rngd:obj:1" comment="Retrieve the ActiveState property of rngd" version="1">
          <linux:unit operation="pattern match">^rngd\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_rngd_package_rng-tools_installed:obj:1" version="1">
          <linux:name>rng-tools</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_rpcgssd:obj:1" comment="Retrieve the ActiveState property of rpcgssd" version="1">
          <linux:unit operation="pattern match">^rpcgssd\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_rpcgssd:obj:1" comment="Retrieve the LoadState property of rpcgssd" version="1">
          <linux:unit operation="pattern match">^rpcgssd\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_rpcgssd_package_nfs-utils_removed:obj:1" version="1">
          <linux:name>nfs-utils</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_rpcidmapd:obj:1" comment="Retrieve the ActiveState property of rpcidmapd" version="1">
          <linux:unit operation="pattern match">^rpcidmapd\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_rpcidmapd:obj:1" comment="Retrieve the LoadState property of rpcidmapd" version="1">
          <linux:unit operation="pattern match">^rpcidmapd\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_rpcidmapd_package_nfs-utils_removed:obj:1" version="1">
          <linux:name>nfs-utils</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_rpcsvcgssd:obj:1" comment="Retrieve the ActiveState property of rpcsvcgssd" version="1">
          <linux:unit operation="pattern match">^rpcsvcgssd\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_rpcsvcgssd:obj:1" comment="Retrieve the LoadState property of rpcsvcgssd" version="1">
          <linux:unit operation="pattern match">^rpcsvcgssd\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_rpcsvcgssd_package_nfs-utils_removed:obj:1" version="1">
          <linux:name>nfs-utils</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_rsyncd:obj:1" comment="Retrieve the ActiveState property of rsyncd" version="1">
          <linux:unit operation="pattern match">^rsyncd\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_rsyncd:obj:1" comment="Retrieve the LoadState property of rsyncd" version="1">
          <linux:unit operation="pattern match">^rsyncd\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_rsyncd_package_rsync-daemon_removed:obj:1" version="1">
          <linux:name>rsync-daemon</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rsyslog_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rsyslog_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_rsyslog:obj:1" comment="Retrieve the ActiveState property of rsyslog" version="1">
          <linux:unit operation="pattern match">^rsyslog\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_rsyslog_package_rsyslog_installed:obj:1" version="1">
          <linux:name>rsyslog</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_sshd:obj:1" comment="Retrieve the ActiveState property of sshd" version="1">
          <linux:unit operation="pattern match">^sshd\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_sshd:obj:1" comment="Retrieve the LoadState property of sshd" version="1">
          <linux:unit operation="pattern match">^sshd\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_sshd_package_openssh-server_removed:obj:1" version="1">
          <linux:name>openssh-server</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_sssd:obj:1" comment="Retrieve the ActiveState property of sssd" version="1">
          <linux:unit operation="pattern match">^sssd\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_sssd:obj:1" comment="Retrieve the LoadState property of sssd" version="1">
          <linux:unit operation="pattern match">^sssd\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_sssd_package_sssd-common_removed:obj:1" version="1">
          <linux:name>sssd-common</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_syslog:obj:1" comment="Retrieve the ActiveState property of syslog" version="1">
          <linux:unit operation="pattern match">^syslog\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_syslog:obj:1" comment="Retrieve the LoadState property of syslog" version="1">
          <linux:unit operation="pattern match">^syslog\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_syslog_package_rsyslog_removed:obj:1" version="1">
          <linux:name>rsyslog</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_syslog-ng_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_syslog-ng_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_syslog-ng:obj:1" comment="Retrieve the ActiveState property of syslog-ng" version="1">
          <linux:unit operation="pattern match">^syslog-ng\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_syslog-ng_package_syslog-ng_installed:obj:1" version="1">
          <linux:name>syslog-ng</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_systemd-coredump:obj:1" comment="Retrieve the ActiveState property of systemd-coredump" version="1">
          <linux:unit operation="pattern match">^systemd-coredump\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_systemd-coredump:obj:1" comment="Retrieve the LoadState property of systemd-coredump" version="1">
          <linux:unit operation="pattern match">^systemd-coredump\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_systemd-coredump_package_systemd_removed:obj:1" version="1">
          <linux:name>systemd</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_usbguard_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_usbguard_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_usbguard:obj:1" comment="Retrieve the ActiveState property of usbguard" version="1">
          <linux:unit operation="pattern match">^usbguard\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_usbguard_package_usbguard_installed:obj:1" version="1">
          <linux:name>usbguard</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_empty_passwords:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitEmptyPasswords(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_empty_passwords_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitEmptyPasswords(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_gssapi_auth:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_gssapi_auth_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_kerb_auth:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)KerberosAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_kerb_auth_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)KerberosAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_pubkey_auth:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PubkeyAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_pubkey_auth_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PubkeyAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_rhosts:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)IgnoreRhosts(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_rhosts_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)IgnoreRhosts(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_root_login:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_root_login_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_root_password_login:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_root_password_login_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_tcp_forwarding:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)AllowTcpForwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_tcp_forwarding_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)AllowTcpForwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_user_known_hosts:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)IgnoreUserKnownHosts(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_user_known_hosts_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)IgnoreUserKnownHosts(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_x11_forwarding:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)X11Forwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_x11_forwarding_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)X11Forwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_do_not_permit_user_env:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitUserEnvironment(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_do_not_permit_user_env_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitUserEnvironment(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_gssapi_auth:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_gssapi_auth_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_pam:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)UsePAM(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_pam_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)UsePAM(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_pubkey_auth:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PubkeyAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_pubkey_auth_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PubkeyAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_strictmodes:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)StrictModes(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_strictmodes_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)StrictModes(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_warning_banner:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)Banner(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_warning_banner_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)Banner(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_warning_banner_net:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)Banner(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_warning_banner_net_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)Banner(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_x11_forwarding:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)X11Forwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_x11_forwarding_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)X11Forwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_includes_config_files:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*Include /etc/ssh/sshd_config\.d/\*\.conf[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_print_last_log:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PrintLastLog(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_print_last_log_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PrintLastLog(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_set_keepalive_0:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)ClientAliveCountMax(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_set_keepalive_0_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)ClientAliveCountMax(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_info:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_info_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_verbose:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_verbose_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_x11_use_localhost:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)X11UseLocalhost(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_x11_use_localhost_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)X11UseLocalhost(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sssd_enable_certmap:obj:1" version="1">
          <ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\^\[certmap\/\.\+\/\.\+\]\$[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_noexec_sudoers:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(|\.d/.*)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*Defaults.*\bnoexec.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_requiretty_sudoers:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(|\.d/.*)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*Defaults.*\brequiretty.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_use_pty_sudoers:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(|\.d/.*)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*Defaults.*\buse_pty.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_logfile_sudoers:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(|\.d/.*)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*Defaults.*\blogfile=("(?:\\"|\\\\|[^"\\\n])*"\B|[^"](?:(?:\\,|\\"|\\ |\\\\|[^", \\\n])*)\b).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_fs_protected_fifos:obj:1" version="1">
          <unix:name>fs.protected_fifos</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_fs_protected_fifos_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_fs_protected_fifos_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_fs_protected_fifos:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_fs_protected_fifos:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_fs_protected_fifos_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_fs_protected_fifos:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_fs_protected_fifos:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_fs_protected_fifos:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_fs_protected_fifos:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_fs_protected_fifos:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_fs_protected_fifos:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_fs_protected_fifos:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_fs_protected_fifos_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_fs_protected_fifos:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_fs_protected_fifos:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_fs_protected_fifos:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_fs_protected_fifos:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_fs_protected_fifos:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_fs_protected_fifos:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_fs_protected_fifos:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_fs_protected_fifos:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_fs_protected_fifos:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_fs_protected_fifos:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_fs_protected_fifos:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_fs_protected_fifos:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_fifos[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_fs_protected_fifos:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_fifos[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_fs_protected_fifos:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_fifos[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_fs_protected_fifos:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_fifos[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_fs_protected_hardlinks:obj:1" version="1">
          <unix:name>fs.protected_hardlinks</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_fs_protected_hardlinks_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_fs_protected_hardlinks_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_fs_protected_hardlinks:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_fs_protected_hardlinks:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_fs_protected_hardlinks_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_fs_protected_hardlinks:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_fs_protected_hardlinks:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_fs_protected_hardlinks:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_fs_protected_hardlinks:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_fs_protected_hardlinks:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_fs_protected_hardlinks:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_fs_protected_hardlinks:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_fs_protected_hardlinks_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_fs_protected_hardlinks:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_fs_protected_hardlinks:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_fs_protected_hardlinks:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_fs_protected_hardlinks:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_fs_protected_hardlinks:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_fs_protected_hardlinks:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_fs_protected_hardlinks:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_fs_protected_hardlinks:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_fs_protected_hardlinks:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_fs_protected_hardlinks:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_fs_protected_hardlinks:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_fs_protected_hardlinks:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_fs_protected_hardlinks:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_fs_protected_hardlinks:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_fs_protected_hardlinks:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_fs_protected_regular:obj:1" version="1">
          <unix:name>fs.protected_regular</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_fs_protected_regular_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_fs_protected_regular_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_fs_protected_regular:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_fs_protected_regular:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_fs_protected_regular_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_fs_protected_regular:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_fs_protected_regular:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_fs_protected_regular:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_fs_protected_regular:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_fs_protected_regular:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_fs_protected_regular:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_fs_protected_regular:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_fs_protected_regular_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_fs_protected_regular:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_fs_protected_regular:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_fs_protected_regular:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_fs_protected_regular:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_fs_protected_regular:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_fs_protected_regular:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_fs_protected_regular:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_fs_protected_regular:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_fs_protected_regular:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_fs_protected_regular:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_fs_protected_regular:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_fs_protected_regular:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_regular[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_fs_protected_regular:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_regular[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_fs_protected_regular:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_regular[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_fs_protected_regular:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_regular[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_fs_protected_symlinks:obj:1" version="1">
          <unix:name>fs.protected_symlinks</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_fs_protected_symlinks_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_fs_protected_symlinks_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_fs_protected_symlinks:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_fs_protected_symlinks:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_fs_protected_symlinks_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_fs_protected_symlinks:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_fs_protected_symlinks:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_fs_protected_symlinks:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_fs_protected_symlinks:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_fs_protected_symlinks:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_fs_protected_symlinks:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_fs_protected_symlinks:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_fs_protected_symlinks_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_fs_protected_symlinks:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_fs_protected_symlinks:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_fs_protected_symlinks:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_fs_protected_symlinks:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_fs_protected_symlinks:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_fs_protected_symlinks:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_fs_protected_symlinks:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_fs_protected_symlinks:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_fs_protected_symlinks:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_fs_protected_symlinks:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_fs_protected_symlinks:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_fs_protected_symlinks:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_fs_protected_symlinks:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_fs_protected_symlinks:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_fs_protected_symlinks:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_fs_suid_dumpable:obj:1" version="1">
          <unix:name>fs.suid_dumpable</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_fs_suid_dumpable_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_fs_suid_dumpable_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_fs_suid_dumpable:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_fs_suid_dumpable:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_fs_suid_dumpable_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_fs_suid_dumpable:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_fs_suid_dumpable:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_fs_suid_dumpable:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_fs_suid_dumpable:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_fs_suid_dumpable:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_fs_suid_dumpable:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_fs_suid_dumpable:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_fs_suid_dumpable_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_fs_suid_dumpable:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_fs_suid_dumpable:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_fs_suid_dumpable:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_fs_suid_dumpable:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_fs_suid_dumpable:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_fs_suid_dumpable:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_fs_suid_dumpable:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_fs_suid_dumpable:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_fs_suid_dumpable:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_fs_suid_dumpable:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_fs_suid_dumpable:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_fs_suid_dumpable:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_fs_suid_dumpable:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_fs_suid_dumpable:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_fs_suid_dumpable:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_core_pattern:obj:1" version="1">
          <unix:name>kernel.core_pattern</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_kernel_core_pattern_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_kernel_core_pattern_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_core_pattern:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_core_pattern:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_kernel_core_pattern_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_kernel_core_pattern:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_kernel_core_pattern:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_kernel_core_pattern:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_kernel_core_pattern:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_kernel_core_pattern:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_kernel_core_pattern:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_kernel_core_pattern:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_kernel_core_pattern_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_kernel_core_pattern:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_kernel_core_pattern:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_core_pattern:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_kernel_core_pattern:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_core_pattern:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_core_pattern:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_kernel_core_pattern:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_kernel_core_pattern:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_core_pattern:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_kernel_core_pattern:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_core_pattern:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_core_pattern:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.core_pattern[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_core_pattern:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.core_pattern[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_core_pattern:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.core_pattern[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_core_pattern:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.core_pattern[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_dmesg_restrict:obj:1" version="1">
          <unix:name>kernel.dmesg_restrict</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_kernel_dmesg_restrict_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_kernel_dmesg_restrict_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_dmesg_restrict:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_dmesg_restrict:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_kernel_dmesg_restrict_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_kernel_dmesg_restrict:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_kernel_dmesg_restrict:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_kernel_dmesg_restrict:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_kernel_dmesg_restrict:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_kernel_dmesg_restrict:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_kernel_dmesg_restrict:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_kernel_dmesg_restrict:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_kernel_dmesg_restrict_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_kernel_dmesg_restrict:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_kernel_dmesg_restrict:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_dmesg_restrict:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_kernel_dmesg_restrict:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_dmesg_restrict:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_dmesg_restrict:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_kernel_dmesg_restrict:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_kernel_dmesg_restrict:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_dmesg_restrict:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_kernel_dmesg_restrict:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_dmesg_restrict:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_dmesg_restrict:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_dmesg_restrict:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_dmesg_restrict:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_dmesg_restrict:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_kexec_load_disabled:obj:1" version="1">
          <unix:name>kernel.kexec_load_disabled</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_kernel_kexec_load_disabled_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_kernel_kexec_load_disabled_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_kexec_load_disabled:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_kexec_load_disabled:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_kernel_kexec_load_disabled_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_kernel_kexec_load_disabled:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_kernel_kexec_load_disabled:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_kernel_kexec_load_disabled:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_kernel_kexec_load_disabled:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_kernel_kexec_load_disabled:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_kernel_kexec_load_disabled:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_kernel_kexec_load_disabled:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_kernel_kexec_load_disabled_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_kernel_kexec_load_disabled:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_kernel_kexec_load_disabled:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_kexec_load_disabled:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_kernel_kexec_load_disabled:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_kexec_load_disabled:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_kexec_load_disabled:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_kernel_kexec_load_disabled:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_kernel_kexec_load_disabled:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_kexec_load_disabled:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_kernel_kexec_load_disabled:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_kexec_load_disabled:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_kexec_load_disabled:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_kexec_load_disabled:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_kexec_load_disabled:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_kexec_load_disabled:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_kptr_restrict:obj:1" version="1">
          <unix:name>kernel.kptr_restrict</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_kernel_kptr_restrict_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_kernel_kptr_restrict_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_kptr_restrict:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_kptr_restrict:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_kernel_kptr_restrict_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_kernel_kptr_restrict:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_kernel_kptr_restrict:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_kernel_kptr_restrict:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_kernel_kptr_restrict:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_kernel_kptr_restrict:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_kernel_kptr_restrict:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_kernel_kptr_restrict:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_kernel_kptr_restrict_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_kernel_kptr_restrict:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_kernel_kptr_restrict:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_kptr_restrict:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_kernel_kptr_restrict:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_kptr_restrict:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_kptr_restrict:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_kernel_kptr_restrict:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_kernel_kptr_restrict:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_kptr_restrict:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_kernel_kptr_restrict:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_kptr_restrict:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_kptr_restrict:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_kptr_restrict:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_kptr_restrict:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_kptr_restrict:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_modules_disabled:obj:1" version="1">
          <unix:name>kernel.modules_disabled</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_kernel_modules_disabled_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_kernel_modules_disabled_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_modules_disabled:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_modules_disabled:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_kernel_modules_disabled_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_kernel_modules_disabled:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_kernel_modules_disabled:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_kernel_modules_disabled:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_kernel_modules_disabled:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_kernel_modules_disabled:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_kernel_modules_disabled:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_kernel_modules_disabled:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_kernel_modules_disabled_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_kernel_modules_disabled:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_kernel_modules_disabled:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_modules_disabled:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_kernel_modules_disabled:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_modules_disabled:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_modules_disabled:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_kernel_modules_disabled:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_kernel_modules_disabled:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_modules_disabled:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_kernel_modules_disabled:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_modules_disabled:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_modules_disabled:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.modules_disabled[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_modules_disabled:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.modules_disabled[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_modules_disabled:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.modules_disabled[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_modules_disabled:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.modules_disabled[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_panic_on_oops:obj:1" version="1">
          <unix:name>kernel.panic_on_oops</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_kernel_panic_on_oops_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_kernel_panic_on_oops_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_panic_on_oops:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_panic_on_oops:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_kernel_panic_on_oops_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_kernel_panic_on_oops:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_kernel_panic_on_oops:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_kernel_panic_on_oops:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_kernel_panic_on_oops:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_kernel_panic_on_oops:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_kernel_panic_on_oops:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_kernel_panic_on_oops:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_kernel_panic_on_oops_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_kernel_panic_on_oops:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_kernel_panic_on_oops:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_panic_on_oops:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_kernel_panic_on_oops:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_panic_on_oops:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_panic_on_oops:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_kernel_panic_on_oops:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_kernel_panic_on_oops:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_panic_on_oops:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_kernel_panic_on_oops:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_panic_on_oops:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_panic_on_oops:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.panic_on_oops[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_panic_on_oops:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.panic_on_oops[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_panic_on_oops:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.panic_on_oops[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_panic_on_oops:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.panic_on_oops[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_perf_cpu_time_max_percent:obj:1" version="1">
          <unix:name>kernel.perf_cpu_time_max_percent</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_kernel_perf_cpu_time_max_percent_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_kernel_perf_cpu_time_max_percent_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_perf_cpu_time_max_percent:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_perf_cpu_time_max_percent:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_kernel_perf_cpu_time_max_percent_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_kernel_perf_cpu_time_max_percent:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_kernel_perf_cpu_time_max_percent:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_kernel_perf_cpu_time_max_percent:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_kernel_perf_cpu_time_max_percent:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_kernel_perf_cpu_time_max_percent:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_kernel_perf_cpu_time_max_percent:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_kernel_perf_cpu_time_max_percent:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_kernel_perf_cpu_time_max_percent_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_kernel_perf_cpu_time_max_percent:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_kernel_perf_cpu_time_max_percent:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_perf_cpu_time_max_percent:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_kernel_perf_cpu_time_max_percent:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_perf_cpu_time_max_percent:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_perf_cpu_time_max_percent:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_kernel_perf_cpu_time_max_percent:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_kernel_perf_cpu_time_max_percent:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_perf_cpu_time_max_percent:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_kernel_perf_cpu_time_max_percent:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_perf_cpu_time_max_percent:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_perf_cpu_time_max_percent:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_perf_cpu_time_max_percent:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_perf_event_max_sample_rate:obj:1" version="1">
          <unix:name>kernel.perf_event_max_sample_rate</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_kernel_perf_event_max_sample_rate_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_kernel_perf_event_max_sample_rate_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_perf_event_max_sample_rate:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_perf_event_max_sample_rate:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_kernel_perf_event_max_sample_rate_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_kernel_perf_event_max_sample_rate:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_kernel_perf_event_max_sample_rate:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_kernel_perf_event_max_sample_rate:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_kernel_perf_event_max_sample_rate:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_kernel_perf_event_max_sample_rate:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_kernel_perf_event_max_sample_rate:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_kernel_perf_event_max_sample_rate:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_kernel_perf_event_max_sample_rate_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_kernel_perf_event_max_sample_rate:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_kernel_perf_event_max_sample_rate:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_perf_event_max_sample_rate:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_kernel_perf_event_max_sample_rate:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_perf_event_max_sample_rate:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_perf_event_max_sample_rate:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_kernel_perf_event_max_sample_rate:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_kernel_perf_event_max_sample_rate:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_perf_event_max_sample_rate:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_kernel_perf_event_max_sample_rate:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_perf_event_max_sample_rate:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_perf_event_max_sample_rate:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_perf_event_max_sample_rate:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_perf_event_paranoid:obj:1" version="1">
          <unix:name>kernel.perf_event_paranoid</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_kernel_perf_event_paranoid_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_kernel_perf_event_paranoid_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_perf_event_paranoid:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_perf_event_paranoid:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_kernel_perf_event_paranoid_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_kernel_perf_event_paranoid:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_kernel_perf_event_paranoid:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_kernel_perf_event_paranoid:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_kernel_perf_event_paranoid:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_kernel_perf_event_paranoid:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_kernel_perf_event_paranoid:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_kernel_perf_event_paranoid:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_kernel_perf_event_paranoid_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_kernel_perf_event_paranoid:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_kernel_perf_event_paranoid:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_perf_event_paranoid:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_kernel_perf_event_paranoid:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_perf_event_paranoid:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_perf_event_paranoid:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_kernel_perf_event_paranoid:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_kernel_perf_event_paranoid:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_perf_event_paranoid:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_kernel_perf_event_paranoid:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_paranoid:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_perf_event_paranoid:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_perf_event_paranoid:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_perf_event_paranoid:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_paranoid:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_pid_max:obj:1" version="1">
          <unix:name>kernel.pid_max</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_kernel_pid_max_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_kernel_pid_max_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_pid_max:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_pid_max:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_kernel_pid_max_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_kernel_pid_max:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_kernel_pid_max:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_kernel_pid_max:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_kernel_pid_max:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_kernel_pid_max:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_kernel_pid_max:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_kernel_pid_max:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_kernel_pid_max_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_kernel_pid_max:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_kernel_pid_max:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_pid_max:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_kernel_pid_max:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_pid_max:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_pid_max:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_kernel_pid_max:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_kernel_pid_max:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_pid_max:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_kernel_pid_max:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_pid_max:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_pid_max:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_pid_max:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_pid_max:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_pid_max:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_randomize_va_space:obj:1" version="1">
          <unix:name>kernel.randomize_va_space</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_kernel_randomize_va_space_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_kernel_randomize_va_space_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_randomize_va_space:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_randomize_va_space:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_kernel_randomize_va_space_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_kernel_randomize_va_space:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_kernel_randomize_va_space:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_kernel_randomize_va_space:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_kernel_randomize_va_space:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_kernel_randomize_va_space:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_kernel_randomize_va_space:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_kernel_randomize_va_space:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_kernel_randomize_va_space_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_kernel_randomize_va_space:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_kernel_randomize_va_space:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_randomize_va_space:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_kernel_randomize_va_space:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_randomize_va_space:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_randomize_va_space:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_kernel_randomize_va_space:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_kernel_randomize_va_space:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_randomize_va_space:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_kernel_randomize_va_space:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_randomize_va_space:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_randomize_va_space:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_randomize_va_space:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_randomize_va_space:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_randomize_va_space:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_sysrq:obj:1" version="1">
          <unix:name>kernel.sysrq</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_kernel_sysrq_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_kernel_sysrq_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_sysrq:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_sysrq:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_kernel_sysrq_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_kernel_sysrq:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_kernel_sysrq:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_kernel_sysrq:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_kernel_sysrq:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_kernel_sysrq:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_kernel_sysrq:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_kernel_sysrq:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_kernel_sysrq_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_kernel_sysrq:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_kernel_sysrq:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_sysrq:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_kernel_sysrq:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_sysrq:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_sysrq:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_kernel_sysrq:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_kernel_sysrq:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_sysrq:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_kernel_sysrq:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_sysrq:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_sysrq:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_sysrq:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_sysrq:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_sysrq:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_unprivileged_bpf_disabled:obj:1" version="1">
          <unix:name>kernel.unprivileged_bpf_disabled</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_kernel_unprivileged_bpf_disabled_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_kernel_unprivileged_bpf_disabled_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_unprivileged_bpf_disabled:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_unprivileged_bpf_disabled:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_kernel_unprivileged_bpf_disabled_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_kernel_unprivileged_bpf_disabled:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_kernel_unprivileged_bpf_disabled:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_kernel_unprivileged_bpf_disabled:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_kernel_unprivileged_bpf_disabled:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_kernel_unprivileged_bpf_disabled:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_kernel_unprivileged_bpf_disabled:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_kernel_unprivileged_bpf_disabled:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_kernel_unprivileged_bpf_disabled_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_kernel_unprivileged_bpf_disabled:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_kernel_unprivileged_bpf_disabled:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_unprivileged_bpf_disabled:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_kernel_unprivileged_bpf_disabled:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_unprivileged_bpf_disabled:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_unprivileged_bpf_disabled:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_kernel_unprivileged_bpf_disabled:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_kernel_unprivileged_bpf_disabled:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_unprivileged_bpf_disabled:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_kernel_unprivileged_bpf_disabled:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_unprivileged_bpf_disabled:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_unprivileged_bpf_disabled:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_unprivileged_bpf_disabled:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_yama_ptrace_scope:obj:1" version="1">
          <unix:name>kernel.yama.ptrace_scope</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_kernel_yama_ptrace_scope_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_kernel_yama_ptrace_scope_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_yama_ptrace_scope:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_yama_ptrace_scope:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_kernel_yama_ptrace_scope_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_kernel_yama_ptrace_scope:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_kernel_yama_ptrace_scope:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_kernel_yama_ptrace_scope:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_kernel_yama_ptrace_scope:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_kernel_yama_ptrace_scope:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_kernel_yama_ptrace_scope:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_kernel_yama_ptrace_scope:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_kernel_yama_ptrace_scope_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_kernel_yama_ptrace_scope:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_kernel_yama_ptrace_scope:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_yama_ptrace_scope:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_kernel_yama_ptrace_scope:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_yama_ptrace_scope:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_yama_ptrace_scope:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_kernel_yama_ptrace_scope:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_kernel_yama_ptrace_scope:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_yama_ptrace_scope:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_kernel_yama_ptrace_scope:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_yama_ptrace_scope:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_yama_ptrace_scope:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_yama_ptrace_scope:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_yama_ptrace_scope:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_yama_ptrace_scope:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_core_bpf_jit_harden:obj:1" version="1">
          <unix:name>net.core.bpf_jit_harden</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_core_bpf_jit_harden_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_core_bpf_jit_harden_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_core_bpf_jit_harden:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_core_bpf_jit_harden:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_core_bpf_jit_harden_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_core_bpf_jit_harden:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_core_bpf_jit_harden:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_core_bpf_jit_harden:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_core_bpf_jit_harden:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_core_bpf_jit_harden:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_core_bpf_jit_harden:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_core_bpf_jit_harden:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_core_bpf_jit_harden_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_core_bpf_jit_harden:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_core_bpf_jit_harden:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_core_bpf_jit_harden:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_core_bpf_jit_harden:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_core_bpf_jit_harden:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_core_bpf_jit_harden:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_core_bpf_jit_harden:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_core_bpf_jit_harden:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_core_bpf_jit_harden:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_core_bpf_jit_harden:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_core_bpf_jit_harden:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_core_bpf_jit_harden:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_core_bpf_jit_harden:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_core_bpf_jit_harden:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_core_bpf_jit_harden:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_accept_local:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.accept_local</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_all_accept_local_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_accept_local_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_accept_local:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_accept_local:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv4_conf_all_accept_local_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_all_accept_local:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_all_accept_local:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_all_accept_local:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_all_accept_local:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_all_accept_local:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_all_accept_local:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_all_accept_local:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv4_conf_all_accept_local_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_all_accept_local:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_accept_local:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_accept_local:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_accept_local:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_accept_local:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_accept_local:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_local:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_local:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_accept_local:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_local:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_local:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_local:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_local[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_local:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_local[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_local:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_local[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_local:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_local[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.accept_redirects</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_all_accept_redirects_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_accept_redirects_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv4_conf_all_accept_redirects_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_all_accept_redirects:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_all_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_all_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_all_accept_redirects:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_all_accept_redirects:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_all_accept_redirects:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_all_accept_redirects:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv4_conf_all_accept_redirects_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_all_accept_redirects:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_accept_redirects:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.accept_source_route</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_all_accept_source_route_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_accept_source_route_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_accept_source_route:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv4_conf_all_accept_source_route_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_all_accept_source_route:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_all_accept_source_route:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_all_accept_source_route:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_all_accept_source_route:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_all_accept_source_route:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_all_accept_source_route:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_all_accept_source_route:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv4_conf_all_accept_source_route_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_all_accept_source_route:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_accept_source_route:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_accept_source_route:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_accept_source_route:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_source_route:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_source_route:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_arp_filter:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.arp_filter</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_all_arp_filter_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_arp_filter_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_arp_filter:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_arp_filter:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv4_conf_all_arp_filter_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_all_arp_filter:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_all_arp_filter:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_all_arp_filter:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_all_arp_filter:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_all_arp_filter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_all_arp_filter:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_all_arp_filter:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv4_conf_all_arp_filter_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_all_arp_filter:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_arp_filter:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_arp_filter:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_arp_filter:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_arp_filter:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_arp_filter:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_all_arp_filter:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_arp_filter:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_arp_filter:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_arp_filter:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_arp_filter:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_arp_filter:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_filter[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_arp_filter:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_filter[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_arp_filter:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_filter[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_arp_filter:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_filter[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.arp_ignore</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_all_arp_ignore_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_arp_ignore_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_arp_ignore:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv4_conf_all_arp_ignore_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_all_arp_ignore:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_all_arp_ignore:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_all_arp_ignore:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_all_arp_ignore:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_all_arp_ignore:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_all_arp_ignore:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_all_arp_ignore:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv4_conf_all_arp_ignore_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_all_arp_ignore:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_arp_ignore:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_arp_ignore:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_arp_ignore:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_all_arp_ignore:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_arp_ignore:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_arp_ignore:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_arp_ignore:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_ignore[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_ignore[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_ignore[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_ignore[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.drop_gratuitous_arp</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv4_conf_all_drop_gratuitous_arp_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_all_drop_gratuitous_arp:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_all_drop_gratuitous_arp:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv4_conf_all_drop_gratuitous_arp_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_all_drop_gratuitous_arp:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_drop_gratuitous_arp:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.drop_gratuitous_arp[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.drop_gratuitous_arp[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.drop_gratuitous_arp[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.drop_gratuitous_arp[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_log_martians:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.log_martians</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_all_log_martians_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_log_martians_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_log_martians:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_log_martians:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv4_conf_all_log_martians_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_all_log_martians:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_all_log_martians:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_all_log_martians:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_all_log_martians:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_all_log_martians:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_all_log_martians:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_all_log_martians:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv4_conf_all_log_martians_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_all_log_martians:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_log_martians:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_log_martians:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_log_martians:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_log_martians:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_log_martians:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_all_log_martians:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_log_martians:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_log_martians:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_log_martians:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_log_martians:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_log_martians:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_log_martians:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_route_localnet:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.route_localnet</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_all_route_localnet_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_route_localnet_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_route_localnet:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_route_localnet:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv4_conf_all_route_localnet_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_all_route_localnet:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_all_route_localnet:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_all_route_localnet:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_all_route_localnet:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_all_route_localnet:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_all_route_localnet:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_all_route_localnet:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv4_conf_all_route_localnet_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_all_route_localnet:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_route_localnet:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_route_localnet:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_route_localnet:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_route_localnet:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_route_localnet:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_all_route_localnet:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_route_localnet:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_route_localnet:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_route_localnet:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_route_localnet:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_route_localnet:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.route_localnet[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_route_localnet:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.route_localnet[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_route_localnet:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.route_localnet[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_route_localnet:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.route_localnet[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_rp_filter:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.rp_filter</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_all_rp_filter_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_rp_filter_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_rp_filter:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_rp_filter:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv4_conf_all_rp_filter_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_all_rp_filter:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_all_rp_filter:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_all_rp_filter:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_all_rp_filter:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_all_rp_filter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_all_rp_filter:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_all_rp_filter:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv4_conf_all_rp_filter_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_all_rp_filter:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_rp_filter:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_rp_filter:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_rp_filter:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_rp_filter:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_rp_filter:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_all_rp_filter:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_rp_filter:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_rp_filter:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_rp_filter:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_rp_filter:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_rp_filter:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_rp_filter:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.secure_redirects</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_all_secure_redirects_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_secure_redirects_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_secure_redirects:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv4_conf_all_secure_redirects_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_all_secure_redirects:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_all_secure_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_all_secure_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_all_secure_redirects:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_all_secure_redirects:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_all_secure_redirects:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_all_secure_redirects:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv4_conf_all_secure_redirects_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_all_secure_redirects:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_secure_redirects:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_secure_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_secure_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_all_secure_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_secure_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_send_redirects:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.send_redirects</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_all_send_redirects_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_send_redirects_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_send_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_send_redirects:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv4_conf_all_send_redirects_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_all_send_redirects:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_all_send_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_all_send_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_all_send_redirects:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_all_send_redirects:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_all_send_redirects:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_all_send_redirects:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv4_conf_all_send_redirects_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_all_send_redirects:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_send_redirects:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_send_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_send_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_send_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_send_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_all_send_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_send_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_send_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_send_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_send_redirects:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_send_redirects:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_send_redirects:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_shared_media:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.shared_media</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_all_shared_media_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_shared_media_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_shared_media:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_shared_media:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv4_conf_all_shared_media_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_all_shared_media:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_all_shared_media:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_all_shared_media:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_all_shared_media:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_all_shared_media:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_all_shared_media:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_all_shared_media:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv4_conf_all_shared_media_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_all_shared_media:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_shared_media:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_shared_media:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_shared_media:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_shared_media:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_shared_media:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_all_shared_media:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_shared_media:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_shared_media:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_shared_media:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_shared_media:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_shared_media:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.shared_media[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_shared_media:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.shared_media[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_shared_media:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.shared_media[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_shared_media:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.shared_media[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
          <unix:name>net.ipv4.conf.default.accept_redirects</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_default_accept_redirects_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_accept_redirects_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv4_conf_default_accept_redirects_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_default_accept_redirects:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_default_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_default_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_default_accept_redirects:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_default_accept_redirects:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_default_accept_redirects:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_default_accept_redirects:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv4_conf_default_accept_redirects_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_default_accept_redirects:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_accept_redirects:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_default_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
          <unix:name>net.ipv4.conf.default.accept_source_route</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_default_accept_source_route_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_accept_source_route_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_accept_source_route:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv4_conf_default_accept_source_route_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_default_accept_source_route:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_default_accept_source_route:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_default_accept_source_route:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_default_accept_source_route:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_default_accept_source_route:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_default_accept_source_route:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_default_accept_source_route:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv4_conf_default_accept_source_route_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_default_accept_source_route:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_accept_source_route:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_accept_source_route:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_accept_source_route:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_default_accept_source_route:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_source_route:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_log_martians:obj:1" version="1">
          <unix:name>net.ipv4.conf.default.log_martians</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_default_log_martians_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_log_martians_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_log_martians:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_log_martians:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv4_conf_default_log_martians_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_default_log_martians:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_default_log_martians:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_default_log_martians:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_default_log_martians:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_default_log_martians:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_default_log_martians:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_default_log_martians:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv4_conf_default_log_martians_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_default_log_martians:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_log_martians:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_log_martians:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_log_martians:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_log_martians:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_log_martians:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_default_log_martians:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_log_martians:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_log_martians:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_log_martians:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_log_martians:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_log_martians:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_log_martians:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_rp_filter:obj:1" version="1">
          <unix:name>net.ipv4.conf.default.rp_filter</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_default_rp_filter_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_rp_filter_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_rp_filter:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_rp_filter:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv4_conf_default_rp_filter_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_default_rp_filter:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_default_rp_filter:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_default_rp_filter:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_default_rp_filter:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_default_rp_filter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_default_rp_filter:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_default_rp_filter:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv4_conf_default_rp_filter_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_default_rp_filter:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_rp_filter:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_rp_filter:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_rp_filter:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_rp_filter:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_rp_filter:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_default_rp_filter:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_rp_filter:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_rp_filter:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_rp_filter:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_rp_filter:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_rp_filter:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_rp_filter:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
          <unix:name>net.ipv4.conf.default.secure_redirects</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_default_secure_redirects_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_secure_redirects_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_secure_redirects:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv4_conf_default_secure_redirects_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_default_secure_redirects:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_default_secure_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_default_secure_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_default_secure_redirects:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_default_secure_redirects:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_default_secure_redirects:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_default_secure_redirects:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv4_conf_default_secure_redirects_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_default_secure_redirects:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_secure_redirects:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_secure_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_secure_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_default_secure_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_secure_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_send_redirects:obj:1" version="1">
          <unix:name>net.ipv4.conf.default.send_redirects</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_default_send_redirects_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_send_redirects_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_send_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_send_redirects:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv4_conf_default_send_redirects_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_default_send_redirects:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_default_send_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_default_send_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_default_send_redirects:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_default_send_redirects:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_default_send_redirects:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_default_send_redirects:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv4_conf_default_send_redirects_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_default_send_redirects:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_send_redirects:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_send_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_send_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_send_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_send_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_default_send_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_send_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_send_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_send_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_send_redirects:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_send_redirects:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_send_redirects:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_shared_media:obj:1" version="1">
          <unix:name>net.ipv4.conf.default.shared_media</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_default_shared_media_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_shared_media_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_shared_media:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_shared_media:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv4_conf_default_shared_media_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_default_shared_media:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_default_shared_media:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_default_shared_media:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_default_shared_media:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_default_shared_media:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_default_shared_media:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_default_shared_media:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv4_conf_default_shared_media_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_default_shared_media:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_shared_media:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_shared_media:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_shared_media:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_shared_media:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_shared_media:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_default_shared_media:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_shared_media:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_shared_media:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_shared_media:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_shared_media:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_shared_media:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.shared_media[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_shared_media:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.shared_media[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_shared_media:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.shared_media[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_shared_media:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.shared_media[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
          <unix:name>net.ipv4.icmp_echo_ignore_broadcasts</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv4_icmp_echo_ignore_broadcasts_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv4_icmp_echo_ignore_broadcasts:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv4_icmp_echo_ignore_broadcasts:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv4_icmp_echo_ignore_broadcasts_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv4_icmp_echo_ignore_broadcasts:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_icmp_echo_ignore_broadcasts:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
          <unix:name>net.ipv4.icmp_ignore_bogus_error_responses</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv4_icmp_ignore_bogus_error_responses_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv4_icmp_ignore_bogus_error_responses:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv4_icmp_ignore_bogus_error_responses:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv4_icmp_ignore_bogus_error_responses_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv4_icmp_ignore_bogus_error_responses:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_icmp_ignore_bogus_error_responses:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_ip_forward:obj:1" version="1">
          <unix:name>net.ipv4.ip_forward</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv4_ip_forward_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_ip_forward_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_ip_forward:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_ip_forward:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv4_ip_forward_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv4_ip_forward:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv4_ip_forward:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv4_ip_forward:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv4_ip_forward:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv4_ip_forward:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_ip_forward:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv4_ip_forward:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv4_ip_forward_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv4_ip_forward:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_ip_forward:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_ip_forward:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_ip_forward:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_ip_forward:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_ip_forward:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv4_ip_forward:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_ip_forward:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_ip_forward:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_ip_forward:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_forward:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_ip_forward:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_ip_forward:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_ip_forward:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_forward:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_ip_local_port_range:obj:1" version="1">
          <unix:name>net.ipv4.ip_local_port_range</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv4_ip_local_port_range_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_ip_local_port_range_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_ip_local_port_range:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_ip_local_port_range:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv4_ip_local_port_range_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv4_ip_local_port_range:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv4_ip_local_port_range:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv4_ip_local_port_range:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv4_ip_local_port_range:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv4_ip_local_port_range:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_ip_local_port_range:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv4_ip_local_port_range:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv4_ip_local_port_range_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv4_ip_local_port_range:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_ip_local_port_range:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_ip_local_port_range:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_ip_local_port_range:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_ip_local_port_range:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_ip_local_port_range:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv4_ip_local_port_range:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_ip_local_port_range:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_ip_local_port_range:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_ip_local_port_range:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_local_port_range:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_ip_local_port_range:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_local_port_range[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_ip_local_port_range:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_local_port_range[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_ip_local_port_range:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_local_port_range[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_local_port_range:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_local_port_range[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_tcp_syncookies:obj:1" version="1">
          <unix:name>net.ipv4.tcp_syncookies</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv4_tcp_syncookies_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_tcp_syncookies_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_tcp_syncookies:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_tcp_syncookies:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv4_tcp_syncookies_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv4_tcp_syncookies:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv4_tcp_syncookies:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv4_tcp_syncookies:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv4_tcp_syncookies:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv4_tcp_syncookies:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_tcp_syncookies:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv4_tcp_syncookies:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv4_tcp_syncookies_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv4_tcp_syncookies:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_tcp_syncookies:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_tcp_syncookies:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_tcp_syncookies:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_tcp_syncookies:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_tcp_syncookies:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv4_tcp_syncookies:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_tcp_syncookies:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_tcp_syncookies:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_tcp_syncookies:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_tcp_syncookies:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_tcp_syncookies:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_tcp_syncookies:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.accept_ra_defrtr</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_all_accept_ra_defrtr_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_accept_ra_defrtr_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_accept_ra_defrtr:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv6_conf_all_accept_ra_defrtr_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_all_accept_ra_defrtr:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_all_accept_ra_defrtr:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_all_accept_ra_defrtr:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_all_accept_ra_defrtr:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_all_accept_ra_defrtr:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_all_accept_ra_defrtr:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_all_accept_ra_defrtr:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv6_conf_all_accept_ra_defrtr_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_all_accept_ra_defrtr:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_accept_ra_defrtr:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_accept_ra_defrtr:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_accept_ra_defrtr:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.accept_ra_pinfo</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_all_accept_ra_pinfo_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_accept_ra_pinfo_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_accept_ra_pinfo:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv6_conf_all_accept_ra_pinfo_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_all_accept_ra_pinfo:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_all_accept_ra_pinfo:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_all_accept_ra_pinfo:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_all_accept_ra_pinfo:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_all_accept_ra_pinfo:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_all_accept_ra_pinfo:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_all_accept_ra_pinfo:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv6_conf_all_accept_ra_pinfo_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_all_accept_ra_pinfo:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_accept_ra_pinfo:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_accept_ra_pinfo:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_accept_ra_pinfo:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.accept_ra_rtr_pref</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv6_conf_all_accept_ra_rtr_pref_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_all_accept_ra_rtr_pref:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_all_accept_ra_rtr_pref:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv6_conf_all_accept_ra_rtr_pref_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_all_accept_ra_rtr_pref:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_autoconf:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.autoconf</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_all_autoconf_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_autoconf_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_autoconf:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_autoconf:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv6_conf_all_autoconf_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_all_autoconf:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_all_autoconf:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_all_autoconf:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_all_autoconf:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_all_autoconf:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_all_autoconf:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_all_autoconf:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv6_conf_all_autoconf_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_all_autoconf:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_autoconf:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_autoconf:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_autoconf:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_autoconf:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_autoconf:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_all_autoconf:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_autoconf:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_autoconf:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_autoconf:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_autoconf:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_autoconf:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.autoconf[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_autoconf:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.autoconf[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_autoconf:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.autoconf[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_autoconf:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.autoconf[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.disable_ipv6</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_all_disable_ipv6_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_disable_ipv6_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_disable_ipv6:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv6_conf_all_disable_ipv6_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_all_disable_ipv6:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_all_disable_ipv6:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_all_disable_ipv6:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_all_disable_ipv6:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_all_disable_ipv6:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_all_disable_ipv6:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_all_disable_ipv6:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv6_conf_all_disable_ipv6_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_all_disable_ipv6:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_disable_ipv6:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_disable_ipv6:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_disable_ipv6:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_max_addresses:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.max_addresses</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_all_max_addresses_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_max_addresses_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_max_addresses:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_max_addresses:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv6_conf_all_max_addresses_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_all_max_addresses:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_all_max_addresses:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_all_max_addresses:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_all_max_addresses:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_all_max_addresses:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_all_max_addresses:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_all_max_addresses:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv6_conf_all_max_addresses_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_all_max_addresses:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_max_addresses:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_max_addresses:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_max_addresses:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_max_addresses:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_max_addresses:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_all_max_addresses:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_max_addresses:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_max_addresses:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_max_addresses:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_max_addresses:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_max_addresses:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.max_addresses[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_max_addresses:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.max_addresses[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_max_addresses:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.max_addresses[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_max_addresses:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.max_addresses[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.router_solicitations</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_all_router_solicitations_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_router_solicitations_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_router_solicitations:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv6_conf_all_router_solicitations_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_all_router_solicitations:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_all_router_solicitations:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_all_router_solicitations:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_all_router_solicitations:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_all_router_solicitations:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_all_router_solicitations:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_all_router_solicitations:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv6_conf_all_router_solicitations_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_all_router_solicitations:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_router_solicitations:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_router_solicitations:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_router_solicitations:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_all_router_solicitations:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_router_solicitations:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_router_solicitations:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_router_solicitations:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.accept_ra</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_default_accept_ra_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_accept_ra_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_accept_ra:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_ra:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv6_conf_default_accept_ra_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_default_accept_ra:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_default_accept_ra:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_default_accept_ra:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_default_accept_ra:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_default_accept_ra:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_default_accept_ra:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_default_accept_ra:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv6_conf_default_accept_ra_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_default_accept_ra:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_accept_ra:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_ra:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_accept_ra:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_accept_ra:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_accept_ra:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_accept_ra:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.accept_ra_defrtr</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_default_accept_ra_defrtr_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_accept_ra_defrtr_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_ra_defrtr:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv6_conf_default_accept_ra_defrtr_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_default_accept_ra_defrtr:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_default_accept_ra_defrtr:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_default_accept_ra_defrtr:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_default_accept_ra_defrtr:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_default_accept_ra_defrtr:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_default_accept_ra_defrtr:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_default_accept_ra_defrtr:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv6_conf_default_accept_ra_defrtr_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_default_accept_ra_defrtr:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_accept_ra_defrtr:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_accept_ra_defrtr:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_accept_ra_defrtr:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.accept_ra_pinfo</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_default_accept_ra_pinfo_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_accept_ra_pinfo_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_ra_pinfo:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv6_conf_default_accept_ra_pinfo_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_default_accept_ra_pinfo:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_default_accept_ra_pinfo:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_default_accept_ra_pinfo:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_default_accept_ra_pinfo:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_default_accept_ra_pinfo:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_default_accept_ra_pinfo:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_default_accept_ra_pinfo:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv6_conf_default_accept_ra_pinfo_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_default_accept_ra_pinfo:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_accept_ra_pinfo:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_accept_ra_pinfo:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_accept_ra_pinfo:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.accept_ra_rtr_pref</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv6_conf_default_accept_ra_rtr_pref_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_default_accept_ra_rtr_pref:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_default_accept_ra_rtr_pref:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv6_conf_default_accept_ra_rtr_pref_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_default_accept_ra_rtr_pref:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.accept_redirects</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_default_accept_redirects_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_accept_redirects_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv6_conf_default_accept_redirects_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_default_accept_redirects:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_default_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_default_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_default_accept_redirects:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_default_accept_redirects:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_default_accept_redirects:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_default_accept_redirects:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv6_conf_default_accept_redirects_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_default_accept_redirects:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_accept_redirects:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_autoconf:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.autoconf</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_default_autoconf_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_autoconf_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_autoconf:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_autoconf:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv6_conf_default_autoconf_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_default_autoconf:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_default_autoconf:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_default_autoconf:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_default_autoconf:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_default_autoconf:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_default_autoconf:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_default_autoconf:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv6_conf_default_autoconf_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_default_autoconf:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_autoconf:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_autoconf:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_autoconf:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_autoconf:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_autoconf:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_default_autoconf:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_autoconf:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_autoconf:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_autoconf:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_autoconf:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_autoconf:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.autoconf[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_autoconf:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.autoconf[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_autoconf:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.autoconf[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_autoconf:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.autoconf[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.disable_ipv6</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_default_disable_ipv6_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_disable_ipv6_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_disable_ipv6:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv6_conf_default_disable_ipv6_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_default_disable_ipv6:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_default_disable_ipv6:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_default_disable_ipv6:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_default_disable_ipv6:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_default_disable_ipv6:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_default_disable_ipv6:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_default_disable_ipv6:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv6_conf_default_disable_ipv6_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_default_disable_ipv6:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_disable_ipv6:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_disable_ipv6:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_disable_ipv6:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.disable_ipv6[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.disable_ipv6[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.disable_ipv6[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.disable_ipv6[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_max_addresses:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.max_addresses</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_default_max_addresses_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_max_addresses_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_max_addresses:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_max_addresses:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv6_conf_default_max_addresses_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_default_max_addresses:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_default_max_addresses:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_default_max_addresses:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_default_max_addresses:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_default_max_addresses:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_default_max_addresses:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_default_max_addresses:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv6_conf_default_max_addresses_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_default_max_addresses:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_max_addresses:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_max_addresses:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_max_addresses:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_max_addresses:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_max_addresses:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_default_max_addresses:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_max_addresses:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_max_addresses:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_max_addresses:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_max_addresses:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_max_addresses:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.max_addresses[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_max_addresses:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.max_addresses[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_max_addresses:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.max_addresses[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_max_addresses:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.max_addresses[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.router_solicitations</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_default_router_solicitations_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_router_solicitations_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_router_solicitations:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_net_ipv6_conf_default_router_solicitations_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_default_router_solicitations:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_default_router_solicitations:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_default_router_solicitations:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_default_router_solicitations:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_default_router_solicitations:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_default_router_solicitations:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_default_router_solicitations:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_net_ipv6_conf_default_router_solicitations_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_default_router_solicitations:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_router_solicitations:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_router_solicitations:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_router_solicitations:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_default_router_solicitations:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_router_solicitations:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_router_solicitations:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_router_solicitations:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.router_solicitations[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.router_solicitations[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.router_solicitations[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.router_solicitations[\s]*=[\s]*(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_user_max_user_namespaces:obj:1" version="1">
          <unix:name>user.max_user_namespaces</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_user_max_user_namespaces_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_user_max_user_namespaces_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_user_max_user_namespaces:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_user_max_user_namespaces:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_user_max_user_namespaces_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_user_max_user_namespaces:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_user_max_user_namespaces:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_user_max_user_namespaces:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_user_max_user_namespaces:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_user_max_user_namespaces:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_user_max_user_namespaces:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_user_max_user_namespaces:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_user_max_user_namespaces_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_user_max_user_namespaces:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_user_max_user_namespaces:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_user_max_user_namespaces:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_user_max_user_namespaces:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_user_max_user_namespaces:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_user_max_user_namespaces:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_user_max_user_namespaces:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_user_max_user_namespaces:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_user_max_user_namespaces:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_user_max_user_namespaces:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_user_max_user_namespaces:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_user_max_user_namespaces:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_user_max_user_namespaces:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_user_max_user_namespaces:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_user_max_user_namespaces:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_vm_mmap_min_addr:obj:1" version="1">
          <unix:name>vm.mmap_min_addr</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-oject_sysctl_vm_mmap_min_addr_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_unique_sysctl_vm_mmap_min_addr_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_vm_mmap_min_addr:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_set_unfiltered_sysctls_vm_mmap_min_addr:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_vm_mmap_min_addr_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_vm_mmap_min_addr:obj:1" comment="combine the blank string with symlink paths found" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_vm_mmap_min_addr:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_vm_mmap_min_addr:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_vm_mmap_min_addr:obj:1" comment="variable object of the blank string" version="1">
          <ind:var_ref>oval:ssg-local_var_blank_path_vm_mmap_min_addr:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_vm_mmap_min_addr:obj:1" comment="variable object of the symlinks found" version="1">
          <ind:var_ref>oval:ssg-local_var_symlinks_vm_mmap_min_addr:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="Symlinks referencing files in default dirs" id="oval:ssg-object_vm_mmap_min_addr_symlinks:obj:1" version="1">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_vm_mmap_min_addr:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_vm_mmap_min_addr:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_vm_mmap_min_addr:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_vm_mmap_min_addr:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_vm_mmap_min_addr:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_vm_mmap_min_addr:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_vm_mmap_min_addr:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_vm_mmap_min_addr:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_vm_mmap_min_addr:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_vm_mmap_min_addr:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_usr_lib_sysctld_vm_mmap_min_addr:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_vm_mmap_min_addr:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_vm_mmap_min_addr:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_vm_mmap_min_addr:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_vm_mmap_min_addr:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_dnf-automatic_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_timer_running_dnf-automatic:obj:1" comment="Retrieve the ActiveState property of dnf-automatic" version="1">
          <linux:unit operation="pattern match">dnf-automatic\.timer</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_accounts_password_pam_faillock:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_faillock\.so.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality:obj:1" version="1">
          <ind:filepath var_ref="oval:ssg-var_pam_pwquality_config_path:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_auditctl:obj:1" version="1">
          <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
          <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_augenrules:obj:1" version="1">
          <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
          <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_setdomainname_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_setdomainname_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_setdomainname_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_setdomainname_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_sethostname_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_sethostname_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_sethostname_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_sethostname_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_conf_log_file:obj:1" version="1">
          <ind:filepath operation="equals">/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^(log_file\s*=\s*.*)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_conf_log_group_root:obj:1" comment="log_group = root" version="1">
          <ind:filepath operation="equals">/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*log_group[ ]+=[ ]+root[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_conf_log_group_is_set:obj:1" comment="log_group is set" version="1">
          <ind:filepath operation="equals">/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*log_group[ ]+=.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_bootloader_disable_recovery_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_DISABLE_RECOVERY=(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="Ensure more than one chronyd NTP server is set" id="oval:ssg-object_chronyd_multiple_servers:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^([\s]*server[\s]+.+$){2,}$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_default_exists:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT=.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_entries_reference_kernelopts:obj:1" version="1">
          <ind:path>/boot/loader/entries/</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^options(?:\s+.*)?\s+\$kernelopts\b.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_centos6:obj:1" version="1">
          <linux:name>centos-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_centos7:obj:1" version="1">
          <linux:name>centos-release</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_name_centos8:obj:1" version="1" comment="Check os-release ID">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^ID="(\w+)"$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_version_centos8:obj:1" version="1" comment="Check os-release VERSION_ID">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION_ID="(\d)"$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_name_centos9:obj:1" version="1" comment="Check os-release ID">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^ID="(\w+)"$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_version_centos9:obj:1" version="1" comment="Check os-release VERSION_ID">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION_ID="(\d)"$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object comment="check /etc/debian_version file" id="oval:ssg-obj_debian:obj:1" version="1">
          <unix:filepath>/etc/debian_version</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_debian_10:obj:1" version="1" comment="Check Debian version">
          <ind:filepath>/etc/debian_version</ind:filepath>
          <ind:pattern operation="pattern match">^10.[0-9]+$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_debian_11:obj:1" version="1" comment="Check Debian version">
          <ind:filepath>/etc/debian_version</ind:filepath>
          <ind:pattern operation="pattern match">^11.[0-9]+$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_debian_9:obj:1" version="1" comment="Check Debian version">
          <ind:filepath>/etc/debian_version</ind:filepath>
          <ind:pattern operation="pattern match">^9.[0-9]+$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-object_fedora_release_rpm:obj:1" version="1">
          <linux:name operation="pattern match">fedora-release.*</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-object_fedora_vendor_product:obj:1" version="1">
          <ind:filepath>/etc/system-release-cpe</ind:filepath>
          <ind:pattern operation="pattern match">^cpe:\/o:fedoraproject:fedora:[\d]+$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_ol7_system:obj:1" version="1">
          <linux:name>oraclelinux-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_ol8_system:obj:1" version="1">
          <linux:name>oraclelinux-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_ol9_system:obj:1" version="1">
          <linux:name>oraclelinux-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_opensuse_installed:obj:1" version="1">
          <linux:name>openSUSE-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_opensuse_leap15_installed:obj:1" version="1">
          <linux:name>openSUSE-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_opensuse_leap42_installed:obj:1" version="1">
          <linux:name>openSUSE-release</linux:name>
        </linux:rpminfo_object>
        <ind:family_object id="oval:ssg-object_unix_family:obj:1" version="1"/>
        <ind:textfilecontent54_object id="oval:ssg-obj_rhcos:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^ID="(\w+)"$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rhcos4:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION_ID="(\d)\.\d+"$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:family_object id="oval:ssg-obj_rhel7_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_rhel7_client:obj:1" version="1">
          <linux:name>redhat-release-client</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel7_workstation:obj:1" version="1">
          <linux:name>redhat-release-workstation</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel7_server:obj:1" version="1">
          <linux:name>redhat-release-server</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel7_computenode:obj:1" version="1">
          <linux:name>redhat-release-computenode</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel7_version:obj:1" version="1">
          <ind:filepath>/etc/redhat-release</ind:filepath>
          <ind:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:family_object id="oval:ssg-obj_rhel8_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_0:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_1:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_2:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_3:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_4:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_5:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_6:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_7:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_8:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_9:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_10:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel8_version:obj:1" version="1">
          <ind:filepath>/etc/redhat-release</ind:filepath>
          <ind:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:family_object id="oval:ssg-obj_rhel9_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_rhel9:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel9_version:obj:1" version="1">
          <ind:filepath>/etc/redhat-release</ind:filepath>
          <ind:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhvh4_version:obj:1" version="1">
          <linux:name>redhat-release-virtualization-host</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sl6:obj:1" version="1">
          <linux:name>sl-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sl7:obj:1" version="1">
          <linux:name>sl-release</linux:name>
        </linux:rpminfo_object>
        <ind:family_object id="oval:ssg-obj_sle12_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_sle12_desktop:obj:1" version="1">
          <linux:name>sled-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sle12_server:obj:1" version="1">
          <linux:name>sles-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sles_12_for_sap:obj:1" version="1">
          <linux:name>SLES_SAP-release</linux:name>
        </linux:rpminfo_object>
        <ind:family_object id="oval:ssg-obj_sle15_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_sle15_desktop:obj:1" version="1">
          <linux:name>sled-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sle15_server:obj:1" version="1">
          <linux:name>sles-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sles_15_for_sap:obj:1" version="1">
          <linux:name>SLES_SAP-release</linux:name>
        </linux:rpminfo_object>
        <unix:file_object comment="check /etc/lsb-release file" id="oval:ssg-obj_lsb:obj:1" version="1">
          <unix:filepath>/etc/lsb-release</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ubuntu:obj:1" version="1" comment="Check Ubuntu">
          <ind:filepath>/etc/lsb-release</ind:filepath>
          <ind:pattern operation="pattern match">^DISTRIB_ID=Ubuntu$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ubuntu_xenial:obj:1" version="1" comment="Check Ubuntu version">
          <ind:filepath>/etc/lsb-release</ind:filepath>
          <ind:pattern operation="pattern match">^DISTRIB_CODENAME=xenial$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ubuntu_bionic:obj:1" version="1" comment="Check Ubuntu version">
          <ind:filepath>/etc/lsb-release</ind:filepath>
          <ind:pattern operation="pattern match">^DISTRIB_CODENAME=bionic$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ubuntu_focal:obj:1" version="1" comment="Check Ubuntu version">
          <ind:filepath>/etc/lsb-release</ind:filepath>
          <ind:pattern operation="pattern match">^DISTRIB_CODENAME=focal$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:family_object id="oval:ssg-obj_unix_wrlinux1019:obj:1" version="1"/>
        <ind:textfilecontent54_object id="oval:ssg-obj_name_wrlinux1019:obj:1" version="1" comment="Check WRLinux1019 produce name">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^NAME=.Wind[\s]+River[\s]+Linux.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_version_wrlinux1019:obj:1" version="1" comment="Check WRLinux1019 version">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION=.10\.19.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:family_object id="oval:ssg-obj_unix_wrlinux8:obj:1" version="1"/>
        <ind:textfilecontent54_object id="oval:ssg-obj_version_wrlinux8:obj:1" version="1" comment="Check WRLinux8 version">
          <ind:filepath>/etc/wrlinux-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION=.8\.0.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhevm4_version:obj:1" version="1">
          <linux:name>rhvm-appliance</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_audit_installed:obj:1" version="1">
          <linux:name>audit</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_env_has_chrony_installed:obj:1" version="1">
          <linux:name>chrony</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_gdm_installed:obj:1" version="1">
          <linux:name>gdm</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_grub2_installed:obj:1" version="1">
          <linux:name>grub2-common</linux:name>
        </linux:rpminfo_object>
        <unix:file_object id="oval:ssg-object_system_using_opal:obj:1" version="1">
          <unix:filepath>/sys/firmware/opal</unix:filepath>
        </unix:file_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_libuser_installed:obj:1" version="1">
          <linux:name>libuser</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_login_defs_installed:obj:1" version="1">
          <linux:name>shadow-utils</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_net-snmp_installed:obj:1" version="1">
          <linux:name>net-snmp</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_nss-pam-ldapd_installed:obj:1" version="1">
          <linux:name>nss-pam-ldapd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_env_has_ntp_installed:obj:1" version="1">
          <linux:name>ntp</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_ovirt-host_installed:obj:1" version="1">
          <linux:name>ovirt-host</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_ovirt-engine_installed:obj:1" version="1">
          <linux:name>ovirt-engine</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_pam_installed:obj:1" version="1">
          <linux:name>pam</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_env_has_polkit_installed:obj:1" version="1">
          <linux:name>polkit</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_env_has_postfix_installed:obj:1" version="1">
          <linux:name>postfix</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_sssd-common_installed:obj:1" version="1">
          <linux:name>sssd-common</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_sudo_installed:obj:1" version="1">
          <linux:name>sudo</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_systemd_installed:obj:1" version="1">
          <linux:name>systemd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_tftp_server_installed:obj:1" version="1">
          <linux:name>tftp-server</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_usbguard_installed:obj:1" version="1">
          <linux:name>usbguard</linux:name>
        </linux:rpminfo_object>
        <unix:file_object comment="/proc/net/wireless file" id="oval:ssg-object_proc_net_wireless_exists:obj:1" version="1">
          <unix:filepath>/proc/net/wireless</unix:filepath>
        </unix:file_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_yum_installed:obj:1" version="1">
          <linux:name>yum</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_zipl_installed:obj:1" version="1">
          <linux:name>s390utils-base</linux:name>
        </linux:rpminfo_object>
        <unix:file_object comment="Check file /.dockerenv" id="oval:ssg-object_installed_env_is_a_docker_container:obj:1" version="1">
          <unix:filepath datatype="string">/.dockerenv</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="Check file /run/.containerenv" id="oval:ssg-object_installed_env_is_a_podman_container:obj:1" version="1">
          <unix:filepath datatype="string">/run/.containerenv</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_no_cd_dvd_drive_in_etc_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_proc_sys_kernel_osrelease_arch_aarch64:obj:1" version="1">
          <ind:filepath>/proc/sys/kernel/osrelease</ind:filepath>
          <ind:pattern operation="pattern match">^.*\.(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_proc_sys_kernel_osrelease_arch_s390x:obj:1" version="1">
          <ind:filepath>/proc/sys/kernel/osrelease</ind:filepath>
          <ind:pattern operation="pattern match">^.*\.(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_removable_partition_doesnt_exist:obj:1" version="1">
          <unix:filepath var_ref="oval:ssg-var_removable_partition:var:1" var_check="at least one"/>
        </unix:file_object>
        <ind:variable_object id="oval:ssg-object_sshd_not_required:obj:1" version="1">
          <ind:var_ref>oval:ssg-sshd_required:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_sshd_required:obj:1" version="1">
          <ind:var_ref>oval:ssg-sshd_required:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_sshd_requirement_unknown:obj:1" version="1">
          <ind:var_ref>oval:ssg-sshd_required:var:1</ind:var_ref>
        </ind:variable_object>
        <linux:rpminfo_object id="oval:ssg-obj_openssh-server_version:obj:1" version="1">
          <linux:name>openssh-server</linux:name>
        </linux:rpminfo_object>
        <unix:file_object comment="/etc/sssd/sssd.conf" id="oval:ssg-object_sssd_conf_exists:obj:1" version="1">
          <unix:filepath>/etc/sssd/sssd.conf</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_id_provider_is_set_to_ad:obj:1" version="1">
          <ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\[domain\/[^]]*]([^\n\[\]]*\n+)+?[\s]*id_provider[ \t]*=[ \t]*((?i)ad)[ \t]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object comment="/sys/firmware/efi" id="oval:ssg-object_file_sys_firmware_efi:obj:1" version="1">
          <unix:path>/sys/firmware/efi</unix:path>
          <unix:filename xsi:nil="true"/>
        </unix:file_object>
        <unix:uname_object comment="64 bit architecture" id="oval:ssg-object_system_info_architecture_aarch_64:obj:1" version="1"/>
        <unix:uname_object comment="64 bit architecture" id="oval:ssg-object_system_info_architecture_ppc_64:obj:1" version="1"/>
        <unix:uname_object comment="64 bit architecture" id="oval:ssg-object_system_info_architecture_ppcle_64:obj:1" version="1"/>
        <unix:uname_object comment="64 bit architecture" id="oval:ssg-object_system_info_architecture_s390_64:obj:1" version="1"/>
        <unix:uname_object comment="32 bit architecture" id="oval:ssg-object_system_info_architecture_x86:obj:1" version="1"/>
        <unix:uname_object comment="64 bit architecture" id="oval:ssg-object_system_info_architecture_x86_64:obj:1" version="1"/>
        <ind:textfilecontent54_object id="oval:ssg-obj_usbguard_rules_nonempty:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/usbguard/(rules|rules\.d/.*)\.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^.*\S+.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_accounts_user_umask_umask_as_number:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_accounts_user_umask_umask_as_number:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_var_removable_partition_is_cd_dvd_drive:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_removable_partition:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_var_umask_for_daemons_umask_as_number:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_umask_for_daemons_umask_as_number:var:1</ind:var_ref>
        </ind:variable_object>
      </oval-def:objects>
      <oval-def:states>
        <ind:textfilecontent54_state id="oval:ssg-state_root_mail_alias:ste:1" version="1" comment="root email alias">
          <ind:subexpression operation="equals" var_check="all" var_ref="oval:ssg-var_postfix_root_mail_alias:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_chronyd_port_value_0:ste:1" version="1">
          <ind:subexpression>0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_chronyd_cmdport_value_0:ste:1" version="1">
          <ind:subexpression>0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_time_service_set_maxpoll:ste:1" version="1">
          <ind:subexpression operation="less than or equal" var_ref="oval:ssg-var_time_service_set_maxpoll:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_server_has_maxpoll:ste:1" version="1">
          <ind:subexpression operation="pattern match" datatype="string">maxpoll \d+</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_chronyd_run_as_chrony_user:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^["]?.*-u chrony.*["]?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_compression:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-var_sshd_disable_compression:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state comment="upper bound of ClientAliveInterval in seconds" id="oval:ssg-state_timeout_value_upper_bound:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-sshd_idle_timeout_value:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state comment="lower bound of ClientAliveInterval in seconds" id="oval:ssg-state_timeout_value_lower_bound:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_clientalivecountmax:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-var_sshd_set_keepalive:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state comment="upper bound of LoginGraceTime in number of sessions" id="oval:ssg-state_logingracetime_value_upper_bound:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-var_sshd_set_login_grace_time:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state comment="lower bound of LoginGraceTime in number of sessions" id="oval:ssg-state_logingracetime_value_lower_bound:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state comment="upper bound of MaxAuthTries" id="oval:ssg-state_maxauthtries_value_upper_bound:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-sshd_max_auth_tries_value:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state comment="lower bound of MaxAuthTries" id="oval:ssg-state_maxauthtries_value_lower_bound:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state comment="upper bound of MaxSessions in number of sessions" id="oval:ssg-state_maxsessions_value_upper_bound:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-var_sshd_max_sessions:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state comment="lower bound of MaxSessions in number of sessions" id="oval:ssg-state_maxsessions_value_lower_bound:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than or equal">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-ste_sshd_config_start_parameter_valid:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than or equal">10</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-ste_sshd_config_rate_parameter_valid:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than or equal">30</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-ste_sshd_config_full_parameter_valid:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than or equal">100</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_use_priv_separation:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-var_sshd_priv_separation:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state comment="value of certificate_verification" id="oval:ssg-state_sssd_certificate_verification:ste:1" version="1">
          <ind:subexpression operation="equals" var_check="all" var_ref="oval:ssg-var_sssd_certificate_verification_digest_function:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state comment="value of memcache_timeout setting" id="oval:ssg-state_sssd_memcache_timeout:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-var_sssd_memcache_timeout:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sssd_user_value:ste:1" comment="value of user setting" version="1">
          <ind:subexpression>sssd</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state comment="value of ssh_known_hosts_timeout setting" id="oval:ssg-state_sssd_ssh_known_hosts_timeout:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-var_sssd_ssh_known_hosts_timeout:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_configure_usbguard_auditbackend:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^LinuxAudit$</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="default.target is linked to multi-user.target" id="oval:ssg-state_disable_xwindows_runlevel_target:ste:1" version="1">
          <unix:filepath>/etc/systemd/system/default.target</unix:filepath>
          <unix:canonical_path operation="pattern match">^(/usr)?/lib/systemd/system/multi-user.target$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_banner_etc_issue:ste:1" version="1">
          <ind:subexpression datatype="string" var_ref="oval:ssg-login_banner_text:var:1" operation="pattern match"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_banner_etc_motd:ste:1" version="1">
          <ind:subexpression datatype="string" var_ref="oval:ssg-login_banner_text:var:1" operation="pattern match"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_gdm_login_banner_text_setting:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match" var_ref="oval:ssg-login_banner_text:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_password_pam_pwhistory_remember_password_auth:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_remember:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_password_pam_pwhistory_remember_system_auth:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_remember:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_password_pam_unix_remember:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_unix_remember:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state version="1" id="oval:ssg-state_accounts_passwords_pam_faillock_deny_parameter_upper_bound:ste:1">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state version="1" id="oval:ssg-state_accounts_passwords_pam_faillock_deny_parameter_lower_bound:ste:1">
          <ind:subexpression datatype="int" operation="greater than">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state version="1" id="oval:ssg-state_accounts_passwords_pam_faillock_interval_parameter_lower_bound:ste:1">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state version="1" id="oval:ssg-state_accounts_passwords_pam_faillock_unlock_time_parameter_lower_bound:ste:1">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_retry_upper_bound:ste:1" version="1" comment="upper bound of password_pam_retry">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_retry:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_retry_lower_bound:ste:1" version="1" comment="lower bound of password_pam_retry">
          <ind:subexpression datatype="int" operation="greater than">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_last_encrypt_method_instance_value:ste:1" version="1">
          <ind:value operation="equals" datatype="string" var_ref="oval:ssg-var_password_hashing_algorithm:var:1"/>
        </ind:variable_state>
        <unix:symlink_state comment="Disable Ctrl-Alt-Del key sequence override exists" id="oval:ssg-state_disable_ctrlaltdel_exists:ste:1" version="1">
          <unix:filepath>/etc/systemd/system/ctrl-alt-del.target</unix:filepath>
          <unix:canonical_path>/dev/null</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_configure_opensc_card_drivers:ste:1" version="1">
          <ind:subexpression datatype="string" operation="equals" var_check="all" var_ref="oval:ssg-var_smartcard_drivers:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_force_opensc_card_drivers:ste:1" version="1">
          <ind:subexpression datatype="string" operation="equals" var_check="all" var_ref="oval:ssg-var_smartcard_drivers:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_pam_pkcs11_cert_policy_ocsp_on:ste:1" version="1">
          <ind:subexpression operation="pattern match">^.*ocsp_on.*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_no_duplicate_uids:ste:1" version="1">
          <ind:value var_ref="oval:ssg-variable_count_of_unique_uids:var:1" datatype="int" operation="equals" var_check="at least one"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_default_os_user:ste:1" version="1" comment="The user root is always allowed as default opering system user">
          <ind:subexpression operation="pattern match">^root$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_authorized_local_users:ste:1" version="1" comment="authorized usernames required by the installed software groups and applications">
          <ind:subexpression operation="pattern match" var_ref="oval:ssg-var_accounts_authorized_local_users_regex:var:1"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_no_duplicate_group_ids:ste:1" version="1">
          <ind:value var_ref="oval:ssg-variable_count_of_unique_group_ids:var:1" datatype="int" operation="equals" var_check="at least one"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_no_duplicate_group_names:ste:1" version="1">
          <ind:value var_ref="oval:ssg-variable_count_of_unique_group_names:var:1" datatype="int" operation="equals" var_check="at least one"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_etc_default_useradd_inactive:ste:1" version="1">
          <ind:subexpression operation="less than or equal" var_ref="oval:ssg-var_account_disable_post_pw_expiration:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_etc_default_useradd_inactive_nonnegative:ste:1" version="1">
          <ind:subexpression operation="greater than" datatype="int">-1</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_etc_passwd_no_duplicate_user_names:ste:1" version="1">
          <ind:value var_ref="oval:ssg-variable_count_of_unique_usernames_from_etc_passwd:var:1" datatype="int" operation="equals" var_check="at least one"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_last_pass_max_days_instance_value:ste:1" version="1">
          <ind:value operation="less than or equal" var_ref="oval:ssg-var_accounts_maximum_age_login_defs:var:1" datatype="int" var_check="at least one"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_last_pass_min_days_instance_value:ste:1" version="1">
          <ind:value operation="greater than or equal" var_ref="oval:ssg-var_accounts_minimum_age_login_defs:var:1" datatype="int" var_check="at least one"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_last_pass_min_len_instance_value:ste:1" version="1">
          <ind:value operation="greater than or equal" var_ref="oval:ssg-var_accounts_password_minlen_login_defs:var:1" datatype="int" var_check="at least one"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_last_pass_warn_age_instance_value:ste:1" version="1">
          <ind:value operation="greater than or equal" var_ref="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" datatype="int" var_check="at least one"/>
        </ind:variable_state>
        <unix:password_state id="oval:ssg-state_accounts_password_all_shadowed:ste:1" version="1">
          <unix:password operation="pattern match">^[x*]$</unix:password>
        </unix:password_state>
        <unix:shadow_state id="oval:ssg-state_accounts_password_all_shadowed_has_no_password:ste:1" version="1">
          <unix:password operation="pattern match">^(!|!!|\*)$</unix:password>
        </unix:shadow_state>
        <unix:shadow_state id="oval:ssg-state_accounts_password_all_shadowed_sha512:ste:1" version="1">
          <unix:encrypt_method operation="equals">SHA-512</unix:encrypt_method>
        </unix:shadow_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_auth_pam_unix_rounds:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_unix_rounds:var:1"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_password_auth_default_pam_unix_rounds_var:ste:1" version="1">
          <ind:value datatype="int" operation="equals" var_check="all" var_ref="oval:ssg-var_password_auth_default_hashing_rounds:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_system_auth_pam_unix_rounds:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_unix_rounds:var:1"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_system_auth_default_pam_unix_rounds_var:ste:1" version="1">
          <ind:value datatype="int" operation="equals" var_check="all" var_ref="oval:ssg-var_system_auth_default_hashing_rounds:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_gid_passwd_group_same:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-var_gid_passwd_group_same:var:1" var_check="at least one" datatype="string"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_root_gid_zero:ste:1" version="1" comment="root account's gid is equal to 0">
          <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_uid_less_than_zero:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_uid_greater_than_or_equal_uid_min:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-variable_uid_min_value:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_uid_greater_than_or_equal_sys_uid_min:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-variable_sys_uid_min_value:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_uid_less_than_sys_uid_min:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than" var_ref="oval:ssg-variable_sys_uid_min_value:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_uid_greater_than_or_equal_sys_uid_max:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-variable_sys_uid_max_value:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_logon_fail_delay:ste:1" version="1">
          <ind:subexpression operation="greater than or equal" var_ref="oval:ssg-var_accounts_fail_delay:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_maxlogins:ste:1" version="1">
          <ind:subexpression operation="less than or equal" var_ref="oval:ssg-var_accounts_max_concurrent_login_sessions:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_tmp_inst:ste:1" version="1">
          <unix:type>directory</unix:type>
          <unix:uread datatype="boolean">false</unix:uread>
          <unix:uwrite datatype="boolean">false</unix:uwrite>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_var_tmp_tmp_inst:ste:1" version="1">
          <unix:type>directory</unix:type>
          <unix:uread datatype="boolean">false</unix:uread>
          <unix:uwrite datatype="boolean">false</unix:uwrite>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_etc_profile_tmout:ste:1" version="2">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-var_accounts_tmout:var:1"/>
        </ind:textfilecontent54_state>
        <unix:password_state id="oval:ssg-state_file_permissions_home_dirs_interactive_uids:ste:1" version="1">
          <unix:user_id datatype="int" operation="greater than or equal">1000</unix:user_id>
        </unix:password_state>
        <unix:file_state id="oval:ssg-state_file_permissions_home_dirs_dirs:ste:1" version="1" operator="AND">
          <unix:type operation="equals">directory</unix:type>
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state comment="group or other has write privilege" id="oval:ssg-state_accounts_root_path_dirs_wrong_perms:ste:1" version="1" operator="OR">
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:owrite datatype="boolean">true</unix:owrite>
        </unix:file_state>
        <unix:file_state comment="symbolic link" id="oval:ssg-state_accounts_root_path_dirs_symlink:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <ind:environmentvariable58_state comment="starts with colon or period" id="oval:ssg-state_begins_colon_period:ste:1" version="1">
          <ind:value operation="pattern match">^[:\.]</ind:value>
        </ind:environmentvariable58_state>
        <ind:environmentvariable58_state comment="colon twice in a row" id="oval:ssg-state_contains_double_colon:ste:1" version="1">
          <ind:value operation="pattern match">::</ind:value>
        </ind:environmentvariable58_state>
        <ind:environmentvariable58_state comment="period twice in a row" id="oval:ssg-state_contains_double_period:ste:1" version="1">
          <ind:value operation="pattern match">\.\.</ind:value>
        </ind:environmentvariable58_state>
        <ind:environmentvariable58_state comment="ends with colon or period" id="oval:ssg-state_ends_colon_period:ste:1" version="1">
          <ind:value operation="pattern match">[:\.]$</ind:value>
        </ind:environmentvariable58_state>
        <ind:environmentvariable58_state comment="begins with a slash" id="oval:ssg-state_begins_slash:ste:1" version="1">
          <ind:value operation="pattern match">^[^/]</ind:value>
        </ind:environmentvariable58_state>
        <ind:environmentvariable58_state comment="elements begin with a slash" id="oval:ssg-state_contains_relative_path:ste:1" version="1">
          <ind:value operation="pattern match">[^\\]:[^/]</ind:value>
        </ind:environmentvariable58_state>
        <ind:variable_state id="oval:ssg-ste_accounts_umask_etc_login_defs:ste:1" version="1">
          <ind:value datatype="int" operation="bitwise and" var_ref="oval:ssg-var_accounts_user_umask_umask_as_number:var:1"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-ste_accounts_umask_etc_profile:ste:1" version="1">
          <ind:value datatype="int" operation="bitwise and" var_ref="oval:ssg-var_accounts_user_umask_umask_as_number:var:1"/>
        </ind:variable_state>
        <unix:file_state id="oval:ssg-state_not_mode_0700:ste:1" version="1" operator="OR">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:gread datatype="boolean">true</unix:gread>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:oread datatype="boolean">true</unix:oread>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_not_mode_0750:ste:1" version="1" operator="OR">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:oread datatype="boolean">true</unix:oread>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_owner_not_root_root_var_log_audit:ste:1" version="1" operator="OR">
          <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
          <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1" version="1" operator="OR">
          <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
          <unix:user_id datatype="int" operation="equals">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_not_mode_0600:ste:1" version="1" operator="OR">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:uexec datatype="boolean">true</unix:uexec>
          <unix:gread datatype="boolean">true</unix:gread>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:oread datatype="boolean">true</unix:oread>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_not_mode_0640:ste:1" version="1" operator="OR">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:uexec datatype="boolean">true</unix:uexec>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:oread datatype="boolean">true</unix:oread>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_setuid_or_setgid_set:ste:1" version="1" operator="OR">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_dev_proc_sys_dirs:ste:1" version="1">
          <unix:filepath operation="pattern match">^\/(dev|proc|sys)\/.*$</unix:filepath>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_proper_audit_rule_but_for_unprivileged_command:ste:1" version="1">
          <ind:subexpression operation="not equal" datatype="string" var_ref="oval:ssg-variable_all_privileged_commands:var:1" var_check="all"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_audit_rules_privileged_commands:ste:1" version="1">
          <ind:subexpression operation="pattern match" datatype="string" var_ref="oval:ssg-variable_all_privileged_commands:var:1" var_check="at least one"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_count_of_privileged_commands_having_audit_definition_augenrules:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-variable_count_of_privileged_commands_having_audit_definition_augenrules:var:1" var_check="at least one"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_count_of_privileged_commands_having_audit_definition_auditctl:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-variable_count_of_privileged_commands_having_audit_definition_auditctl:var:1" var_check="at least one"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_audispd_configure_remote_server:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-var_audispd_remote_server:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_disk_error_action:ste:1" version="1">
          <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_disk_error_action:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_disk_full_action:ste:1" version="1">
          <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_disk_full_action:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_action_mail_acct:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-var_auditd_action_mail_acct:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_admin_space_left_action:ste:1" version="1">
          <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_admin_space_left_action:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_flush:ste:1" version="1">
          <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_flush:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_max_log_file:ste:1" version="1">
          <ind:subexpression operation="greater than or equal" var_ref="oval:ssg-var_auditd_max_log_file:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_max_log_file_action:ste:1" version="1">
          <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_max_log_file_action:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_num_logs:ste:1" version="1">
          <ind:subexpression operation="greater than or equal" var_ref="oval:ssg-var_auditd_num_logs:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_space_left_action:ste:1" version="2">
          <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_space_left_action:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_space_left_percentage:ste:1" version="1">
          <ind:subexpression operation="greater than or equal" var_ref="oval:ssg-var_auditd_space_left_percentage:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_overflow_action:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)(syslog|single|halt)(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_bootloader_superuser_differ_from_other_users:ste:1" version="1">
          <ind:subexpression datatype="string" operation="not equal" var_check="all" var_ref="oval:ssg-var_user_accounts:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_bootloader_uefi_superuser_differ_from_other_users:ste:1" version="1">
          <ind:subexpression datatype="string" operation="not equal" var_check="all" var_ref="oval:ssg-var_uefi_user_accounts:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_groupownership_ignore_include_paths:ste:1" comment="ignore" version="1">
          <ind:text operation="pattern match">(?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*)</ind:text>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_rsyslog_files_groupownership:ste:1" version="1">
          <unix:type operation="equals">regular</unix:type>
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_owner_ignore_include_paths:ste:1" comment="ignore" version="1">
          <ind:text operation="pattern match">(?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*)</ind:text>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_rsyslog_files_ownership:ste:1" version="1">
          <unix:type operation="equals">regular</unix:type>
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_permissions_ignore_include_paths:ste:1" comment="ignore" version="1">
          <ind:text operation="pattern match">(?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*)</ind:text>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_rsyslog_files_permissions:ste:1" version="1">
          <unix:type operation="equals">regular</unix:type>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rsyslog_remote_tls:ste:1" comment="value of omfwd action" version="1">
          <ind:subexpression datatype="string" operation="pattern match">(?=[\S\s]*\s(?i)protocol(?-i)="tcp")(?=[\S\s]*\s(?i)Target(?-i)="[^"]+?")(?=[\S\s]*\s(?i)port(?-i)="6514")(?=[\S\s]*\s(?i)StreamDriver(?-i)="gtls")(?=[\S\s]*\s(?i)StreamDriverMode(?-i)="1")(?=[\S\s]*\s(?i)StreamDriverAuthMode(?-i)="x509/name")(?=[\S\s]*\s(?i)StreamDriver\.CheckExtendedKeyPurpose(?-i)="on")</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_network_nmcli_permissions:ste:1" version="1">
          <ind:subexpression datatype="string">ResultActive=auth_admin</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:interface_state id="oval:ssg-state_promisc:ste:1" version="1">
          <unix:flag datatype="string" entity_check="at least one" operation="equals">PROMISC</unix:flag>
        </unix:interface_state>
        <unix:interface_state id="oval:ssg-state_wifi_up:ste:1" version="1">
          <unix:flag datatype="string" entity_check="at least one" operation="equals">UP</unix:flag>
        </unix:interface_state>
        <unix:file_state comment="uid greater than 0 and world writable" id="oval:ssg-state_uid_is_not_root_and_world_writable:ste:1" version="1">
          <unix:user_id datatype="int" operation="greater than">0</unix:user_id>
          <unix:owrite datatype="boolean">true</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_world_writable_and_not_sticky:ste:1" version="1">
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:owrite datatype="boolean">true</unix:owrite>
        </unix:file_state>
        <unix:file_state comment="uid greater than or equal to 1000 and world writable" id="oval:ssg-state_uid_is_user_and_world_writable:ste:1" version="1">
          <unix:user_id datatype="int" operation="greater than or equal">1000</unix:user_id>
          <unix:owrite datatype="boolean">true</unix:owrite>
        </unix:file_state>
        <unix:file_state comment="gid greater than or equal to 1000 and world writable" id="oval:ssg-state_gid_is_user_and_world_writable:ste:1" version="1">
          <unix:group_id datatype="int" operation="greater than or equal">1000</unix:group_id>
          <unix:owrite datatype="boolean">true</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_owner_systemmap:ste:1" version="1">
          <unix:user_id datatype="int" operation="equals">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_systemmap:ste:1" version="1">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_sgid_sgid_set:ste:1" version="1">
          <unix:sgid datatype="boolean">true</unix:sgid>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_sgid_filepaths:ste:1" version="1">
          <unix:filepath var_ref="oval:ssg-var_file_permissions_unauthorized_sgid_rpms:var:1" var_check="at least one"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_suid_suid_set:ste:1" version="1">
          <unix:suid datatype="boolean">true</unix:suid>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_suid_filepaths:ste:1" version="1">
          <unix:filepath var_ref="oval:ssg-var_file_permissions_unauthorized_suid_rpms:var:1" var_check="at least one"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write:ste:1" version="1">
          <unix:type operation="equals">regular</unix:type>
          <unix:owrite datatype="boolean">true</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write_exclude_special_selinux_files:ste:1" version="1">
          <unix:filepath operation="pattern match">^/selinux/(?:(?:member)|(?:user)|(?:relabel)|(?:create)|(?:access)|(?:context))$</unix:filepath>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write_exclude_proc:ste:1" version="1">
          <unix:filepath operation="pattern match">^/proc/.*$</unix:filepath>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write_exclude_sys:ste:1" version="1">
          <unix:filepath operation="pattern match">^/sys/.*$</unix:filepath>
        </unix:file_state>
        <unix:file_state comment="Files that are owned by a group." id="oval:ssg-state_file_permissions_ungroupowned:ste:1" version="1">
          <unix:group_id datatype="int" var_ref="oval:ssg-variable_file_permissions_ungroupowned:var:1" var_check="at least one"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-file_permissions_unowned_userid_list_match:ste:1" version="1">
          <unix:user_id var_check="at least one" var_ref="oval:ssg-file_permissions_unowned_userid_list:var:1" datatype="int"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_groupowner_system_commands_dirs_not_root:ste:1" version="1">
          <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_owner_binaries_not_root:ste:1" version="1" operator="OR">
          <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_perms_binary_files_nogroupwrite_noworldwrite:ste:1" version="1" operator="OR">
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:owrite datatype="boolean">true</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_perms_binary_files_symlink:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_nousb_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^.*\bnousb\b.*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_local_nodev:ste:1" version="1">
          <linux:device operation="pattern match">^/dev/.*$</linux:device>
          <linux:mount_options datatype="string" entity_check="all" operation="not equal">nodev</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_mount_option_var_tmp_bind_compare_source:ste:1" version="1">
          <linux:device datatype="string" entity_check="at least one" operation="equals" var_ref="oval:ssg-var_mount_option_var_tmp_bind_var_tmp_source_device:var:1"/>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_coredump_disable_backtraces:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)0(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_coredump_disable_storage:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)none(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_core_dumps_limitsconf:ste:1" version="1">
          <ind:subexpression operation="equals">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_core_dumps_limits_d:ste:1" version="1">
          <ind:subexpression operation="equals">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-ste_umask_for_daemons:ste:1" version="1">
          <ind:value datatype="int" operation="bitwise and" var_ref="oval:ssg-var_umask_for_daemons_umask_as_number:var:1"/>
        </ind:variable_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_exec_shield:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <unix:file_state id="oval:ssg-state_block_or_char_device_file:ste:1" version="1" comment="device files">
          <unix:type operation="pattern match">^(block|character) special$</unix:type>
        </unix:file_state>
        <linux:selinuxsecuritycontext_state comment="device_t label" id="oval:ssg-state_selinux_dev_device_t:ste:1" version="1">
          <linux:type datatype="string" operation="equals">device_t</linux:type>
        </linux:selinuxsecuritycontext_state>
        <linux:selinuxsecuritycontext_state comment="unlabeled_t label" id="oval:ssg-state_selinux_dev_unlabeled_t:ste:1" version="1">
          <linux:type datatype="string" operation="equals">unlabeled_t</linux:type>
        </linux:selinuxsecuritycontext_state>
        <linux:selinuxsecuritycontext_state comment="state unconfined_service_t" id="oval:ssg-state_selinux_confinement_of_daemons:ste:1" version="1">
          <linux:type datatype="string" operation="equals">unconfined_service_t</linux:type>
        </linux:selinuxsecuritycontext_state>
        <ind:textfilecontent54_state id="oval:ssg-state_selinux_policy:ste:1" version="1">
          <ind:subexpression operation="equals" var_check="all" var_ref="oval:ssg-var_selinux_policy_name:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_etc_selinux_config:ste:1" version="1">
          <ind:subexpression datatype="string" operation="equals" var_check="all" var_ref="oval:ssg-var_selinux_state:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_proc_cpuinfo_64_bit:ste:1" version="1">
          <ind:subexpression operation="pattern match">\blm\b</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_proc_sys_kernel_osrelease_64_bit:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(x86_64|aarch64|ppc64le|s390x)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_distro_db_is_up_to_date:ste:1" version="1">
          <ind:value datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-var_dconf_distro_keyfiles_modified_time:var:1"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_local_db_is_up_to_date:ste:1" version="1">
          <ind:value datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-var_dconf_local_keyfiles_modified_time:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_gnome_gdm_disable_xdmcp:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^false$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_screensaver_idle_delay_setting:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-inactivity_timeout_value:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_screensaver_lock_delay_setting:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-var_screensaver_lock_delay:var:1"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_crypto_current_file_newer_than_config_file:ste:1" version="1">
          <ind:value datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-variable_crypto_policies_current_file_timestamp:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_configure_crypto_policy:ste:1" version="1">
          <ind:subexpression operation="equals" var_check="all" var_ref="oval:ssg-var_system_crypto_policy:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_configure_crypto_policy_current:ste:1" version="1">
          <ind:subexpression operation="equals" var_check="all" var_ref="oval:ssg-var_system_crypto_policy:var:1"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_symlink_kerberos_crypto_policy_backend:ste:1" version="1">
          <ind:value datatype="string" operation="equals" var_ref="oval:ssg-var_symlink_kerberos_crypto_policy_backend:var:1"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_location_of_kerberos_crypto_policy_backend:ste:1" version="1">
          <ind:value datatype="string" operation="equals">/etc/crypto-policies/back-ends/krb5.config</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_Match:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^final all$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_RekeyLimit:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^512M 1h$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_GSSAPIAuthentication:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_Ciphers:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^aes256-ctr,aes256-cbc,aes128-ctr,aes128-cbc$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_MACs:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^hmac-sha2-512,hmac-sha2-256$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_KexAlgorithms:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-ste_harden_sshd_ciphers_openssh_conf_crypto_policy:ste:1" version="1">
          <ind:text var_ref="oval:ssg-sshd_ciphers_crypto:var:1" operation="equals"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_harden_sshd_crypto_policy:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^'-oCiphers=aes256-ctr,aes128-ctr,aes256-cbc,aes128-cbc -oMACs=hmac-sha2-512,hmac-sha2-256 -oGSSAPIKeyExchange=no -oKexAlgorithms=ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256 -oPubkeyAcceptedKeyTypes=rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256'$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-ste_harden_sshd_macs_openssh_conf_crypto_policy:ste:1" version="1">
          <ind:text var_ref="oval:ssg-sshd_macs_crypto:var:1" operation="equals"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_enable_dracut_fips_module:ste:1" version="1">
          <ind:subexpression datatype="string" operation="equals">fips</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state comment="variable value is set to 'FIPS' or 'FIPS:modifier', where the modifier corresponds to a crypto policy module that further restricts the modified crypto policy." id="oval:ssg-ste_system_crypto_policy_value:ste:1" version="2">
          <ind:value operation="pattern match" datatype="string">^FIPS(:(OSPP|NO-SHA1|NO-CAMELLIA))?$</ind:value>
        </ind:variable_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_crypto_fips_enabled:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_aide_check_attributes:ste:1" version="1">
          <ind:subexpression operation="equals">p+i+n+u+g+s+b+acl+selinux+xattrs+sha512</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:rpmverifyfile_state id="oval:ssg-state_files_fail_md5_hash:ste:1" version="1" operator="AND">
          <linux:md5_differs>fail</linux:md5_differs>
          <linux:configuration_file datatype="boolean">false</linux:configuration_file>
          <linux:ghost_file datatype="boolean">false</linux:ghost_file>
        </linux:rpmverifyfile_state>
        <linux:rpmverifyfile_state id="oval:ssg-state_files_fail_mode:ste:1" version="1">
          <linux:mode_differs>fail</linux:mode_differs>
        </linux:rpmverifyfile_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sudoers_default_includedir:ste:1" version="1">
          <ind:subexpression operation="equals">/etc/sudoers.d</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_sudoers_passwd_n_files:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_dnf-automatic_apply_updates:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_dnf-automatic_security_updates_only:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^security$</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:rpminfo_state id="oval:ssg-state_package_gpg-pubkey-5323552a-6112bcdc:ste:1" version="1">
          <linux:release>6112bcdc</linux:release>
          <linux:version>5323552a</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_package_gpg-pubkey-38ab71f4-60242b08:ste:1" version="1">
          <linux:release>60242b08</linux:release>
          <linux:version>38ab71f4</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_package_gpg-pubkey-9867c58f-601c49ca:ste:1" version="1">
          <linux:release>601c49ca</linux:release>
          <linux:version>9867c58f</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_package_gpg-pubkey-45719a39-5f2c0192:ste:1" version="1">
          <linux:release>5f2c0192</linux:release>
          <linux:version>45719a39</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_dcredit:ste:1" version="3">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_dcredit:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_dictcheck:ste:1" version="3">
          <ind:subexpression datatype="int" operation="equals" var_ref="oval:ssg-var_password_pam_dictcheck:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_difok:ste:1" version="3">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_difok:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_lcredit:ste:1" version="3">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_lcredit:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_maxclassrepeat:ste:1" version="3">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_maxclassrepeat:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_maxclassrepeat_zero_comparison:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_maxrepeat:ste:1" version="3">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_maxrepeat:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_minclass:ste:1" version="3">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_minclass:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_minlen:ste:1" version="3">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_minlen:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_ocredit:ste:1" version="3">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_ocredit:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_ucredit:ste:1" version="3">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_ucredit:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_freq:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)50(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_local_events:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)yes(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_log_format:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)ENRICHED(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_name_format:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)hostname(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_write_logs:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)yes(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?selinux=0(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?selinux=0(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?selinux=0(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_dconf_gnome_disable_user_admin:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^true$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_dconf_gnome_lock_screen_on_smartcard_removal:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^'lock-screen'$</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_gid_0_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_gid_0_1:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_gid_0_2:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_gid_0_3:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupownerdir_group_ownership_library_dirs_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_1:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_2:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_3:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_4:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_5:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_1:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_2:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_3:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_ownerdir_ownership_library_dirs_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdir_permissions_binary_dirs_0_mode_0755or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdir_permissions_binary_dirs_1_mode_0755or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdir_permissions_binary_dirs_2_mode_0755or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdir_permissions_binary_dirs_3_mode_0755or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdir_permissions_binary_dirs_4_mode_0755or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdir_permissions_binary_dirs_5_mode_0755or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdir_permissions_library_dirs_0_mode_0755or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdir_permissions_library_dirs_1_mode_0755or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdir_permissions_library_dirs_2_mode_0755or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdir_permissions_library_dirs_3_mode_0755or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks_dir_permissions_library_dirs:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_disable_host_auth:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_disable_host_auth_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_backup_etc_group_gid_0_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_backup_etc_group_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_backup_etc_gshadow_gid_0_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_backup_etc_gshadow_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_backup_etc_passwd_gid_0_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_backup_etc_passwd_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_backup_etc_shadow_gid_0_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_backup_etc_shadow_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_efi_grub2_cfg_gid_0_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_efi_grub2_cfg_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_group_gid_0_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_etc_group_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_gshadow_gid_0_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_etc_gshadow_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_issue_gid_0_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_etc_issue_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_motd_gid_0_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_etc_motd_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_passwd_gid_0_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_etc_passwd_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_shadow_gid_0_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_etc_shadow_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_grub2_cfg_gid_0_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_grub2_cfg_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_var_log_gid_0_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_var_log_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_var_log_messages_gid_0_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_var_log_messages_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_var_log_syslog_gid_4_0:ste:1" version="1">
          <unix:group_id datatype="int">4</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_var_log_syslog_uid_4:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownership_audit_configuration_gid_0_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownership_audit_configuration_gid_0_1:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupownership_audit_configuration_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_backup_etc_group_uid_0_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_backup_etc_group_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_backup_etc_gshadow_uid_0_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_backup_etc_gshadow_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_backup_etc_passwd_uid_0_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_backup_etc_passwd_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_backup_etc_shadow_uid_0_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_backup_etc_shadow_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_efi_grub2_cfg_uid_0_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_efi_grub2_cfg_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_etc_group_uid_0_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_etc_group_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_etc_gshadow_uid_0_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_etc_gshadow_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_etc_issue_uid_0_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_etc_issue_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_etc_motd_uid_0_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_etc_motd_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_etc_passwd_uid_0_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_etc_passwd_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_etc_shadow_uid_0_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_etc_shadow_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_grub2_cfg_uid_0_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_grub2_cfg_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_var_log_uid_0_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_var_log_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_var_log_messages_uid_0_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_var_log_messages_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_var_log_syslog_uid_104_0:ste:1" version="1">
          <unix:user_id datatype="int">104</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_var_log_syslog_uid_104:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownership_audit_configuration_uid_0_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownership_audit_configuration_uid_0_1:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_ownership_audit_configuration_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownership_library_dirs_uid_0_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownership_library_dirs_uid_0_1:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownership_library_dirs_uid_0_2:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownership_library_dirs_uid_0_3:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_ownership_library_dirs_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_backup_etc_group_0_mode_0644or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__backup_etc_group:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_backup_etc_gshadow_0_mode_0000or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uread datatype="boolean">false</unix:uread>
          <unix:uwrite datatype="boolean">false</unix:uwrite>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__backup_etc_gshadow:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_backup_etc_passwd_0_mode_0644or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__backup_etc_passwd:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_backup_etc_shadow_0_mode_0000or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uread datatype="boolean">false</unix:uread>
          <unix:uwrite datatype="boolean">false</unix:uwrite>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__backup_etc_shadow:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_efi_grub2_cfg_0_mode_0700or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__efi_grub2_cfg:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_audit_auditd_0_mode_0640or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__etc_audit_auditd:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_audit_rulesd_0_mode_0640or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__etc_audit_rulesd:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_group_0_mode_0644or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__etc_group:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_gshadow_0_mode_0000or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uread datatype="boolean">false</unix:uread>
          <unix:uwrite datatype="boolean">false</unix:uwrite>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__etc_gshadow:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_issue_0_mode_0644or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__etc_issue:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_motd_0_mode_0644or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__etc_motd:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_passwd_0_mode_0644or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__etc_passwd:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_shadow_0_mode_0000or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uread datatype="boolean">false</unix:uread>
          <unix:uwrite datatype="boolean">false</unix:uwrite>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__etc_shadow:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_grub2_cfg_0_mode_0600or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__grub2_cfg:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_library_dirs_0_mode_7755or_stricter_:ste:1" operator="AND" version="3">
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_library_dirs_1_mode_7755or_stricter_:ste:1" operator="AND" version="3">
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_library_dirs_2_mode_7755or_stricter_:ste:1" operator="AND" version="3">
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_library_dirs_3_mode_7755or_stricter_:ste:1" operator="AND" version="3">
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__library_dirs:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_sshd_private_key_0_mode_0600or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__sshd_private_key:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_sshd_pub_key_0_mode_0644or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__sshd_pub_key:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_var_log_0_mode_0755or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__var_log:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_var_log_messages_0_mode_0640or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__var_log_messages:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_var_log_syslog_0_mode_0640or_stricter_:ste:1" operator="AND" version="3">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__var_log_syslog:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_audit_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?audit=1(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_audit_backlog_limit_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?audit_backlog_limit=8192(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_iommu_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?iommu=force(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_ipv6_disable_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?ipv6\.disable=1(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_l1tf_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match" var_ref="oval:ssg-local_var_regex_l1tf_var_l1tf_options:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_mce_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?mce=0(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_mds_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match" var_ref="oval:ssg-local_var_regex_mds_var_mds_options:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_page_poison_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?page_poison=1(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_pti_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?pti=on(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_rng_core_default_quality_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match" var_ref="oval:ssg-local_var_regex_rng_core_default_quality_var_rng_core_default_quality:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_slab_nomerge_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?slab_nomerge=yes(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_slub_debug_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match" var_ref="oval:ssg-local_var_regex_slub_debug_var_slub_debug_options:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_spec_store_bypass_disable_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match" var_ref="oval:ssg-local_var_regex_spec_store_bypass_disable_var_spec_store_bypass_disable_options:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_spectre_v2_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?spectre_v2=on(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_vsyscall_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?vsyscall=none(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_acpi_custom_method:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_acpi_custom_method:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_acpi_custom_method_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_arm64_sw_ttbr0_pan:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_arm64_sw_ttbr0_pan:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_arm64_sw_ttbr0_pan_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_binfmt_misc:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_binfmt_misc:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_binfmt_misc_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_bug:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_bug:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_bug_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_bug_on_data_corruption:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_bug_on_data_corruption:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_bug_on_data_corruption_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_compat_brk:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_compat_brk:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_compat_brk_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_compat_vdso:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_compat_vdso:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_compat_vdso_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_debug_credentials:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_debug_credentials:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_debug_credentials_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_debug_fs:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_debug_fs:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_debug_fs_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_debug_list:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_debug_list:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_debug_list_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_debug_notifiers:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_debug_notifiers:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_debug_notifiers_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_debug_sg:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_debug_sg:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_debug_sg_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_debug_wx:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_debug_wx:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_debug_wx_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_default_mmap_min_addr:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">65536</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_default_mmap_min_addr:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_default_mmap_min_addr_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_devkmem:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_devkmem:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_devkmem_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_fortify_source:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_fortify_source:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_fortify_source_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_gcc_plugin_latent_entropy:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_gcc_plugin_latent_entropy:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_gcc_plugin_latent_entropy_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_gcc_plugin_randstruct:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_gcc_plugin_randstruct:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_gcc_plugin_randstruct_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_gcc_plugin_stackleak:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_gcc_plugin_stackleak:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_gcc_plugin_stackleak_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_gcc_plugin_structleak:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_gcc_plugin_structleak:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_gcc_plugin_structleak_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_gcc_plugin_structleak_byref_all:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_gcc_plugin_structleak_byref_all:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_gcc_plugin_structleak_byref_all_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_hardened_usercopy:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_hardened_usercopy:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_hardened_usercopy_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_hardened_usercopy_fallback:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_hardened_usercopy_fallback:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_hardened_usercopy_fallback_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_hibernation:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_hibernation:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_hibernation_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_ia32_emulation:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_ia32_emulation:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_ia32_emulation_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_ipv6:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_ipv6:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_ipv6_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_kexec:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_kexec:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_kexec_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_legacy_ptys:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_legacy_ptys:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_legacy_ptys_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_legacy_vsyscall_emulate:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_legacy_vsyscall_emulate:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_legacy_vsyscall_emulate_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_legacy_vsyscall_none:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_legacy_vsyscall_none:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_legacy_vsyscall_none_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_legacy_vsyscall_xonly:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_legacy_vsyscall_xonly:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_legacy_vsyscall_xonly_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_modify_ldt_syscall:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_modify_ldt_syscall:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_modify_ldt_syscall_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_module_sig:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_module_sig:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_module_sig_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_module_sig_all:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_module_sig_all:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_module_sig_all_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_module_sig_force:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_module_sig_force:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_module_sig_force_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_module_sig_hash:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string" var_ref="oval:ssg-var_kernel_config_module_sig_hash:var:1"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_module_sig_hash:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_module_sig_hash_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_module_sig_key:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string" var_ref="oval:ssg-var_kernel_config_module_sig_key:var:1"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_module_sig_key:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_module_sig_key_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_module_sig_sha512:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_module_sig_sha512:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_module_sig_sha512_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_page_poisoning:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_page_poisoning:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_page_poisoning_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_page_poisoning_no_sanity:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_page_poisoning_no_sanity:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_page_poisoning_no_sanity_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_page_poisoning_zero:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_page_poisoning_zero:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_page_poisoning_zero_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_page_table_isolation:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_page_table_isolation:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_page_table_isolation_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_panic_on_oops:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_panic_on_oops:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_panic_on_oops_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_panic_timeout:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string" var_ref="oval:ssg-var_kernel_config_panic_timeout:var:1"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_panic_timeout:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_panic_timeout_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_proc_kcore:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_proc_kcore:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_proc_kcore_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_randomize_base:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_randomize_base:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_randomize_base_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_randomize_memory:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_randomize_memory:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_randomize_memory_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_refcount_full:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_refcount_full:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_refcount_full_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_retpoline:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_retpoline:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_retpoline_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_sched_stack_end_check:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_sched_stack_end_check:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_sched_stack_end_check_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_seccomp:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_seccomp:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_seccomp_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_seccomp_filter:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_seccomp_filter:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_seccomp_filter_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_security:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_security:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_security_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_security_dmesg_restrict:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_security_dmesg_restrict:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_security_dmesg_restrict_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_security_writable_hooks:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_security_writable_hooks:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_security_writable_hooks_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_security_yama:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_security_yama:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_security_yama_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_slab_freelist_hardened:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_slab_freelist_hardened:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_slab_freelist_hardened_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_slab_frelist_random:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_slab_frelist_random:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_slab_frelist_random_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_slab_merge_default:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_slab_merge_default:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_slab_merge_default_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_slub_debug:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_slub_debug:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_slub_debug_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_stackprotector:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_stackprotector:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_stackprotector_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_stackprotector_strong:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_stackprotector_strong:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_stackprotector_strong_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_strict_kernel_rwx:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_strict_kernel_rwx:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_strict_kernel_rwx_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_strict_module_rwx:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_strict_module_rwx:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_strict_module_rwx_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_syn_cookies:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_syn_cookies:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_syn_cookies_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_unmap_kernel_at_el0:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_unmap_kernel_at_el0:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_unmap_kernel_at_el0_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_vmap_stack:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_vmap_stack:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_vmap_stack_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_x86_vsyscall_emulation:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_x86_vsyscall_emulation:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_x86_vsyscall_emulation_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <linux:partition_state version="1" id="oval:ssg-state_boot_partition_noauto_optional_yes:ste:1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noauto</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state version="1" id="oval:ssg-state_boot_partition_nodev_optional_yes:ste:1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state version="1" id="oval:ssg-state_boot_partition_noexec_optional_yes:ste:1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state version="1" id="oval:ssg-state_boot_partition_nosuid_optional_yes:ste:1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state version="1" id="oval:ssg-state_dev_shm_partition_nodev_optional_no:ste:1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state version="1" id="oval:ssg-state_dev_shm_partition_noexec_optional_no:ste:1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state version="1" id="oval:ssg-state_dev_shm_partition_nosuid_optional_no:ste:1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state version="1" id="oval:ssg-state_home_partition_noexec_optional_yes:ste:1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_nodev_etc_fstab_cd_dvd_drive:ste:1" version="1">
          <ind:subexpression operation="pattern match" datatype="string">^.*,?nodev,?.*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_nodev_etc_fstab_not_cd_dvd_drive:ste:1" version="1">
          <ind:subexpression operation="pattern match" datatype="string">^.*,?nodev,?.*</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_noexec_etc_fstab_cd_dvd_drive:ste:1" version="1">
          <ind:subexpression operation="pattern match" datatype="string">^.*,?noexec,?.*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_noexec_etc_fstab_not_cd_dvd_drive:ste:1" version="1">
          <ind:subexpression operation="pattern match" datatype="string">^.*,?noexec,?.*</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_nosuid_etc_fstab_cd_dvd_drive:ste:1" version="1">
          <ind:subexpression operation="pattern match" datatype="string">^.*,?nosuid,?.*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_nosuid_etc_fstab_not_cd_dvd_drive:ste:1" version="1">
          <ind:subexpression operation="pattern match" datatype="string">^.*,?nosuid,?.*</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state version="1" id="oval:ssg-state_opt_partition_nosuid_optional_yes:ste:1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state version="1" id="oval:ssg-state_proc_partition_hidepid_optional_no:ste:1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals" var_ref="oval:ssg-local_var_mountoption_hidepid_with_value:var:1"/>
        </linux:partition_state>
        <linux:partition_state version="1" id="oval:ssg-state_srv_partition_nosuid_optional_yes:ste:1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state version="1" id="oval:ssg-state_tmp_partition_nodev_optional_yes:ste:1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state version="1" id="oval:ssg-state_tmp_partition_noexec_optional_yes:ste:1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state version="1" id="oval:ssg-state_tmp_partition_nosuid_optional_yes:ste:1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state version="1" id="oval:ssg-state_var_log_audit_partition_nodev_optional_yes:ste:1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state version="1" id="oval:ssg-state_var_log_audit_partition_noexec_optional_yes:ste:1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state version="1" id="oval:ssg-state_var_log_audit_partition_nosuid_optional_yes:ste:1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state version="1" id="oval:ssg-state_var_log_partition_nodev_optional_yes:ste:1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state version="1" id="oval:ssg-state_var_log_partition_noexec_optional_yes:ste:1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state version="1" id="oval:ssg-state_var_log_partition_nosuid_optional_yes:ste:1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state version="1" id="oval:ssg-state_var_partition_nodev_optional_yes:ste:1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state version="1" id="oval:ssg-state_var_partition_noexec_optional_yes:ste:1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state version="1" id="oval:ssg-state_var_partition_nosuid_optional_yes:ste:1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <unix:file_state id="oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_gid_0_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_gid_0_1:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_gid_0_2:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_gid_0_3:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupownerroot_permissions_syslibrary_files_uid_0:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_atd:ste:1" version="1" comment="atd is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_atd:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_auditd_on:ste:1" comment="auditd listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">auditd.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_auditd_socket_on:ste:1" comment="auditd listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">auditd.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_auditd:ste:1" version="1" comment="auditd is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_autofs:ste:1" version="1" comment="autofs is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_autofs:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_bluetooth:ste:1" version="1" comment="bluetooth is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_bluetooth:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_chronyd_on:ste:1" comment="chronyd listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">chronyd.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_chronyd_socket_on:ste:1" comment="chronyd listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">chronyd.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_chronyd:ste:1" version="1" comment="chronyd is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_cron_on:ste:1" comment="cron listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">cron.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_cron_socket_on:ste:1" comment="cron listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">cron.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_cron:ste:1" version="1" comment="cron is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_crond_on:ste:1" comment="crond listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">crond.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_crond_socket_on:ste:1" comment="crond listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">crond.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_crond:ste:1" version="1" comment="crond is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_debug-shell:ste:1" version="1" comment="debug-shell is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_debug-shell:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_firewalld_on:ste:1" comment="firewalld listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">firewalld.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_firewalld_socket_on:ste:1" comment="firewalld listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">firewalld.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_firewalld:ste:1" version="1" comment="firewalld is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_ip6tables_on:ste:1" comment="ip6tables listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">ip6tables.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_ip6tables_socket_on:ste:1" comment="ip6tables listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">ip6tables.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_ip6tables:ste:1" version="1" comment="ip6tables is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_iptables_on:ste:1" comment="iptables listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">iptables.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_iptables_socket_on:ste:1" comment="iptables listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">iptables.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_iptables:ste:1" version="1" comment="iptables is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_netfs:ste:1" version="1" comment="netfs is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_netfs:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_nfs-server:ste:1" version="1" comment="nfs-server is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_nfs-server:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_nfslock:ste:1" version="1" comment="nfslock is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_nfslock:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_ntp_on:ste:1" comment="ntp listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">ntp.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_ntp_socket_on:ste:1" comment="ntp listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">ntp.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_ntp:ste:1" version="1" comment="ntp is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_ntpd_on:ste:1" comment="ntpd listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">ntpd.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_ntpd_socket_on:ste:1" comment="ntpd listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">ntpd.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_ntpd:ste:1" version="1" comment="ntpd is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_pcscd_on:ste:1" comment="pcscd listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">pcscd.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_pcscd_socket_on:ste:1" comment="pcscd listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">pcscd.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_pcscd:ste:1" version="1" comment="pcscd is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rngd_on:ste:1" comment="rngd listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">rngd.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rngd_socket_on:ste:1" comment="rngd listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">rngd.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_rngd:ste:1" version="1" comment="rngd is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_rpcgssd:ste:1" version="1" comment="rpcgssd is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_rpcgssd:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_rpcidmapd:ste:1" version="1" comment="rpcidmapd is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_rpcidmapd:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_rpcsvcgssd:ste:1" version="1" comment="rpcsvcgssd is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_rpcsvcgssd:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_rsyncd:ste:1" version="1" comment="rsyncd is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_rsyncd:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rsyslog_on:ste:1" comment="rsyslog listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">rsyslog.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rsyslog_socket_on:ste:1" comment="rsyslog listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">rsyslog.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_rsyslog:ste:1" version="1" comment="rsyslog is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_sshd:ste:1" version="1" comment="sshd is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_sshd:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_sssd:ste:1" version="1" comment="sssd is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_sssd:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_syslog:ste:1" version="1" comment="syslog is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_syslog:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_syslog-ng_on:ste:1" comment="syslog-ng listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">syslog-ng.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_syslog-ng_socket_on:ste:1" comment="syslog-ng listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">syslog-ng.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_syslog-ng:ste:1" version="1" comment="syslog-ng is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_systemd-coredump:ste:1" version="1" comment="systemd-coredump is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_systemd-coredump:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_usbguard_on:ste:1" comment="usbguard listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">usbguard.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_usbguard_socket_on:ste:1" comment="usbguard listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">usbguard.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_usbguard:ste:1" version="1" comment="usbguard is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_empty_passwords:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_empty_passwords_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_gssapi_auth:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_gssapi_auth_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_kerb_auth:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_kerb_auth_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_pubkey_auth:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_pubkey_auth_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_rhosts:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_rhosts_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_root_login:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_root_login_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_root_password_login:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^prohibit-password$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_root_password_login_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^prohibit-password$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_tcp_forwarding:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_tcp_forwarding_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_user_known_hosts:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_user_known_hosts_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_x11_forwarding:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_x11_forwarding_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_do_not_permit_user_env:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_do_not_permit_user_env_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_gssapi_auth:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_gssapi_auth_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_pam:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_pam_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_pubkey_auth:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_pubkey_auth_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_strictmodes:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_strictmodes_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_warning_banner:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^/etc/issue$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_warning_banner_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^/etc/issue$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_warning_banner_net:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^/etc/issue.net$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_warning_banner_net_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^/etc/issue.net$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_x11_forwarding:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_x11_forwarding_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_print_last_log:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_print_last_log_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_set_keepalive_0:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^0$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_set_keepalive_0_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^0$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_set_loglevel_info:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^INFO$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_set_loglevel_info_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^INFO$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_set_loglevel_verbose:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^VERBOSE$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_set_loglevel_verbose_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^VERBOSE$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_x11_use_localhost:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_x11_use_localhost_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_logfile_sudoers:ste:1" version="1">
          <ind:subexpression datatype="string" operation="equals" var_ref="oval:ssg-var_sudo_logfile:var:1"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_fs_protected_fifos:ste:1" version="1">
          <unix:value datatype="int" operation="equals">2</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_fs_protected_fifos_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_fs_protected_fifos_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_fs_protected_fifos:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_fs_protected_fifos:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_fs_protected_fifos:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">2</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_fs_protected_hardlinks:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_fs_protected_hardlinks_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_fs_protected_hardlinks_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_fs_protected_hardlinks:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_fs_protected_hardlinks:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_fs_protected_hardlinks:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_fs_protected_regular:ste:1" version="1">
          <unix:value datatype="int" operation="equals">2</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_fs_protected_regular_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_fs_protected_regular_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_fs_protected_regular:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_fs_protected_regular:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_fs_protected_regular:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">2</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_fs_protected_symlinks:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_fs_protected_symlinks_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_fs_protected_symlinks_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_fs_protected_symlinks:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_fs_protected_symlinks:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_fs_protected_symlinks:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_fs_suid_dumpable:ste:1" version="1">
          <unix:value datatype="int" operation="equals">0</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_fs_suid_dumpable_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_fs_suid_dumpable_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_fs_suid_dumpable:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_fs_suid_dumpable:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_fs_suid_dumpable:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_core_pattern:ste:1" version="1">
          <unix:value datatype="string" operation="equals">|/bin/false</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_kernel_core_pattern_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_core_pattern_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_kernel_core_pattern:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_core_pattern:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_core_pattern:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="string">|/bin/false</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_dmesg_restrict:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_kernel_dmesg_restrict_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_dmesg_restrict_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_kernel_dmesg_restrict:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_dmesg_restrict:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_dmesg_restrict:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_kexec_load_disabled:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_kernel_kexec_load_disabled_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_kexec_load_disabled_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_kernel_kexec_load_disabled:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_kexec_load_disabled:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_kexec_load_disabled:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_kptr_restrict:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_kernel_kptr_restrict_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_kernel_kptr_restrict_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_kptr_restrict_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_kernel_kptr_restrict:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_kptr_restrict:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_kptr_restrict:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_kernel_kptr_restrict_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_modules_disabled:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_kernel_modules_disabled_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_modules_disabled_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_kernel_modules_disabled:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_modules_disabled:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_modules_disabled:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_panic_on_oops:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_kernel_panic_on_oops_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_panic_on_oops_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_kernel_panic_on_oops:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_panic_on_oops:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_panic_on_oops:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_perf_cpu_time_max_percent:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_kernel_perf_cpu_time_max_percent_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_perf_cpu_time_max_percent_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_kernel_perf_cpu_time_max_percent:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_perf_cpu_time_max_percent:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_perf_cpu_time_max_percent:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_perf_event_max_sample_rate:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_kernel_perf_event_max_sample_rate_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_perf_event_max_sample_rate_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_kernel_perf_event_max_sample_rate:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_perf_event_max_sample_rate:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_perf_event_max_sample_rate:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_perf_event_paranoid:ste:1" version="1">
          <unix:value datatype="int" operation="equals">2</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_kernel_perf_event_paranoid_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_perf_event_paranoid_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_kernel_perf_event_paranoid:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_perf_event_paranoid:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_perf_event_paranoid:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">2</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_pid_max:ste:1" version="1">
          <unix:value datatype="int" operation="equals">65536</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_kernel_pid_max_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_pid_max_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_kernel_pid_max:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_pid_max:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_pid_max:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">65536</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_randomize_va_space:ste:1" version="1">
          <unix:value datatype="int" operation="equals">2</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_kernel_randomize_va_space_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_randomize_va_space_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_kernel_randomize_va_space:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_randomize_va_space:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_randomize_va_space:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">2</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_sysrq:ste:1" version="1">
          <unix:value datatype="int" operation="equals">0</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_kernel_sysrq_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_sysrq_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_kernel_sysrq:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_sysrq:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_sysrq:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_unprivileged_bpf_disabled:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_kernel_unprivileged_bpf_disabled_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_unprivileged_bpf_disabled_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_kernel_unprivileged_bpf_disabled:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_unprivileged_bpf_disabled:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_unprivileged_bpf_disabled:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_yama_ptrace_scope:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_kernel_yama_ptrace_scope_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_yama_ptrace_scope_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_kernel_yama_ptrace_scope:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_yama_ptrace_scope:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_yama_ptrace_scope:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_core_bpf_jit_harden:ste:1" version="1">
          <unix:value datatype="int" operation="equals">2</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_core_bpf_jit_harden_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_core_bpf_jit_harden_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_core_bpf_jit_harden:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_core_bpf_jit_harden:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_core_bpf_jit_harden:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">2</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_accept_local:ste:1" version="1">
          <unix:value datatype="int" operation="equals">0</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_accept_local_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_all_accept_local_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_accept_local:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_accept_local:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_local:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_accept_redirects:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_accept_redirects_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_all_accept_redirects_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_accept_redirects:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_accept_redirects:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_accept_source_route:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_accept_source_route_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_all_accept_source_route_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_accept_source_route:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_accept_source_route:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_arp_filter:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_arp_filter_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_arp_filter_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_all_arp_filter_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_arp_filter:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_arp_filter:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_arp_filter:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_arp_filter_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_arp_ignore:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_arp_ignore_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_arp_ignore_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_all_arp_ignore_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_arp_ignore:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_arp_ignore:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_arp_ignore:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_arp_ignore_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_drop_gratuitous_arp:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_all_drop_gratuitous_arp_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_drop_gratuitous_arp:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_drop_gratuitous_arp:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_log_martians:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_log_martians_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_all_log_martians_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_log_martians:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_log_martians:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_route_localnet:ste:1" version="1">
          <unix:value datatype="int" operation="equals">0</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_route_localnet_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_all_route_localnet_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_route_localnet:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_route_localnet:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_route_localnet:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_rp_filter:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_rp_filter_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_all_rp_filter_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_rp_filter:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_rp_filter:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_secure_redirects:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_secure_redirects_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_all_secure_redirects_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_secure_redirects:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_secure_redirects:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_send_redirects:ste:1" version="1">
          <unix:value datatype="int" operation="equals">0</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_send_redirects_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_all_send_redirects_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_send_redirects:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_send_redirects:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_send_redirects:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_shared_media:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_shared_media_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_shared_media_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_all_shared_media_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_shared_media:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_shared_media:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_shared_media:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_shared_media_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_accept_redirects:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_accept_redirects_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_default_accept_redirects_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_accept_redirects:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_accept_redirects:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_accept_source_route:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_accept_source_route_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_default_accept_source_route_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_accept_source_route:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_accept_source_route:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_log_martians:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_log_martians_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_default_log_martians_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_log_martians:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_log_martians:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_rp_filter:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_rp_filter_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_default_rp_filter_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_rp_filter:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_rp_filter:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_secure_redirects:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_secure_redirects_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_default_secure_redirects_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_secure_redirects:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_secure_redirects:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_send_redirects:ste:1" version="1">
          <unix:value datatype="int" operation="equals">0</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_send_redirects_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_default_send_redirects_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_send_redirects:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_send_redirects:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_send_redirects:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_shared_media:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_shared_media_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_shared_media_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_default_shared_media_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_shared_media:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_shared_media:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_shared_media:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_shared_media_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv4_icmp_echo_ignore_broadcasts_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_icmp_echo_ignore_broadcasts:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_icmp_echo_ignore_broadcasts:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv4_icmp_ignore_bogus_error_responses_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_icmp_ignore_bogus_error_responses:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_icmp_ignore_bogus_error_responses:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_ip_forward:ste:1" version="1">
          <unix:value datatype="int" operation="equals">0</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv4_ip_forward_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv4_ip_forward_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_ip_forward:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_ip_forward:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_ip_forward:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_ip_local_port_range:ste:1" version="1">
          <unix:value datatype="string" operation="pattern match">32768\s*65535</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv4_ip_local_port_range_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv4_ip_local_port_range_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_ip_local_port_range:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_ip_local_port_range:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_ip_local_port_range:ste:1" version="1">
          <ind:subexpression operation="pattern match" datatype="string">32768\s*65535</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_tcp_syncookies:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv4_tcp_syncookies_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv4_tcp_syncookies_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_tcp_syncookies:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_tcp_syncookies:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_ra_defrtr_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_all_accept_ra_defrtr_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_accept_ra_defrtr:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_accept_ra_defrtr:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_defrtr:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_ra_pinfo_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_all_accept_ra_pinfo_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_accept_ra_pinfo:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_accept_ra_pinfo:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_pinfo:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_all_accept_ra_rtr_pref_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_accept_ra_rtr_pref:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_autoconf:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_autoconf_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_autoconf_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_all_autoconf_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_autoconf:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_autoconf:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_autoconf:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_autoconf_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_disable_ipv6_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_all_disable_ipv6_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_disable_ipv6:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_disable_ipv6:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_disable_ipv6:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_max_addresses:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_max_addresses_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_all_max_addresses_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_max_addresses:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_max_addresses:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_max_addresses:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_router_solicitations:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_router_solicitations_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_all_router_solicitations_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_router_solicitations:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_router_solicitations:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_router_solicitations:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_default_accept_ra_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_accept_ra:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_accept_ra:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_defrtr_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_default_accept_ra_defrtr_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_accept_ra_defrtr:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_accept_ra_defrtr:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_defrtr:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_pinfo_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_default_accept_ra_pinfo_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_accept_ra_pinfo:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_accept_ra_pinfo:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_pinfo:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_default_accept_ra_rtr_pref_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_accept_ra_rtr_pref:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_redirects:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_redirects_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_default_accept_redirects_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_accept_redirects:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_accept_redirects:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_autoconf:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_autoconf_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_autoconf_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_default_autoconf_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_autoconf:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_autoconf:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_autoconf:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_autoconf_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_disable_ipv6_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_default_disable_ipv6_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_disable_ipv6:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_disable_ipv6:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_disable_ipv6:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_max_addresses:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_max_addresses_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_default_max_addresses_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_max_addresses:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_max_addresses:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_max_addresses:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_router_solicitations:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations_value:var:1"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_router_solicitations_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_default_router_solicitations_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_router_solicitations:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_router_solicitations:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_router_solicitations:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_user_max_user_namespaces:ste:1" version="1">
          <unix:value datatype="int" operation="equals">0</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_user_max_user_namespaces_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_user_max_user_namespaces_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_user_max_user_namespaces:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_user_max_user_namespaces:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_user_max_user_namespaces:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_vm_mmap_min_addr:ste:1" version="1">
          <unix:value datatype="int" operation="equals">65536</unix:value>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_vm_mmap_min_addr_defined_in_one_file:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_vm_mmap_min_addr_filepath_is_symlink:ste:1" version="1">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_safe_symlinks_vm_mmap_min_addr:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="State that matches symlinks referencing files not in the default dirs" id="oval:ssg-state_symlink_points_outside_usual_dirs_vm_mmap_min_addr:ste:1" version="1">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_vm_mmap_min_addr:ste:1" version="1">
          <ind:subexpression operation="equals" datatype="int">65536</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_dnf-automatic_on:ste:1" comment="dnf-automatic listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">dnf-automatic.timer</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_timer_running_dnf-automatic:ste:1" version="1" comment="dnf-automatic is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <ind:textfilecontent54_state id="oval:ssg-state_bootloader_disable_recovery_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^true|"true"$</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:rpminfo_state id="oval:ssg-state_centos6:ste:1" version="1">
          <linux:version operation="pattern match">^6.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_centos7:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_name_centos8:ste:1" version="1">
          <ind:subexpression>centos</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_version_centos8:ste:1" version="1">
          <ind:subexpression>8</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_name_centos9:ste:1" version="1">
          <ind:subexpression>centos</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_version_centos9:ste:1" version="1">
          <ind:subexpression>9</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:rpminfo_state id="oval:ssg-state_ol7_system:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_ol8_system:ste:1" version="1">
          <linux:version operation="pattern match">^8.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_ol9_system:ste:1" version="1">
          <linux:version operation="pattern match">^9.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_opensuse_installed:ste:1" version="1">
          <linux:name operation="pattern match">openSUSE-release</linux:name>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_opensuse_leap15_installed:ste:1" version="1">
          <linux:version operation="pattern match">^15.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_opensuse_leap42_installed:ste:1" version="1">
          <linux:version operation="pattern match">^42.*$</linux:version>
        </linux:rpminfo_state>
        <ind:family_state id="oval:ssg-state_unix_family:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rhcos:ste:1" version="1">
          <ind:subexpression operation="pattern match">rhcos</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rhcos4:ste:1" version="1">
          <ind:subexpression operation="pattern match">4</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:family_state id="oval:ssg-state_rhel7_unix_family:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel7_client:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel7_workstation:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel7_server:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel7_computenode:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rhevh_rhel7_version:ste:1" version="1">
          <ind:subexpression operation="pattern match">7</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:family_state id="oval:ssg-state_rhel8_unix_family:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8:ste:1" version="1">
          <linux:version operation="pattern match">^8.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_0:ste:1" version="1">
          <linux:version operation="pattern match">^8.0*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_1:ste:1" version="1">
          <linux:version operation="pattern match">^8.1*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_2:ste:1" version="1">
          <linux:version operation="pattern match">^8.2*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_3:ste:1" version="1">
          <linux:version operation="pattern match">^8.3*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_4:ste:1" version="1">
          <linux:version operation="pattern match">^8.4*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_5:ste:1" version="1">
          <linux:version operation="pattern match">^8.5*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_6:ste:1" version="1">
          <linux:version operation="pattern match">^8.6*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_7:ste:1" version="1">
          <linux:version operation="pattern match">^8.7*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_8:ste:1" version="1">
          <linux:version operation="pattern match">^8.8*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_9:ste:1" version="1">
          <linux:version operation="pattern match">^8.9*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_10:ste:1" version="1">
          <linux:version operation="pattern match">^8.10*$</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rhevh_rhel8_version:ste:1" version="1">
          <ind:subexpression operation="pattern match">8</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:family_state id="oval:ssg-state_rhel9_unix_family:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel9:ste:1" version="1">
          <linux:version operation="pattern match">^9.*$</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rhevh_rhel9_version:ste:1" version="1">
          <ind:subexpression operation="pattern match">9</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:rpminfo_state id="oval:ssg-state_rhvh4_version:ste:1" version="1">
          <linux:evr datatype="evr_string" operation="greater than or equal">0:4.4</linux:evr>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sl6:ste:1" version="1">
          <linux:version operation="pattern match">^6.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sl7:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <ind:family_state id="oval:ssg-state_sle12_unix_family:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_sle12_desktop:ste:1" version="1">
          <linux:version operation="pattern match">^12.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sle12_server:ste:1" version="1">
          <linux:version operation="pattern match">^12.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sles_12_for_sap:ste:1" version="1">
          <linux:version operation="pattern match">^12.*$</linux:version>
        </linux:rpminfo_state>
        <ind:family_state id="oval:ssg-state_sle15_unix_family:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_sle15_desktop:ste:1" version="1">
          <linux:version operation="pattern match">^15.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sle15_server:ste:1" version="1">
          <linux:version operation="pattern match">^15.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sles_15_for_sap:ste:1" version="1">
          <linux:version operation="pattern match">^15.*$</linux:version>
        </linux:rpminfo_state>
        <ind:family_state id="oval:ssg-state_unix_wrlinux1019:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <ind:family_state id="oval:ssg-state_unix_wrlinux8:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_rhevm4_version:ste:1" version="1">
          <linux:version operation="pattern match">^4.*$</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_proc_sys_kernel_osrelease_arch_aarch64:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^aarch64$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_proc_sys_kernel_osrelease_arch_s390x:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^s390x$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_sshd_not_required:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_sshd_required:ste:1" version="1">
          <ind:value operation="equals" datatype="int">2</ind:value>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_sshd_requirement_unset:ste:1" version="1">
          <ind:value operation="equals" datatype="int">0</ind:value>
        </ind:variable_state>
        <linux:rpminfo_state id="oval:ssg-state_openssh-server_version:ste:1" version="1">
          <linux:evr datatype="evr_string" operation="greater than or equal">0:7.4</linux:evr>
        </linux:rpminfo_state>
        <unix:uname_state comment="64 bit architecture" id="oval:ssg-state_system_info_architecture_aarch_64:ste:1" version="1">
          <unix:processor_type operation="equals">aarch64</unix:processor_type>
        </unix:uname_state>
        <unix:uname_state comment="64 bit architecture" id="oval:ssg-state_system_info_architecture_ppc_64:ste:1" version="1">
          <unix:processor_type operation="equals">ppc64</unix:processor_type>
        </unix:uname_state>
        <unix:uname_state comment="64 bit architecture" id="oval:ssg-state_system_info_architecture_ppcle_64:ste:1" version="1">
          <unix:processor_type operation="equals">ppc64le</unix:processor_type>
        </unix:uname_state>
        <unix:uname_state comment="64 bit architecture" id="oval:ssg-state_system_info_architecture_s390_64:ste:1" version="1">
          <unix:processor_type operation="equals">s390x</unix:processor_type>
        </unix:uname_state>
        <unix:uname_state comment="32 bit architecture" id="oval:ssg-state_system_info_architecture_x86:ste:1" version="1">
          <unix:processor_type operation="equals">i686</unix:processor_type>
        </unix:uname_state>
        <unix:uname_state comment="64 bit architecture" id="oval:ssg-state_system_info_architecture_x86_64:ste:1" version="1">
          <unix:processor_type operation="equals">x86_64</unix:processor_type>
        </unix:uname_state>
        <ind:variable_state id="oval:ssg-state_var_removable_partition_is_cd_dvd_drive:ste:1" version="1">
          <ind:value operation="equals">/dev/cdrom</ind:value>
        </ind:variable_state>
      </oval-def:states>
      <oval-def:variables>
        <oval-def:external_variable comment="expected email alias" datatype="string" id="oval:ssg-var_postfix_root_mail_alias:var:1" version="1"/>
        <oval-def:external_variable comment="maxpoll value" datatype="int" id="oval:ssg-var_time_service_set_maxpoll:var:1" version="1"/>
        <oval-def:external_variable comment="external variable for the desired value of Compression" datatype="string" id="oval:ssg-var_sshd_disable_compression:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-sshd_line_regex:var:1" datatype="string" comment="The regex of the directive" version="1">
          <oval-def:concat>
            <oval-def:literal_component>^[\s]*RekeyLimit[\s]+</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_rekey_limit_size:var:1"/>
            <oval-def:literal_component>[\s]+</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_rekey_limit_time:var:1"/>
            <oval-def:literal_component>[\s]*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable comment="Size component of the rekey limit" datatype="string" id="oval:ssg-var_rekey_limit_size:var:1" version="1"/>
        <oval-def:external_variable comment="Time component of the rekey limit" datatype="string" id="oval:ssg-var_rekey_limit_time:var:1" version="1"/>
        <oval-def:external_variable comment="timeout value" datatype="int" id="oval:ssg-sshd_idle_timeout_value:var:1" version="1"/>
        <oval-def:external_variable comment="ClientAliveCountMax value" datatype="int" id="oval:ssg-var_sshd_set_keepalive:var:1" version="1"/>
        <oval-def:external_variable comment="logingracetime value" datatype="int" id="oval:ssg-var_sshd_set_login_grace_time:var:1" version="1"/>
        <oval-def:external_variable comment="maxauthtries value" datatype="int" id="oval:ssg-sshd_max_auth_tries_value:var:1" version="1"/>
        <oval-def:external_variable comment="maxsessions value" datatype="int" id="oval:ssg-var_sshd_max_sessions:var:1" version="1"/>
        <oval-def:external_variable comment="external variable for the desired value of UsePrivilegeSeparation" datatype="string" id="oval:ssg-var_sshd_priv_separation:var:1" version="1"/>
        <oval-def:external_variable comment="certificate_verification value" datatype="string" id="oval:ssg-var_sssd_certificate_verification_digest_function:var:1" version="1"/>
        <oval-def:external_variable comment="memcache_timeout value" datatype="int" id="oval:ssg-var_sssd_memcache_timeout:var:1" version="1"/>
        <oval-def:external_variable comment="var_sssd_ssh_known_hosts_timeout value" datatype="int" id="oval:ssg-var_sssd_ssh_known_hosts_timeout:var:1" version="1"/>
        <oval-def:external_variable comment="warning banner text variable" datatype="string" id="oval:ssg-login_banner_text:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-pwhistory_line_regex_password_auth:var:1" datatype="string" comment="The regex of the directive" version="1">
          <oval-def:concat>
            <oval-def:literal_component>^\s*password\s+(?:</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_password_pam_remember_control_flag:var:1"/>
            <oval-def:literal_component>)\s+pam_pwhistory\.so.*remember=([0-9]*).*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable comment="number of passwords that should be remembered" datatype="int" id="oval:ssg-var_password_pam_remember:var:1" version="1"/>
        <oval-def:external_variable comment="control flag for pwhistory module" datatype="string" id="oval:ssg-var_password_pam_remember_control_flag:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-pwhistory_line_regex_system_auth:var:1" datatype="string" comment="The regex of the directive" version="1">
          <oval-def:concat>
            <oval-def:literal_component>^\s*password\s+(?:</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_password_pam_remember_control_flag:var:1"/>
            <oval-def:literal_component>)\s+pam_pwhistory\.so.*remember=([0-9]*).*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable comment="number of passwords that should be remembered" datatype="int" id="oval:ssg-var_password_pam_unix_remember:var:1" version="1"/>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_unix_regex:var:1" datatype="string" version="1" comment="regex to identify pam_unix.so in auth section of pam files">
          <oval-def:value>^[\s]*auth\N+pam_unix\.so</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_auth_regex:var:1" datatype="string" version="1" comment="regex to identify pam_faillock.so entries in auth section of pam files">
          <oval-def:value>^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_account_regex:var:1" datatype="string" version="1" comment="regex to identify pam_faillock.so entry in account section of pam files">
          <oval-def:value>^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_deny_parameter_regex:var:1" datatype="string" version="1" comment="regex to identify pam_faillock.so deny entry in auth section of pam files">
          <oval-def:value>^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*deny=([0-9]+)</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_faillock_conf_deny_parameter_regex:var:1" datatype="string" version="1" comment="regex to identify deny entry in /etc/security/faillock.conf">
          <oval-def:value>^[\s]*deny[\s]*=[\s]*([0-9]+)</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:external_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1" datatype="int" comment="number of failed login attempts allowed" version="1"/>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_unix_regex:var:1" datatype="string" version="1" comment="regex to identify pam_unix.so in auth section of pam files">
          <oval-def:value>^[\s]*auth\N+pam_unix\.so</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_auth_regex:var:1" datatype="string" version="1" comment="regex to identify pam_faillock.so entries in auth section of pam files">
          <oval-def:value>^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_account_regex:var:1" datatype="string" version="1" comment="regex to identify pam_faillock.so entry in account section of pam files">
          <oval-def:value>^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_parameter_regex:var:1" datatype="string" version="1" comment="regex to identify pam_faillock.so deny entry in auth section of pam files">
          <oval-def:value>^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*even_deny_root</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_faillock_conf_parameter_regex:var:1" datatype="string" version="1" comment="regex to identify deny entry in /etc/security/faillock.conf">
          <oval-def:value>^[\s]*even_deny_root</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_enforce_local_pam_unix_regex:var:1" datatype="string" version="1" comment="regex to identify pam_unix.so in auth section of pam files">
          <oval-def:value>^[\s]*auth\N+pam_unix\.so</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_enforce_local_pam_faillock_auth_regex:var:1" datatype="string" version="1" comment="regex to identify pam_faillock.so entries in auth section of pam files">
          <oval-def:value>^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_enforce_local_pam_faillock_account_regex:var:1" datatype="string" version="1" comment="regex to identify pam_faillock.so entry in account section of pam files">
          <oval-def:value>^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_enforce_local_faillock_conf_parameter_regex:var:1" datatype="string" version="1" comment="regex to identify deny entry in /etc/security/faillock.conf">
          <oval-def:value>^[\s]*local_users_only</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_unix_regex:var:1" datatype="string" version="1" comment="regex to identify pam_unix.so in auth section of pam files">
          <oval-def:value>^[\s]*auth\N+pam_unix\.so</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_auth_regex:var:1" datatype="string" version="1" comment="regex to identify pam_faillock.so entries in auth section of pam files">
          <oval-def:value>^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_account_regex:var:1" datatype="string" version="1" comment="regex to identify pam_faillock.so entry in account section of pam files">
          <oval-def:value>^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_fail_interval_parameter_regex:var:1" datatype="string" version="1" comment="regex to identify pam_faillock.so fail_interval entry in auth section of pam files">
          <oval-def:value>^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*fail_interval=([0-9]+)</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_interval_faillock_conf_fail_interval_parameter_regex:var:1" datatype="string" version="1" comment="regex to identify fail_interval entry in /etc/security/faillock.conf">
          <oval-def:value>^[\s]*fail_interval[\s]*=[\s]*([0-9]+)</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:external_variable id="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1" datatype="int" comment="number of failed login attempts allowed" version="1"/>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_unix_regex:var:1" datatype="string" version="1" comment="regex to identify pam_unix.so in auth section of pam files">
          <oval-def:value>^[\s]*auth\N+pam_unix\.so</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_auth_regex:var:1" datatype="string" version="1" comment="regex to identify pam_faillock.so entries in auth section of pam files">
          <oval-def:value>^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_account_regex:var:1" datatype="string" version="1" comment="regex to identify pam_faillock.so entry in account section of pam files">
          <oval-def:value>^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_unlock_time_parameter_regex:var:1" datatype="string" version="1" comment="regex to identify pam_faillock.so unlock_time entry in auth section of pam files">
          <oval-def:value>^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*unlock_time=([0-9]+)</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_faillock_conf_unlock_time_parameter_regex:var:1" datatype="string" version="1" comment="regex to identify unlock_time entry in /etc/security/faillock.conf">
          <oval-def:value>^[\s]*unlock_time[\s]*=[\s]*([0-9]+)</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:external_variable id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1" datatype="int" comment="number of failed login attempts allowed" version="1"/>
        <oval-def:external_variable datatype="int" id="oval:ssg-var_password_pam_retry:var:1" version="1" comment="External variable for pam_pwquality retry"/>
        <oval-def:local_variable id="oval:ssg-variable_last_encrypt_method_instance_value:var:1" datatype="string" comment="The value of last ENCRYPT_METHOD directive in /etc/login.defs" version="1">
          <oval-def:regex_capture pattern="ENCRYPT_METHOD\s+(\w+)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_last_encrypt_method_from_etc_login_defs:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:external_variable comment="defined hashing algorithm" datatype="string" id="oval:ssg-var_password_hashing_algorithm:var:1" version="1"/>
        <oval-def:external_variable comment="external variable for opensc smartcard drivers" datatype="string" id="oval:ssg-var_smartcard_drivers:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-variable_smart_card_enabled_system_auth:var:1" datatype="string" comment="Regular expression to check if smartcard authentication is enabled in /etc/pam.d/system-auth" version="1">
          <oval-def:concat>
            <oval-def:literal_component>\nauth[\s]+required[\s]+pam_env.so</oval-def:literal_component>
            <oval-def:literal_component>\nauth[\s]+\[success=1[\s]default=ignore\][\s]pam_succeed_if.so[\s]service[\s]notin[\s]</oval-def:literal_component>
            <oval-def:literal_component>login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kscreensaver[\s]quiet[\s]use_uid</oval-def:literal_component>
            <oval-def:literal_component>\nauth[\s]+\[success=done[\s]authinfo_unavail=ignore[\s]ignore=ignore[\s]default=die\][\s]</oval-def:literal_component>
            <oval-def:literal_component>pam_pkcs11.so[\s]nodebug\n</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_smart_card_required_system_auth:var:1" datatype="string" comment="Regular expressiion to check if smartcard authentication is required in /etc/pam.d/system-auth" version="1">
          <oval-def:concat>
            <oval-def:literal_component>\nauth[\s]+required[\s]+pam_env.so</oval-def:literal_component>
            <oval-def:literal_component>\nauth[\s]+\[success=1[\s]default=ignore\][\s]pam_succeed_if.so[\s]service[\s]notin[\s]</oval-def:literal_component>
            <oval-def:literal_component>login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kscreensaver[\s]quiet[\s]use_uid</oval-def:literal_component>
            <oval-def:literal_component>\nauth[\s]+\[success=done[\s]ignore=ignore[\s]default=die\][\s]</oval-def:literal_component>
            <oval-def:literal_component>pam_pkcs11.so[\s]nodebug[\s]wait_for_card\n</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_smart_card_required_smartcard_auth:var:1" datatype="string" comment="Regular expression to check if smartcard authentication is required in /etc/pam.d/smartcard-auth" version="1">
          <oval-def:concat>
            <oval-def:literal_component>\nauth[\s]+required[\s]+pam_env.so.*</oval-def:literal_component>
            <oval-def:literal_component>\nauth[\s]+\[success=done[\s]ignore=ignore[\s]default=die\][\s]</oval-def:literal_component>
            <oval-def:literal_component>pam_pkcs11.so[\s]nodebug[\s]wait_for_card\n.*</oval-def:literal_component>
            <oval-def:literal_component>\npassword[\s]+required[\s]+pam_pkcs11.so\n</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_count_of_all_uids:var:1" datatype="int" version="1" comment="Count of all uids (including duplicates if any)">
          <oval-def:count>
            <oval-def:object_component item_field="user_id" object_ref="oval:ssg-obj_all_uids:obj:1"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_count_of_unique_uids:var:1" datatype="int" version="1" comment="Count of unique uids">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component item_field="user_id" object_ref="oval:ssg-obj_all_uids:obj:1"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_accounts_authorized_local_users_regex:var:1" version="1" datatype="string" comment="accounts authorized local users on operating system"/>
        <oval-def:local_variable id="oval:ssg-variable_count_of_all_group_ids:var:1" datatype="int" version="1" comment="Count of all group ids (including duplicates if any)">
          <oval-def:count>
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_all_group_ids:obj:1"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_count_of_unique_group_ids:var:1" datatype="int" version="1" comment="Count of unique group ids">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_all_group_ids:obj:1"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_count_of_all_group_names:var:1" datatype="int" version="1" comment="Count of all group names (including duplicates if any)">
          <oval-def:count>
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_all_group_names:obj:1"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_count_of_unique_group_names:var:1" datatype="int" version="1" comment="Count of unique group names">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_all_group_names:obj:1"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:external_variable comment="inactive days expiration" datatype="int" id="oval:ssg-var_account_disable_post_pw_expiration:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1" datatype="int" version="1" comment="Count of all username rows retrieved from /etc/passwd (including duplicates if any)">
          <oval-def:count>
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_etc_passwd_content:obj:1"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_count_of_unique_usernames_from_etc_passwd:var:1" datatype="int" version="1" comment="Count of unique username rows retrieved from /etc/passwd">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_etc_passwd_content:obj:1"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_last_pass_max_days_instance_value:var:1" datatype="int" comment="The value of last PASS_MAX_DAYS directive in /etc/login.defs" version="1">
          <oval-def:regex_capture pattern="PASS_MAX_DAYS\s+(\d+)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_max_days_from_etc_login_defs:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:external_variable comment="Maximum password age" datatype="int" id="oval:ssg-var_accounts_maximum_age_login_defs:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-variable_last_pass_min_days_instance_value:var:1" datatype="int" comment="The value of last PASS_MIN_DAYS directive in /etc/login.defs" version="1">
          <oval-def:regex_capture pattern="PASS_MIN_DAYS\s+(\d+)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_min_days_from_etc_login_defs:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:external_variable comment="Minimum password age in days" datatype="int" id="oval:ssg-var_accounts_minimum_age_login_defs:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-variable_last_pass_min_len_instance_value:var:1" datatype="int" comment="The value of last PASS_MIN_LEN directive in /etc/login.defs" version="1">
          <oval-def:regex_capture pattern="PASS_MIN_LEN\s+(\d+)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_min_len_from_etc_login_defs:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:external_variable comment="Password minimum length" datatype="int" id="oval:ssg-var_accounts_password_minlen_login_defs:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-variable_last_pass_warn_age_instance_value:var:1" datatype="int" comment="The value of last PASS_WARN_AGE directive in /etc/login.defs" version="1">
          <oval-def:regex_capture pattern="PASS_WARN_AGE\s+(\d+)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_warn_age_from_etc_login_defs:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:external_variable comment="password expiration warning age in days" datatype="int" id="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-var_password_auth_default_hashing_rounds:var:1" datatype="int" version="1" comment="Default number of password hashing rounds">
          <oval-def:literal_component>5000</oval-def:literal_component>
        </oval-def:local_variable>
        <oval-def:external_variable comment="number of passwords hashing rounds" datatype="int" id="oval:ssg-var_password_pam_unix_rounds:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-var_system_auth_default_hashing_rounds:var:1" datatype="int" version="1" comment="Default number of password hashing rounds">
          <oval-def:literal_component>5000</oval-def:literal_component>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_gid_passwd_group_same:var:1" comment="GIDs from /etc/group" datatype="string" version="1">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_gid_passwd_group_same_var:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_uid_min_value:var:1" datatype="int" comment="Value of last UID_MIN from /etc/login.defs" version="1">
          <oval-def:regex_capture pattern="UID_MIN[\s]+(\d+)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_last_uid_min_from_etc_login_defs:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_sys_uid_min_value:var:1" datatype="int" comment="Value of last SYS_UID_MIN from /etc/login.defs" version="1">
          <oval-def:regex_capture pattern="SYS_UID_MIN[\s]+(\d+)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_sys_uid_max_value:var:1" datatype="int" comment="Value of last SYS_UID_MAX from /etc/login.defs" version="1">
          <oval-def:regex_capture pattern="SYS_UID_MAX[\s]+(\d+)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_accounts_fail_delay:var:1" datatype="int" version="1" comment="Expected fail_delay"/>
        <oval-def:external_variable comment="maximum number of concurrent logins per user" datatype="int" id="oval:ssg-var_accounts_max_concurrent_login_sessions:var:1" version="1"/>
        <oval-def:external_variable comment="external variable for TMOUT" datatype="int" id="oval:ssg-var_accounts_tmout:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-var_file_permissions_home_dirs_dirs:var:1" datatype="string" version="1" comment="Variable including all home dirs from interactive users">
          <oval-def:object_component item_field="home_dir" object_ref="oval:ssg-object_file_permissions_home_dirs_objects:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Split the PATH on the : delimiter" datatype="string" id="oval:ssg-var_accounts_root_path_dirs_no_write:var:1" version="1">
          <oval-def:split delimiter=":">
            <oval-def:object_component item_field="value" object_ref="oval:ssg-object_accounts_root_path_dirs_no_write_pathenv:obj:1"/>
          </oval-def:split>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_login_defs:var:1" comment="First octal digit of umask from /etc/login.defs" datatype="int" version="1">
          <oval-def:substring substring_start="1" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_login_defs:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_login_defs:var:1" comment="Second octal digit of umask from /etc/login.defs" datatype="int" version="1">
          <oval-def:substring substring_start="2" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_login_defs:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_login_defs:var:1" comment="Third octal digit of umask from /etc/login.defs" datatype="int" version="1">
          <oval-def:substring substring_start="3" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_login_defs:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_etc_login_defs_umask_as_number:var:1" comment="/etc/login.defs umask converted from string to a number" datatype="int" version="1">
          <oval-def:arithmetic arithmetic_operation="add">
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">64</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_login_defs:var:1"/>
            </oval-def:arithmetic>
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">8</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_login_defs:var:1"/>
            </oval-def:arithmetic>
            <oval-def:variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_login_defs:var:1"/>
          </oval-def:arithmetic>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_profile:var:1" comment="First octal digit of umask from /etc/profile" datatype="int" version="1">
          <oval-def:substring substring_start="1" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_profile:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_profile:var:1" comment="Second octal digit of umask from /etc/profile" datatype="int" version="1">
          <oval-def:substring substring_start="2" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_profile:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_profile:var:1" comment="Third octal digit of umask from /etc/profile" datatype="int" version="1">
          <oval-def:substring substring_start="3" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_profile:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_etc_profile_umask_as_number:var:1" comment="/etc/profile umask converted from string to a number" datatype="int" version="1">
          <oval-def:arithmetic arithmetic_operation="add">
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">64</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_profile:var:1"/>
            </oval-def:arithmetic>
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">8</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_profile:var:1"/>
            </oval-def:arithmetic>
            <oval-def:variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_profile:var:1"/>
          </oval-def:arithmetic>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_access_var_log_audit_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+dir=/var/log/audit/)[\s]+(?:-F[\s]+perm=r)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-audit_log_dir:var:1" datatype="string" version="1" comment="path to audit log directory">
          <oval-def:regex_capture pattern="^(.*)\/([^\/]+$)">
            <oval-def:variable_component var_ref="oval:ssg-audit_log_file_path:var:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_all_privileged_commands:var:1" comment="All privileged commands" datatype="string" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_system_privileged_commands:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_count_of_suid_sgid_binaries_on_system:var:1" comment="count of suid / sgid binaries actually present on the system" datatype="int" version="1">
          <oval-def:count>
            <oval-def:object_component object_ref="oval:ssg-object_system_privileged_commands:obj:1" item_field="filepath"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_count_of_privileged_commands_having_audit_definition_augenrules:var:1" comment="count of suid / sgid binaries having full audit rule definition in some of /etc/audit/rules.d/*.rules files" datatype="int" version="1">
          <oval-def:count>
            <oval-def:object_component object_ref="oval:ssg-object_arpc_suid_sgid_augenrules:obj:1" item_field="subexpression"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_count_of_privileged_commands_having_audit_definition_auditctl:var:1" comment="count of suid / sgid binaries having full audit rule definition in /etc/audit/audit.rules file" datatype="int" version="1">
          <oval-def:count>
            <oval-def:object_component object_ref="oval:ssg-object_arpc_suid_sgid_auditctl:obj:1" item_field="subexpression"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:external_variable comment="audispd remote_server setting" datatype="string" id="oval:ssg-var_audispd_remote_server:var:1" version="1"/>
        <oval-def:external_variable comment="audit disk_error_action setting" datatype="string" id="oval:ssg-var_auditd_disk_error_action:var:1" version="1"/>
        <oval-def:external_variable comment="audit disk_full_action setting" datatype="string" id="oval:ssg-var_auditd_disk_full_action:var:1" version="1"/>
        <oval-def:external_variable comment="audit action_mail_acct setting" datatype="string" id="oval:ssg-var_auditd_action_mail_acct:var:1" version="1"/>
        <oval-def:external_variable comment="audit admin_space_left_action setting" datatype="string" id="oval:ssg-var_auditd_admin_space_left_action:var:1" version="1"/>
        <oval-def:external_variable comment="audit flush setting" datatype="string" id="oval:ssg-var_auditd_flush:var:1" version="1"/>
        <oval-def:external_variable comment="audit max_log_file setting" datatype="int" id="oval:ssg-var_auditd_max_log_file:var:1" version="1"/>
        <oval-def:external_variable comment="audit max_log_file_action setting" datatype="string" id="oval:ssg-var_auditd_max_log_file_action:var:1" version="1"/>
        <oval-def:external_variable comment="audit num_logs setting" datatype="int" id="oval:ssg-var_auditd_num_logs:var:1" version="1"/>
        <oval-def:external_variable comment="audit space_left_action setting" datatype="string" id="oval:ssg-var_auditd_space_left_action:var:1" version="2"/>
        <oval-def:external_variable comment="audit space_left setting" datatype="int" id="oval:ssg-var_auditd_space_left_percentage:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-var_user_accounts:var:1" datatype="string" version="1" comment="Variable           including all system usernames">
          <oval-def:object_component item_field="username" object_ref="oval:ssg-object_user_accounts:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_uefi_user_accounts:var:1" datatype="string" version="1" comment="Variable           including all system usernames">
          <oval-def:object_component item_field="username" object_ref="oval:ssg-object_uefi_user_accounts:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rfg_include_config_regex:var:1" datatype="string" version="1" comment="$IncludeConfig value converted to regex">
          <oval-def:unique>
            <oval-def:glob_to_regex>
              <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_rfg_rsyslog_include_config_value:obj:1"/>
            </oval-def:glob_to_regex>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rfg_syslog_config:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
          <oval-def:literal_component datatype="string">^/etc/rsyslog.conf$</oval-def:literal_component>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rfg_all_log_files:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
          <oval-def:object_component object_ref="oval:ssg-object_var_rfg_all_log_files:obj:1" item_field="value"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rfg_log_files_paths:var:1" datatype="string" version="1" comment="File paths of all rsyslog configuration files">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_rfg_log_files_paths:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rfo_include_config_regex:var:1" datatype="string" version="1" comment="$IncludeConfig value converted to regex">
          <oval-def:unique>
            <oval-def:glob_to_regex>
              <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_rfo_rsyslog_include_config_value:obj:1"/>
            </oval-def:glob_to_regex>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rfo_syslog_config:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
          <oval-def:literal_component datatype="string">^/etc/rsyslog.conf$</oval-def:literal_component>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rfo_all_log_files:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
          <oval-def:object_component object_ref="oval:ssg-object_var_rfo_all_log_files:obj:1" item_field="value"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rfo_log_files_paths:var:1" datatype="string" version="1" comment="File paths of all rsyslog configuration files">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_rfo_log_files_paths:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rfp_include_config_regex:var:1" datatype="string" version="1" comment="$IncludeConfig value converted to regex">
          <oval-def:unique>
            <oval-def:glob_to_regex>
              <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_rfp_rsyslog_include_config_value:obj:1"/>
            </oval-def:glob_to_regex>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rfp_syslog_config:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
          <oval-def:literal_component datatype="string">^/etc/rsyslog.conf$</oval-def:literal_component>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rfp_all_log_files:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
          <oval-def:object_component object_ref="oval:ssg-object_var_rfp_all_log_files:obj:1" item_field="value"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rfp_log_files_paths:var:1" datatype="string" version="1" comment="File paths of all rsyslog configuration files">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_rfp_log_files_paths:obj:1"/>
        </oval-def:local_variable>
        <oval-def:external_variable comment="used for remediation only" datatype="string" id="oval:ssg-rsyslog_remote_loghost_address:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-var_file_permissions_unauthorized_sgid_rpms:var:1" datatype="string" version="1" comment="all files with sgid set that come from a RPM package">
          <oval-def:object_component item_field="filepath" object_ref="oval:ssg-obj_file_permissions_unauthorized_sgid_rpms:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_file_permissions_unauthorized_sgid_all:var:1" datatype="string" version="1" comment="all files with sgid set">
          <oval-def:object_component item_field="filepath" object_ref="oval:ssg-obj_file_permissions_unauthorized_sgid_files:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_file_permissions_unauthorized_suid_rpms:var:1" datatype="string" version="1" comment="all files with suid set that come from a RPM package">
          <oval-def:object_component item_field="filepath" object_ref="oval:ssg-obj_file_permissions_unauthorized_suid_rpms:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_file_permissions_unauthorized_suid_all:var:1" datatype="string" version="1" comment="all files with suid set">
          <oval-def:object_component item_field="filepath" object_ref="oval:ssg-obj_file_permissions_unauthorized_suid_files:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_file_permissions_ungroupowned:var:1" datatype="int" version="1" comment="all GIDs on the target system">
          <oval-def:object_component object_ref="oval:ssg-etc_group_object:obj:1" item_field="subexpression"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-file_permissions_unowned_userid_list:var:1" comment="List of valid user ids" datatype="int" version="1">
          <oval-def:object_component item_field="user_id" object_ref="oval:ssg-file_permissions_unowned_userid_list_object:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Source device of /var/tmp" datatype="string" id="oval:ssg-var_mount_option_var_tmp_bind_var_tmp_source_device:var:1" version="1">
          <oval-def:object_component item_field="device" object_ref="oval:ssg-object_mount_option_var_tmp:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_init_d_functions:var:1" comment="First octal digit of umask from /etc/init.d/functions" datatype="int" version="1">
          <oval-def:substring substring_start="1" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_init_d_functions:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_init_d_functions:var:1" comment="Second octal digit of umask from /etc/init.d/functions" datatype="int" version="1">
          <oval-def:substring substring_start="2" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_init_d_functions:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_init_d_functions:var:1" comment="Third octal digit of umask from /etc/init.d/functions" datatype="int" version="1">
          <oval-def:substring substring_start="3" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_init_d_functions:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_etc_init_d_functions_umask_as_number:var:1" comment="/etc/init.d/functions umask converted from string to a number" datatype="int" version="1">
          <oval-def:arithmetic arithmetic_operation="add">
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">64</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_init_d_functions:var:1"/>
            </oval-def:arithmetic>
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">8</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_init_d_functions:var:1"/>
            </oval-def:arithmetic>
            <oval-def:variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_init_d_functions:var:1"/>
          </oval-def:arithmetic>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_dev_device_files:var:1" comment="all device files within /dev directory" datatype="string" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_dev_device_files:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable comment="External variable: name of selinux policy in /etc/selinux/config" datatype="string" id="oval:ssg-var_selinux_policy_name:var:1" version="1"/>
        <oval-def:external_variable comment="external variable for selinux state" datatype="string" id="oval:ssg-var_selinux_state:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-var_dconf_distro_db_modified_time:var:1" datatype="string" version="1" comment="When the 'distro' dconf DB has been modified">
          <oval-def:time_difference format_2="seconds_since_epoch">
            <oval-def:object_component object_ref="oval:ssg-obj_dconf_distro_db:obj:1" item_field="m_time"/>
          </oval-def:time_difference>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_dconf_distro_keyfiles_modified_time:var:1" datatype="int" version="1" comment="When dconf keyfiles in the 'distro' tree have been modified">
          <oval-def:time_difference format_2="seconds_since_epoch">
            <oval-def:object_component object_ref="oval:ssg-obj_dconf_distro_config:obj:1" item_field="m_time"/>
          </oval-def:time_difference>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_dconf_local_db_modified_time:var:1" datatype="string" version="1" comment="When the 'local' dconf DB has been modified">
          <oval-def:time_difference format_2="seconds_since_epoch">
            <oval-def:object_component object_ref="oval:ssg-obj_dconf_local_db:obj:1" item_field="m_time"/>
          </oval-def:time_difference>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_dconf_local_keyfiles_modified_time:var:1" datatype="int" version="1" comment="When dconf keyfiles in the 'local' tree have been modified">
          <oval-def:time_difference format_2="seconds_since_epoch">
            <oval-def:object_component object_ref="oval:ssg-obj_dconf_local_config:obj:1" item_field="m_time"/>
          </oval-def:time_difference>
        </oval-def:local_variable>
        <oval-def:external_variable comment="inactivity timeout variable" datatype="int" id="oval:ssg-inactivity_timeout_value:var:1" version="1"/>
        <oval-def:external_variable comment="screensaver lock delay variable" datatype="int" id="oval:ssg-var_screensaver_lock_delay:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-variable_crypto_policies_current_file_timestamp:var:1" version="1" comment="Age of /etc/crypto-policies/state/current" datatype="int">
          <oval-def:object_component object_ref="oval:ssg-crypto_policies_current_file:obj:1" item_field="m_time"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_crypto_policies_config_file_timestamp:var:1" version="1" comment="Age of /etc/crypto-policies/config" datatype="int">
          <oval-def:object_component object_ref="oval:ssg-crypto_policies_config_file:obj:1" item_field="m_time"/>
        </oval-def:local_variable>
        <oval-def:external_variable comment="defined crypto policy" datatype="string" id="oval:ssg-var_system_crypto_policy:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-var_symlink_kerberos_crypto_policy_configuration:var:1" datatype="string" comment="regex variable for canonical path to targeted kerberos policy" version="1">
          <oval-def:object_component item_field="canonical_path" object_ref="oval:ssg-object_kerberos_crypto_policy_configuration:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_symlink_kerberos_crypto_policy_backend:var:1" datatype="string" comment="regex variable for canonical path to targeted kerberos policy" version="1">
          <oval-def:object_component item_field="canonical_path" object_ref="oval:ssg-object_kerberos_crypto_policy_backend:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-sshd_ciphers_crypto:var:1" datatype="string" comment="The regex of the directive" version="1">
          <oval-def:concat>
            <oval-def:literal_component>Ciphers </oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-sshd_approved_ciphers:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable comment="SSH Approved Ciphers by FIPS" datatype="string" id="oval:ssg-sshd_approved_ciphers:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-sshd_macs_crypto:var:1" datatype="string" comment="The regex of the directive" version="1">
          <oval-def:concat>
            <oval-def:literal_component>MACs </oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-sshd_approved_macs:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable comment="SSH Approved MACs by FIPS" datatype="string" id="oval:ssg-sshd_approved_macs:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-variable_aide_build_new_database_absolute_path:var:1" datatype="string" comment="Absolute path of Aide build database file" version="1">
          <oval-def:concat>
            <oval-def:object_component object_ref="oval:ssg-object_aide_build_database_dirpath:obj:1" item_field="subexpression"/>
            <oval-def:literal_component>/</oval-def:literal_component>
            <oval-def:object_component object_ref="oval:ssg-object_aide_build_new_database_filename:obj:1" item_field="subexpression"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_aide_operational_database_absolute_path:var:1" datatype="string" comment="Absolute path of Aide build database file" version="1">
          <oval-def:concat>
            <oval-def:object_component object_ref="oval:ssg-object_aide_build_database_dirpath:obj:1" item_field="subexpression"/>
            <oval-def:literal_component>/</oval-def:literal_component>
            <oval-def:object_component object_ref="oval:ssg-object_aide_operational_database_filename:obj:1" item_field="subexpression"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Items counter" datatype="int" id="oval:ssg-local_variable_counter_sudoers_passwd_n_files:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_test_sudoers_targetpw_config:obj:1" item_field="filepath"/>
              <oval-def:object_component object_ref="oval:ssg-object_test_sudoers_rootpw_config:obj:1" item_field="filepath"/>
              <oval-def:object_component object_ref="oval:ssg-object_test_sudoers_runaspw_config:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:external_variable comment="External variable for pam_dcredit" datatype="int" id="oval:ssg-var_password_pam_dcredit:var:1" version="3"/>
        <oval-def:external_variable comment="External variable for pam_dictcheck" datatype="int" id="oval:ssg-var_password_pam_dictcheck:var:1" version="3"/>
        <oval-def:external_variable comment="External variable for pam_difok" datatype="int" id="oval:ssg-var_password_pam_difok:var:1" version="3"/>
        <oval-def:external_variable comment="External variable for pam_lcredit" datatype="int" id="oval:ssg-var_password_pam_lcredit:var:1" version="3"/>
        <oval-def:external_variable comment="External variable for pam_maxclassrepeat" datatype="int" id="oval:ssg-var_password_pam_maxclassrepeat:var:1" version="3"/>
        <oval-def:external_variable comment="External variable for pam_maxrepeat" datatype="int" id="oval:ssg-var_password_pam_maxrepeat:var:1" version="3"/>
        <oval-def:external_variable comment="External variable for pam_minclass" datatype="int" id="oval:ssg-var_password_pam_minclass:var:1" version="3"/>
        <oval-def:external_variable comment="External variable for pam_minlen" datatype="int" id="oval:ssg-var_password_pam_minlen:var:1" version="3"/>
        <oval-def:external_variable comment="External variable for pam_ocredit" datatype="int" id="oval:ssg-var_password_pam_ocredit:var:1" version="3"/>
        <oval-def:external_variable comment="External variable for pam_ucredit" datatype="int" id="oval:ssg-var_password_pam_ucredit:var:1" version="3"/>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_32bit_open_write_tc_group_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_64bit_open_write_tc_group_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_group_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_group_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_32bit_openat_write_tc_group_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_64bit_openat_write_tc_group_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_32bit_open_write_tc_gshadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_64bit_open_write_tc_gshadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_gshadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_gshadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_32bit_openat_write_tc_gshadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_64bit_openat_write_tc_gshadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_32bit_open_write_tc_passwd_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_64bit_open_write_tc_passwd_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_passwd_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_passwd_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_32bit_openat_write_tc_passwd_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_64bit_openat_write_tc_passwd_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_32bit_open_write_tc_shadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_64bit_open_write_tc_shadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_shadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_shadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_32bit_openat_write_tc_shadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_64bit_openat_write_tc_shadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_chmod_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_chmod_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_chmod_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_chmod_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit chmod EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_chmod_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_chmod_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_chmod_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit chmod EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_chmod_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_chmod_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_chmod_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit chmod EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_chmod_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_chmod_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_chmod_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit chmod EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_chmod_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_chmod_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_chown_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_chown_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_chown_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_chown_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit chown EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_chown_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_chown_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_chown_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit chown EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_chown_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_chown_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_chown_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit chown EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_chown_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_chown_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_chown_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit chown EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_chown_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_chown_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_creat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_creat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_creat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_creat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit creat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_creat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_creat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit creat EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_creat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_creat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit creat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_creat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_creat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit creat EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_creat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_fchmod_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_fchmod_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_fchmod_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_fchmod_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchmod EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_fchmod_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchmod_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_fchmod_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchmod EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_fchmod_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchmod_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_fchmod_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchmod EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_fchmod_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchmod_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_fchmod_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchmod EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_fchmod_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchmod_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_fchmodat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_fchmodat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_fchmodat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_fchmodat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchmodat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_fchmodat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchmodat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_fchmodat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchmodat EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_fchmodat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchmodat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_fchmodat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchmodat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_fchmodat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchmodat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_fchmodat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchmodat EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_fchmodat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchmodat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_fchown_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_fchown_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_fchown_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_fchown_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchown EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_fchown_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchown_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_fchown_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchown EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_fchown_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchown_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_fchown_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchown EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_fchown_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchown_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_fchown_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchown EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_fchown_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchown_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_fchownat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_fchownat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_fchownat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_fchownat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchownat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_fchownat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchownat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_fchownat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchownat EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_fchownat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchownat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_fchownat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchownat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_fchownat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchownat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_fchownat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchownat EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_fchownat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchownat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_fremovexattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_fremovexattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_fremovexattr_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_fremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fremovexattr EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_fremovexattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fremovexattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_fremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fremovexattr EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_fremovexattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fremovexattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_fremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fremovexattr EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_fremovexattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fremovexattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_fremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fremovexattr EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_fremovexattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fremovexattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_fsetxattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_fsetxattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_fsetxattr_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_fsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fsetxattr EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_fsetxattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fsetxattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_fsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fsetxattr EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_fsetxattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fsetxattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_fsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fsetxattr EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_fsetxattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fsetxattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_fsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fsetxattr EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_fsetxattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fsetxattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_ftruncate_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_ftruncate_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_ftruncate_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_ftruncate_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit ftruncate EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_ftruncate_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_ftruncate_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_ftruncate_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit ftruncate EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_ftruncate_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_ftruncate_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_ftruncate_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit ftruncate EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_ftruncate_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_ftruncate_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_ftruncate_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit ftruncate EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_ftruncate_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_ftruncate_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_lchown_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_lchown_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_lchown_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_lchown_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit lchown EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_lchown_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_lchown_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_lchown_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit lchown EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_lchown_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_lchown_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_lchown_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit lchown EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_lchown_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_lchown_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_lchown_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit lchown EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_lchown_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_lchown_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_lremovexattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_lremovexattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_lremovexattr_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_lremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit lremovexattr EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_lremovexattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_lremovexattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_lremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit lremovexattr EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_lremovexattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_lremovexattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_lremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit lremovexattr EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_lremovexattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_lremovexattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_lremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit lremovexattr EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_lremovexattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_lremovexattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_lsetxattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_lsetxattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_lsetxattr_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_lsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit lsetxattr EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_lsetxattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_lsetxattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_lsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit lsetxattr EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_lsetxattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_lsetxattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_lsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit lsetxattr EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_lsetxattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_lsetxattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_lsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit lsetxattr EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_lsetxattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_lsetxattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_open_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_open_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_open_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_open_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_open_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_open_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_open_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_open_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_open_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_open_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_open_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_open_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_open_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_open_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_open_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_open_by_handle_at_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_open_by_handle_at_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_open_by_handle_at_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_open_by_handle_at_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_open_by_handle_at_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_open_by_handle_at_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_open_by_handle_at_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_open_by_handle_at_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_open_by_handle_at_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_open_by_handle_at_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open_by_handle_at EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_open_by_handle_at_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_open_by_handle_at_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_open_by_handle_at_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open_by_handle_at EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_open_by_handle_at_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_open_by_handle_at_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_separator_regex:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>(?:[^.]|\.\s)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at O_CREAT EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at O_CREAT EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open_by_handle_at O_CREAT EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at O_CREAT EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_separator_regex:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>(?:[^.]|\.\s)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at O_TRUNC EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at O_TRUNC EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open_by_handle_at O_TRUNC EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open_by_handle_at O_TRUNC EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_eacces_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_eperm_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_eacces_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_eperm_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_auditctl_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_auditctl_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_open_by_handle_at_order_64bit_auditctl_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_auditctl_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_o_creat_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_o_creat_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_o_creat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_o_creat_separator_regex:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>(?:[^.]|\.\s)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open O_CREAT EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open O_CREAT EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open O_CREAT EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open O_CREAT EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_o_trunc_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_o_trunc_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_o_trunc_separator_regex:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>(?:[^.]|\.\s)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open O_TRUNC EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open O_TRUNC EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open O_TRUNC EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open O_TRUNC EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_order_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_order_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_order_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_order_32bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_order_32bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_order_32bit_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_order_32bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_order_32bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_order_32bit_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_order_64bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_order_64bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_order_64bit_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_order_64bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_order_64bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_order_64bit_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_eacces_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_eperm_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_64bit_open_eacces_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_64bit_open_eperm_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_auditctl_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_auditctl_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_open_order_64bit_auditctl_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_64bit_open_auditctl_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_openat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_openat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_openat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_openat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_openat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_openat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_openat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_openat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_openat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_openat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit openat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_openat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_openat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_openat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit openat EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_openat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_openat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_openat_o_creat_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_openat_o_creat_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_openat_o_creat_separator_regex:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>(?:[^.]|\.\s)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat O_CREAT EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat O_CREAT EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit openat O_CREAT EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat O_CREAT EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_openat_o_trunc_separator_regex:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>(?:[^.]|\.\s)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat O_TRUNC EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat O_TRUNC EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit openat O_TRUNC EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit openat O_TRUNC EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_openat_order_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_order_32bit_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_order_32bit_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_order_64bit_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_order_64bit_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_32bit_openat_eacces_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_32bit_openat_eperm_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_64bit_openat_eacces_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_64bit_openat_eperm_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_32bit_openat_auditctl_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_32bit_openat_auditctl_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_openat_order_64bit_auditctl_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_64bit_openat_auditctl_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_removexattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_removexattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_removexattr_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_removexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit removexattr EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_removexattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_removexattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_removexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit removexattr EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_removexattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_removexattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_removexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit removexattr EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_removexattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_removexattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_removexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit removexattr EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_removexattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_removexattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_rename_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_rename_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_rename_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_rename_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit rename EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_rename_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_rename_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_rename_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit rename EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_rename_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_rename_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_rename_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit rename EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_rename_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_rename_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_rename_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit rename EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_rename_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_rename_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_renameat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_renameat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_renameat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_renameat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit renameat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_renameat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_renameat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_renameat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit renameat EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_renameat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_renameat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_renameat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit renameat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_renameat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_renameat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_renameat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit renameat EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_renameat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_renameat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_setxattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_setxattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_setxattr_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_setxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit setxattr EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_setxattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_setxattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_setxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit setxattr EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_setxattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_setxattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_setxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit setxattr EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_setxattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_setxattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_setxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit setxattr EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_setxattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_setxattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_truncate_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_truncate_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_truncate_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_truncate_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit truncate EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_truncate_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_truncate_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_truncate_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit truncate EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_truncate_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_truncate_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_truncate_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit truncate EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_truncate_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_truncate_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_truncate_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit truncate EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_truncate_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_truncate_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_unlink_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_unlink_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_unlink_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_unlink_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit unlink EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_unlink_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_unlink_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_unlink_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit unlink EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_unlink_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_unlink_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_unlink_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit unlink EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_unlink_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_unlink_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_unlink_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit unlink EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_unlink_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_unlink_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_unlinkat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_unlinkat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_unlinkat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_unlinkat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit unlinkat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_unlinkat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_unlinkat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_unlinkat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit unlinkat EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_unlinkat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_unlinkat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_unlinkat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit unlinkat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_unlinkat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_unlinkat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_unlinkat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit unlinkat EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_unlinkat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_unlinkat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_regex_l1tf_var_l1tf_options:var:1" comment="Regex that matches l1tf with value var_l1tf_options" datatype="string" version="1">
          <oval-def:concat>
            <oval-def:literal_component>^(?:.*\s)?l1tf=</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_l1tf_options:var:1"/>
            <oval-def:literal_component>(?:\s.*)?$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable comment="Variable defining the value the argument should have" datatype="string" id="oval:ssg-var_l1tf_options:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-local_var_regex_mds_var_mds_options:var:1" comment="Regex that matches mds with value var_mds_options" datatype="string" version="1">
          <oval-def:concat>
            <oval-def:literal_component>^(?:.*\s)?mds=</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_mds_options:var:1"/>
            <oval-def:literal_component>(?:\s.*)?$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable comment="Variable defining the value the argument should have" datatype="string" id="oval:ssg-var_mds_options:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-local_var_regex_rng_core_default_quality_var_rng_core_default_quality:var:1" comment="Regex that matches rng_core.default_quality with value var_rng_core_default_quality" datatype="string" version="1">
          <oval-def:concat>
            <oval-def:literal_component>^(?:.*\s)?rng_core.default_quality=</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_rng_core_default_quality:var:1"/>
            <oval-def:literal_component>(?:\s.*)?$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable comment="Variable defining the value the argument should have" datatype="string" id="oval:ssg-var_rng_core_default_quality:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-local_var_regex_slub_debug_var_slub_debug_options:var:1" comment="Regex that matches slub_debug with value var_slub_debug_options" datatype="string" version="1">
          <oval-def:concat>
            <oval-def:literal_component>^(?:.*\s)?slub_debug=</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_slub_debug_options:var:1"/>
            <oval-def:literal_component>(?:\s.*)?$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable comment="Variable defining the value the argument should have" datatype="string" id="oval:ssg-var_slub_debug_options:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-local_var_regex_spec_store_bypass_disable_var_spec_store_bypass_disable_options:var:1" comment="Regex that matches spec_store_bypass_disable with value var_spec_store_bypass_disable_options" datatype="string" version="1">
          <oval-def:concat>
            <oval-def:literal_component>^(?:.*\s)?spec_store_bypass_disable=</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_spec_store_bypass_disable_options:var:1"/>
            <oval-def:literal_component>(?:\s.*)?$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable comment="Variable defining the value the argument should have" datatype="string" id="oval:ssg-var_spec_store_bypass_disable_options:var:1" version="1"/>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_acpi_custom_method_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_acpi_custom_method_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_acpi_custom_method_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_acpi_custom_method:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_arm64_sw_ttbr0_pan_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_arm64_sw_ttbr0_pan_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_arm64_sw_ttbr0_pan_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_arm64_sw_ttbr0_pan:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_binfmt_misc_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_binfmt_misc_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_binfmt_misc_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_binfmt_misc:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_bug_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_bug_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_bug_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_bug:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_bug_on_data_corruption_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_bug_on_data_corruption_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_bug_on_data_corruption_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_bug_on_data_corruption:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_compat_brk_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_compat_brk_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_compat_brk_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_compat_brk:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_compat_vdso_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_compat_vdso_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_compat_vdso_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_compat_vdso:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_debug_credentials_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_debug_credentials_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_debug_credentials_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_debug_credentials:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_debug_fs_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_debug_fs_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_debug_fs_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_debug_fs:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_debug_list_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_debug_list_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_debug_list_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_debug_list:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_debug_notifiers_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_debug_notifiers_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_debug_notifiers_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_debug_notifiers:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_debug_sg_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_debug_sg_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_debug_sg_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_debug_sg:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_debug_wx_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_debug_wx_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_debug_wx_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_debug_wx:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_default_mmap_min_addr_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_default_mmap_min_addr_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_default_mmap_min_addr_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_default_mmap_min_addr:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_devkmem_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_devkmem_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_devkmem_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_devkmem:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_fortify_source_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_fortify_source_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_fortify_source_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_fortify_source:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_gcc_plugin_latent_entropy_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_latent_entropy_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_gcc_plugin_latent_entropy_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_latent_entropy:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_gcc_plugin_randstruct_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_randstruct_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_gcc_plugin_randstruct_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_randstruct:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_gcc_plugin_stackleak_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_stackleak_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_gcc_plugin_stackleak_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_stackleak:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_gcc_plugin_structleak_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_structleak_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_gcc_plugin_structleak_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_structleak:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_gcc_plugin_structleak_byref_all_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_structleak_byref_all_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_gcc_plugin_structleak_byref_all_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_structleak_byref_all:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_hardened_usercopy_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_hardened_usercopy_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_hardened_usercopy_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_hardened_usercopy:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_hardened_usercopy_fallback_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_hardened_usercopy_fallback_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_hardened_usercopy_fallback_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_hardened_usercopy_fallback:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_hibernation_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_hibernation_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_hibernation_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_hibernation:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_ia32_emulation_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_ia32_emulation_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_ia32_emulation_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_ia32_emulation:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_ipv6_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_ipv6_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_ipv6_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_ipv6:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_kexec_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_kexec_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_kexec_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_kexec:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_legacy_ptys_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_legacy_ptys_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_legacy_ptys_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_legacy_ptys:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_legacy_vsyscall_emulate_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_emulate_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_legacy_vsyscall_emulate_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_emulate:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_legacy_vsyscall_none_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_none_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_legacy_vsyscall_none_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_none:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_legacy_vsyscall_xonly_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_xonly_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_legacy_vsyscall_xonly_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_xonly:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_modify_ldt_syscall_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_modify_ldt_syscall_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_modify_ldt_syscall_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_modify_ldt_syscall:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_module_sig_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_module_sig_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_module_sig_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_module_sig:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_module_sig_all_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_module_sig_all_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_module_sig_all_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_module_sig_all:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_module_sig_force_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_module_sig_force_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_module_sig_force_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_module_sig_force:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_module_sig_hash_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_module_sig_hash_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_module_sig_hash_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_module_sig_hash:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:external_variable comment="Value for kernel CONFIG_MODULE_SIG_HASH setting" datatype="string" id="oval:ssg-var_kernel_config_module_sig_hash:var:1" version="1"/>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_module_sig_key_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_module_sig_key_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_module_sig_key_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_module_sig_key:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:external_variable comment="Value for kernel CONFIG_MODULE_SIG_KEY setting" datatype="string" id="oval:ssg-var_kernel_config_module_sig_key:var:1" version="1"/>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_module_sig_sha512_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_module_sig_sha512_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_module_sig_sha512_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_module_sig_sha512:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_page_poisoning_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_page_poisoning_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_page_poisoning_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_page_poisoning:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_page_poisoning_no_sanity_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_page_poisoning_no_sanity_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_page_poisoning_no_sanity_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_page_poisoning_no_sanity:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_page_poisoning_zero_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_page_poisoning_zero_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_page_poisoning_zero_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_page_poisoning_zero:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_page_table_isolation_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_page_table_isolation_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_page_table_isolation_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_page_table_isolation:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_panic_on_oops_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_panic_on_oops_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_panic_on_oops_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_panic_on_oops:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_panic_timeout_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_panic_timeout_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_panic_timeout_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_panic_timeout:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:external_variable comment="Value for kernel CONFIG_PANIC_TIMEOUT setting" datatype="string" id="oval:ssg-var_kernel_config_panic_timeout:var:1" version="1"/>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_proc_kcore_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_proc_kcore_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_proc_kcore_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_proc_kcore:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_randomize_base_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_randomize_base_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_randomize_base_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_randomize_base:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_randomize_memory_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_randomize_memory_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_randomize_memory_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_randomize_memory:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_refcount_full_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_refcount_full_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_refcount_full_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_refcount_full:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_retpoline_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_retpoline_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_retpoline_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_retpoline:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_sched_stack_end_check_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_sched_stack_end_check_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_sched_stack_end_check_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_sched_stack_end_check:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_seccomp_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_seccomp_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_seccomp_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_seccomp:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_seccomp_filter_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_seccomp_filter_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_seccomp_filter_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_seccomp_filter:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_security_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_security_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_security_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_security:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_security_dmesg_restrict_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_security_dmesg_restrict_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_security_dmesg_restrict_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_security_dmesg_restrict:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_security_writable_hooks_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_security_writable_hooks_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_security_writable_hooks_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_security_writable_hooks:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_security_yama_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_security_yama_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_security_yama_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_security_yama:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_slab_freelist_hardened_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_slab_freelist_hardened_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_slab_freelist_hardened_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_slab_freelist_hardened:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_slab_frelist_random_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_slab_frelist_random_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_slab_frelist_random_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_slab_frelist_random:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_slab_merge_default_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_slab_merge_default_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_slab_merge_default_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_slab_merge_default:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_slub_debug_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_slub_debug_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_slub_debug_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_slub_debug:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_stackprotector_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_stackprotector_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_stackprotector_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_stackprotector:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_stackprotector_strong_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_stackprotector_strong_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_stackprotector_strong_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_stackprotector_strong:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_strict_kernel_rwx_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_strict_kernel_rwx_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_strict_kernel_rwx_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_strict_kernel_rwx:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_strict_module_rwx_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_strict_module_rwx_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_strict_module_rwx_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_strict_module_rwx:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_syn_cookies_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_syn_cookies_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_syn_cookies_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_syn_cookies:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_unmap_kernel_at_el0_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_unmap_kernel_at_el0_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_unmap_kernel_at_el0_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_unmap_kernel_at_el0:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_vmap_stack_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_vmap_stack_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_vmap_stack_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_vmap_stack:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of kernels installed" datatype="int" id="oval:ssg-local_var_config_x86_vsyscall_emulation_count_kernels_installed:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_x86_vsyscall_emulation_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count number of configs found" datatype="int" id="oval:ssg-local_var_config_x86_vsyscall_emulation_count_compliant_configs:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_x86_vsyscall_emulation:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-variable_cd_dvd_drive_alternative_names_nodev:var:1" datatype="string" comment="CD/DVD drive alternative names whitelist" version="1">
          <oval-def:value>/dev/cdrom</oval-def:value>
          <oval-def:value>/dev/dvd</oval-def:value>
          <oval-def:value>/dev/scd0</oval-def:value>
          <oval-def:value>/dev/sr0</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-variable_cd_dvd_drive_regex_pattern_nodev:var:1" datatype="string" comment="Regular expression pattern for CD / DVD drive alternative names" version="1">
          <oval-def:concat>
            <oval-def:literal_component>^[\s]*</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names_nodev:var:1"/>
            <oval-def:literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_nodev:var:1" datatype="string" comment="Regular expression pattern for removable block special device other than CD / DVD drive" version="1">
          <oval-def:concat>
            <oval-def:literal_component>^[\s]*</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_removable_partition:var:1"/>
            <oval-def:literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable comment="removable partition" datatype="string" id="oval:ssg-var_removable_partition:var:1" version="1"/>
        <oval-def:constant_variable id="oval:ssg-variable_cd_dvd_drive_alternative_names_noexec:var:1" datatype="string" comment="CD/DVD drive alternative names whitelist" version="1">
          <oval-def:value>/dev/cdrom</oval-def:value>
          <oval-def:value>/dev/dvd</oval-def:value>
          <oval-def:value>/dev/scd0</oval-def:value>
          <oval-def:value>/dev/sr0</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-variable_cd_dvd_drive_regex_pattern_noexec:var:1" datatype="string" comment="Regular expression pattern for CD / DVD drive alternative names" version="1">
          <oval-def:concat>
            <oval-def:literal_component>^[\s]*</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names_noexec:var:1"/>
            <oval-def:literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_noexec:var:1" datatype="string" comment="Regular expression pattern for removable block special device other than CD / DVD drive" version="1">
          <oval-def:concat>
            <oval-def:literal_component>^[\s]*</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_removable_partition:var:1"/>
            <oval-def:literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-variable_cd_dvd_drive_alternative_names_nosuid:var:1" datatype="string" comment="CD/DVD drive alternative names whitelist" version="1">
          <oval-def:value>/dev/cdrom</oval-def:value>
          <oval-def:value>/dev/dvd</oval-def:value>
          <oval-def:value>/dev/scd0</oval-def:value>
          <oval-def:value>/dev/sr0</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-variable_cd_dvd_drive_regex_pattern_nosuid:var:1" datatype="string" comment="Regular expression pattern for CD / DVD drive alternative names" version="1">
          <oval-def:concat>
            <oval-def:literal_component>^[\s]*</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names_nosuid:var:1"/>
            <oval-def:literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_nosuid:var:1" datatype="string" comment="Regular expression pattern for removable block special device other than CD / DVD drive" version="1">
          <oval-def:concat>
            <oval-def:literal_component>^[\s]*</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_removable_partition:var:1"/>
            <oval-def:literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable datatype="string" id="oval:ssg-var_mount_option_proc_hidepid:var:1" version="1" comment="Variable defining the value the argument should have"/>
        <oval-def:local_variable id="oval:ssg-local_var_mountoption_hidepid_with_value:var:1" comment="Value used in hidepid option as defined in var_mount_option_proc_hidepid variable" datatype="string" version="1">
          <oval-def:concat>
            <oval-def:literal_component>hidepid=</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_mount_option_proc_hidepid:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable comment="Variable value for sudo logfile " datatype="string" id="oval:ssg-var_sudo_logfile:var:1" version="1"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_fs_protected_fifos_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_fs_protected_fifos:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_fs_protected_fifos:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_fs_protected_fifos:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_fs_protected_fifos:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_fs_protected_fifos:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_fs_protected_fifos_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_fs_protected_fifos:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_fs_protected_fifos:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_fs_protected_hardlinks_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_fs_protected_hardlinks:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_fs_protected_hardlinks:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_fs_protected_hardlinks:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_fs_protected_hardlinks:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_fs_protected_hardlinks:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_fs_protected_hardlinks_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_fs_protected_hardlinks:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_fs_protected_hardlinks:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_fs_protected_regular_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_fs_protected_regular:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_fs_protected_regular:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_fs_protected_regular:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_fs_protected_regular:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_fs_protected_regular:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_fs_protected_regular_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_fs_protected_regular:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_fs_protected_regular:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_fs_protected_symlinks_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_fs_protected_symlinks:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_fs_protected_symlinks:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_fs_protected_symlinks:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_fs_protected_symlinks:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_fs_protected_symlinks:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_fs_protected_symlinks_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_fs_protected_symlinks:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_fs_protected_symlinks:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_fs_suid_dumpable_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_fs_suid_dumpable:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_fs_suid_dumpable:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_fs_suid_dumpable:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_fs_suid_dumpable:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_fs_suid_dumpable:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_fs_suid_dumpable_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_fs_suid_dumpable:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_fs_suid_dumpable:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_kernel_core_pattern_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_core_pattern:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_kernel_core_pattern:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_kernel_core_pattern:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_kernel_core_pattern:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_kernel_core_pattern:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_kernel_core_pattern_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_kernel_core_pattern:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_core_pattern:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_kernel_dmesg_restrict_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_dmesg_restrict:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_kernel_dmesg_restrict:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_kernel_dmesg_restrict:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_kernel_dmesg_restrict:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_kernel_dmesg_restrict:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_kernel_dmesg_restrict_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_kernel_dmesg_restrict:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_dmesg_restrict:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_kernel_kexec_load_disabled_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_kexec_load_disabled:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_kernel_kexec_load_disabled:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_kernel_kexec_load_disabled:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_kernel_kexec_load_disabled:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_kernel_kexec_load_disabled:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_kernel_kexec_load_disabled_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_kernel_kexec_load_disabled:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_kexec_load_disabled:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_kernel_kptr_restrict_value:var:1" version="1" comment="External variable for kernel.kptr_restrict" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_kernel_kptr_restrict_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_kptr_restrict:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_kernel_kptr_restrict:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_kernel_kptr_restrict:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_kernel_kptr_restrict:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_kernel_kptr_restrict:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_kernel_kptr_restrict_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_kernel_kptr_restrict:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_kptr_restrict:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_kernel_modules_disabled_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_modules_disabled:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_kernel_modules_disabled:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_kernel_modules_disabled:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_kernel_modules_disabled:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_kernel_modules_disabled:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_kernel_modules_disabled_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_kernel_modules_disabled:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_modules_disabled:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_kernel_panic_on_oops_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_panic_on_oops:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_kernel_panic_on_oops:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_kernel_panic_on_oops:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_kernel_panic_on_oops:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_kernel_panic_on_oops:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_kernel_panic_on_oops_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_kernel_panic_on_oops:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_panic_on_oops:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_kernel_perf_cpu_time_max_percent_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_perf_cpu_time_max_percent:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_kernel_perf_cpu_time_max_percent:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_kernel_perf_cpu_time_max_percent:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_kernel_perf_cpu_time_max_percent:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_kernel_perf_cpu_time_max_percent:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_kernel_perf_cpu_time_max_percent_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_kernel_perf_cpu_time_max_percent:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_perf_cpu_time_max_percent:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_kernel_perf_event_max_sample_rate_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_perf_event_max_sample_rate:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_kernel_perf_event_max_sample_rate:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_kernel_perf_event_max_sample_rate:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_kernel_perf_event_max_sample_rate:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_kernel_perf_event_max_sample_rate:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_kernel_perf_event_max_sample_rate_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_kernel_perf_event_max_sample_rate:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_perf_event_max_sample_rate:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_kernel_perf_event_paranoid_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_perf_event_paranoid:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_kernel_perf_event_paranoid:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_kernel_perf_event_paranoid:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_kernel_perf_event_paranoid:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_kernel_perf_event_paranoid:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_kernel_perf_event_paranoid_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_kernel_perf_event_paranoid:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_perf_event_paranoid:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_kernel_pid_max_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_pid_max:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_kernel_pid_max:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_kernel_pid_max:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_kernel_pid_max:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_kernel_pid_max:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_kernel_pid_max_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_kernel_pid_max:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_pid_max:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_kernel_randomize_va_space_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_randomize_va_space:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_kernel_randomize_va_space:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_kernel_randomize_va_space:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_kernel_randomize_va_space:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_kernel_randomize_va_space:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_kernel_randomize_va_space_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_kernel_randomize_va_space:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_randomize_va_space:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_kernel_sysrq_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_sysrq:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_kernel_sysrq:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_kernel_sysrq:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_kernel_sysrq:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_kernel_sysrq:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_kernel_sysrq_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_kernel_sysrq:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_sysrq:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_kernel_unprivileged_bpf_disabled_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_unprivileged_bpf_disabled:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_kernel_unprivileged_bpf_disabled:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_kernel_unprivileged_bpf_disabled:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_kernel_unprivileged_bpf_disabled:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_kernel_unprivileged_bpf_disabled:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_kernel_unprivileged_bpf_disabled_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_kernel_unprivileged_bpf_disabled:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_unprivileged_bpf_disabled:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_kernel_yama_ptrace_scope_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_yama_ptrace_scope:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_kernel_yama_ptrace_scope:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_kernel_yama_ptrace_scope:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_kernel_yama_ptrace_scope:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_kernel_yama_ptrace_scope:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_kernel_yama_ptrace_scope_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_kernel_yama_ptrace_scope:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_yama_ptrace_scope:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_core_bpf_jit_harden_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_core_bpf_jit_harden:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_core_bpf_jit_harden:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_core_bpf_jit_harden:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_core_bpf_jit_harden:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_core_bpf_jit_harden:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_core_bpf_jit_harden_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_core_bpf_jit_harden:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_core_bpf_jit_harden:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_accept_local_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_accept_local:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_accept_local:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_all_accept_local:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv4_conf_all_accept_local:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv4_conf_all_accept_local:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv4_conf_all_accept_local_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv4_conf_all_accept_local:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_accept_local:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1" version="1" comment="External variable for net.ipv4.conf.all.accept_redirects" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_accept_redirects_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_accept_redirects:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_accept_redirects:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_all_accept_redirects:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv4_conf_all_accept_redirects:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv4_conf_all_accept_redirects:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv4_conf_all_accept_redirects_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv4_conf_all_accept_redirects:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_accept_redirects:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1" version="1" comment="External variable for net.ipv4.conf.all.accept_source_route" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_accept_source_route_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_accept_source_route:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_accept_source_route:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_all_accept_source_route:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv4_conf_all_accept_source_route:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv4_conf_all_accept_source_route:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv4_conf_all_accept_source_route_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv4_conf_all_accept_source_route:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_accept_source_route:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_arp_filter_value:var:1" version="1" comment="External variable for net.ipv4.conf.all.arp_filter" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_arp_filter_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_arp_filter:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_arp_filter:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_all_arp_filter:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv4_conf_all_arp_filter:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv4_conf_all_arp_filter:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv4_conf_all_arp_filter_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv4_conf_all_arp_filter:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_arp_filter:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_arp_ignore_value:var:1" version="1" comment="External variable for net.ipv4.conf.all.arp_ignore" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_arp_ignore_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_arp_ignore:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_arp_ignore:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_all_arp_ignore:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv4_conf_all_arp_ignore:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv4_conf_all_arp_ignore:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv4_conf_all_arp_ignore_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv4_conf_all_arp_ignore:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_arp_ignore:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_drop_gratuitous_arp:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv4_conf_all_drop_gratuitous_arp:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv4_conf_all_drop_gratuitous_arp:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv4_conf_all_drop_gratuitous_arp_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv4_conf_all_drop_gratuitous_arp:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1" version="1" comment="External variable for net.ipv4.conf.all.log_martians" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_log_martians_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_log_martians:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_log_martians:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_all_log_martians:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv4_conf_all_log_martians:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv4_conf_all_log_martians:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv4_conf_all_log_martians_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv4_conf_all_log_martians:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_log_martians:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_route_localnet_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_route_localnet:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_route_localnet:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_all_route_localnet:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv4_conf_all_route_localnet:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv4_conf_all_route_localnet:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv4_conf_all_route_localnet_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv4_conf_all_route_localnet:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_route_localnet:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_value:var:1" version="1" comment="External variable for net.ipv4.conf.all.rp_filter" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_rp_filter_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_rp_filter:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_rp_filter:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_all_rp_filter:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv4_conf_all_rp_filter:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv4_conf_all_rp_filter:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv4_conf_all_rp_filter_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv4_conf_all_rp_filter:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_rp_filter:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1" version="1" comment="External variable for net.ipv4.conf.all.secure_redirects" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_secure_redirects_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_secure_redirects:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_secure_redirects:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_all_secure_redirects:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv4_conf_all_secure_redirects:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv4_conf_all_secure_redirects:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv4_conf_all_secure_redirects_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv4_conf_all_secure_redirects:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_secure_redirects:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_send_redirects_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_send_redirects:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_send_redirects:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_all_send_redirects:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv4_conf_all_send_redirects:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv4_conf_all_send_redirects:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv4_conf_all_send_redirects_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv4_conf_all_send_redirects:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_send_redirects:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_shared_media_value:var:1" version="1" comment="External variable for net.ipv4.conf.all.shared_media" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_shared_media_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_shared_media:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_shared_media:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_all_shared_media:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv4_conf_all_shared_media:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv4_conf_all_shared_media:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv4_conf_all_shared_media_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv4_conf_all_shared_media:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_shared_media:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1" version="1" comment="External variable for net.ipv4.conf.default.accept_redirects" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_accept_redirects_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_accept_redirects:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_accept_redirects:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_default_accept_redirects:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv4_conf_default_accept_redirects:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv4_conf_default_accept_redirects:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv4_conf_default_accept_redirects_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv4_conf_default_accept_redirects:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_accept_redirects:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1" version="1" comment="External variable for net.ipv4.conf.default.accept_source_route" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_accept_source_route_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_accept_source_route:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_accept_source_route:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_default_accept_source_route:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv4_conf_default_accept_source_route:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv4_conf_default_accept_source_route:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv4_conf_default_accept_source_route_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv4_conf_default_accept_source_route:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_accept_source_route:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_value:var:1" version="1" comment="External variable for net.ipv4.conf.default.log_martians" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_log_martians_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_log_martians:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_log_martians:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_default_log_martians:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv4_conf_default_log_martians:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv4_conf_default_log_martians:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv4_conf_default_log_martians_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv4_conf_default_log_martians:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_log_martians:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1" version="1" comment="External variable for net.ipv4.conf.default.rp_filter" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_rp_filter_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_rp_filter:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_rp_filter:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_default_rp_filter:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv4_conf_default_rp_filter:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv4_conf_default_rp_filter:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv4_conf_default_rp_filter_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv4_conf_default_rp_filter:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_rp_filter:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1" version="1" comment="External variable for net.ipv4.conf.default.secure_redirects" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_secure_redirects_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_secure_redirects:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_secure_redirects:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_default_secure_redirects:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv4_conf_default_secure_redirects:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv4_conf_default_secure_redirects:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv4_conf_default_secure_redirects_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv4_conf_default_secure_redirects:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_secure_redirects:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_send_redirects_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_send_redirects:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_send_redirects:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_default_send_redirects:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv4_conf_default_send_redirects:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv4_conf_default_send_redirects:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv4_conf_default_send_redirects_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv4_conf_default_send_redirects:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_send_redirects:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_default_shared_media_value:var:1" version="1" comment="External variable for net.ipv4.conf.default.shared_media" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_shared_media_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_shared_media:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_shared_media:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_default_shared_media:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv4_conf_default_shared_media:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv4_conf_default_shared_media:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv4_conf_default_shared_media_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv4_conf_default_shared_media:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_shared_media:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1" version="1" comment="External variable for net.ipv4.icmp_echo_ignore_broadcasts" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv4_icmp_echo_ignore_broadcasts:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv4_icmp_echo_ignore_broadcasts:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv4_icmp_echo_ignore_broadcasts:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv4_icmp_echo_ignore_broadcasts_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv4_icmp_echo_ignore_broadcasts:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1" version="1" comment="External variable for net.ipv4.icmp_ignore_bogus_error_responses" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv4_icmp_ignore_bogus_error_responses:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv4_icmp_ignore_bogus_error_responses:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv4_icmp_ignore_bogus_error_responses:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv4_icmp_ignore_bogus_error_responses_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv4_icmp_ignore_bogus_error_responses:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv4_ip_forward_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_ip_forward:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv4_ip_forward:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_ip_forward:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv4_ip_forward:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv4_ip_forward:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv4_ip_forward_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv4_ip_forward:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_ip_forward:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv4_ip_local_port_range_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_ip_local_port_range:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv4_ip_local_port_range:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_ip_local_port_range:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv4_ip_local_port_range:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv4_ip_local_port_range:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv4_ip_local_port_range_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv4_ip_local_port_range:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_ip_local_port_range:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1" version="1" comment="External variable for net.ipv4.tcp_syncookies" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv4_tcp_syncookies_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_tcp_syncookies:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv4_tcp_syncookies:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_tcp_syncookies:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv4_tcp_syncookies:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv4_tcp_syncookies:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv4_tcp_syncookies_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv4_tcp_syncookies:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_tcp_syncookies:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_value:var:1" version="1" comment="External variable for net.ipv6.conf.all.accept_ra_defrtr" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_accept_ra_defrtr_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_accept_ra_defrtr:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_accept_ra_defrtr:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_all_accept_ra_defrtr:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv6_conf_all_accept_ra_defrtr:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv6_conf_all_accept_ra_defrtr:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv6_conf_all_accept_ra_defrtr_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv6_conf_all_accept_ra_defrtr:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_accept_ra_defrtr:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_value:var:1" version="1" comment="External variable for net.ipv6.conf.all.accept_ra_pinfo" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_accept_ra_pinfo_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_accept_ra_pinfo:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_accept_ra_pinfo:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_all_accept_ra_pinfo:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv6_conf_all_accept_ra_pinfo:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv6_conf_all_accept_ra_pinfo:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv6_conf_all_accept_ra_pinfo_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv6_conf_all_accept_ra_pinfo:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_accept_ra_pinfo:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value:var:1" version="1" comment="External variable for net.ipv6.conf.all.accept_ra_rtr_pref" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_accept_ra_rtr_pref:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv6_conf_all_accept_ra_rtr_pref:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv6_conf_all_accept_ra_rtr_pref:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv6_conf_all_accept_ra_rtr_pref_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv6_conf_all_accept_ra_rtr_pref:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_autoconf_value:var:1" version="1" comment="External variable for net.ipv6.conf.all.autoconf" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_autoconf_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_autoconf:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_autoconf:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_all_autoconf:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv6_conf_all_autoconf:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv6_conf_all_autoconf:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv6_conf_all_autoconf_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv6_conf_all_autoconf:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_autoconf:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_disable_ipv6_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_disable_ipv6:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_disable_ipv6:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_all_disable_ipv6:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv6_conf_all_disable_ipv6:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv6_conf_all_disable_ipv6:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv6_conf_all_disable_ipv6_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv6_conf_all_disable_ipv6:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_disable_ipv6:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses_value:var:1" version="1" comment="External variable for net.ipv6.conf.all.max_addresses" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_max_addresses_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_max_addresses:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_max_addresses:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_all_max_addresses:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv6_conf_all_max_addresses:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv6_conf_all_max_addresses:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv6_conf_all_max_addresses_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv6_conf_all_max_addresses:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_max_addresses:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations_value:var:1" version="1" comment="External variable for net.ipv6.conf.all.router_solicitations" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_router_solicitations_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_router_solicitations:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_router_solicitations:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_all_router_solicitations:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv6_conf_all_router_solicitations:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv6_conf_all_router_solicitations:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv6_conf_all_router_solicitations_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv6_conf_all_router_solicitations:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_router_solicitations:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1" version="1" comment="External variable for net.ipv6.conf.default.accept_ra" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_accept_ra_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_accept_ra:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_accept_ra:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_default_accept_ra:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv6_conf_default_accept_ra:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv6_conf_default_accept_ra:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv6_conf_default_accept_ra_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv6_conf_default_accept_ra:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_ra:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_value:var:1" version="1" comment="External variable for net.ipv6.conf.default.accept_ra_defrtr" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_accept_ra_defrtr_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_accept_ra_defrtr:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_accept_ra_defrtr:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_default_accept_ra_defrtr:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv6_conf_default_accept_ra_defrtr:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv6_conf_default_accept_ra_defrtr:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv6_conf_default_accept_ra_defrtr_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv6_conf_default_accept_ra_defrtr:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_ra_defrtr:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_value:var:1" version="1" comment="External variable for net.ipv6.conf.default.accept_ra_pinfo" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_accept_ra_pinfo_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_accept_ra_pinfo:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_accept_ra_pinfo:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_default_accept_ra_pinfo:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv6_conf_default_accept_ra_pinfo:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv6_conf_default_accept_ra_pinfo:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv6_conf_default_accept_ra_pinfo_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv6_conf_default_accept_ra_pinfo:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_ra_pinfo:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value:var:1" version="1" comment="External variable for net.ipv6.conf.default.accept_ra_rtr_pref" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_accept_ra_rtr_pref:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv6_conf_default_accept_ra_rtr_pref:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv6_conf_default_accept_ra_rtr_pref:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv6_conf_default_accept_ra_rtr_pref_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv6_conf_default_accept_ra_rtr_pref:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1" version="1" comment="External variable for net.ipv6.conf.default.accept_redirects" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_accept_redirects_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_accept_redirects:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_accept_redirects:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_default_accept_redirects:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv6_conf_default_accept_redirects:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv6_conf_default_accept_redirects:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv6_conf_default_accept_redirects_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv6_conf_default_accept_redirects:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_redirects:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_autoconf_value:var:1" version="1" comment="External variable for net.ipv6.conf.default.autoconf" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_autoconf_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_autoconf:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_autoconf:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_default_autoconf:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv6_conf_default_autoconf:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv6_conf_default_autoconf:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv6_conf_default_autoconf_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv6_conf_default_autoconf:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_autoconf:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_disable_ipv6_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_disable_ipv6:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_disable_ipv6:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_default_disable_ipv6:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv6_conf_default_disable_ipv6:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv6_conf_default_disable_ipv6:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv6_conf_default_disable_ipv6_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv6_conf_default_disable_ipv6:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_disable_ipv6:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses_value:var:1" version="1" comment="External variable for net.ipv6.conf.default.max_addresses" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_max_addresses_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_max_addresses:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_max_addresses:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_default_max_addresses:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv6_conf_default_max_addresses:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv6_conf_default_max_addresses:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv6_conf_default_max_addresses_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv6_conf_default_max_addresses:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_max_addresses:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations_value:var:1" version="1" comment="External variable for net.ipv6.conf.default.router_solicitations" datatype="int"/>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_router_solicitations_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_router_solicitations:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_router_solicitations:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_default_router_solicitations:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_net_ipv6_conf_default_router_solicitations:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_net_ipv6_conf_default_router_solicitations:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_net_ipv6_conf_default_router_solicitations_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_net_ipv6_conf_default_router_solicitations:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_router_solicitations:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_user_max_user_namespaces_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_user_max_user_namespaces:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_user_max_user_namespaces:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_user_max_user_namespaces:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_user_max_user_namespaces:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_user_max_user_namespaces:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_user_max_user_namespaces_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_user_max_user_namespaces:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_user_max_user_namespaces:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Count unique sysctls" datatype="int" id="oval:ssg-local_var_unique_sysctl_vm_mmap_min_addr_counter:var:1" version="1">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_static_set_sysctls_vm_mmap_min_addr:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_safe_symlinks_vm_mmap_min_addr:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_vm_mmap_min_addr:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Blank string" datatype="string" id="oval:ssg-local_var_blank_path_vm_mmap_min_addr:var:1" version="1">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Unique list of symlink conf files" datatype="string" id="oval:ssg-local_var_symlinks_vm_mmap_min_addr:var:1" version="1">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_vm_mmap_min_addr_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable comment="List of conf files" datatype="string" id="oval:ssg-local_var_conf_files_vm_mmap_min_addr:var:1" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_vm_mmap_min_addr:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_pam_pwquality_config_path:var:1" version="1" datatype="string" comment="correct path for pam_pwquality.so check">
          <oval-def:value>/etc/pam.d/system-auth</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-audit_log_file_path:var:1" datatype="string" version="1" comment="path to audit log files">
          <oval-def:regex_capture pattern="^log_file\s*=\s*(.*)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_auditd_conf_log_file:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-variable_cd_dvd_drive_alternative_names:var:1" datatype="string" comment="CD/DVD drive alternative names whitelist" version="1">
          <oval-def:value>/dev/cdrom</oval-def:value>
          <oval-def:value>/dev/dvd</oval-def:value>
          <oval-def:value>/dev/scd0</oval-def:value>
          <oval-def:value>/dev/sr0</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:external_variable comment="May be defined by Profiles to explicitly say if sshd is required or not" datatype="int" id="oval:ssg-sshd_required:var:1" version="1"/>
        <oval-def:external_variable id="oval:ssg-var_accounts_user_umask:var:1" datatype="string" version="1" comment="Value of var_accounts_user_umask (the required umask) as string"/>
        <oval-def:local_variable id="oval:ssg-var_first_digit_of_umask_from_var_accounts_user_umask:var:1" comment="First octal digit of umask from var_accounts_user_umask" datatype="int" version="1">
          <oval-def:substring substring_start="1" substring_length="1">
            <oval-def:variable_component var_ref="oval:ssg-var_accounts_user_umask:var:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_second_digit_of_umask_from_var_accounts_user_umask:var:1" comment="Second octal digit of umask from var_accounts_user_umask" datatype="int" version="1">
          <oval-def:substring substring_start="2" substring_length="1">
            <oval-def:variable_component var_ref="oval:ssg-var_accounts_user_umask:var:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_third_digit_of_umask_from_var_accounts_user_umask:var:1" comment="Third octal digit of umask from var_accounts_user_umask" datatype="int" version="1">
          <oval-def:substring substring_start="3" substring_length="1">
            <oval-def:variable_component var_ref="oval:ssg-var_accounts_user_umask:var:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_user_umask_umask_as_number:var:1" comment="var_accounts_user_umask umask converted from string to a number" datatype="int" version="1">
          <oval-def:arithmetic arithmetic_operation="add">
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">64</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_var_accounts_user_umask:var:1"/>
            </oval-def:arithmetic>
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">8</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_var_accounts_user_umask:var:1"/>
            </oval-def:arithmetic>
            <oval-def:variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_var_accounts_user_umask:var:1"/>
          </oval-def:arithmetic>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_umask_for_daemons:var:1" datatype="string" version="1" comment="Value of var_umask_for_daemons (the required umask) as string"/>
        <oval-def:local_variable id="oval:ssg-var_first_digit_of_umask_from_var_umask_for_daemons:var:1" comment="First octal digit of umask from var_umask_for_daemons" datatype="int" version="1">
          <oval-def:substring substring_start="1" substring_length="1">
            <oval-def:variable_component var_ref="oval:ssg-var_umask_for_daemons:var:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_second_digit_of_umask_from_var_umask_for_daemons:var:1" comment="Second octal digit of umask from var_umask_for_daemons" datatype="int" version="1">
          <oval-def:substring substring_start="2" substring_length="1">
            <oval-def:variable_component var_ref="oval:ssg-var_umask_for_daemons:var:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_third_digit_of_umask_from_var_umask_for_daemons:var:1" comment="Third octal digit of umask from var_umask_for_daemons" datatype="int" version="1">
          <oval-def:substring substring_start="3" substring_length="1">
            <oval-def:variable_component var_ref="oval:ssg-var_umask_for_daemons:var:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_umask_for_daemons_umask_as_number:var:1" comment="var_umask_for_daemons umask converted from string to a number" datatype="int" version="1">
          <oval-def:arithmetic arithmetic_operation="add">
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">64</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_var_umask_for_daemons:var:1"/>
            </oval-def:arithmetic>
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">8</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_var_umask_for_daemons:var:1"/>
            </oval-def:arithmetic>
            <oval-def:variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_var_umask_for_daemons:var:1"/>
          </oval-def:arithmetic>
        </oval-def:local_variable>
      </oval-def:variables>
    </oval-def:oval_definitions>
  </ds:component>
  <ds:component id="scap_org.open-scap_comp_ssg-fedora-ocil.xml" timestamp="2022-07-23T00:00:00">
    <ocil:ocil>
      <ocil:generator>
        <ocil:product_name>build_shorthand.py from SCAP Security Guide</ocil:product_name>
        <ocil:product_version>ssg: 0.1.62</ocil:product_version>
        <ocil:schema_version>2.0</ocil:schema_version>
        <ocil:timestamp>2022-07-23T00:00:00</ocil:timestamp>
      </ocil:generator>
      <ocil:questionnaires>
        <ocil:questionnaire id="ocil:ssg-package_abrt_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall Automatic Bug Reporting Tool (abrt)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_abrt_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_at_deny_not_exist_ocil:questionnaire:1">
          <ocil:title>Ensure that /etc/at.deny does not exist</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_at_deny_not_exist_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_cron_deny_not_exist_ocil:questionnaire:1">
          <ocil:title>Ensure that /etc/cron.deny does not exist</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_cron_deny_not_exist_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-disable_anacron_ocil:questionnaire:1">
          <ocil:title>Disable anacron Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-disable_anacron_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_atd_disabled_ocil:questionnaire:1">
          <ocil:title>Disable At Service (atd)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_atd_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_cron_enabled_ocil:questionnaire:1">
          <ocil:title>Enable cron Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_cron_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_crond_enabled_ocil:questionnaire:1">
          <ocil:title>Enable cron Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_crond_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_bind_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall bind Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_bind_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_fapolicyd_installed_ocil:questionnaire:1">
          <ocil:title>Install fapolicyd Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_fapolicyd_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_vsftpd_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall vsftpd Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_vsftpd_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ftp_log_transactions_ocil:questionnaire:1">
          <ocil:title>Enable Logging of All FTP Transactions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ftp_log_transactions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ftp_present_banner_ocil:questionnaire:1">
          <ocil:title>Create Warning Banners for All FTP Users</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ftp_present_banner_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kerberos_disable_no_keytab_ocil:questionnaire:1">
          <ocil:title>Disable Kerberos by removing host keytab</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kerberos_disable_no_keytab_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_openldap-clients_removed_ocil:questionnaire:1">
          <ocil:title>Ensure LDAP client is not installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_openldap-clients_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-postfix_client_configure_mail_alias_ocil:questionnaire:1">
          <ocil:title>Configure System to Forward All Mail For The Root Account</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-postfix_client_configure_mail_alias_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-postfix_client_configure_relayhost_ocil:questionnaire:1">
          <ocil:title>Configure System to Forward All Mail through a specific host</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-postfix_client_configure_relayhost_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_sendmail_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall Sendmail Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_sendmail_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-nfs_no_anonymous_ocil:questionnaire:1">
          <ocil:title>Specify UID and GID for Anonymous NFS Connections</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-nfs_no_anonymous_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_nfs_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Network File System (nfs)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_nfs_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_rpcsvcgssd_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Secure RPC Server Service (rpcsvcgssd)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_rpcsvcgssd_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_all_squash_exports_ocil:questionnaire:1">
          <ocil:title>Ensure All-Squashing Disabled On All Exports</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_all_squash_exports_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_insecure_locks_exports_ocil:questionnaire:1">
          <ocil:title>Ensure Insecure File Locking is Not Allowed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_insecure_locks_exports_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_nfs-utils_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall nfs-utils Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_nfs-utils_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-chronyd_client_only_ocil:questionnaire:1">
          <ocil:title>Disable chrony daemon from acting as server</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-chronyd_client_only_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-chronyd_no_chronyc_network_ocil:questionnaire:1">
          <ocil:title>Disable network management of chrony daemon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-chronyd_no_chronyc_network_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-chronyd_or_ntpd_set_maxpoll_ocil:questionnaire:1">
          <ocil:title>Configure Time Service Maxpoll Interval</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-chronyd_or_ntpd_set_maxpoll_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-chronyd_or_ntpd_specify_remote_server_ocil:questionnaire:1">
          <ocil:title>Specify a Remote NTP Server</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-chronyd_or_ntpd_specify_remote_server_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-chronyd_run_as_chrony_user_ocil:questionnaire:1">
          <ocil:title>Ensure that chronyd is running under chrony user account</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-chronyd_run_as_chrony_user_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-chronyd_server_directive_ocil:questionnaire:1">
          <ocil:title>Ensure Chrony is only configured with the server directive</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-chronyd_server_directive_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-chronyd_specify_remote_server_ocil:questionnaire:1">
          <ocil:title>A remote time server for Chrony is configured</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-chronyd_specify_remote_server_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ntpd_configure_restrictions_ocil:questionnaire:1">
          <ocil:title>Configure server restrictions for ntpd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ntpd_configure_restrictions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ntpd_run_as_ntp_user_ocil:questionnaire:1">
          <ocil:title>Configure ntpd To Run As ntp User</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ntpd_run_as_ntp_user_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ntpd_specify_remote_server_ocil:questionnaire:1">
          <ocil:title>Specify a Remote NTP Server</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ntpd_specify_remote_server_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_chrony_installed_ocil:questionnaire:1">
          <ocil:title>The Chrony package is installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_chrony_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_ntp_installed_ocil:questionnaire:1">
          <ocil:title>Install the ntp service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_ntp_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_chronyd_enabled_ocil:questionnaire:1">
          <ocil:title>The Chronyd service is enabled</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_chronyd_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_chronyd_or_ntpd_enabled_ocil:questionnaire:1">
          <ocil:title>Enable the NTP Daemon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_chronyd_or_ntpd_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_ntp_enabled_ocil:questionnaire:1">
          <ocil:title>Enable the NTP Daemon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_ntp_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_ntpd_enabled_ocil:questionnaire:1">
          <ocil:title>Enable the NTP Daemon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_ntpd_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_rsh_trust_files_ocil:questionnaire:1">
          <ocil:title>Remove Rsh Trust Files</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_rsh_trust_files_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_rsyncd_disabled_ocil:questionnaire:1">
          <ocil:title>Ensure rsyncd service is diabled</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_rsyncd_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_rngd_enabled_ocil:questionnaire:1">
          <ocil:title>Enable the Hardware RNG Entropy Gatherer Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_rngd_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_net-snmp_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall net-snmp Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_net-snmp_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-snmpd_no_rwusers_ocil:questionnaire:1">
          <ocil:title>Ensure SNMP Read Write is disabled</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-snmpd_no_rwusers_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-snmpd_not_default_password_ocil:questionnaire:1">
          <ocil:title>Ensure Default SNMP Password Is Not Used</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-snmpd_not_default_password_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-snmpd_use_newer_protocol_ocil:questionnaire:1">
          <ocil:title>Configure SNMP Service to Use Only SNMPv3 or Newer</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-snmpd_use_newer_protocol_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-disable_host_auth_ocil:questionnaire:1">
          <ocil:title>Disable Host-Based Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-disable_host_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_allow_only_protocol2_ocil:questionnaire:1">
          <ocil:title>Allow Only SSH Protocol 2</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_allow_only_protocol2_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_compression_ocil:questionnaire:1">
          <ocil:title>Disable Compression Or Set Compression to delayed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_compression_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_empty_passwords_ocil:questionnaire:1">
          <ocil:title>Disable SSH Access via Empty Passwords</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_empty_passwords_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_gssapi_auth_ocil:questionnaire:1">
          <ocil:title>Disable GSSAPI Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_gssapi_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_kerb_auth_ocil:questionnaire:1">
          <ocil:title>Disable Kerberos Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_kerb_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_pubkey_auth_ocil:questionnaire:1">
          <ocil:title>Disable PubkeyAuthentication Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_pubkey_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_rhosts_ocil:questionnaire:1">
          <ocil:title>Disable SSH Support for .rhosts Files</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_rhosts_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_rhosts_rsa_ocil:questionnaire:1">
          <ocil:title>Disable SSH Support for Rhosts RSA Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_rhosts_rsa_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_root_login_ocil:questionnaire:1">
          <ocil:title>Disable SSH Root Login</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_root_login_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_root_password_login_ocil:questionnaire:1">
          <ocil:title>Disable SSH root Login with a Password (Insecure)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_root_password_login_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_tcp_forwarding_ocil:questionnaire:1">
          <ocil:title>Disable SSH TCP Forwarding</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_tcp_forwarding_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_user_known_hosts_ocil:questionnaire:1">
          <ocil:title>Disable SSH Support for User Known Hosts</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_user_known_hosts_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_x11_forwarding_ocil:questionnaire:1">
          <ocil:title>Disable X11 Forwarding</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_x11_forwarding_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_do_not_permit_user_env_ocil:questionnaire:1">
          <ocil:title>Do Not Allow SSH Environment Options</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_do_not_permit_user_env_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_enable_gssapi_auth_ocil:questionnaire:1">
          <ocil:title>Enable GSSAPI Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_enable_gssapi_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_enable_pam_ocil:questionnaire:1">
          <ocil:title>Enable PAM</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_enable_pam_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_enable_pubkey_auth_ocil:questionnaire:1">
          <ocil:title>Enable Public Key Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_enable_pubkey_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_enable_strictmodes_ocil:questionnaire:1">
          <ocil:title>Enable Use of Strict Mode Checking</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_enable_strictmodes_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_enable_warning_banner_ocil:questionnaire:1">
          <ocil:title>Enable SSH Warning Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_enable_warning_banner_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_enable_warning_banner_net_ocil:questionnaire:1">
          <ocil:title>Enable SSH Warning Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_enable_warning_banner_net_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_enable_x11_forwarding_ocil:questionnaire:1">
          <ocil:title>Enable Encrypted X11 Forwarding</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_enable_x11_forwarding_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_limit_user_access_ocil:questionnaire:1">
          <ocil:title>Limit Users' SSH Access</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_limit_user_access_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_print_last_log_ocil:questionnaire:1">
          <ocil:title>Enable SSH Print Last Log</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_print_last_log_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_rekey_limit_ocil:questionnaire:1">
          <ocil:title>Force frequent session key renegotiation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_rekey_limit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_idle_timeout_ocil:questionnaire:1">
          <ocil:title>Set SSH Idle Timeout Interval</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_idle_timeout_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_keepalive_ocil:questionnaire:1">
          <ocil:title>Set SSH Client Alive Count Max</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_keepalive_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_keepalive_0_ocil:questionnaire:1">
          <ocil:title>Set SSH Client Alive Count Max to zero</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_keepalive_0_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_login_grace_time_ocil:questionnaire:1">
          <ocil:title>Ensure SSH LoginGraceTime is configured</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_login_grace_time_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_loglevel_info_ocil:questionnaire:1">
          <ocil:title>Set LogLevel to INFO</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_loglevel_info_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_loglevel_verbose_ocil:questionnaire:1">
          <ocil:title>Set SSH Daemon LogLevel to VERBOSE</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_loglevel_verbose_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_max_auth_tries_ocil:questionnaire:1">
          <ocil:title>Set SSH authentication attempt limit</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_max_auth_tries_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_max_sessions_ocil:questionnaire:1">
          <ocil:title>Set SSH MaxSessions limit</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_max_sessions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_maxstartups_ocil:questionnaire:1">
          <ocil:title>Ensure SSH MaxStartups is configured</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_maxstartups_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_use_directory_configuration_ocil:questionnaire:1">
          <ocil:title>Distribute the SSH Server configuration to multiple files in a config directory.</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_use_directory_configuration_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_use_priv_separation_ocil:questionnaire:1">
          <ocil:title>Enable Use of Privilege Separation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_use_priv_separation_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_x11_use_localhost_ocil:questionnaire:1">
          <ocil:title>Prevent remote hosts from connecting to the proxy display</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_x11_use_localhost_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_sshd_private_key_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on SSH Server Private *_key Key Files</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_sshd_private_key_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_sshd_pub_key_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on SSH Server Public *.pub Key Files</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_sshd_pub_key_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_openssh-server_installed_ocil:questionnaire:1">
          <ocil:title>Install the OpenSSH Server Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_openssh-server_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_openssh-server_removed_ocil:questionnaire:1">
          <ocil:title>Remove the OpenSSH Server Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_openssh-server_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_sssd-ipa_installed_ocil:questionnaire:1">
          <ocil:title>Install sssd-ipa Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_sssd-ipa_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sssd_certificate_verification_ocil:questionnaire:1">
          <ocil:title>Certificate status checking in SSSD</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sssd_certificate_verification_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sssd_enable_certmap_ocil:questionnaire:1">
          <ocil:title>Enable Certmap in SSSD</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sssd_enable_certmap_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sssd_enable_smartcards_ocil:questionnaire:1">
          <ocil:title>Enable Smartcards in SSSD</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sssd_enable_smartcards_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sssd_memcache_timeout_ocil:questionnaire:1">
          <ocil:title>Configure SSSD's Memory Cache to Expire</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sssd_memcache_timeout_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sssd_offline_cred_expiration_ocil:questionnaire:1">
          <ocil:title>Configure SSSD to Expire Offline Credentials</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sssd_offline_cred_expiration_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sssd_run_as_sssd_user_ocil:questionnaire:1">
          <ocil:title>Configure SSSD to run as user sssd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sssd_run_as_sssd_user_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sssd_ssh_known_hosts_timeout_ocil:questionnaire:1">
          <ocil:title>Configure SSSD to Expire SSH Known Hosts</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sssd_ssh_known_hosts_timeout_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_usbguard_auditbackend_ocil:questionnaire:1">
          <ocil:title>Log USBGuard daemon audit events using Linux Audit</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_usbguard_auditbackend_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_usbguard_installed_ocil:questionnaire:1">
          <ocil:title>Install usbguard Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_usbguard_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_usbguard_enabled_ocil:questionnaire:1">
          <ocil:title>Enable the USBGuard Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_usbguard_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-usbguard_allow_hid_ocil:questionnaire:1">
          <ocil:title>Authorize Human Interface Devices in USBGuard daemon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-usbguard_allow_hid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-usbguard_allow_hid_and_hub_ocil:questionnaire:1">
          <ocil:title>Authorize Human Interface Devices and USB hubs in USBGuard daemon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-usbguard_allow_hid_and_hub_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-usbguard_allow_hub_ocil:questionnaire:1">
          <ocil:title>Authorize USB hubs in USBGuard daemon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-usbguard_allow_hub_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_xorg-x11-server-common_removed_ocil:questionnaire:1">
          <ocil:title>Remove the X Windows Package Group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_xorg-x11-server-common_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-xwindows_runlevel_target_ocil:questionnaire:1">
          <ocil:title>Disable X Windows Startup By Setting Default Target</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-xwindows_runlevel_target_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_banner_enabled_ocil:questionnaire:1">
          <ocil:title>Enable GNOME3 Login Warning Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_banner_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_login_banner_text_ocil:questionnaire:1">
          <ocil:title>Set the GNOME3 Login Warning Banner Text</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_login_banner_text_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-banner_etc_issue_ocil:questionnaire:1">
          <ocil:title>Modify the System Login Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-banner_etc_issue_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-banner_etc_motd_ocil:questionnaire:1">
          <ocil:title>Modify the System Message of the Day Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-banner_etc_motd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_etc_issue_ocil:questionnaire:1">
          <ocil:title>Verify Group Ownership of System Login Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_etc_issue_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_etc_motd_ocil:questionnaire:1">
          <ocil:title>Verify Group Ownership of Message of the Day Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_etc_motd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_etc_issue_ocil:questionnaire:1">
          <ocil:title>Verify ownership of System Login Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_etc_issue_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_etc_motd_ocil:questionnaire:1">
          <ocil:title>Verify ownership of Message of the Day Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_etc_motd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_issue_ocil:questionnaire:1">
          <ocil:title>Verify permissions on System Login Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_issue_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_motd_ocil:questionnaire:1">
          <ocil:title>Verify permissions on Message of the Day Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_motd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_pwhistory_remember_password_auth_ocil:questionnaire:1">
          <ocil:title>Limit Password Reuse: password-auth</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_pwhistory_remember_password_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_pwhistory_remember_system_auth_ocil:questionnaire:1">
          <ocil:title>Limit Password Reuse: system-auth</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_pwhistory_remember_system_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_unix_remember_ocil:questionnaire:1">
          <ocil:title>Limit Password Reuse</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_unix_remember_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_passwords_pam_faillock_deny_ocil:questionnaire:1">
          <ocil:title>Lock Accounts After Failed Password Attempts</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_passwords_pam_faillock_deny_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_passwords_pam_faillock_deny_root_ocil:questionnaire:1">
          <ocil:title>Configure the root Account for Failed Password Attempts</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_passwords_pam_faillock_deny_root_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_passwords_pam_faillock_enforce_local_ocil:questionnaire:1">
          <ocil:title>Enforce pam_faillock for Local Accounts Only</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_passwords_pam_faillock_enforce_local_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_passwords_pam_faillock_interval_ocil:questionnaire:1">
          <ocil:title>Set Interval For Counting Failed Password Attempts</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_passwords_pam_faillock_interval_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_ocil:questionnaire:1">
          <ocil:title>Set Lockout Time for Failed Password Attempts</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_passwords_pam_faillock_unlock_time_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_dcredit_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Minimum Digit Characters</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_dcredit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_dictcheck_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_dictcheck_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_difok_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Minimum Different Characters</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_difok_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_enforce_local_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Enforce for Local Accounts Only</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_enforce_local_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_enforce_root_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Enforce for root User</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_enforce_root_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_lcredit_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_lcredit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_maxclassrepeat_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_maxclassrepeat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_maxrepeat_ocil:questionnaire:1">
          <ocil:title>Set Password Maximum Consecutive Repeating Characters</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_maxrepeat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_minclass_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Minimum Different Categories</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_minclass_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_minlen_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Minimum Length</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_minlen_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_ocredit_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Minimum Special Characters</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_ocredit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_pwquality_password_auth_ocil:questionnaire:1">
          <ocil:title>Ensure PAM password complexity module is enabled in password-auth</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_pwquality_password_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_pwquality_system_auth_ocil:questionnaire:1">
          <ocil:title>Ensure PAM password complexity module is enabled in system-auth</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_pwquality_system_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_retry_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_retry_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_ucredit_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_ucredit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-set_password_hashing_algorithm_libuserconf_ocil:questionnaire:1">
          <ocil:title>Set Password Hashing Algorithm in /etc/libuser.conf</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-set_password_hashing_algorithm_libuserconf_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-set_password_hashing_algorithm_logindefs_ocil:questionnaire:1">
          <ocil:title>Set Password Hashing Algorithm in /etc/login.defs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-set_password_hashing_algorithm_logindefs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-set_password_hashing_algorithm_passwordauth_ocil:questionnaire:1">
          <ocil:title>Set PAM's Password Hashing Algorithm - password-auth</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-set_password_hashing_algorithm_passwordauth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-set_password_hashing_algorithm_systemauth_ocil:questionnaire:1">
          <ocil:title>Set PAM's Password Hashing Algorithm</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-set_password_hashing_algorithm_systemauth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-disallow_bypass_password_sudo_ocil:questionnaire:1">
          <ocil:title>Disallow Configuration to Bypass Password Requirements for Privilege Escalation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-disallow_bypass_password_sudo_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-display_login_attempts_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Displays Last Logon/Access Notification</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-display_login_attempts_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-enable_pam_namespace_ocil:questionnaire:1">
          <ocil:title>Set Up a Private Namespace in PAM Configuration</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-enable_pam_namespace_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_bashrc_exec_tmux_ocil:questionnaire:1">
          <ocil:title>Support session locking with tmux</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_bashrc_exec_tmux_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_tmux_lock_after_time_ocil:questionnaire:1">
          <ocil:title>Configure tmux to lock session after inactivity</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_tmux_lock_after_time_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_tmux_lock_command_ocil:questionnaire:1">
          <ocil:title>Configure the tmux Lock Command</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_tmux_lock_command_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_tmux_in_shells_ocil:questionnaire:1">
          <ocil:title>Prevent user from disabling the screen lock</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_tmux_in_shells_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_screen_installed_ocil:questionnaire:1">
          <ocil:title>Install the screen Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_screen_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_tmux_installed_ocil:questionnaire:1">
          <ocil:title>Install the tmux Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_tmux_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_opensc_card_drivers_ocil:questionnaire:1">
          <ocil:title>Configure opensc Smart Card Drivers</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_opensc_card_drivers_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_opensc_nss_db_ocil:questionnaire:1">
          <ocil:title>Configure NSS DB To Use opensc</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_opensc_nss_db_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-force_opensc_card_drivers_ocil:questionnaire:1">
          <ocil:title>Force opensc To Use Defined Smart Card Driver</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-force_opensc_card_drivers_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-install_smartcard_packages_ocil:questionnaire:1">
          <ocil:title>Install Smart Card Packages For Multifactor Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-install_smartcard_packages_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_opensc_installed_ocil:questionnaire:1">
          <ocil:title>Install the opensc Package For Multifactor Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_opensc_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_pcsc-lite_installed_ocil:questionnaire:1">
          <ocil:title>Install the pcsc-lite package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_pcsc-lite_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_pcscd_enabled_ocil:questionnaire:1">
          <ocil:title>Enable the pcscd Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_pcscd_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-smartcard_auth_ocil:questionnaire:1">
          <ocil:title>Enable Smart Card Login</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-smartcard_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-disable_ctrlaltdel_reboot_ocil:questionnaire:1">
          <ocil:title>Disable Ctrl-Alt-Del Reboot Activation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-disable_ctrlaltdel_reboot_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_disable_interactive_boot_ocil:questionnaire:1">
          <ocil:title>Verify that Interactive Boot is Disabled</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_disable_interactive_boot_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-require_emergency_target_auth_ocil:questionnaire:1">
          <ocil:title>Require Authentication for Emergency Systemd Target</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-require_emergency_target_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-require_singleuser_auth_ocil:questionnaire:1">
          <ocil:title>Require Authentication for Single User Mode</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-require_singleuser_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_debug-shell_disabled_ocil:questionnaire:1">
          <ocil:title>Disable debug-shell SystemD Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_debug-shell_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-account_disable_post_pw_expiration_ocil:questionnaire:1">
          <ocil:title>Set Account Expiration Following Inactivity</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-account_disable_post_pw_expiration_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-account_emergency_expire_date_ocil:questionnaire:1">
          <ocil:title>Assign Expiration Date to Emergency Accounts</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-account_emergency_expire_date_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-account_temp_expire_date_ocil:questionnaire:1">
          <ocil:title>Assign Expiration Date to Temporary Accounts</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-account_temp_expire_date_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-account_unique_name_ocil:questionnaire:1">
          <ocil:title>Ensure All Accounts on the System Have Unique Names</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-account_unique_name_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-account_use_centralized_automated_auth_ocil:questionnaire:1">
          <ocil:title>Use Centralized and Automated Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-account_use_centralized_automated_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_maximum_age_login_defs_ocil:questionnaire:1">
          <ocil:title>Set Password Maximum Age</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_maximum_age_login_defs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_minimum_age_login_defs_ocil:questionnaire:1">
          <ocil:title>Set Password Minimum Age</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_minimum_age_login_defs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_minlen_login_defs_ocil:questionnaire:1">
          <ocil:title>Set Password Minimum Length in login.defs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_minlen_login_defs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_warn_age_login_defs_ocil:questionnaire:1">
          <ocil:title>Set Password Warning Age</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_warn_age_login_defs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_all_shadowed_ocil:questionnaire:1">
          <ocil:title>Verify All Account Password Hashes are Shadowed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_all_shadowed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_all_shadowed_sha512_ocil:questionnaire:1">
          <ocil:title>Verify All Account Password Hashes are Shadowed with SHA512</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_all_shadowed_sha512_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_unix_rounds_password_auth_ocil:questionnaire:1">
          <ocil:title>Set number of Password Hashing Rounds - password-auth</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_unix_rounds_password_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_unix_rounds_system_auth_ocil:questionnaire:1">
          <ocil:title>Set number of Password Hashing Rounds - system-auth</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_unix_rounds_system_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-gid_passwd_group_same_ocil:questionnaire:1">
          <ocil:title>All GIDs referenced in /etc/passwd must be defined in /etc/group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-gid_passwd_group_same_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_empty_passwords_ocil:questionnaire:1">
          <ocil:title>Prevent Login to Accounts With Empty Password</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_empty_passwords_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_empty_passwords_etc_shadow_ocil:questionnaire:1">
          <ocil:title>Ensure There Are No Accounts With Blank or Null Passwords</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_empty_passwords_etc_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_legacy_plus_entries_etc_group_ocil:questionnaire:1">
          <ocil:title>Ensure there are no legacy + NIS entries in /etc/group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_legacy_plus_entries_etc_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_legacy_plus_entries_etc_passwd_ocil:questionnaire:1">
          <ocil:title>Ensure there are no legacy + NIS entries in /etc/passwd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_legacy_plus_entries_etc_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_legacy_plus_entries_etc_shadow_ocil:questionnaire:1">
          <ocil:title>Ensure there are no legacy + NIS entries in /etc/shadow</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_legacy_plus_entries_etc_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_netrc_files_ocil:questionnaire:1">
          <ocil:title>Verify No netrc Files Exist</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_netrc_files_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_no_uid_except_zero_ocil:questionnaire:1">
          <ocil:title>Verify Only Root Has UID 0</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_no_uid_except_zero_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_root_gid_zero_ocil:questionnaire:1">
          <ocil:title>Verify Root Has A Primary GID 0</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_root_gid_zero_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_direct_root_logins_ocil:questionnaire:1">
          <ocil:title>Direct root Logins Not Allowed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_direct_root_logins_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_password_auth_for_systemaccounts_ocil:questionnaire:1">
          <ocil:title>Ensure that System Accounts Are Locked</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_password_auth_for_systemaccounts_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_root_webbrowsing_ocil:questionnaire:1">
          <ocil:title>Restrict Web Browser Use for Administrative Accounts</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_root_webbrowsing_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_shelllogin_for_systemaccounts_ocil:questionnaire:1">
          <ocil:title>Ensure that System Accounts Do Not Run a Shell Upon Login</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_shelllogin_for_systemaccounts_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-restrict_serial_port_logins_ocil:questionnaire:1">
          <ocil:title>Restrict Serial Port Root Logins</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-restrict_serial_port_logins_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-root_path_default_ocil:questionnaire:1">
          <ocil:title>Root Path Must Be Vendor Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-root_path_default_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-securetty_root_login_console_only_ocil:questionnaire:1">
          <ocil:title>Restrict Virtual Console Root Logins</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-securetty_root_login_console_only_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-use_pam_wheel_for_su_ocil:questionnaire:1">
          <ocil:title>Enforce usage of pam_wheel for su authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-use_pam_wheel_for_su_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-account_unique_id_ocil:questionnaire:1">
          <ocil:title>Ensure All Accounts on the System Have Unique User IDs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-account_unique_id_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_authorized_local_users_ocil:questionnaire:1">
          <ocil:title>Only Authorized Local User Accounts Exist on Operating System</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_authorized_local_users_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-group_unique_id_ocil:questionnaire:1">
          <ocil:title>Ensure All Groups on the System Have Unique Group ID</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-group_unique_id_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-group_unique_name_ocil:questionnaire:1">
          <ocil:title>Ensure All Groups on the System Have Unique Group Names</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-group_unique_name_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_root_path_dirs_no_write_ocil:questionnaire:1">
          <ocil:title>Ensure that Root's Path Does Not Include World or Group-Writable Directories</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_umask_etc_login_defs_ocil:questionnaire:1">
          <ocil:title>Ensure the Default Umask is Set Correctly in login.defs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_umask_etc_login_defs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_umask_etc_profile_ocil:questionnaire:1">
          <ocil:title>Ensure the Default Umask is Set Correctly in /etc/profile</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_umask_etc_profile_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_have_homedir_login_defs_ocil:questionnaire:1">
          <ocil:title>Ensure Home Directories are Created for New Users</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_have_homedir_login_defs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_logon_fail_delay_ocil:questionnaire:1">
          <ocil:title>Ensure the Logon Failure Delay is Set Correctly in login.defs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_logon_fail_delay_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_max_concurrent_login_sessions_ocil:questionnaire:1">
          <ocil:title>Limit the Number of Concurrent Login Sessions Allowed Per User</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_max_concurrent_login_sessions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_polyinstantiated_tmp_ocil:questionnaire:1">
          <ocil:title>Configure Polyinstantiation of /tmp Directories</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_polyinstantiated_tmp_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_polyinstantiated_var_tmp_ocil:questionnaire:1">
          <ocil:title>Configure Polyinstantiation of /var/tmp Directories</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_polyinstantiated_var_tmp_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_tmout_ocil:questionnaire:1">
          <ocil:title>Set Interactive Session Timeout</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_tmout_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_home_dirs_ocil:questionnaire:1">
          <ocil:title>Ensure that User Home Directories are not Group-Writable or World-Readable</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_home_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_chmod_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - chmod</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_chmod_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_chown_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - chown</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_chown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_fchmod_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - fchmod</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_fchmod_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_fchmodat_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - fchmodat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_fchmodat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_fchown_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - fchown</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_fchown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_fchownat_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - fchownat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_fchownat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_fremovexattr_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - fremovexattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_fremovexattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_fsetxattr_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - fsetxattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_fsetxattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_lchown_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - lchown</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_lchown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_lremovexattr_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - lremovexattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_lremovexattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_lsetxattr_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - lsetxattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_lsetxattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_removexattr_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - removexattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_removexattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_setxattr_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - setxattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_setxattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_umount_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - umount</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_umount_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_umount2_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - umount2</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_umount2_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_execution_chcon_ocil:questionnaire:1">
          <ocil:title>Record Any Attempts to Run chcon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_execution_chcon_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_execution_restorecon_ocil:questionnaire:1">
          <ocil:title>Record Any Attempts to Run restorecon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_execution_restorecon_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_execution_semanage_ocil:questionnaire:1">
          <ocil:title>Record Any Attempts to Run semanage</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_execution_semanage_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_execution_setsebool_ocil:questionnaire:1">
          <ocil:title>Record Any Attempts to Run setsebool</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_execution_setsebool_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_execution_seunshare_ocil:questionnaire:1">
          <ocil:title>Record Any Attempts to Run seunshare</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_execution_seunshare_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_file_deletion_events_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects File Deletion Events by User</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_file_deletion_events_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_file_deletion_events_rename_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects File Deletion Events by User - rename</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_file_deletion_events_rename_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_file_deletion_events_renameat_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects File Deletion Events by User - renameat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_file_deletion_events_renameat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_file_deletion_events_rmdir_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects File Deletion Events by User - rmdir</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_file_deletion_events_rmdir_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_file_deletion_events_unlink_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects File Deletion Events by User - unlink</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_file_deletion_events_unlink_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_file_deletion_events_unlinkat_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects File Deletion Events by User - unlinkat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_file_deletion_events_unlinkat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_chmod_ocil:questionnaire:1">
          <ocil:title>Record Successful Permission Changes to Files - chmod</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_chmod_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_chown_ocil:questionnaire:1">
          <ocil:title>Record Successful Ownership Changes to Files - chown</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_chown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_creat_ocil:questionnaire:1">
          <ocil:title>Record Successful Access Attempts to Files - creat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_creat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_fchmod_ocil:questionnaire:1">
          <ocil:title>Record Successful Permission Changes to Files - fchmod</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_fchmod_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_fchmodat_ocil:questionnaire:1">
          <ocil:title>Record Successful Permission Changes to Files - fchmodat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_fchmodat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_fchown_ocil:questionnaire:1">
          <ocil:title>Record Successful Ownership Changes to Files - fchown</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_fchown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_fchownat_ocil:questionnaire:1">
          <ocil:title>Record Successful Ownership Changes to Files - fchownat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_fchownat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_fremovexattr_ocil:questionnaire:1">
          <ocil:title>Record Successful Permission Changes to Files - fremovexattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_fremovexattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_fsetxattr_ocil:questionnaire:1">
          <ocil:title>Record Successful Permission Changes to Files - fsetxattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_fsetxattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_ftruncate_ocil:questionnaire:1">
          <ocil:title>Record Successful Access Attempts to Files - ftruncate</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_ftruncate_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_lchown_ocil:questionnaire:1">
          <ocil:title>Record Successful Ownership Changes to Files - lchown</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_lchown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_lremovexattr_ocil:questionnaire:1">
          <ocil:title>Record Successful Permission Changes to Files - lremovexattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_lremovexattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_lsetxattr_ocil:questionnaire:1">
          <ocil:title>Record Successful Permission Changes to Files - lsetxattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_lsetxattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_open_ocil:questionnaire:1">
          <ocil:title>Record Successful Access Attempts to Files - open</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_open_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_ocil:questionnaire:1">
          <ocil:title>Record Successful Access Attempts to Files - open_by_handle_at</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_creat_ocil:questionnaire:1">
          <ocil:title>Record Successful Creation Attempts to Files - open_by_handle_at O_CREAT</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_creat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write_ocil:questionnaire:1">
          <ocil:title>Record Successful Creation Attempts to Files - open_by_handle_at O_TRUNC_WRITE</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_open_o_creat_ocil:questionnaire:1">
          <ocil:title>Record Successful Creation Attempts to Files - open O_CREAT</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_open_o_creat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_open_o_trunc_write_ocil:questionnaire:1">
          <ocil:title>Record Successful Creation Attempts to Files - open O_TRUNC_WRITE</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_open_o_trunc_write_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_openat_ocil:questionnaire:1">
          <ocil:title>Record Successful Access Attempts to Files - openat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_openat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_openat_o_creat_ocil:questionnaire:1">
          <ocil:title>Record Successful Creation Attempts to Files - openat O_CREAT</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_openat_o_creat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_openat_o_trunc_write_ocil:questionnaire:1">
          <ocil:title>Record Successful Creation Attempts to Files - openat O_TRUNC_WRITE</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_openat_o_trunc_write_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_removexattr_ocil:questionnaire:1">
          <ocil:title>Record Successful Permission Changes to Files - removexattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_removexattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_rename_ocil:questionnaire:1">
          <ocil:title>Record Successful Delete Attempts to Files - rename</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_rename_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_renameat_ocil:questionnaire:1">
          <ocil:title>Record Successful Delete Attempts to Files - renameat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_renameat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_setxattr_ocil:questionnaire:1">
          <ocil:title>Record Successful Permission Changes to Files - setxattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_setxattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_truncate_ocil:questionnaire:1">
          <ocil:title>Record Successful Access Attempts to Files - truncate</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_truncate_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_unlink_ocil:questionnaire:1">
          <ocil:title>Record Successful Delete Attempts to Files - unlink</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_unlink_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_unlinkat_ocil:questionnaire:1">
          <ocil:title>Record Successful Delete Attempts to Files - unlinkat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_unlinkat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_chmod_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Permission Changes to Files - chmod</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_chmod_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_chown_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Ownership Changes to Files - chown</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_chown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_creat_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Access Attempts to Files - creat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_creat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmod_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Permission Changes to Files - fchmod</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_fchmod_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmodat_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Permission Changes to Files - fchmodat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_fchmodat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchown_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Ownership Changes to Files - fchown</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_fchown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchownat_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Ownership Changes to Files - fchownat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_fchownat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_fremovexattr_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Permission Changes to Files - fremovexattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_fremovexattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_fsetxattr_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Permission Changes to Files - fsetxattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_fsetxattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Access Attempts to Files - ftruncate</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_lchown_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Ownership Changes to Files - lchown</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_lchown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_lremovexattr_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Permission Changes to Files - lremovexattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_lremovexattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_lsetxattr_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Permission Changes to Files - lsetxattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_lsetxattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Access Attempts to Files - open</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_open_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Access Attempts to Files - open_by_handle_at</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_creat_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Creation Attempts to Files - open O_CREAT</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_creat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_rule_order_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_open_rule_order_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Access Attempts to Files - openat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_openat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Creation Attempts to Files - openat O_CREAT</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_rule_order_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_openat_rule_order_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_removexattr_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Permission Changes to Files - removexattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_removexattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_rename_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Delete Attempts to Files - rename</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_rename_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_renameat_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Delete Attempts to Files - renameat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_renameat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_setxattr_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Permission Changes to Files - setxattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_setxattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Access Attempts to Files - truncate</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_unlink_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Delete Attempts to Files - unlink</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_unlink_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_unlinkat_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Delete Attempts to Files - unlinkat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_unlinkat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_kernel_module_loading_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on Kernel Module Loading and Unloading</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_kernel_module_loading_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_kernel_module_loading_delete_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on Kernel Module Unloading - delete_module</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_kernel_module_loading_delete_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_kernel_module_loading_finit_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_kernel_module_loading_finit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_kernel_module_loading_init_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on Kernel Module Loading - init_module</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_kernel_module_loading_init_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_login_events_faillock_ocil:questionnaire:1">
          <ocil:title>Record Attempts to Alter Logon and Logout Events - faillock</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_login_events_faillock_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_login_events_lastlog_ocil:questionnaire:1">
          <ocil:title>Record Attempts to Alter Logon and Logout Events - lastlog</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_login_events_lastlog_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_login_events_tallylog_ocil:questionnaire:1">
          <ocil:title>Record Attempts to Alter Logon and Logout Events - tallylog</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_login_events_tallylog_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_at_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - at</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_at_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_chage_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - chage</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_chage_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_chsh_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - chsh</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_chsh_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_crontab_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - crontab</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_crontab_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_gpasswd_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_gpasswd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_mount_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - mount</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_mount_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_newgidmap_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - newgidmap</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_newgidmap_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_newgrp_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_newgrp_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_newuidmap_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - newuidmap</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_newuidmap_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_passwd_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - passwd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_pt_chown_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - pt_chown</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_pt_chown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_ssh_keysign_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_ssh_keysign_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_su_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - su</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_su_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_sudo_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - sudo</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_sudo_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_sudoedit_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_sudoedit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_umount_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - umount</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_umount_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_unix_chkpwd_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_unix_chkpwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_userhelper_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - userhelper</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_userhelper_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_usernetctl_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - usernetctl</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_usernetctl_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_time_adjtimex_ocil:questionnaire:1">
          <ocil:title>Record attempts to alter time through adjtimex</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_time_adjtimex_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_time_clock_settime_ocil:questionnaire:1">
          <ocil:title>Record Attempts to Alter Time Through clock_settime</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_time_clock_settime_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_time_settimeofday_ocil:questionnaire:1">
          <ocil:title>Record attempts to alter time through settimeofday</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_time_settimeofday_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_time_stime_ocil:questionnaire:1">
          <ocil:title>Record Attempts to Alter Time Through stime</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_time_stime_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_time_watch_localtime_ocil:questionnaire:1">
          <ocil:title>Record Attempts to Alter the localtime File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_time_watch_localtime_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_etc_group_open_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information via open syscall - /etc/group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_etc_group_open_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_etc_group_open_by_handle_at_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_etc_group_open_by_handle_at_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_etc_group_openat_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information via openat syscall - /etc/group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_etc_group_openat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_etc_gshadow_open_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information via open syscall - /etc/gshadow</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_etc_gshadow_open_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_etc_gshadow_open_by_handle_at_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_etc_gshadow_open_by_handle_at_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_etc_gshadow_openat_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information via openat syscall - /etc/gshadow</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_etc_gshadow_openat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_etc_passwd_open_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information via open syscall - /etc/passwd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_etc_passwd_open_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_etc_passwd_open_by_handle_at_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_etc_passwd_open_by_handle_at_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_etc_passwd_openat_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information via openat syscall - /etc/passwd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_etc_passwd_openat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_etc_shadow_open_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information via open syscall - /etc/shadow</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_etc_shadow_open_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_etc_shadow_open_by_handle_at_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_etc_shadow_open_by_handle_at_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_etc_shadow_openat_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information via openat syscall - /etc/shadow</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_etc_shadow_openat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_immutable_ocil:questionnaire:1">
          <ocil:title>Make the auditd Configuration Immutable</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_immutable_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_mac_modification_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Mandatory Access Controls</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_mac_modification_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_media_export_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on Exporting to Media (successful)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_media_export_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_networkconfig_modification_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Network Environment</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_networkconfig_modification_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_sysadmin_actions_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects System Administrator Actions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_sysadmin_actions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_usergroup_modification_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_usergroup_modification_group_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information - /etc/group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_usergroup_modification_gshadow_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information - /etc/gshadow</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_gshadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_usergroup_modification_opasswd_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information - /etc/security/opasswd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_opasswd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_usergroup_modification_passwd_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information - /etc/passwd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_usergroup_modification_shadow_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information - /etc/shadow</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_access_var_log_audit_ocil:questionnaire:1">
          <ocil:title>Record Access Events to Audit Log Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_access_var_log_audit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_permissions_var_log_audit_ocil:questionnaire:1">
          <ocil:title>System Audit Logs Must Have Mode 0750 or Less Permissive</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_permissions_var_log_audit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupownership_audit_configuration_ocil:questionnaire:1">
          <ocil:title>Audit Configuration Files Must Be Owned By Group root</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupownership_audit_configuration_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_ownership_audit_configuration_ocil:questionnaire:1">
          <ocil:title>Audit Configuration Files Must Be Owned By Root</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_ownership_audit_configuration_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_ownership_var_log_audit_ocil:questionnaire:1">
          <ocil:title>System Audit Logs Must Be Owned By Root</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_ownership_var_log_audit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_var_log_audit_ocil:questionnaire:1">
          <ocil:title>System Audit Logs Must Have Mode 0640 or Less Permissive</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_var_log_audit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_audispd_configure_remote_server_ocil:questionnaire:1">
          <ocil:title>Configure audispd Plugin To Send Logs To Remote Server</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_audispd_configure_remote_server_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_audispd_encrypt_sent_records_ocil:questionnaire:1">
          <ocil:title>Encrypt Audit Records Sent With audispd Plugin</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_audispd_encrypt_sent_records_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_audispd_syslog_plugin_activated_ocil:questionnaire:1">
          <ocil:title>Configure auditd to use audispd's syslog plugin</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_audispd_syslog_plugin_activated_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_disk_error_action_ocil:questionnaire:1">
          <ocil:title>Configure auditd Disk Error Action on Disk Error</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_disk_error_action_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_disk_full_action_ocil:questionnaire:1">
          <ocil:title>Configure auditd Disk Full Action when Disk Space Is Full</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_disk_full_action_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_retention_action_mail_acct_ocil:questionnaire:1">
          <ocil:title>Configure auditd mail_acct Action on Low Disk Space</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_retention_action_mail_acct_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_retention_admin_space_left_action_ocil:questionnaire:1">
          <ocil:title>Configure auditd admin_space_left Action on Low Disk Space</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_retention_admin_space_left_action_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_retention_flush_ocil:questionnaire:1">
          <ocil:title>Configure auditd flush priority</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_retention_flush_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_retention_max_log_file_ocil:questionnaire:1">
          <ocil:title>Configure auditd Max Log File Size</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_retention_max_log_file_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_retention_max_log_file_action_ocil:questionnaire:1">
          <ocil:title>Configure auditd max_log_file_action Upon Reaching Maximum Log Size</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_retention_max_log_file_action_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_retention_num_logs_ocil:questionnaire:1">
          <ocil:title>Configure auditd Number of Logs Retained</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_retention_num_logs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_retention_space_left_action_ocil:questionnaire:1">
          <ocil:title>Configure auditd space_left Action on Low Disk Space</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_retention_space_left_action_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_retention_space_left_percentage_ocil:questionnaire:1">
          <ocil:title>Configure auditd space_left on Low Disk Space</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_retention_space_left_percentage_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_freq_ocil:questionnaire:1">
          <ocil:title>Set number of records to cause an explicit flush to audit logs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_freq_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_local_events_ocil:questionnaire:1">
          <ocil:title>Include Local Events in Audit Logs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_local_events_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_log_format_ocil:questionnaire:1">
          <ocil:title>Resolve information before writing to audit logs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_log_format_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_name_format_ocil:questionnaire:1">
          <ocil:title>Set hostname as computer node name in audit logs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_name_format_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_overflow_action_ocil:questionnaire:1">
          <ocil:title>Appropriate Action Must be Setup When the Internal Audit Event Queue is Full</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_overflow_action_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_write_logs_ocil:questionnaire:1">
          <ocil:title>Write Audit Logs to the Disk</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_write_logs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_audit_argument_ocil:questionnaire:1">
          <ocil:title>Enable Auditing for Processes Which Start Prior to the Audit Daemon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_audit_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_audit_backlog_limit_argument_ocil:questionnaire:1">
          <ocil:title>Extend Audit Backlog Limit for the Audit Daemon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_audit_backlog_limit_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_audispd-plugins_installed_ocil:questionnaire:1">
          <ocil:title>Install audispd-plugins Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_audispd-plugins_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_audit-audispd-plugins_installed_ocil:questionnaire:1">
          <ocil:title>Ensure the default plugins for the audit dispatcher are Installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_audit-audispd-plugins_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_audit_installed_ocil:questionnaire:1">
          <ocil:title>Ensure the audit Subsystem is Installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_audit_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_auditd_enabled_ocil:questionnaire:1">
          <ocil:title>Enable auditd Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_auditd_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_grub2_cfg_ocil:questionnaire:1">
          <ocil:title>Verify /boot/grub2/grub.cfg Group Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_grub2_cfg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_grub2_cfg_ocil:questionnaire:1">
          <ocil:title>Verify /boot/grub2/grub.cfg User Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_grub2_cfg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_grub2_cfg_ocil:questionnaire:1">
          <ocil:title>Verify /boot/grub2/grub.cfg Permissions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_grub2_cfg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_admin_username_ocil:questionnaire:1">
          <ocil:title>Set the Boot Loader Admin Username to a Non-Default Value</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_admin_username_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_password_ocil:questionnaire:1">
          <ocil:title>Set Boot Loader Password in grub2</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_password_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_efi_grub2_cfg_ocil:questionnaire:1">
          <ocil:title>Verify the UEFI Boot Loader grub.cfg Group Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_efi_grub2_cfg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_efi_grub2_cfg_ocil:questionnaire:1">
          <ocil:title>Verify the UEFI Boot Loader grub.cfg User Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_efi_grub2_cfg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_efi_grub2_cfg_ocil:questionnaire:1">
          <ocil:title>Verify the UEFI Boot Loader grub.cfg Permissions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_efi_grub2_cfg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_uefi_admin_username_ocil:questionnaire:1">
          <ocil:title>Set the UEFI Boot Loader Admin Username to a Non-Default Value</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_uefi_admin_username_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_uefi_password_ocil:questionnaire:1">
          <ocil:title>Set the UEFI Boot Loader Password</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_uefi_password_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_enable_iommu_force_ocil:questionnaire:1">
          <ocil:title>IOMMU configuration directive</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_enable_iommu_force_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_l1tf_argument_ocil:questionnaire:1">
          <ocil:title>Configure L1 Terminal Fault mitigations</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_l1tf_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_mce_argument_ocil:questionnaire:1">
          <ocil:title>Force kernel panic on uncorrected MCEs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_mce_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_mds_argument_ocil:questionnaire:1">
          <ocil:title>Configure Microarchitectural Data Sampling mitigation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_mds_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_nosmap_argument_absent_ocil:questionnaire:1">
          <ocil:title>Ensure SMAP is not disabled during boot</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_nosmap_argument_absent_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_nosmep_argument_absent_ocil:questionnaire:1">
          <ocil:title>Ensure SMEP is not disabled during boot</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_nosmep_argument_absent_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_pti_argument_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Page-Table Isolation (KPTI)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_pti_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_rng_core_default_quality_argument_ocil:questionnaire:1">
          <ocil:title>Configure the confidence in TPM for entropy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_rng_core_default_quality_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_slab_nomerge_argument_ocil:questionnaire:1">
          <ocil:title>Disable merging of slabs with similar size</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_slab_nomerge_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_spec_store_bypass_disable_argument_ocil:questionnaire:1">
          <ocil:title>Configure Speculative Store Bypass Mitigation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_spec_store_bypass_disable_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_spectre_v2_argument_ocil:questionnaire:1">
          <ocil:title>Enforce Spectre v2 mitigation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_spectre_v2_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_vsyscall_argument_ocil:questionnaire:1">
          <ocil:title>Disable vsyscalls</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_vsyscall_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_gcc_plugin_latent_entropy_ocil:questionnaire:1">
          <ocil:title>Generate some entropy during boot and runtime</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_gcc_plugin_latent_entropy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_gcc_plugin_randstruct_ocil:questionnaire:1">
          <ocil:title>Randomize layout of sensitive kernel structures</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_gcc_plugin_randstruct_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_gcc_plugin_stackleak_ocil:questionnaire:1">
          <ocil:title>Poison kernel stack before returning from syscalls</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_gcc_plugin_stackleak_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_gcc_plugin_structleak_ocil:questionnaire:1">
          <ocil:title>Force initialization of variables containing userspace addresses</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_gcc_plugin_structleak_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_gcc_plugin_structleak_byref_all_ocil:questionnaire:1">
          <ocil:title>zero-init everything passed by reference</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_gcc_plugin_structleak_byref_all_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_acpi_custom_method_ocil:questionnaire:1">
          <ocil:title>Do not allow ACPI methods to be inserted/replaced at run time</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_acpi_custom_method_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_arm64_sw_ttbr0_pan_ocil:questionnaire:1">
          <ocil:title>Emulate Privileged Access Never (PAN)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_arm64_sw_ttbr0_pan_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_binfmt_misc_ocil:questionnaire:1">
          <ocil:title>Disable kernel support for MISC binaries</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_binfmt_misc_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_bug_ocil:questionnaire:1">
          <ocil:title>Enable support for BUG()</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_bug_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_bug_on_data_corruption_ocil:questionnaire:1">
          <ocil:title>Trigger a kernel BUG when data corruption is detected</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_bug_on_data_corruption_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_compat_brk_ocil:questionnaire:1">
          <ocil:title>Disable compatibility with brk()</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_compat_brk_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_compat_vdso_ocil:questionnaire:1">
          <ocil:title>Disable the 32-bit vDSO</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_compat_vdso_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_debug_credentials_ocil:questionnaire:1">
          <ocil:title>Enable checks on credential management</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_debug_credentials_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_debug_fs_ocil:questionnaire:1">
          <ocil:title>Disable kernel debugfs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_debug_fs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_debug_list_ocil:questionnaire:1">
          <ocil:title>Enable checks on linked list manipulation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_debug_list_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_debug_notifiers_ocil:questionnaire:1">
          <ocil:title>Enable checks on notifier call chains</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_debug_notifiers_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_debug_sg_ocil:questionnaire:1">
          <ocil:title>Enable checks on scatter-gather (SG) table operations</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_debug_sg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_debug_wx_ocil:questionnaire:1">
          <ocil:title>Warn on W+X mappings found at boot</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_debug_wx_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_default_mmap_min_addr_ocil:questionnaire:1">
          <ocil:title>Configure low address space to protect from user allocation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_default_mmap_min_addr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_devkmem_ocil:questionnaire:1">
          <ocil:title>Disable /dev/kmem virtual device support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_devkmem_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_fortify_source_ocil:questionnaire:1">
          <ocil:title>Harden common str/mem functions against buffer overflows</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_fortify_source_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_hardened_usercopy_ocil:questionnaire:1">
          <ocil:title>Harden memory copies between kernel and userspace</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_hardened_usercopy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_hardened_usercopy_fallback_ocil:questionnaire:1">
          <ocil:title>Do not allow usercopy whitelist violations to fallback to object size</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_hardened_usercopy_fallback_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_hibernation_ocil:questionnaire:1">
          <ocil:title>Disable hibernation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_hibernation_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_ia32_emulation_ocil:questionnaire:1">
          <ocil:title>Disable IA32 emulation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_ia32_emulation_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_ipv6_ocil:questionnaire:1">
          <ocil:title>Disable the IPv6 protocol</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_ipv6_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_kexec_ocil:questionnaire:1">
          <ocil:title>Disable kexec system call</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_kexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_legacy_ptys_ocil:questionnaire:1">
          <ocil:title>Disable legacy (BSD) PTY support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_legacy_ptys_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_legacy_vsyscall_emulate_ocil:questionnaire:1">
          <ocil:title>Disable vsyscall emulation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_legacy_vsyscall_emulate_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_legacy_vsyscall_none_ocil:questionnaire:1">
          <ocil:title>Disable vsyscall mapping</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_legacy_vsyscall_none_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_legacy_vsyscall_xonly_ocil:questionnaire:1">
          <ocil:title>Disable vsyscall emulate execution only</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_legacy_vsyscall_xonly_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_modify_ldt_syscall_ocil:questionnaire:1">
          <ocil:title>Disable the LDT (local descriptor table)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_modify_ldt_syscall_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_module_sig_ocil:questionnaire:1">
          <ocil:title>Enable module signature verification</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_module_sig_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_module_sig_all_ocil:questionnaire:1">
          <ocil:title>Enable automatic signing of all modules</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_module_sig_all_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_module_sig_force_ocil:questionnaire:1">
          <ocil:title>Require modules to be validly signed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_module_sig_force_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_module_sig_hash_ocil:questionnaire:1">
          <ocil:title>Specify the hash to use when signing modules</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_module_sig_hash_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_module_sig_key_ocil:questionnaire:1">
          <ocil:title>Specify module signing key to use</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_module_sig_key_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_module_sig_sha512_ocil:questionnaire:1">
          <ocil:title>Sign kernel modules with SHA-512</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_module_sig_sha512_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_page_poisoning_ocil:questionnaire:1">
          <ocil:title>Enable poison of pages after freeing</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_page_poisoning_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_page_poisoning_no_sanity_ocil:questionnaire:1">
          <ocil:title>Enable poison without sanity check</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_page_poisoning_no_sanity_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_page_poisoning_zero_ocil:questionnaire:1">
          <ocil:title>Use zero for poisoning instead of debugging value</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_page_poisoning_zero_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_page_table_isolation_ocil:questionnaire:1">
          <ocil:title>Remove the kernel mapping in user mode</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_page_table_isolation_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_panic_on_oops_ocil:questionnaire:1">
          <ocil:title>Kernel panic oops</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_panic_on_oops_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_panic_timeout_ocil:questionnaire:1">
          <ocil:title>Kernel panic timeout</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_panic_timeout_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_proc_kcore_ocil:questionnaire:1">
          <ocil:title>Disable support for /proc/kkcore</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_proc_kcore_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_randomize_base_ocil:questionnaire:1">
          <ocil:title>Randomize the address of the kernel image (KASLR)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_randomize_base_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_randomize_memory_ocil:questionnaire:1">
          <ocil:title>Randomize the kernel memory sections</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_randomize_memory_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_refcount_full_ocil:questionnaire:1">
          <ocil:title>Perform full reference count validation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_refcount_full_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_retpoline_ocil:questionnaire:1">
          <ocil:title>Avoid speculative indirect branches in kernel</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_retpoline_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_sched_stack_end_check_ocil:questionnaire:1">
          <ocil:title>Detect stack corruption on calls to schedule()</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_sched_stack_end_check_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_seccomp_ocil:questionnaire:1">
          <ocil:title>Enable seccomp to safely compute untrusted bytecode</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_seccomp_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_seccomp_filter_ocil:questionnaire:1">
          <ocil:title>Enable use of Berkeley Packet Filter with seccomp</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_seccomp_filter_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_security_ocil:questionnaire:1">
          <ocil:title>Enable different security models</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_security_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_security_dmesg_restrict_ocil:questionnaire:1">
          <ocil:title>Restrict unprivileged access to the kernel syslog</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_security_dmesg_restrict_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_security_writable_hooks_ocil:questionnaire:1">
          <ocil:title>Disable mutable hooks</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_security_writable_hooks_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_security_yama_ocil:questionnaire:1">
          <ocil:title>Enable Yama support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_security_yama_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_slab_freelist_hardened_ocil:questionnaire:1">
          <ocil:title>Harden slab freelist metadata</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_slab_freelist_hardened_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_slab_freelist_random_ocil:questionnaire:1">
          <ocil:title>Randomize slab freelist</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_slab_freelist_random_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_slab_merge_default_ocil:questionnaire:1">
          <ocil:title>Disallow merge of slab caches</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_slab_merge_default_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_slub_debug_ocil:questionnaire:1">
          <ocil:title>Enable SLUB debugging support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_slub_debug_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_stackprotector_ocil:questionnaire:1">
          <ocil:title>Stack Protector buffer overlow detection</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_stackprotector_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_stackprotector_strong_ocil:questionnaire:1">
          <ocil:title>Strong Stack Protector</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_stackprotector_strong_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_strict_kernel_rwx_ocil:questionnaire:1">
          <ocil:title>Make the kernel text and rodata read-only</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_strict_kernel_rwx_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_strict_module_rwx_ocil:questionnaire:1">
          <ocil:title>Make the module text and rodata read-only</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_strict_module_rwx_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_syn_cookies_ocil:questionnaire:1">
          <ocil:title>Enable TCP/IP syncookie support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_syn_cookies_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_unmap_kernel_at_el0_ocil:questionnaire:1">
          <ocil:title>Unmap kernel when running in userspace (aka KAISER)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_unmap_kernel_at_el0_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_vmap_stack_ocil:questionnaire:1">
          <ocil:title>User a virtually-mapped stack</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_vmap_stack_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_x86_vsyscall_emulation_ocil:questionnaire:1">
          <ocil:title>Disable x86 vsyscall emulation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_x86_vsyscall_emulation_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_cron_logging_ocil:questionnaire:1">
          <ocil:title>Ensure cron Is Logging To Rsyslog</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_cron_logging_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode_ocil:questionnaire:1">
          <ocil:title>Ensure Rsyslog Authenticates Off-Loaded Audit Records</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode_ocil:questionnaire:1">
          <ocil:title>Ensure Rsyslog Encrypts Off-Loaded Audit Records</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver_ocil:questionnaire:1">
          <ocil:title>Ensure Rsyslog Encrypts Off-Loaded Audit Records</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_files_groupownership_ocil:questionnaire:1">
          <ocil:title>Ensure Log Files Are Owned By Appropriate Group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_files_groupownership_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_files_ownership_ocil:questionnaire:1">
          <ocil:title>Ensure Log Files Are Owned By Appropriate User</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_files_ownership_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_files_permissions_ocil:questionnaire:1">
          <ocil:title>Ensure System Log Files Have Correct Permissions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_files_permissions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_remote_access_monitoring_ocil:questionnaire:1">
          <ocil:title>Ensure remote access methods are monitored in Rsyslog</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_remote_access_monitoring_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ensure_logrotate_activated_ocil:questionnaire:1">
          <ocil:title>Ensure Logrotate Runs Periodically</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ensure_logrotate_activated_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_syslogng_installed_ocil:questionnaire:1">
          <ocil:title>Ensure syslog-ng is Installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_syslogng_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_nolisten_ocil:questionnaire:1">
          <ocil:title>Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_nolisten_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_syslogng_enabled_ocil:questionnaire:1">
          <ocil:title>Enable syslog-ng Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_syslogng_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_remote_loghost_ocil:questionnaire:1">
          <ocil:title>Ensure Logs Sent To Remote Host</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_remote_loghost_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_remote_tls_ocil:questionnaire:1">
          <ocil:title>Configure TLS for rsyslog remote logging</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_remote_tls_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_remote_tls_cacert_ocil:questionnaire:1">
          <ocil:title>Configure CA certificate for rsyslog remote logging</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_remote_tls_cacert_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_rsyslog-gnutls_installed_ocil:questionnaire:1">
          <ocil:title>Ensure rsyslog-gnutls is installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_rsyslog-gnutls_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_rsyslog_installed_ocil:questionnaire:1">
          <ocil:title>Ensure rsyslog is Installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_rsyslog_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_rsyslog_enabled_ocil:questionnaire:1">
          <ocil:title>Enable rsyslog Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_rsyslog_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_firewalld_enabled_ocil:questionnaire:1">
          <ocil:title>Verify firewalld Enabled</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_firewalld_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-set_firewalld_default_zone_ocil:questionnaire:1">
          <ocil:title>Set Default firewalld Zone for Incoming Packets</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-set_firewalld_default_zone_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-libreswan_approved_tunnels_ocil:questionnaire:1">
          <ocil:title>Verify Any Configured IPSec Tunnel Connections</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-libreswan_approved_tunnels_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_libreswan_installed_ocil:questionnaire:1">
          <ocil:title>Install libreswan Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_libreswan_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_ip6tables_enabled_ocil:questionnaire:1">
          <ocil:title>Verify ip6tables Enabled if Using IPv6</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_ip6tables_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_iptables_enabled_ocil:questionnaire:1">
          <ocil:title>Verify iptables Enabled</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_iptables_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-set_ip6tables_default_rule_ocil:questionnaire:1">
          <ocil:title>Set Default ip6tables Policy for Incoming Packets</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-set_ip6tables_default_rule_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-set_iptables_default_rule_ocil:questionnaire:1">
          <ocil:title>Set Default iptables Policy for Incoming Packets</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-set_iptables_default_rule_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-set_iptables_default_rule_forward_ocil:questionnaire:1">
          <ocil:title>Set Default iptables Policy for Forwarded Packets</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-set_iptables_default_rule_forward_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_iptables_installed_ocil:questionnaire:1">
          <ocil:title>Install iptables Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_iptables_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_ocil:questionnaire:1">
          <ocil:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_ocil:questionnaire:1">
          <ocil:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_ocil:questionnaire:1">
          <ocil:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_autoconf_ocil:questionnaire:1">
          <ocil:title>Configure Auto Configuration on All IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_autoconf_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_max_addresses_ocil:questionnaire:1">
          <ocil:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_max_addresses_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_router_solicitations_ocil:questionnaire:1">
          <ocil:title>Configure Denying Router Solicitations on All IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_router_solicitations_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_ocil:questionnaire:1">
          <ocil:title>Disable Accepting Router Advertisements on all IPv6 Interfaces by Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_ocil:questionnaire:1">
          <ocil:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_ocil:questionnaire:1">
          <ocil:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_ocil:questionnaire:1">
          <ocil:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_autoconf_ocil:questionnaire:1">
          <ocil:title>Configure Auto Configuration on All IPv6 Interfaces By Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_autoconf_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_max_addresses_ocil:questionnaire:1">
          <ocil:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_max_addresses_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_router_solicitations_ocil:questionnaire:1">
          <ocil:title>Configure Denying Router Solicitations on All IPv6 Interfaces By Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_router_solicitations_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_ipv6_disable_argument_ocil:questionnaire:1">
          <ocil:title>Ensure IPv6 is disabled through kernel boot parameter</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_ipv6_disable_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_ipv6_option_disabled_ocil:questionnaire:1">
          <ocil:title>Disable IPv6 Networking Support Automatic Loading</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_ipv6_option_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_ocil:questionnaire:1">
          <ocil:title>Disable IPv6 Addressing on All IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_disable_ipv6_ocil:questionnaire:1">
          <ocil:title>Disable IPv6 Addressing on IPv6 Interfaces by Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_disable_ipv6_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_local_ocil:questionnaire:1">
          <ocil:title>Disable Accepting Packets Routed Between Local Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_accept_local_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_ocil:questionnaire:1">
          <ocil:title>Disable Accepting ICMP Redirects for All IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_ocil:questionnaire:1">
          <ocil:title>Configure ARP filtering for All IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_arp_ignore_ocil:questionnaire:1">
          <ocil:title>Configure Response Mode of ARP Requests for All IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_arp_ignore_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_drop_gratuitous_arp_ocil:questionnaire:1">
          <ocil:title>Drop Gratuitious ARP frames on All IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_drop_gratuitous_arp_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_route_localnet_ocil:questionnaire:1">
          <ocil:title>Prevent Routing External Traffic to Local Loopback on All IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_route_localnet_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_shared_media_ocil:questionnaire:1">
          <ocil:title>Configure Sending and Accepting Shared Media Redirects for All IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_shared_media_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_ocil:questionnaire:1">
          <ocil:title>Configure Kernel Parameter for Accepting Secure Redirects By Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_shared_media_ocil:questionnaire:1">
          <ocil:title>Configure Sending and Accepting Shared Media Redirects by Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_shared_media_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_ip_local_port_range_ocil:questionnaire:1">
          <ocil:title>Set Kernel Parameter to Increase Local Port Range</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_ip_local_port_range_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_tcp_syncookies_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_tcp_syncookies_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_ip_forward_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_ip_forward_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_atm_disabled_ocil:questionnaire:1">
          <ocil:title>Disable ATM Support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_atm_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_can_disabled_ocil:questionnaire:1">
          <ocil:title>Disable CAN Support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_can_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_dccp_disabled_ocil:questionnaire:1">
          <ocil:title>Disable DCCP Support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_dccp_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_firewire-core_disabled_ocil:questionnaire:1">
          <ocil:title>Disable IEEE 1394 (FireWire) Support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_firewire-core_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_rds_disabled_ocil:questionnaire:1">
          <ocil:title>Disable RDS Support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_rds_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_tipc_disabled_ocil:questionnaire:1">
          <ocil:title>Disable TIPC Support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_tipc_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_bluetooth_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Bluetooth Kernel Module</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_bluetooth_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_cfg80211_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Kernel cfg80211 Module</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_cfg80211_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_iwlmvm_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Kernel iwlmvm Module</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_iwlmvm_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_iwlwifi_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Kernel iwlwifi Module</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_iwlwifi_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_mac80211_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Kernel mac80211 Module</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_mac80211_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_bluetooth_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Bluetooth Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_bluetooth_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-wireless_disable_interfaces_ocil:questionnaire:1">
          <ocil:title>Deactivate Wireless Network Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-wireless_disable_interfaces_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-network_nmcli_permissions_ocil:questionnaire:1">
          <ocil:title>Prevent non-Privileged Users from Modifying Network Interfaces using nmcli</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-network_nmcli_permissions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-network_sniffer_disabled_ocil:questionnaire:1">
          <ocil:title>Ensure System is Not Acting as a Network Sniffer</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-network_sniffer_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_backup_etc_group_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns Backup group File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_backup_etc_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_backup_etc_gshadow_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns Backup gshadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_backup_etc_gshadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_backup_etc_passwd_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns Backup passwd File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_backup_etc_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_backup_etc_shadow_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns Backup shadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_backup_etc_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_etc_group_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns group File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_etc_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_etc_gshadow_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns gshadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_etc_gshadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_etc_passwd_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns passwd File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_etc_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_etc_shadow_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns shadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_etc_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_backup_etc_group_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns Backup group File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_backup_etc_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_backup_etc_gshadow_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns Backup gshadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_backup_etc_gshadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_backup_etc_passwd_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns Backup passwd File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_backup_etc_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_backup_etc_shadow_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns Backup shadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_backup_etc_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_etc_group_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns group File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_etc_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_etc_gshadow_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns gshadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_etc_gshadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_etc_passwd_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns passwd File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_etc_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_etc_shadow_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns shadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_etc_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_backup_etc_group_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on Backup group File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_backup_etc_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_backup_etc_gshadow_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on Backup gshadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_backup_etc_gshadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_backup_etc_passwd_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on Backup passwd File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_backup_etc_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_backup_etc_shadow_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on Backup shadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_backup_etc_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_group_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on group File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_gshadow_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on gshadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_gshadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_passwd_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on passwd File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_shadow_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on shadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_var_log_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns /var/log Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_var_log_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_var_log_messages_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns /var/log/messages File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_var_log_messages_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_var_log_syslog_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns /var/log/syslog File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_var_log_syslog_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_var_log_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns /var/log Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_var_log_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_var_log_messages_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns /var/log/messages File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_var_log_messages_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_var_log_syslog_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns /var/log/syslog File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_var_log_syslog_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_var_log_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on /var/log Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_var_log_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_var_log_messages_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on /var/log/messages File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_var_log_messages_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_var_log_syslog_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on /var/log/syslog File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_var_log_syslog_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_group_ownership_library_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that Shared Library Directories Have Root Group Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_group_ownership_library_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_ownership_binary_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that System Executable Have Root Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_ownership_binary_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_ownership_library_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that Shared Library Directories Have Root Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_ownership_library_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_permissions_binary_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that System Executable Directories Have Restrictive Permissions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_permissions_binary_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_permissions_library_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that Shared Library Directories Have Restrictive Permissions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_permissions_library_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupownership_system_commands_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that system commands files are group owned by root</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupownership_system_commands_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_ownership_binary_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that System Executables Have Root Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_ownership_binary_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_ownership_library_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that Shared Library Files Have Root Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_ownership_library_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_binary_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that System Executables Have Restrictive Permissions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_binary_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_library_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that Shared Library Files Have Restrictive Permissions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_library_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-root_permissions_syslibrary_files_ocil:questionnaire:1">
          <ocil:title>Verify the system-wide library files in directories
"/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are group-owned by root.</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-root_permissions_syslibrary_files_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_perms_world_writable_root_owned_ocil:questionnaire:1">
          <ocil:title>Ensure All World-Writable Directories Are Owned by root user</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_perms_world_writable_root_owned_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_perms_world_writable_sticky_bits_ocil:questionnaire:1">
          <ocil:title>Verify that All World-Writable Directories Have Sticky Bits Set</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_perms_world_writable_sticky_bits_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_perms_world_writable_system_owned_ocil:questionnaire:1">
          <ocil:title>Ensure All World-Writable Directories Are Owned by a System Account</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_perms_world_writable_system_owned_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_perms_world_writable_system_owned_group_ocil:questionnaire:1">
          <ocil:title>Ensure All World-Writable Directories Are Group Owned by a System Account</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_perms_world_writable_system_owned_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_audit_auditd_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on /etc/audit/auditd.conf</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_audit_auditd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_audit_rulesd_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on /etc/audit/rules.d/*.rules</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_audit_rulesd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_systemmap_ocil:questionnaire:1">
          <ocil:title>Verify that local System.map file (if exists) is readable only by root</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_systemmap_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_unauthorized_sgid_ocil:questionnaire:1">
          <ocil:title>Ensure All SGID Executables Are Authorized</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_unauthorized_sgid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_unauthorized_suid_ocil:questionnaire:1">
          <ocil:title>Ensure All SUID Executables Are Authorized</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_unauthorized_suid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_unauthorized_world_writable_ocil:questionnaire:1">
          <ocil:title>Ensure No World-Writable Files Exist</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_unauthorized_world_writable_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_ungroupowned_ocil:questionnaire:1">
          <ocil:title>Ensure All Files Are Owned by a Group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_ungroupowned_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_files_unowned_by_user_ocil:questionnaire:1">
          <ocil:title>Ensure All Files Are Owned by a User</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_files_unowned_by_user_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_fs_protected_fifos_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Enforce DAC on FIFOs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_fs_protected_fifos_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_fs_protected_hardlinks_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Enforce DAC on Hardlinks</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_fs_protected_hardlinks_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_fs_protected_regular_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Enforce DAC on Regular files</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_fs_protected_regular_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_fs_protected_symlinks_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Enforce DAC on Symlinks</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_fs_protected_symlinks_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_cramfs_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Mounting of cramfs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_cramfs_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_usb-storage_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Modprobe Loading of USB Storage Driver</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_usb-storage_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_autofs_disabled_ocil:questionnaire:1">
          <ocil:title>Disable the Automounter</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_autofs_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_boot_noauto_ocil:questionnaire:1">
          <ocil:title>Add noauto Option to /boot</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_boot_noauto_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_boot_nodev_ocil:questionnaire:1">
          <ocil:title>Add nodev Option to /boot</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_boot_nodev_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_boot_noexec_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to /boot</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_boot_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_boot_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /boot</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_boot_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_dev_shm_nodev_ocil:questionnaire:1">
          <ocil:title>Add nodev Option to /dev/shm</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_dev_shm_nodev_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_dev_shm_noexec_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to /dev/shm</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_dev_shm_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_dev_shm_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /dev/shm</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_dev_shm_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_home_noexec_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to /home</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_home_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_nodev_nonroot_local_partitions_ocil:questionnaire:1">
          <ocil:title>Add nodev Option to Non-Root Local Partitions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_nodev_nonroot_local_partitions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_noexec_removable_partitions_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to Removable Media Partitions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_noexec_removable_partitions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_opt_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /opt</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_opt_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_proc_hidepid_ocil:questionnaire:1">
          <ocil:title>Add hidepid Option to /proc</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_proc_hidepid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_srv_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /srv</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_srv_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_tmp_nodev_ocil:questionnaire:1">
          <ocil:title>Add nodev Option to /tmp</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_tmp_nodev_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_tmp_noexec_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to /tmp</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_tmp_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_tmp_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /tmp</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_tmp_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_log_audit_nodev_ocil:questionnaire:1">
          <ocil:title>Add nodev Option to /var/log/audit</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_log_audit_nodev_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_log_audit_noexec_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to /var/log/audit</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_log_audit_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_log_audit_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /var/log/audit</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_log_audit_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_log_nodev_ocil:questionnaire:1">
          <ocil:title>Add nodev Option to /var/log</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_log_nodev_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_log_noexec_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to /var/log</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_log_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_log_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /var/log</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_log_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_nodev_ocil:questionnaire:1">
          <ocil:title>Add nodev Option to /var</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_nodev_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_noexec_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to /var</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /var</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-coredump_disable_backtraces_ocil:questionnaire:1">
          <ocil:title>Disable core dump backtraces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-coredump_disable_backtraces_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-coredump_disable_storage_ocil:questionnaire:1">
          <ocil:title>Disable storing core dump</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-coredump_disable_storage_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-disable_users_coredumps_ocil:questionnaire:1">
          <ocil:title>Disable Core Dumps for All Users</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-disable_users_coredumps_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_systemd-coredump_disabled_ocil:questionnaire:1">
          <ocil:title>Disable acquiring, saving, and processing core dumps</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_systemd-coredump_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_fs_suid_dumpable_ocil:questionnaire:1">
          <ocil:title>Disable Core Dumps for SUID programs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_fs_suid_dumpable_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-umask_for_daemons_ocil:questionnaire:1">
          <ocil:title>Set Daemon Umask</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-umask_for_daemons_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_exec_shield_ocil:questionnaire:1">
          <ocil:title>Enable ExecShield via sysctl</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_exec_shield_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_kptr_restrict_ocil:questionnaire:1">
          <ocil:title>Restrict Exposed Kernel Pointer Addresses Access</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_kptr_restrict_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_randomize_va_space_ocil:questionnaire:1">
          <ocil:title>Enable Randomized Layout of Virtual Address Space</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_randomize_va_space_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-bios_enable_execution_restrictions_ocil:questionnaire:1">
          <ocil:title>Enable NX or XD Support in the BIOS</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-bios_enable_execution_restrictions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_page_poison_argument_ocil:questionnaire:1">
          <ocil:title>Enable page allocator poisoning</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_page_poison_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_slub_debug_argument_ocil:questionnaire:1">
          <ocil:title>Enable SLUB/SLAB allocator poisoning</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_slub_debug_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_core_pattern_ocil:questionnaire:1">
          <ocil:title>Disable storing core dumps</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_core_pattern_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_dmesg_restrict_ocil:questionnaire:1">
          <ocil:title>Restrict Access to Kernel Message Buffer</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_dmesg_restrict_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_kexec_load_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Image Loading</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_kexec_load_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_modules_disabled_ocil:questionnaire:1">
          <ocil:title>Disable loading and unloading of kernel modules</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_modules_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_panic_on_oops_ocil:questionnaire:1">
          <ocil:title>Kernel panic on oops</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_panic_on_oops_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_perf_cpu_time_max_percent_ocil:questionnaire:1">
          <ocil:title>Limit CPU consumption of the Perf system</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_perf_cpu_time_max_percent_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_perf_event_max_sample_rate_ocil:questionnaire:1">
          <ocil:title>Limit sampling frequency of the Perf system</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_perf_event_max_sample_rate_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_perf_event_paranoid_ocil:questionnaire:1">
          <ocil:title>Disallow kernel profiling by unprivileged users</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_perf_event_paranoid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_pid_max_ocil:questionnaire:1">
          <ocil:title>Configure maximum number of process identifiers</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_pid_max_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_sysrq_ocil:questionnaire:1">
          <ocil:title>Disallow magic SysRq key</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_sysrq_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Access to Network bpf() Syscall From Unprivileged Processes</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_yama_ptrace_scope_ocil:questionnaire:1">
          <ocil:title>Restrict usage of ptrace to descendant processes</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_yama_ptrace_scope_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_core_bpf_jit_harden_ocil:questionnaire:1">
          <ocil:title>Harden the operation of the BPF just-in-time compiler</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_core_bpf_jit_harden_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_user_max_user_namespaces_ocil:questionnaire:1">
          <ocil:title>Disable the use of user namespaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_user_max_user_namespaces_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_vm_mmap_min_addr_ocil:questionnaire:1">
          <ocil:title>Prevent applications from mapping low portion of virtual memory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_vm_mmap_min_addr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-coreos_enable_selinux_kernel_argument_ocil:questionnaire:1">
          <ocil:title>Ensure SELinux Not Disabled in the kernel arguments</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-coreos_enable_selinux_kernel_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_enable_selinux_ocil:questionnaire:1">
          <ocil:title>Ensure SELinux Not Disabled in /etc/default/grub</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_enable_selinux_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_libselinux_installed_ocil:questionnaire:1">
          <ocil:title>Install libselinux Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_libselinux_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_policycoreutils_installed_ocil:questionnaire:1">
          <ocil:title>Install policycoreutils Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_policycoreutils_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_setroubleshoot-plugins_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall setroubleshoot-plugins Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_setroubleshoot-plugins_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_setroubleshoot-server_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall setroubleshoot-server Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_setroubleshoot-server_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-selinux_all_devicefiles_labeled_ocil:questionnaire:1">
          <ocil:title>Ensure No Device Files are Unlabeled by SELinux</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-selinux_all_devicefiles_labeled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-selinux_confinement_of_daemons_ocil:questionnaire:1">
          <ocil:title>Ensure No Daemons are Unconfined by SELinux</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-selinux_confinement_of_daemons_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-selinux_policytype_ocil:questionnaire:1">
          <ocil:title>Configure SELinux Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-selinux_policytype_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-selinux_state_ocil:questionnaire:1">
          <ocil:title>Ensure SELinux State is Enforcing</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-selinux_state_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-encrypt_partitions_ocil:questionnaire:1">
          <ocil:title>Encrypt Partitions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-encrypt_partitions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_boot_ocil:questionnaire:1">
          <ocil:title>Ensure /boot Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_boot_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_home_ocil:questionnaire:1">
          <ocil:title>Ensure /home Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_home_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_opt_ocil:questionnaire:1">
          <ocil:title>Ensure /opt Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_opt_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_srv_ocil:questionnaire:1">
          <ocil:title>Ensure /srv Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_srv_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_tmp_ocil:questionnaire:1">
          <ocil:title>Ensure /tmp Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_tmp_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_usr_ocil:questionnaire:1">
          <ocil:title>Ensure /usr Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_usr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_var_ocil:questionnaire:1">
          <ocil:title>Ensure /var Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_var_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_var_log_ocil:questionnaire:1">
          <ocil:title>Ensure /var/log Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_var_log_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_var_log_audit_ocil:questionnaire:1">
          <ocil:title>Ensure /var/log/audit Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_var_log_audit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_restart_shutdown_ocil:questionnaire:1">
          <ocil:title>Disable the GNOME3 Login Restart and Shutdown Buttons</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_restart_shutdown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_user_list_ocil:questionnaire:1">
          <ocil:title>Disable the GNOME3 Login User List</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_user_list_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_enable_smartcard_auth_ocil:questionnaire:1">
          <ocil:title>Enable the GNOME3 Login Smartcard Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_enable_smartcard_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_lock_screen_on_smartcard_removal_ocil:questionnaire:1">
          <ocil:title>Enable the GNOME3 Screen Locking On Smartcard Removal</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_lock_screen_on_smartcard_removal_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_login_retries_ocil:questionnaire:1">
          <ocil:title>Set the GNOME3 Login Number of Failures</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_login_retries_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-gnome_gdm_disable_automatic_login_ocil:questionnaire:1">
          <ocil:title>Disable GDM Automatic Login</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-gnome_gdm_disable_automatic_login_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-gnome_gdm_disable_guest_login_ocil:questionnaire:1">
          <ocil:title>Disable GDM Guest Login</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-gnome_gdm_disable_guest_login_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-gnome_gdm_disable_xdmcp_ocil:questionnaire:1">
          <ocil:title>Disable XDMCP in GDM</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-gnome_gdm_disable_xdmcp_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_automount_ocil:questionnaire:1">
          <ocil:title>Disable GNOME3 Automounting</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_automount_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_automount_open_ocil:questionnaire:1">
          <ocil:title>Disable GNOME3 Automount Opening</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_automount_open_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_autorun_ocil:questionnaire:1">
          <ocil:title>Disable GNOME3 Automount running</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_autorun_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_thumbnailers_ocil:questionnaire:1">
          <ocil:title>Disable All GNOME3 Thumbnailers</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_thumbnailers_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_wifi_create_ocil:questionnaire:1">
          <ocil:title>Disable WIFI Network Connection Creation in GNOME3</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_wifi_create_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_wifi_notification_ocil:questionnaire:1">
          <ocil:title>Disable WIFI Network Notification in GNOME3</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_wifi_notification_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_remote_access_credential_prompt_ocil:questionnaire:1">
          <ocil:title>Require Credential Prompting for Remote Access in GNOME3</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_remote_access_credential_prompt_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_remote_access_encryption_ocil:questionnaire:1">
          <ocil:title>Require Encryption for Remote Access in GNOME3</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_remote_access_encryption_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_screensaver_idle_activation_enabled_ocil:questionnaire:1">
          <ocil:title>Enable GNOME3 Screensaver Idle Activation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_screensaver_idle_activation_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_screensaver_idle_activation_locked_ocil:questionnaire:1">
          <ocil:title>Ensure Users Cannot Change GNOME3 Screensaver Idle Activation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_screensaver_idle_activation_locked_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_screensaver_idle_delay_ocil:questionnaire:1">
          <ocil:title>Set GNOME3 Screensaver Inactivity Timeout</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_screensaver_idle_delay_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_screensaver_lock_delay_ocil:questionnaire:1">
          <ocil:title>Set GNOME3 Screensaver Lock Delay After Activation Period</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_screensaver_lock_delay_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_screensaver_lock_enabled_ocil:questionnaire:1">
          <ocil:title>Enable GNOME3 Screensaver Lock After Idle Period</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_screensaver_lock_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_screensaver_lock_locked_ocil:questionnaire:1">
          <ocil:title>Ensure Users Cannot Change GNOME3 Screensaver Lock After Idle Period</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_screensaver_lock_locked_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_screensaver_mode_blank_ocil:questionnaire:1">
          <ocil:title>Implement Blank Screensaver</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_screensaver_mode_blank_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_screensaver_user_info_ocil:questionnaire:1">
          <ocil:title>Disable Full User Name on Splash Shield</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_screensaver_user_info_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_screensaver_user_locks_ocil:questionnaire:1">
          <ocil:title>Ensure Users Cannot Change GNOME3 Screensaver Settings</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_screensaver_user_locks_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_session_idle_user_locks_ocil:questionnaire:1">
          <ocil:title>Ensure Users Cannot Change GNOME3 Session Idle Settings</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_session_idle_user_locks_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_ctrlaltdel_reboot_ocil:questionnaire:1">
          <ocil:title>Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_ctrlaltdel_reboot_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_geolocation_ocil:questionnaire:1">
          <ocil:title>Disable Geolocation in GNOME3</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_geolocation_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_power_settings_ocil:questionnaire:1">
          <ocil:title>Disable Power Settings in GNOME3</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_power_settings_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_user_admin_ocil:questionnaire:1">
          <ocil:title>Disable User Administration in GNOME3</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_user_admin_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_db_up_to_date_ocil:questionnaire:1">
          <ocil:title>Make sure that the dconf databases are up-to-date with regards to respective keyfiles</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_db_up_to_date_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-enable_dconf_user_profile_ocil:questionnaire:1">
          <ocil:title>Configure GNOME3 DConf User Profile</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-enable_dconf_user_profile_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_gdm_removed_ocil:questionnaire:1">
          <ocil:title>Remove the GDM Package Group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_gdm_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-installed_OS_is_FIPS_certified_ocil:questionnaire:1">
          <ocil:title>The Installed Operating System Is FIPS 140-2 Certified</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-installed_OS_is_FIPS_certified_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-installed_OS_is_vendor_supported_ocil:questionnaire:1">
          <ocil:title>The Installed Operating System Is Vendor Supported</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-installed_OS_is_vendor_supported_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_bind_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure BIND to use System Crypto Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_bind_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure System Cryptography Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_gnutls_tls_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure GnuTLS library to use DoD-approved TLS Encryption</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_gnutls_tls_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_kerberos_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure Kerberos to use System Crypto Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_kerberos_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_libreswan_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure Libreswan to use System Crypto Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_libreswan_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_openssl_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure OpenSSL library to use System Crypto Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_openssl_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_ssh_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure SSH to use System Crypto Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_ssh_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-harden_ssh_client_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Harden SSH client Crypto Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-harden_ssh_client_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure SSH Client to Use FIPS 140-2 Validated Ciphers: openssh.config</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-harden_sshd_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Harden SSHD Crypto Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-harden_sshd_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-harden_sshd_macs_openssh_conf_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure SSH Client to Use FIPS 140-2 Validated MACs: openssh.config</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-harden_sshd_macs_openssh_conf_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_MFEhiplsm_installed_ocil:questionnaire:1">
          <ocil:title>Install the Host Intrusion Prevention System (HIPS) Module</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_MFEhiplsm_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_user_data_backups_ocil:questionnaire:1">
          <ocil:title>Configure Backups of User Data</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_user_data_backups_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-install_antivirus_ocil:questionnaire:1">
          <ocil:title>Install Virus Scanning Software</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-install_antivirus_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-install_hids_ocil:questionnaire:1">
          <ocil:title>Install Intrusion Detection Software</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-install_hids_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-enable_dracut_fips_module_ocil:questionnaire:1">
          <ocil:title>Enable Dracut FIPS Module</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-enable_dracut_fips_module_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-enable_fips_mode_ocil:questionnaire:1">
          <ocil:title>Enable FIPS Mode</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-enable_fips_mode_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-etc_system_fips_exists_ocil:questionnaire:1">
          <ocil:title>Ensure '/etc/system-fips' exists</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-etc_system_fips_exists_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_crypto_fips_enabled_ocil:questionnaire:1">
          <ocil:title>Set kernel parameter 'crypto.fips_enabled' to 1</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_crypto_fips_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-aide_build_database_ocil:questionnaire:1">
          <ocil:title>Build and Test AIDE Database</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-aide_build_database_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-aide_check_audit_tools_ocil:questionnaire:1">
          <ocil:title>Configure AIDE to Verify the Audit Tools</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-aide_check_audit_tools_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-aide_periodic_cron_checking_ocil:questionnaire:1">
          <ocil:title>Configure Periodic Execution of AIDE</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-aide_periodic_cron_checking_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_aide_installed_ocil:questionnaire:1">
          <ocil:title>Install AIDE</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_aide_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rpm_verify_hashes_ocil:questionnaire:1">
          <ocil:title>Verify File Hashes with RPM</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rpm_verify_hashes_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rpm_verify_permissions_ocil:questionnaire:1">
          <ocil:title>Verify and Correct File Permissions with RPM</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rpm_verify_permissions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_sudo_installed_ocil:questionnaire:1">
          <ocil:title>Install sudo Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_sudo_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_add_noexec_ocil:questionnaire:1">
          <ocil:title>Ensure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_add_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_add_requiretty_ocil:questionnaire:1">
          <ocil:title>Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo requiretty</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_add_requiretty_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_add_use_pty_ocil:questionnaire:1">
          <ocil:title>Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_add_use_pty_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_custom_logfile_ocil:questionnaire:1">
          <ocil:title>Ensure Sudo Logfile Exists - sudo logfile</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_custom_logfile_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_remove_no_authenticate_ocil:questionnaire:1">
          <ocil:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_remove_no_authenticate_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_remove_nopasswd_ocil:questionnaire:1">
          <ocil:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_remove_nopasswd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_require_authentication_ocil:questionnaire:1">
          <ocil:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_require_authentication_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_vdsm_nopasswd_ocil:questionnaire:1">
          <ocil:title>Only the VDSM User Can Use sudo NOPASSWD</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_vdsm_nopasswd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudoers_default_includedir_ocil:questionnaire:1">
          <ocil:title>Ensure sudo only includes the default configuration directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudoers_default_includedir_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudoers_explicit_command_args_ocil:questionnaire:1">
          <ocil:title>Explicit arguments in sudo specifications</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudoers_explicit_command_args_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudoers_no_command_negation_ocil:questionnaire:1">
          <ocil:title>Don't define allowed commands in sudoers by means of exclusion</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudoers_no_command_negation_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudoers_no_root_target_ocil:questionnaire:1">
          <ocil:title>Don't target root user in the sudoers file</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudoers_no_root_target_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudoers_validate_passwd_ocil:questionnaire:1">
          <ocil:title>Ensure invoking users password for privilege escalation when using sudo</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudoers_validate_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_abrt-addon-ccpp_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall abrt-addon-ccpp Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_abrt-addon-ccpp_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_abrt-addon-kerneloops_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall abrt-addon-kerneloops Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_abrt-addon-kerneloops_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_abrt-cli_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall abrt-cli Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_abrt-cli_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_abrt-plugin-logger_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall abrt-plugin-logger Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_abrt-plugin-logger_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_abrt-plugin-rhtsupport_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall abrt-plugin-rhtsupport Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_abrt-plugin-rhtsupport_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_abrt-plugin-sosreport_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall abrt-plugin-sosreport Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_abrt-plugin-sosreport_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_binutils_installed_ocil:questionnaire:1">
          <ocil:title>Install binutils Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_binutils_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_cryptsetup-luks_installed_ocil:questionnaire:1">
          <ocil:title>Install cryptsetup-luks Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_cryptsetup-luks_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_geolite2-city_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall geolite2-city Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_geolite2-city_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_geolite2-country_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall geolite2-country Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_geolite2-country_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_gnutls-utils_installed_ocil:questionnaire:1">
          <ocil:title>Ensure gnutls-utils is installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_gnutls-utils_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_gssproxy_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall gssproxy Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_gssproxy_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_iprutils_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall iprutils Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_iprutils_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_krb5-workstation_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall krb5-workstation Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_krb5-workstation_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_libcap-ng-utils_installed_ocil:questionnaire:1">
          <ocil:title>Install libcap-ng-utils Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_libcap-ng-utils_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_libreport-plugin-logger_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall libreport-plugin-logger Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_libreport-plugin-logger_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_libreport-plugin-rhtsupport_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall libreport-plugin-rhtsupport Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_libreport-plugin-rhtsupport_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_nss-tools_installed_ocil:questionnaire:1">
          <ocil:title>Ensure nss-tools is installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_nss-tools_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_openscap-scanner_installed_ocil:questionnaire:1">
          <ocil:title>Install openscap-scanner Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_openscap-scanner_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_python3-abrt-addon_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall python3-abrt-addon Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_python3-abrt-addon_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_rear_installed_ocil:questionnaire:1">
          <ocil:title>Install rear Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_rear_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_rng-tools_installed_ocil:questionnaire:1">
          <ocil:title>Install rng-tools Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_rng-tools_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_scap-security-guide_installed_ocil:questionnaire:1">
          <ocil:title>Install scap-security-guide Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_scap-security-guide_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_tar_installed_ocil:questionnaire:1">
          <ocil:title>Install tar Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_tar_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_tuned_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall tuned Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_tuned_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_vim_installed_ocil:questionnaire:1">
          <ocil:title>Install vim Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_vim_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-clean_components_post_updating_ocil:questionnaire:1">
          <ocil:title>Ensure dnf Removes Previous Package Versions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-clean_components_post_updating_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dnf-automatic_apply_updates_ocil:questionnaire:1">
          <ocil:title>Configure dnf-automatic to Install Available Updates Automatically</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dnf-automatic_apply_updates_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dnf-automatic_security_updates_only_ocil:questionnaire:1">
          <ocil:title>Configure dnf-automatic to Install Only Security Updates</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dnf-automatic_security_updates_only_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ensure_fedora_gpgkey_installed_ocil:questionnaire:1">
          <ocil:title>Ensure Fedora GPG Key Installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ensure_fedora_gpgkey_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ensure_gpgcheck_globally_activated_ocil:questionnaire:1">
          <ocil:title>Ensure gpgcheck Enabled In Main dnf Configuration</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ensure_gpgcheck_globally_activated_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ensure_gpgcheck_local_packages_ocil:questionnaire:1">
          <ocil:title>Ensure gpgcheck Enabled for Local Packages</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ensure_gpgcheck_local_packages_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ensure_gpgcheck_never_disabled_ocil:questionnaire:1">
          <ocil:title>Ensure gpgcheck Enabled for All dnf Package Repositories</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ensure_gpgcheck_never_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ensure_gpgcheck_repo_metadata_ocil:questionnaire:1">
          <ocil:title>Ensure gpgcheck Enabled for Repository Metadata</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ensure_gpgcheck_repo_metadata_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_dnf-automatic_installed_ocil:questionnaire:1">
          <ocil:title>Install dnf-automatic Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_dnf-automatic_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-timer_dnf-automatic_enabled_ocil:questionnaire:1">
          <ocil:title>Enable dnf-automatic Timer</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-timer_dnf-automatic_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-prefer_64bit_os_ocil:questionnaire:1">
          <ocil:title>Prefer to use a 64-bit Operating System when supported</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-prefer_64bit_os_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
      </ocil:questionnaires>
      <ocil:test_actions>
        <ocil:boolean_question_test_action id="ocil:ssg-package_abrt_removed_action:testaction:1" question_ref="ocil:ssg-package_abrt_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_at_deny_not_exist_action:testaction:1" question_ref="ocil:ssg-file_at_deny_not_exist_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_cron_deny_not_exist_action:testaction:1" question_ref="ocil:ssg-file_cron_deny_not_exist_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-disable_anacron_action:testaction:1" question_ref="ocil:ssg-disable_anacron_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_atd_disabled_action:testaction:1" question_ref="ocil:ssg-service_atd_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_cron_enabled_action:testaction:1" question_ref="ocil:ssg-service_cron_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_crond_enabled_action:testaction:1" question_ref="ocil:ssg-service_crond_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_bind_removed_action:testaction:1" question_ref="ocil:ssg-package_bind_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_fapolicyd_installed_action:testaction:1" question_ref="ocil:ssg-package_fapolicyd_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_vsftpd_removed_action:testaction:1" question_ref="ocil:ssg-package_vsftpd_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ftp_log_transactions_action:testaction:1" question_ref="ocil:ssg-ftp_log_transactions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ftp_present_banner_action:testaction:1" question_ref="ocil:ssg-ftp_present_banner_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kerberos_disable_no_keytab_action:testaction:1" question_ref="ocil:ssg-kerberos_disable_no_keytab_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_openldap-clients_removed_action:testaction:1" question_ref="ocil:ssg-package_openldap-clients_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-postfix_client_configure_mail_alias_action:testaction:1" question_ref="ocil:ssg-postfix_client_configure_mail_alias_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-postfix_client_configure_relayhost_action:testaction:1" question_ref="ocil:ssg-postfix_client_configure_relayhost_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_sendmail_removed_action:testaction:1" question_ref="ocil:ssg-package_sendmail_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-nfs_no_anonymous_action:testaction:1" question_ref="ocil:ssg-nfs_no_anonymous_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_nfs_disabled_action:testaction:1" question_ref="ocil:ssg-service_nfs_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_rpcsvcgssd_disabled_action:testaction:1" question_ref="ocil:ssg-service_rpcsvcgssd_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_all_squash_exports_action:testaction:1" question_ref="ocil:ssg-no_all_squash_exports_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_insecure_locks_exports_action:testaction:1" question_ref="ocil:ssg-no_insecure_locks_exports_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_nfs-utils_removed_action:testaction:1" question_ref="ocil:ssg-package_nfs-utils_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-chronyd_client_only_action:testaction:1" question_ref="ocil:ssg-chronyd_client_only_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-chronyd_no_chronyc_network_action:testaction:1" question_ref="ocil:ssg-chronyd_no_chronyc_network_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-chronyd_or_ntpd_set_maxpoll_action:testaction:1" question_ref="ocil:ssg-chronyd_or_ntpd_set_maxpoll_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-chronyd_or_ntpd_specify_remote_server_action:testaction:1" question_ref="ocil:ssg-chronyd_or_ntpd_specify_remote_server_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-chronyd_run_as_chrony_user_action:testaction:1" question_ref="ocil:ssg-chronyd_run_as_chrony_user_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-chronyd_server_directive_action:testaction:1" question_ref="ocil:ssg-chronyd_server_directive_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-chronyd_specify_remote_server_action:testaction:1" question_ref="ocil:ssg-chronyd_specify_remote_server_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ntpd_configure_restrictions_action:testaction:1" question_ref="ocil:ssg-ntpd_configure_restrictions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ntpd_run_as_ntp_user_action:testaction:1" question_ref="ocil:ssg-ntpd_run_as_ntp_user_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ntpd_specify_remote_server_action:testaction:1" question_ref="ocil:ssg-ntpd_specify_remote_server_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_chrony_installed_action:testaction:1" question_ref="ocil:ssg-package_chrony_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_ntp_installed_action:testaction:1" question_ref="ocil:ssg-package_ntp_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_chronyd_enabled_action:testaction:1" question_ref="ocil:ssg-service_chronyd_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_chronyd_or_ntpd_enabled_action:testaction:1" question_ref="ocil:ssg-service_chronyd_or_ntpd_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_ntp_enabled_action:testaction:1" question_ref="ocil:ssg-service_ntp_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_ntpd_enabled_action:testaction:1" question_ref="ocil:ssg-service_ntpd_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_rsh_trust_files_action:testaction:1" question_ref="ocil:ssg-no_rsh_trust_files_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_rsyncd_disabled_action:testaction:1" question_ref="ocil:ssg-service_rsyncd_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_rngd_enabled_action:testaction:1" question_ref="ocil:ssg-service_rngd_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_net-snmp_removed_action:testaction:1" question_ref="ocil:ssg-package_net-snmp_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-snmpd_no_rwusers_action:testaction:1" question_ref="ocil:ssg-snmpd_no_rwusers_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-snmpd_not_default_password_action:testaction:1" question_ref="ocil:ssg-snmpd_not_default_password_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-snmpd_use_newer_protocol_action:testaction:1" question_ref="ocil:ssg-snmpd_use_newer_protocol_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-disable_host_auth_action:testaction:1" question_ref="ocil:ssg-disable_host_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_allow_only_protocol2_action:testaction:1" question_ref="ocil:ssg-sshd_allow_only_protocol2_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_compression_action:testaction:1" question_ref="ocil:ssg-sshd_disable_compression_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_empty_passwords_action:testaction:1" question_ref="ocil:ssg-sshd_disable_empty_passwords_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_gssapi_auth_action:testaction:1" question_ref="ocil:ssg-sshd_disable_gssapi_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_kerb_auth_action:testaction:1" question_ref="ocil:ssg-sshd_disable_kerb_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_pubkey_auth_action:testaction:1" question_ref="ocil:ssg-sshd_disable_pubkey_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_rhosts_action:testaction:1" question_ref="ocil:ssg-sshd_disable_rhosts_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_rhosts_rsa_action:testaction:1" question_ref="ocil:ssg-sshd_disable_rhosts_rsa_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_root_login_action:testaction:1" question_ref="ocil:ssg-sshd_disable_root_login_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_root_password_login_action:testaction:1" question_ref="ocil:ssg-sshd_disable_root_password_login_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_tcp_forwarding_action:testaction:1" question_ref="ocil:ssg-sshd_disable_tcp_forwarding_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_user_known_hosts_action:testaction:1" question_ref="ocil:ssg-sshd_disable_user_known_hosts_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_x11_forwarding_action:testaction:1" question_ref="ocil:ssg-sshd_disable_x11_forwarding_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_do_not_permit_user_env_action:testaction:1" question_ref="ocil:ssg-sshd_do_not_permit_user_env_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_enable_gssapi_auth_action:testaction:1" question_ref="ocil:ssg-sshd_enable_gssapi_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_enable_pam_action:testaction:1" question_ref="ocil:ssg-sshd_enable_pam_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_enable_pubkey_auth_action:testaction:1" question_ref="ocil:ssg-sshd_enable_pubkey_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_enable_strictmodes_action:testaction:1" question_ref="ocil:ssg-sshd_enable_strictmodes_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_enable_warning_banner_action:testaction:1" question_ref="ocil:ssg-sshd_enable_warning_banner_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_enable_warning_banner_net_action:testaction:1" question_ref="ocil:ssg-sshd_enable_warning_banner_net_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_enable_x11_forwarding_action:testaction:1" question_ref="ocil:ssg-sshd_enable_x11_forwarding_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_limit_user_access_action:testaction:1" question_ref="ocil:ssg-sshd_limit_user_access_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_print_last_log_action:testaction:1" question_ref="ocil:ssg-sshd_print_last_log_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_rekey_limit_action:testaction:1" question_ref="ocil:ssg-sshd_rekey_limit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_idle_timeout_action:testaction:1" question_ref="ocil:ssg-sshd_set_idle_timeout_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_keepalive_action:testaction:1" question_ref="ocil:ssg-sshd_set_keepalive_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_keepalive_0_action:testaction:1" question_ref="ocil:ssg-sshd_set_keepalive_0_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_login_grace_time_action:testaction:1" question_ref="ocil:ssg-sshd_set_login_grace_time_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_loglevel_info_action:testaction:1" question_ref="ocil:ssg-sshd_set_loglevel_info_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_loglevel_verbose_action:testaction:1" question_ref="ocil:ssg-sshd_set_loglevel_verbose_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_max_auth_tries_action:testaction:1" question_ref="ocil:ssg-sshd_set_max_auth_tries_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_max_sessions_action:testaction:1" question_ref="ocil:ssg-sshd_set_max_sessions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_maxstartups_action:testaction:1" question_ref="ocil:ssg-sshd_set_maxstartups_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_use_directory_configuration_action:testaction:1" question_ref="ocil:ssg-sshd_use_directory_configuration_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_use_priv_separation_action:testaction:1" question_ref="ocil:ssg-sshd_use_priv_separation_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_x11_use_localhost_action:testaction:1" question_ref="ocil:ssg-sshd_x11_use_localhost_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_sshd_private_key_action:testaction:1" question_ref="ocil:ssg-file_permissions_sshd_private_key_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_sshd_pub_key_action:testaction:1" question_ref="ocil:ssg-file_permissions_sshd_pub_key_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_openssh-server_installed_action:testaction:1" question_ref="ocil:ssg-package_openssh-server_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_openssh-server_removed_action:testaction:1" question_ref="ocil:ssg-package_openssh-server_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_sssd-ipa_installed_action:testaction:1" question_ref="ocil:ssg-package_sssd-ipa_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sssd_certificate_verification_action:testaction:1" question_ref="ocil:ssg-sssd_certificate_verification_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sssd_enable_certmap_action:testaction:1" question_ref="ocil:ssg-sssd_enable_certmap_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sssd_enable_smartcards_action:testaction:1" question_ref="ocil:ssg-sssd_enable_smartcards_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sssd_memcache_timeout_action:testaction:1" question_ref="ocil:ssg-sssd_memcache_timeout_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sssd_offline_cred_expiration_action:testaction:1" question_ref="ocil:ssg-sssd_offline_cred_expiration_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sssd_run_as_sssd_user_action:testaction:1" question_ref="ocil:ssg-sssd_run_as_sssd_user_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sssd_ssh_known_hosts_timeout_action:testaction:1" question_ref="ocil:ssg-sssd_ssh_known_hosts_timeout_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_usbguard_auditbackend_action:testaction:1" question_ref="ocil:ssg-configure_usbguard_auditbackend_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_usbguard_installed_action:testaction:1" question_ref="ocil:ssg-package_usbguard_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_usbguard_enabled_action:testaction:1" question_ref="ocil:ssg-service_usbguard_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-usbguard_allow_hid_action:testaction:1" question_ref="ocil:ssg-usbguard_allow_hid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-usbguard_allow_hid_and_hub_action:testaction:1" question_ref="ocil:ssg-usbguard_allow_hid_and_hub_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-usbguard_allow_hub_action:testaction:1" question_ref="ocil:ssg-usbguard_allow_hub_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_xorg-x11-server-common_removed_action:testaction:1" question_ref="ocil:ssg-package_xorg-x11-server-common_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-xwindows_runlevel_target_action:testaction:1" question_ref="ocil:ssg-xwindows_runlevel_target_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_banner_enabled_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_banner_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_login_banner_text_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_login_banner_text_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-banner_etc_issue_action:testaction:1" question_ref="ocil:ssg-banner_etc_issue_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-banner_etc_motd_action:testaction:1" question_ref="ocil:ssg-banner_etc_motd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_issue_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_issue_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_motd_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_motd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_etc_issue_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_issue_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_etc_motd_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_motd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_issue_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_issue_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_motd_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_motd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_pwhistory_remember_password_auth_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_pwhistory_remember_password_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_pwhistory_remember_system_auth_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_pwhistory_remember_system_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_unix_remember_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_unix_remember_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_passwords_pam_faillock_deny_action:testaction:1" question_ref="ocil:ssg-accounts_passwords_pam_faillock_deny_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_passwords_pam_faillock_deny_root_action:testaction:1" question_ref="ocil:ssg-accounts_passwords_pam_faillock_deny_root_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_passwords_pam_faillock_enforce_local_action:testaction:1" question_ref="ocil:ssg-accounts_passwords_pam_faillock_enforce_local_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_passwords_pam_faillock_interval_action:testaction:1" question_ref="ocil:ssg-accounts_passwords_pam_faillock_interval_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_action:testaction:1" question_ref="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_dcredit_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_dcredit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_dictcheck_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_dictcheck_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_difok_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_difok_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_enforce_local_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_enforce_local_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_enforce_root_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_enforce_root_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_lcredit_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_lcredit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_maxclassrepeat_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_maxclassrepeat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_maxrepeat_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_maxrepeat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_minclass_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_minclass_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_minlen_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_minlen_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_ocredit_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_ocredit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_pwquality_password_auth_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_pwquality_password_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_pwquality_system_auth_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_pwquality_system_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_retry_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_retry_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_ucredit_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_ucredit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-set_password_hashing_algorithm_libuserconf_action:testaction:1" question_ref="ocil:ssg-set_password_hashing_algorithm_libuserconf_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-set_password_hashing_algorithm_logindefs_action:testaction:1" question_ref="ocil:ssg-set_password_hashing_algorithm_logindefs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-set_password_hashing_algorithm_passwordauth_action:testaction:1" question_ref="ocil:ssg-set_password_hashing_algorithm_passwordauth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-set_password_hashing_algorithm_systemauth_action:testaction:1" question_ref="ocil:ssg-set_password_hashing_algorithm_systemauth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-disallow_bypass_password_sudo_action:testaction:1" question_ref="ocil:ssg-disallow_bypass_password_sudo_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-display_login_attempts_action:testaction:1" question_ref="ocil:ssg-display_login_attempts_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-enable_pam_namespace_action:testaction:1" question_ref="ocil:ssg-enable_pam_namespace_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_bashrc_exec_tmux_action:testaction:1" question_ref="ocil:ssg-configure_bashrc_exec_tmux_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_tmux_lock_after_time_action:testaction:1" question_ref="ocil:ssg-configure_tmux_lock_after_time_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_tmux_lock_command_action:testaction:1" question_ref="ocil:ssg-configure_tmux_lock_command_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_tmux_in_shells_action:testaction:1" question_ref="ocil:ssg-no_tmux_in_shells_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_screen_installed_action:testaction:1" question_ref="ocil:ssg-package_screen_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_tmux_installed_action:testaction:1" question_ref="ocil:ssg-package_tmux_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_opensc_card_drivers_action:testaction:1" question_ref="ocil:ssg-configure_opensc_card_drivers_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_opensc_nss_db_action:testaction:1" question_ref="ocil:ssg-configure_opensc_nss_db_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-force_opensc_card_drivers_action:testaction:1" question_ref="ocil:ssg-force_opensc_card_drivers_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-install_smartcard_packages_action:testaction:1" question_ref="ocil:ssg-install_smartcard_packages_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_opensc_installed_action:testaction:1" question_ref="ocil:ssg-package_opensc_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_pcsc-lite_installed_action:testaction:1" question_ref="ocil:ssg-package_pcsc-lite_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_pcscd_enabled_action:testaction:1" question_ref="ocil:ssg-service_pcscd_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-smartcard_auth_action:testaction:1" question_ref="ocil:ssg-smartcard_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-disable_ctrlaltdel_reboot_action:testaction:1" question_ref="ocil:ssg-disable_ctrlaltdel_reboot_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_disable_interactive_boot_action:testaction:1" question_ref="ocil:ssg-grub2_disable_interactive_boot_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-require_emergency_target_auth_action:testaction:1" question_ref="ocil:ssg-require_emergency_target_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-require_singleuser_auth_action:testaction:1" question_ref="ocil:ssg-require_singleuser_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_debug-shell_disabled_action:testaction:1" question_ref="ocil:ssg-service_debug-shell_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-account_disable_post_pw_expiration_action:testaction:1" question_ref="ocil:ssg-account_disable_post_pw_expiration_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-account_emergency_expire_date_action:testaction:1" question_ref="ocil:ssg-account_emergency_expire_date_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-account_temp_expire_date_action:testaction:1" question_ref="ocil:ssg-account_temp_expire_date_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-account_unique_name_action:testaction:1" question_ref="ocil:ssg-account_unique_name_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-account_use_centralized_automated_auth_action:testaction:1" question_ref="ocil:ssg-account_use_centralized_automated_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_maximum_age_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_maximum_age_login_defs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_minimum_age_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_minimum_age_login_defs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_minlen_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_password_minlen_login_defs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_warn_age_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_password_warn_age_login_defs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_all_shadowed_action:testaction:1" question_ref="ocil:ssg-accounts_password_all_shadowed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_all_shadowed_sha512_action:testaction:1" question_ref="ocil:ssg-accounts_password_all_shadowed_sha512_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_unix_rounds_password_auth_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_unix_rounds_password_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_unix_rounds_system_auth_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_unix_rounds_system_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-gid_passwd_group_same_action:testaction:1" question_ref="ocil:ssg-gid_passwd_group_same_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_empty_passwords_action:testaction:1" question_ref="ocil:ssg-no_empty_passwords_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_empty_passwords_etc_shadow_action:testaction:1" question_ref="ocil:ssg-no_empty_passwords_etc_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_legacy_plus_entries_etc_group_action:testaction:1" question_ref="ocil:ssg-no_legacy_plus_entries_etc_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_legacy_plus_entries_etc_passwd_action:testaction:1" question_ref="ocil:ssg-no_legacy_plus_entries_etc_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_legacy_plus_entries_etc_shadow_action:testaction:1" question_ref="ocil:ssg-no_legacy_plus_entries_etc_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_netrc_files_action:testaction:1" question_ref="ocil:ssg-no_netrc_files_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_no_uid_except_zero_action:testaction:1" question_ref="ocil:ssg-accounts_no_uid_except_zero_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_root_gid_zero_action:testaction:1" question_ref="ocil:ssg-accounts_root_gid_zero_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_direct_root_logins_action:testaction:1" question_ref="ocil:ssg-no_direct_root_logins_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_password_auth_for_systemaccounts_action:testaction:1" question_ref="ocil:ssg-no_password_auth_for_systemaccounts_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_root_webbrowsing_action:testaction:1" question_ref="ocil:ssg-no_root_webbrowsing_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_shelllogin_for_systemaccounts_action:testaction:1" question_ref="ocil:ssg-no_shelllogin_for_systemaccounts_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-restrict_serial_port_logins_action:testaction:1" question_ref="ocil:ssg-restrict_serial_port_logins_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-root_path_default_action:testaction:1" question_ref="ocil:ssg-root_path_default_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-securetty_root_login_console_only_action:testaction:1" question_ref="ocil:ssg-securetty_root_login_console_only_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-use_pam_wheel_for_su_action:testaction:1" question_ref="ocil:ssg-use_pam_wheel_for_su_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-account_unique_id_action:testaction:1" question_ref="ocil:ssg-account_unique_id_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_authorized_local_users_action:testaction:1" question_ref="ocil:ssg-accounts_authorized_local_users_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-group_unique_id_action:testaction:1" question_ref="ocil:ssg-group_unique_id_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-group_unique_name_action:testaction:1" question_ref="ocil:ssg-group_unique_name_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1" question_ref="ocil:ssg-accounts_root_path_dirs_no_write_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_umask_etc_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_umask_etc_login_defs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_umask_etc_profile_action:testaction:1" question_ref="ocil:ssg-accounts_umask_etc_profile_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_have_homedir_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_have_homedir_login_defs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_logon_fail_delay_action:testaction:1" question_ref="ocil:ssg-accounts_logon_fail_delay_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_max_concurrent_login_sessions_action:testaction:1" question_ref="ocil:ssg-accounts_max_concurrent_login_sessions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_polyinstantiated_tmp_action:testaction:1" question_ref="ocil:ssg-accounts_polyinstantiated_tmp_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_polyinstantiated_var_tmp_action:testaction:1" question_ref="ocil:ssg-accounts_polyinstantiated_var_tmp_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_tmout_action:testaction:1" question_ref="ocil:ssg-accounts_tmout_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_home_dirs_action:testaction:1" question_ref="ocil:ssg-file_permissions_home_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_chmod_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_chmod_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_chown_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_chown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fchmod_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fchmod_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fchmodat_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fchmodat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fchown_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fchown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fchownat_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fchownat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fremovexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fremovexattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fsetxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fsetxattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_lchown_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_lchown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_lremovexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_lremovexattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_lsetxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_lsetxattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_removexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_removexattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_setxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_setxattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_umount_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_umount_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_umount2_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_umount2_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_execution_chcon_action:testaction:1" question_ref="ocil:ssg-audit_rules_execution_chcon_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_execution_restorecon_action:testaction:1" question_ref="ocil:ssg-audit_rules_execution_restorecon_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_execution_semanage_action:testaction:1" question_ref="ocil:ssg-audit_rules_execution_semanage_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_execution_setsebool_action:testaction:1" question_ref="ocil:ssg-audit_rules_execution_setsebool_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_execution_seunshare_action:testaction:1" question_ref="ocil:ssg-audit_rules_execution_seunshare_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_file_deletion_events_action:testaction:1" question_ref="ocil:ssg-audit_rules_file_deletion_events_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_file_deletion_events_rename_action:testaction:1" question_ref="ocil:ssg-audit_rules_file_deletion_events_rename_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_file_deletion_events_renameat_action:testaction:1" question_ref="ocil:ssg-audit_rules_file_deletion_events_renameat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_file_deletion_events_rmdir_action:testaction:1" question_ref="ocil:ssg-audit_rules_file_deletion_events_rmdir_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_file_deletion_events_unlink_action:testaction:1" question_ref="ocil:ssg-audit_rules_file_deletion_events_unlink_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_file_deletion_events_unlinkat_action:testaction:1" question_ref="ocil:ssg-audit_rules_file_deletion_events_unlinkat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_chmod_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_chmod_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_chown_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_chown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_creat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_fchmod_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_fchmod_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_fchmodat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_fchmodat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_fchown_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_fchown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_fchownat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_fchownat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_fremovexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_fremovexattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_fsetxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_fsetxattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_ftruncate_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_ftruncate_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_lchown_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_lchown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_lremovexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_lremovexattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_lsetxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_lsetxattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_open_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_open_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_creat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_open_o_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_open_o_creat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_open_o_trunc_write_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_open_o_trunc_write_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_openat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_openat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_openat_o_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_openat_o_creat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_openat_o_trunc_write_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_openat_o_trunc_write_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_removexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_removexattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_rename_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_rename_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_renameat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_renameat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_setxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_setxattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_truncate_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_truncate_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_unlink_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_unlink_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_unlinkat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_unlinkat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_chmod_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_chmod_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_chown_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_chown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_creat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmod_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmod_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmodat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmodat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchown_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_fchown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchownat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_fchownat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_fremovexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_fremovexattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_fsetxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_fsetxattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_lchown_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_lchown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_lremovexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_lremovexattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_lsetxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_lsetxattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_open_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_creat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_rule_order_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_open_rule_order_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_rule_order_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_rule_order_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_removexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_removexattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_rename_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_rename_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_renameat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_renameat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_setxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_setxattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_unlink_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_unlink_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_unlinkat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_unlinkat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_kernel_module_loading_action:testaction:1" question_ref="ocil:ssg-audit_rules_kernel_module_loading_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_kernel_module_loading_delete_action:testaction:1" question_ref="ocil:ssg-audit_rules_kernel_module_loading_delete_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_kernel_module_loading_finit_action:testaction:1" question_ref="ocil:ssg-audit_rules_kernel_module_loading_finit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_kernel_module_loading_init_action:testaction:1" question_ref="ocil:ssg-audit_rules_kernel_module_loading_init_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_login_events_faillock_action:testaction:1" question_ref="ocil:ssg-audit_rules_login_events_faillock_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_login_events_lastlog_action:testaction:1" question_ref="ocil:ssg-audit_rules_login_events_lastlog_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_login_events_tallylog_action:testaction:1" question_ref="ocil:ssg-audit_rules_login_events_tallylog_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_at_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_at_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_chage_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_chage_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_chsh_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_chsh_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_crontab_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_crontab_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_gpasswd_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_gpasswd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_mount_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_mount_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_newgidmap_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_newgidmap_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_newgrp_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_newgrp_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_newuidmap_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_newuidmap_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_passwd_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_pt_chown_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_pt_chown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_ssh_keysign_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_ssh_keysign_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_su_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_su_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_sudo_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_sudo_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_sudoedit_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_sudoedit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_umount_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_umount_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_unix_chkpwd_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_unix_chkpwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_userhelper_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_userhelper_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_usernetctl_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_usernetctl_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_time_adjtimex_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_adjtimex_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_time_clock_settime_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_clock_settime_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_time_settimeofday_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_settimeofday_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_time_stime_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_stime_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_time_watch_localtime_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_watch_localtime_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_etc_group_open_action:testaction:1" question_ref="ocil:ssg-audit_rules_etc_group_open_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_etc_group_open_by_handle_at_action:testaction:1" question_ref="ocil:ssg-audit_rules_etc_group_open_by_handle_at_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_etc_group_openat_action:testaction:1" question_ref="ocil:ssg-audit_rules_etc_group_openat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_etc_gshadow_open_action:testaction:1" question_ref="ocil:ssg-audit_rules_etc_gshadow_open_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_etc_gshadow_open_by_handle_at_action:testaction:1" question_ref="ocil:ssg-audit_rules_etc_gshadow_open_by_handle_at_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_etc_gshadow_openat_action:testaction:1" question_ref="ocil:ssg-audit_rules_etc_gshadow_openat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_etc_passwd_open_action:testaction:1" question_ref="ocil:ssg-audit_rules_etc_passwd_open_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_etc_passwd_open_by_handle_at_action:testaction:1" question_ref="ocil:ssg-audit_rules_etc_passwd_open_by_handle_at_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_etc_passwd_openat_action:testaction:1" question_ref="ocil:ssg-audit_rules_etc_passwd_openat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_etc_shadow_open_action:testaction:1" question_ref="ocil:ssg-audit_rules_etc_shadow_open_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_etc_shadow_open_by_handle_at_action:testaction:1" question_ref="ocil:ssg-audit_rules_etc_shadow_open_by_handle_at_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_etc_shadow_openat_action:testaction:1" question_ref="ocil:ssg-audit_rules_etc_shadow_openat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_immutable_action:testaction:1" question_ref="ocil:ssg-audit_rules_immutable_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_mac_modification_action:testaction:1" question_ref="ocil:ssg-audit_rules_mac_modification_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_media_export_action:testaction:1" question_ref="ocil:ssg-audit_rules_media_export_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_networkconfig_modification_action:testaction:1" question_ref="ocil:ssg-audit_rules_networkconfig_modification_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_sysadmin_actions_action:testaction:1" question_ref="ocil:ssg-audit_rules_sysadmin_actions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_usergroup_modification_action:testaction:1" question_ref="ocil:ssg-audit_rules_usergroup_modification_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_usergroup_modification_group_action:testaction:1" question_ref="ocil:ssg-audit_rules_usergroup_modification_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_usergroup_modification_gshadow_action:testaction:1" question_ref="ocil:ssg-audit_rules_usergroup_modification_gshadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_usergroup_modification_opasswd_action:testaction:1" question_ref="ocil:ssg-audit_rules_usergroup_modification_opasswd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_usergroup_modification_passwd_action:testaction:1" question_ref="ocil:ssg-audit_rules_usergroup_modification_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_usergroup_modification_shadow_action:testaction:1" question_ref="ocil:ssg-audit_rules_usergroup_modification_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_access_var_log_audit_action:testaction:1" question_ref="ocil:ssg-directory_access_var_log_audit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_permissions_var_log_audit_action:testaction:1" question_ref="ocil:ssg-directory_permissions_var_log_audit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupownership_audit_configuration_action:testaction:1" question_ref="ocil:ssg-file_groupownership_audit_configuration_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_ownership_audit_configuration_action:testaction:1" question_ref="ocil:ssg-file_ownership_audit_configuration_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_ownership_var_log_audit_action:testaction:1" question_ref="ocil:ssg-file_ownership_var_log_audit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_var_log_audit_action:testaction:1" question_ref="ocil:ssg-file_permissions_var_log_audit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_audispd_configure_remote_server_action:testaction:1" question_ref="ocil:ssg-auditd_audispd_configure_remote_server_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_audispd_encrypt_sent_records_action:testaction:1" question_ref="ocil:ssg-auditd_audispd_encrypt_sent_records_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_audispd_syslog_plugin_activated_action:testaction:1" question_ref="ocil:ssg-auditd_audispd_syslog_plugin_activated_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_disk_error_action_action:testaction:1" question_ref="ocil:ssg-auditd_data_disk_error_action_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_disk_full_action_action:testaction:1" question_ref="ocil:ssg-auditd_data_disk_full_action_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_retention_action_mail_acct_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_action_mail_acct_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_retention_admin_space_left_action_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_admin_space_left_action_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_retention_flush_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_flush_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_retention_max_log_file_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_max_log_file_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_retention_max_log_file_action_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_max_log_file_action_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_retention_num_logs_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_num_logs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_retention_space_left_action_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_space_left_action_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_retention_space_left_percentage_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_space_left_percentage_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_freq_action:testaction:1" question_ref="ocil:ssg-auditd_freq_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_local_events_action:testaction:1" question_ref="ocil:ssg-auditd_local_events_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_log_format_action:testaction:1" question_ref="ocil:ssg-auditd_log_format_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_name_format_action:testaction:1" question_ref="ocil:ssg-auditd_name_format_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_overflow_action_action:testaction:1" question_ref="ocil:ssg-auditd_overflow_action_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_write_logs_action:testaction:1" question_ref="ocil:ssg-auditd_write_logs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_audit_argument_action:testaction:1" question_ref="ocil:ssg-grub2_audit_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_audit_backlog_limit_argument_action:testaction:1" question_ref="ocil:ssg-grub2_audit_backlog_limit_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_audispd-plugins_installed_action:testaction:1" question_ref="ocil:ssg-package_audispd-plugins_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_audit-audispd-plugins_installed_action:testaction:1" question_ref="ocil:ssg-package_audit-audispd-plugins_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_audit_installed_action:testaction:1" question_ref="ocil:ssg-package_audit_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_auditd_enabled_action:testaction:1" question_ref="ocil:ssg-service_auditd_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_grub2_cfg_action:testaction:1" question_ref="ocil:ssg-file_groupowner_grub2_cfg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_grub2_cfg_action:testaction:1" question_ref="ocil:ssg-file_owner_grub2_cfg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_grub2_cfg_action:testaction:1" question_ref="ocil:ssg-file_permissions_grub2_cfg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_admin_username_action:testaction:1" question_ref="ocil:ssg-grub2_admin_username_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_password_action:testaction:1" question_ref="ocil:ssg-grub2_password_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_efi_grub2_cfg_action:testaction:1" question_ref="ocil:ssg-file_groupowner_efi_grub2_cfg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_efi_grub2_cfg_action:testaction:1" question_ref="ocil:ssg-file_owner_efi_grub2_cfg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_efi_grub2_cfg_action:testaction:1" question_ref="ocil:ssg-file_permissions_efi_grub2_cfg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_uefi_admin_username_action:testaction:1" question_ref="ocil:ssg-grub2_uefi_admin_username_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_uefi_password_action:testaction:1" question_ref="ocil:ssg-grub2_uefi_password_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_enable_iommu_force_action:testaction:1" question_ref="ocil:ssg-grub2_enable_iommu_force_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_l1tf_argument_action:testaction:1" question_ref="ocil:ssg-grub2_l1tf_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_mce_argument_action:testaction:1" question_ref="ocil:ssg-grub2_mce_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_mds_argument_action:testaction:1" question_ref="ocil:ssg-grub2_mds_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_nosmap_argument_absent_action:testaction:1" question_ref="ocil:ssg-grub2_nosmap_argument_absent_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_nosmep_argument_absent_action:testaction:1" question_ref="ocil:ssg-grub2_nosmep_argument_absent_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_pti_argument_action:testaction:1" question_ref="ocil:ssg-grub2_pti_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_rng_core_default_quality_argument_action:testaction:1" question_ref="ocil:ssg-grub2_rng_core_default_quality_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_slab_nomerge_argument_action:testaction:1" question_ref="ocil:ssg-grub2_slab_nomerge_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_spec_store_bypass_disable_argument_action:testaction:1" question_ref="ocil:ssg-grub2_spec_store_bypass_disable_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_spectre_v2_argument_action:testaction:1" question_ref="ocil:ssg-grub2_spectre_v2_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_vsyscall_argument_action:testaction:1" question_ref="ocil:ssg-grub2_vsyscall_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_gcc_plugin_latent_entropy_action:testaction:1" question_ref="ocil:ssg-kernel_config_gcc_plugin_latent_entropy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_gcc_plugin_randstruct_action:testaction:1" question_ref="ocil:ssg-kernel_config_gcc_plugin_randstruct_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_gcc_plugin_stackleak_action:testaction:1" question_ref="ocil:ssg-kernel_config_gcc_plugin_stackleak_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_gcc_plugin_structleak_action:testaction:1" question_ref="ocil:ssg-kernel_config_gcc_plugin_structleak_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_gcc_plugin_structleak_byref_all_action:testaction:1" question_ref="ocil:ssg-kernel_config_gcc_plugin_structleak_byref_all_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_acpi_custom_method_action:testaction:1" question_ref="ocil:ssg-kernel_config_acpi_custom_method_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_arm64_sw_ttbr0_pan_action:testaction:1" question_ref="ocil:ssg-kernel_config_arm64_sw_ttbr0_pan_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_binfmt_misc_action:testaction:1" question_ref="ocil:ssg-kernel_config_binfmt_misc_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_bug_action:testaction:1" question_ref="ocil:ssg-kernel_config_bug_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_bug_on_data_corruption_action:testaction:1" question_ref="ocil:ssg-kernel_config_bug_on_data_corruption_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_compat_brk_action:testaction:1" question_ref="ocil:ssg-kernel_config_compat_brk_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_compat_vdso_action:testaction:1" question_ref="ocil:ssg-kernel_config_compat_vdso_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_debug_credentials_action:testaction:1" question_ref="ocil:ssg-kernel_config_debug_credentials_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_debug_fs_action:testaction:1" question_ref="ocil:ssg-kernel_config_debug_fs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_debug_list_action:testaction:1" question_ref="ocil:ssg-kernel_config_debug_list_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_debug_notifiers_action:testaction:1" question_ref="ocil:ssg-kernel_config_debug_notifiers_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_debug_sg_action:testaction:1" question_ref="ocil:ssg-kernel_config_debug_sg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_debug_wx_action:testaction:1" question_ref="ocil:ssg-kernel_config_debug_wx_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_default_mmap_min_addr_action:testaction:1" question_ref="ocil:ssg-kernel_config_default_mmap_min_addr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_devkmem_action:testaction:1" question_ref="ocil:ssg-kernel_config_devkmem_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_fortify_source_action:testaction:1" question_ref="ocil:ssg-kernel_config_fortify_source_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_hardened_usercopy_action:testaction:1" question_ref="ocil:ssg-kernel_config_hardened_usercopy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_hardened_usercopy_fallback_action:testaction:1" question_ref="ocil:ssg-kernel_config_hardened_usercopy_fallback_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_hibernation_action:testaction:1" question_ref="ocil:ssg-kernel_config_hibernation_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_ia32_emulation_action:testaction:1" question_ref="ocil:ssg-kernel_config_ia32_emulation_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_ipv6_action:testaction:1" question_ref="ocil:ssg-kernel_config_ipv6_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_kexec_action:testaction:1" question_ref="ocil:ssg-kernel_config_kexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_legacy_ptys_action:testaction:1" question_ref="ocil:ssg-kernel_config_legacy_ptys_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_legacy_vsyscall_emulate_action:testaction:1" question_ref="ocil:ssg-kernel_config_legacy_vsyscall_emulate_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_legacy_vsyscall_none_action:testaction:1" question_ref="ocil:ssg-kernel_config_legacy_vsyscall_none_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_legacy_vsyscall_xonly_action:testaction:1" question_ref="ocil:ssg-kernel_config_legacy_vsyscall_xonly_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_modify_ldt_syscall_action:testaction:1" question_ref="ocil:ssg-kernel_config_modify_ldt_syscall_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_module_sig_action:testaction:1" question_ref="ocil:ssg-kernel_config_module_sig_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_module_sig_all_action:testaction:1" question_ref="ocil:ssg-kernel_config_module_sig_all_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_module_sig_force_action:testaction:1" question_ref="ocil:ssg-kernel_config_module_sig_force_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_module_sig_hash_action:testaction:1" question_ref="ocil:ssg-kernel_config_module_sig_hash_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_module_sig_key_action:testaction:1" question_ref="ocil:ssg-kernel_config_module_sig_key_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_module_sig_sha512_action:testaction:1" question_ref="ocil:ssg-kernel_config_module_sig_sha512_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_page_poisoning_action:testaction:1" question_ref="ocil:ssg-kernel_config_page_poisoning_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_page_poisoning_no_sanity_action:testaction:1" question_ref="ocil:ssg-kernel_config_page_poisoning_no_sanity_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_page_poisoning_zero_action:testaction:1" question_ref="ocil:ssg-kernel_config_page_poisoning_zero_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_page_table_isolation_action:testaction:1" question_ref="ocil:ssg-kernel_config_page_table_isolation_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_panic_on_oops_action:testaction:1" question_ref="ocil:ssg-kernel_config_panic_on_oops_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_panic_timeout_action:testaction:1" question_ref="ocil:ssg-kernel_config_panic_timeout_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_proc_kcore_action:testaction:1" question_ref="ocil:ssg-kernel_config_proc_kcore_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_randomize_base_action:testaction:1" question_ref="ocil:ssg-kernel_config_randomize_base_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_randomize_memory_action:testaction:1" question_ref="ocil:ssg-kernel_config_randomize_memory_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_refcount_full_action:testaction:1" question_ref="ocil:ssg-kernel_config_refcount_full_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_retpoline_action:testaction:1" question_ref="ocil:ssg-kernel_config_retpoline_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_sched_stack_end_check_action:testaction:1" question_ref="ocil:ssg-kernel_config_sched_stack_end_check_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_seccomp_action:testaction:1" question_ref="ocil:ssg-kernel_config_seccomp_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_seccomp_filter_action:testaction:1" question_ref="ocil:ssg-kernel_config_seccomp_filter_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_security_action:testaction:1" question_ref="ocil:ssg-kernel_config_security_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_security_dmesg_restrict_action:testaction:1" question_ref="ocil:ssg-kernel_config_security_dmesg_restrict_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_security_writable_hooks_action:testaction:1" question_ref="ocil:ssg-kernel_config_security_writable_hooks_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_security_yama_action:testaction:1" question_ref="ocil:ssg-kernel_config_security_yama_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_slab_freelist_hardened_action:testaction:1" question_ref="ocil:ssg-kernel_config_slab_freelist_hardened_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_slab_freelist_random_action:testaction:1" question_ref="ocil:ssg-kernel_config_slab_freelist_random_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_slab_merge_default_action:testaction:1" question_ref="ocil:ssg-kernel_config_slab_merge_default_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_slub_debug_action:testaction:1" question_ref="ocil:ssg-kernel_config_slub_debug_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_stackprotector_action:testaction:1" question_ref="ocil:ssg-kernel_config_stackprotector_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_stackprotector_strong_action:testaction:1" question_ref="ocil:ssg-kernel_config_stackprotector_strong_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_strict_kernel_rwx_action:testaction:1" question_ref="ocil:ssg-kernel_config_strict_kernel_rwx_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_strict_module_rwx_action:testaction:1" question_ref="ocil:ssg-kernel_config_strict_module_rwx_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_syn_cookies_action:testaction:1" question_ref="ocil:ssg-kernel_config_syn_cookies_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_unmap_kernel_at_el0_action:testaction:1" question_ref="ocil:ssg-kernel_config_unmap_kernel_at_el0_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_vmap_stack_action:testaction:1" question_ref="ocil:ssg-kernel_config_vmap_stack_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_x86_vsyscall_emulation_action:testaction:1" question_ref="ocil:ssg-kernel_config_x86_vsyscall_emulation_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_cron_logging_action:testaction:1" question_ref="ocil:ssg-rsyslog_cron_logging_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action:testaction:1" question_ref="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode_action:testaction:1" question_ref="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver_action:testaction:1" question_ref="ocil:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_files_groupownership_action:testaction:1" question_ref="ocil:ssg-rsyslog_files_groupownership_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_files_ownership_action:testaction:1" question_ref="ocil:ssg-rsyslog_files_ownership_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_files_permissions_action:testaction:1" question_ref="ocil:ssg-rsyslog_files_permissions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_remote_access_monitoring_action:testaction:1" question_ref="ocil:ssg-rsyslog_remote_access_monitoring_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ensure_logrotate_activated_action:testaction:1" question_ref="ocil:ssg-ensure_logrotate_activated_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_syslogng_installed_action:testaction:1" question_ref="ocil:ssg-package_syslogng_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_nolisten_action:testaction:1" question_ref="ocil:ssg-rsyslog_nolisten_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_syslogng_enabled_action:testaction:1" question_ref="ocil:ssg-service_syslogng_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_remote_loghost_action:testaction:1" question_ref="ocil:ssg-rsyslog_remote_loghost_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_remote_tls_action:testaction:1" question_ref="ocil:ssg-rsyslog_remote_tls_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_remote_tls_cacert_action:testaction:1" question_ref="ocil:ssg-rsyslog_remote_tls_cacert_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_rsyslog-gnutls_installed_action:testaction:1" question_ref="ocil:ssg-package_rsyslog-gnutls_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_rsyslog_installed_action:testaction:1" question_ref="ocil:ssg-package_rsyslog_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_rsyslog_enabled_action:testaction:1" question_ref="ocil:ssg-service_rsyslog_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_firewalld_enabled_action:testaction:1" question_ref="ocil:ssg-service_firewalld_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-set_firewalld_default_zone_action:testaction:1" question_ref="ocil:ssg-set_firewalld_default_zone_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-libreswan_approved_tunnels_action:testaction:1" question_ref="ocil:ssg-libreswan_approved_tunnels_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_libreswan_installed_action:testaction:1" question_ref="ocil:ssg-package_libreswan_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_ip6tables_enabled_action:testaction:1" question_ref="ocil:ssg-service_ip6tables_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_iptables_enabled_action:testaction:1" question_ref="ocil:ssg-service_iptables_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-set_ip6tables_default_rule_action:testaction:1" question_ref="ocil:ssg-set_ip6tables_default_rule_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-set_iptables_default_rule_action:testaction:1" question_ref="ocil:ssg-set_iptables_default_rule_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-set_iptables_default_rule_forward_action:testaction:1" question_ref="ocil:ssg-set_iptables_default_rule_forward_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_iptables_installed_action:testaction:1" question_ref="ocil:ssg-package_iptables_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_autoconf_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_autoconf_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_max_addresses_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_max_addresses_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_router_solicitations_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_router_solicitations_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_autoconf_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_autoconf_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_max_addresses_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_max_addresses_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_router_solicitations_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_router_solicitations_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_ipv6_disable_argument_action:testaction:1" question_ref="ocil:ssg-grub2_ipv6_disable_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_ipv6_option_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_ipv6_option_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_disable_ipv6_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_disable_ipv6_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_local_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_accept_local_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_arp_ignore_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_arp_ignore_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_drop_gratuitous_arp_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_drop_gratuitous_arp_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_route_localnet_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_route_localnet_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_shared_media_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_shared_media_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_shared_media_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_shared_media_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_ip_local_port_range_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_ip_local_port_range_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_tcp_syncookies_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_tcp_syncookies_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_ip_forward_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_ip_forward_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_atm_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_atm_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_can_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_can_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_dccp_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_dccp_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_firewire-core_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_firewire-core_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_rds_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_rds_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_tipc_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_tipc_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_bluetooth_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_bluetooth_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_cfg80211_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_cfg80211_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_iwlmvm_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_iwlmvm_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_iwlwifi_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_iwlwifi_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_mac80211_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_mac80211_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_bluetooth_disabled_action:testaction:1" question_ref="ocil:ssg-service_bluetooth_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-wireless_disable_interfaces_action:testaction:1" question_ref="ocil:ssg-wireless_disable_interfaces_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-network_nmcli_permissions_action:testaction:1" question_ref="ocil:ssg-network_nmcli_permissions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-network_sniffer_disabled_action:testaction:1" question_ref="ocil:ssg-network_sniffer_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_backup_etc_group_action:testaction:1" question_ref="ocil:ssg-file_groupowner_backup_etc_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_backup_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_groupowner_backup_etc_gshadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_backup_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_groupowner_backup_etc_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_backup_etc_shadow_action:testaction:1" question_ref="ocil:ssg-file_groupowner_backup_etc_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_group_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_gshadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_shadow_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_backup_etc_group_action:testaction:1" question_ref="ocil:ssg-file_owner_backup_etc_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_backup_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_owner_backup_etc_gshadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_backup_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_owner_backup_etc_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_backup_etc_shadow_action:testaction:1" question_ref="ocil:ssg-file_owner_backup_etc_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_etc_group_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_gshadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_etc_shadow_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_backup_etc_group_action:testaction:1" question_ref="ocil:ssg-file_permissions_backup_etc_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_backup_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_permissions_backup_etc_gshadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_backup_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_permissions_backup_etc_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_backup_etc_shadow_action:testaction:1" question_ref="ocil:ssg-file_permissions_backup_etc_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_group_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_gshadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_shadow_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_var_log_action:testaction:1" question_ref="ocil:ssg-file_groupowner_var_log_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_var_log_messages_action:testaction:1" question_ref="ocil:ssg-file_groupowner_var_log_messages_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_var_log_syslog_action:testaction:1" question_ref="ocil:ssg-file_groupowner_var_log_syslog_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_var_log_action:testaction:1" question_ref="ocil:ssg-file_owner_var_log_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_var_log_messages_action:testaction:1" question_ref="ocil:ssg-file_owner_var_log_messages_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_var_log_syslog_action:testaction:1" question_ref="ocil:ssg-file_owner_var_log_syslog_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_var_log_action:testaction:1" question_ref="ocil:ssg-file_permissions_var_log_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_var_log_messages_action:testaction:1" question_ref="ocil:ssg-file_permissions_var_log_messages_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_var_log_syslog_action:testaction:1" question_ref="ocil:ssg-file_permissions_var_log_syslog_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_group_ownership_library_dirs_action:testaction:1" question_ref="ocil:ssg-dir_group_ownership_library_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_ownership_binary_dirs_action:testaction:1" question_ref="ocil:ssg-dir_ownership_binary_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_ownership_library_dirs_action:testaction:1" question_ref="ocil:ssg-dir_ownership_library_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_permissions_binary_dirs_action:testaction:1" question_ref="ocil:ssg-dir_permissions_binary_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_permissions_library_dirs_action:testaction:1" question_ref="ocil:ssg-dir_permissions_library_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupownership_system_commands_dirs_action:testaction:1" question_ref="ocil:ssg-file_groupownership_system_commands_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_ownership_binary_dirs_action:testaction:1" question_ref="ocil:ssg-file_ownership_binary_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_ownership_library_dirs_action:testaction:1" question_ref="ocil:ssg-file_ownership_library_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_binary_dirs_action:testaction:1" question_ref="ocil:ssg-file_permissions_binary_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_library_dirs_action:testaction:1" question_ref="ocil:ssg-file_permissions_library_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-root_permissions_syslibrary_files_action:testaction:1" question_ref="ocil:ssg-root_permissions_syslibrary_files_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_perms_world_writable_root_owned_action:testaction:1" question_ref="ocil:ssg-dir_perms_world_writable_root_owned_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_perms_world_writable_sticky_bits_action:testaction:1" question_ref="ocil:ssg-dir_perms_world_writable_sticky_bits_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_perms_world_writable_system_owned_action:testaction:1" question_ref="ocil:ssg-dir_perms_world_writable_system_owned_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_perms_world_writable_system_owned_group_action:testaction:1" question_ref="ocil:ssg-dir_perms_world_writable_system_owned_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_audit_auditd_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_audit_auditd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_audit_rulesd_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_audit_rulesd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_systemmap_action:testaction:1" question_ref="ocil:ssg-file_permissions_systemmap_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_unauthorized_sgid_action:testaction:1" question_ref="ocil:ssg-file_permissions_unauthorized_sgid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_unauthorized_suid_action:testaction:1" question_ref="ocil:ssg-file_permissions_unauthorized_suid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_unauthorized_world_writable_action:testaction:1" question_ref="ocil:ssg-file_permissions_unauthorized_world_writable_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_ungroupowned_action:testaction:1" question_ref="ocil:ssg-file_permissions_ungroupowned_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_files_unowned_by_user_action:testaction:1" question_ref="ocil:ssg-no_files_unowned_by_user_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_fs_protected_fifos_action:testaction:1" question_ref="ocil:ssg-sysctl_fs_protected_fifos_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_fs_protected_hardlinks_action:testaction:1" question_ref="ocil:ssg-sysctl_fs_protected_hardlinks_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_fs_protected_regular_action:testaction:1" question_ref="ocil:ssg-sysctl_fs_protected_regular_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_fs_protected_symlinks_action:testaction:1" question_ref="ocil:ssg-sysctl_fs_protected_symlinks_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_cramfs_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_cramfs_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_usb-storage_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_usb-storage_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_autofs_disabled_action:testaction:1" question_ref="ocil:ssg-service_autofs_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_boot_noauto_action:testaction:1" question_ref="ocil:ssg-mount_option_boot_noauto_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_boot_nodev_action:testaction:1" question_ref="ocil:ssg-mount_option_boot_nodev_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_boot_noexec_action:testaction:1" question_ref="ocil:ssg-mount_option_boot_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_boot_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_boot_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_dev_shm_nodev_action:testaction:1" question_ref="ocil:ssg-mount_option_dev_shm_nodev_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_dev_shm_noexec_action:testaction:1" question_ref="ocil:ssg-mount_option_dev_shm_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_dev_shm_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_dev_shm_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_home_noexec_action:testaction:1" question_ref="ocil:ssg-mount_option_home_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_nodev_nonroot_local_partitions_action:testaction:1" question_ref="ocil:ssg-mount_option_nodev_nonroot_local_partitions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_noexec_removable_partitions_action:testaction:1" question_ref="ocil:ssg-mount_option_noexec_removable_partitions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_opt_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_opt_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_proc_hidepid_action:testaction:1" question_ref="ocil:ssg-mount_option_proc_hidepid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_srv_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_srv_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_tmp_nodev_action:testaction:1" question_ref="ocil:ssg-mount_option_tmp_nodev_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_tmp_noexec_action:testaction:1" question_ref="ocil:ssg-mount_option_tmp_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_tmp_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_tmp_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_log_audit_nodev_action:testaction:1" question_ref="ocil:ssg-mount_option_var_log_audit_nodev_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_log_audit_noexec_action:testaction:1" question_ref="ocil:ssg-mount_option_var_log_audit_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_log_audit_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_var_log_audit_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_log_nodev_action:testaction:1" question_ref="ocil:ssg-mount_option_var_log_nodev_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_log_noexec_action:testaction:1" question_ref="ocil:ssg-mount_option_var_log_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_log_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_var_log_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_nodev_action:testaction:1" question_ref="ocil:ssg-mount_option_var_nodev_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_noexec_action:testaction:1" question_ref="ocil:ssg-mount_option_var_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_var_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-coredump_disable_backtraces_action:testaction:1" question_ref="ocil:ssg-coredump_disable_backtraces_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-coredump_disable_storage_action:testaction:1" question_ref="ocil:ssg-coredump_disable_storage_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-disable_users_coredumps_action:testaction:1" question_ref="ocil:ssg-disable_users_coredumps_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_systemd-coredump_disabled_action:testaction:1" question_ref="ocil:ssg-service_systemd-coredump_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_fs_suid_dumpable_action:testaction:1" question_ref="ocil:ssg-sysctl_fs_suid_dumpable_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-umask_for_daemons_action:testaction:1" question_ref="ocil:ssg-umask_for_daemons_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_exec_shield_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_exec_shield_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_kptr_restrict_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_kptr_restrict_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_randomize_va_space_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_randomize_va_space_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-bios_enable_execution_restrictions_action:testaction:1" question_ref="ocil:ssg-bios_enable_execution_restrictions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_page_poison_argument_action:testaction:1" question_ref="ocil:ssg-grub2_page_poison_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_slub_debug_argument_action:testaction:1" question_ref="ocil:ssg-grub2_slub_debug_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_core_pattern_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_core_pattern_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_dmesg_restrict_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_dmesg_restrict_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_kexec_load_disabled_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_kexec_load_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_modules_disabled_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_modules_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_panic_on_oops_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_panic_on_oops_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_perf_cpu_time_max_percent_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_perf_cpu_time_max_percent_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_perf_event_max_sample_rate_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_perf_event_max_sample_rate_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_perf_event_paranoid_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_perf_event_paranoid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_pid_max_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_pid_max_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_sysrq_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_sysrq_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_yama_ptrace_scope_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_yama_ptrace_scope_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_core_bpf_jit_harden_action:testaction:1" question_ref="ocil:ssg-sysctl_net_core_bpf_jit_harden_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_user_max_user_namespaces_action:testaction:1" question_ref="ocil:ssg-sysctl_user_max_user_namespaces_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_vm_mmap_min_addr_action:testaction:1" question_ref="ocil:ssg-sysctl_vm_mmap_min_addr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-coreos_enable_selinux_kernel_argument_action:testaction:1" question_ref="ocil:ssg-coreos_enable_selinux_kernel_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_enable_selinux_action:testaction:1" question_ref="ocil:ssg-grub2_enable_selinux_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_libselinux_installed_action:testaction:1" question_ref="ocil:ssg-package_libselinux_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_policycoreutils_installed_action:testaction:1" question_ref="ocil:ssg-package_policycoreutils_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_setroubleshoot-plugins_removed_action:testaction:1" question_ref="ocil:ssg-package_setroubleshoot-plugins_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_setroubleshoot-server_removed_action:testaction:1" question_ref="ocil:ssg-package_setroubleshoot-server_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-selinux_all_devicefiles_labeled_action:testaction:1" question_ref="ocil:ssg-selinux_all_devicefiles_labeled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-selinux_confinement_of_daemons_action:testaction:1" question_ref="ocil:ssg-selinux_confinement_of_daemons_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-selinux_policytype_action:testaction:1" question_ref="ocil:ssg-selinux_policytype_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-selinux_state_action:testaction:1" question_ref="ocil:ssg-selinux_state_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-encrypt_partitions_action:testaction:1" question_ref="ocil:ssg-encrypt_partitions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_boot_action:testaction:1" question_ref="ocil:ssg-partition_for_boot_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_home_action:testaction:1" question_ref="ocil:ssg-partition_for_home_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_opt_action:testaction:1" question_ref="ocil:ssg-partition_for_opt_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_srv_action:testaction:1" question_ref="ocil:ssg-partition_for_srv_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_tmp_action:testaction:1" question_ref="ocil:ssg-partition_for_tmp_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_usr_action:testaction:1" question_ref="ocil:ssg-partition_for_usr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_var_action:testaction:1" question_ref="ocil:ssg-partition_for_var_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_var_log_action:testaction:1" question_ref="ocil:ssg-partition_for_var_log_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_var_log_audit_action:testaction:1" question_ref="ocil:ssg-partition_for_var_log_audit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_restart_shutdown_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_restart_shutdown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_user_list_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_user_list_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_enable_smartcard_auth_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_enable_smartcard_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_lock_screen_on_smartcard_removal_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_lock_screen_on_smartcard_removal_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_login_retries_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_login_retries_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-gnome_gdm_disable_automatic_login_action:testaction:1" question_ref="ocil:ssg-gnome_gdm_disable_automatic_login_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-gnome_gdm_disable_guest_login_action:testaction:1" question_ref="ocil:ssg-gnome_gdm_disable_guest_login_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-gnome_gdm_disable_xdmcp_action:testaction:1" question_ref="ocil:ssg-gnome_gdm_disable_xdmcp_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_automount_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_automount_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_automount_open_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_automount_open_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_autorun_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_autorun_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_thumbnailers_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_thumbnailers_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_wifi_create_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_wifi_create_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_wifi_notification_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_wifi_notification_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_remote_access_credential_prompt_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_remote_access_credential_prompt_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_remote_access_encryption_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_remote_access_encryption_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_idle_activation_enabled_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_idle_activation_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_idle_activation_locked_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_idle_activation_locked_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_idle_delay_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_idle_delay_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_lock_delay_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_lock_delay_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_lock_enabled_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_lock_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_lock_locked_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_lock_locked_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_mode_blank_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_mode_blank_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_user_info_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_user_info_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_user_locks_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_user_locks_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_session_idle_user_locks_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_session_idle_user_locks_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_ctrlaltdel_reboot_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_ctrlaltdel_reboot_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_geolocation_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_geolocation_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_power_settings_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_power_settings_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_user_admin_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_user_admin_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_db_up_to_date_action:testaction:1" question_ref="ocil:ssg-dconf_db_up_to_date_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-enable_dconf_user_profile_action:testaction:1" question_ref="ocil:ssg-enable_dconf_user_profile_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_gdm_removed_action:testaction:1" question_ref="ocil:ssg-package_gdm_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-installed_OS_is_FIPS_certified_action:testaction:1" question_ref="ocil:ssg-installed_OS_is_FIPS_certified_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-installed_OS_is_vendor_supported_action:testaction:1" question_ref="ocil:ssg-installed_OS_is_vendor_supported_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_bind_crypto_policy_action:testaction:1" question_ref="ocil:ssg-configure_bind_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_crypto_policy_action:testaction:1" question_ref="ocil:ssg-configure_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_gnutls_tls_crypto_policy_action:testaction:1" question_ref="ocil:ssg-configure_gnutls_tls_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_kerberos_crypto_policy_action:testaction:1" question_ref="ocil:ssg-configure_kerberos_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_libreswan_crypto_policy_action:testaction:1" question_ref="ocil:ssg-configure_libreswan_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_openssl_crypto_policy_action:testaction:1" question_ref="ocil:ssg-configure_openssl_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_ssh_crypto_policy_action:testaction:1" question_ref="ocil:ssg-configure_ssh_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-harden_ssh_client_crypto_policy_action:testaction:1" question_ref="ocil:ssg-harden_ssh_client_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy_action:testaction:1" question_ref="ocil:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-harden_sshd_crypto_policy_action:testaction:1" question_ref="ocil:ssg-harden_sshd_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-harden_sshd_macs_openssh_conf_crypto_policy_action:testaction:1" question_ref="ocil:ssg-harden_sshd_macs_openssh_conf_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_MFEhiplsm_installed_action:testaction:1" question_ref="ocil:ssg-package_MFEhiplsm_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_user_data_backups_action:testaction:1" question_ref="ocil:ssg-configure_user_data_backups_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-install_antivirus_action:testaction:1" question_ref="ocil:ssg-install_antivirus_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-install_hids_action:testaction:1" question_ref="ocil:ssg-install_hids_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-enable_dracut_fips_module_action:testaction:1" question_ref="ocil:ssg-enable_dracut_fips_module_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-enable_fips_mode_action:testaction:1" question_ref="ocil:ssg-enable_fips_mode_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-etc_system_fips_exists_action:testaction:1" question_ref="ocil:ssg-etc_system_fips_exists_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_crypto_fips_enabled_action:testaction:1" question_ref="ocil:ssg-sysctl_crypto_fips_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-aide_build_database_action:testaction:1" question_ref="ocil:ssg-aide_build_database_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-aide_check_audit_tools_action:testaction:1" question_ref="ocil:ssg-aide_check_audit_tools_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-aide_periodic_cron_checking_action:testaction:1" question_ref="ocil:ssg-aide_periodic_cron_checking_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_aide_installed_action:testaction:1" question_ref="ocil:ssg-package_aide_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rpm_verify_hashes_action:testaction:1" question_ref="ocil:ssg-rpm_verify_hashes_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rpm_verify_permissions_action:testaction:1" question_ref="ocil:ssg-rpm_verify_permissions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_sudo_installed_action:testaction:1" question_ref="ocil:ssg-package_sudo_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_add_noexec_action:testaction:1" question_ref="ocil:ssg-sudo_add_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_add_requiretty_action:testaction:1" question_ref="ocil:ssg-sudo_add_requiretty_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_add_use_pty_action:testaction:1" question_ref="ocil:ssg-sudo_add_use_pty_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_custom_logfile_action:testaction:1" question_ref="ocil:ssg-sudo_custom_logfile_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_remove_no_authenticate_action:testaction:1" question_ref="ocil:ssg-sudo_remove_no_authenticate_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_remove_nopasswd_action:testaction:1" question_ref="ocil:ssg-sudo_remove_nopasswd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_require_authentication_action:testaction:1" question_ref="ocil:ssg-sudo_require_authentication_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_vdsm_nopasswd_action:testaction:1" question_ref="ocil:ssg-sudo_vdsm_nopasswd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudoers_default_includedir_action:testaction:1" question_ref="ocil:ssg-sudoers_default_includedir_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudoers_explicit_command_args_action:testaction:1" question_ref="ocil:ssg-sudoers_explicit_command_args_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudoers_no_command_negation_action:testaction:1" question_ref="ocil:ssg-sudoers_no_command_negation_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudoers_no_root_target_action:testaction:1" question_ref="ocil:ssg-sudoers_no_root_target_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudoers_validate_passwd_action:testaction:1" question_ref="ocil:ssg-sudoers_validate_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_abrt-addon-ccpp_removed_action:testaction:1" question_ref="ocil:ssg-package_abrt-addon-ccpp_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_abrt-addon-kerneloops_removed_action:testaction:1" question_ref="ocil:ssg-package_abrt-addon-kerneloops_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_abrt-cli_removed_action:testaction:1" question_ref="ocil:ssg-package_abrt-cli_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_abrt-plugin-logger_removed_action:testaction:1" question_ref="ocil:ssg-package_abrt-plugin-logger_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_abrt-plugin-rhtsupport_removed_action:testaction:1" question_ref="ocil:ssg-package_abrt-plugin-rhtsupport_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_abrt-plugin-sosreport_removed_action:testaction:1" question_ref="ocil:ssg-package_abrt-plugin-sosreport_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_binutils_installed_action:testaction:1" question_ref="ocil:ssg-package_binutils_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_cryptsetup-luks_installed_action:testaction:1" question_ref="ocil:ssg-package_cryptsetup-luks_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_geolite2-city_removed_action:testaction:1" question_ref="ocil:ssg-package_geolite2-city_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_geolite2-country_removed_action:testaction:1" question_ref="ocil:ssg-package_geolite2-country_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_gnutls-utils_installed_action:testaction:1" question_ref="ocil:ssg-package_gnutls-utils_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_gssproxy_removed_action:testaction:1" question_ref="ocil:ssg-package_gssproxy_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_iprutils_removed_action:testaction:1" question_ref="ocil:ssg-package_iprutils_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_krb5-workstation_removed_action:testaction:1" question_ref="ocil:ssg-package_krb5-workstation_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_libcap-ng-utils_installed_action:testaction:1" question_ref="ocil:ssg-package_libcap-ng-utils_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_libreport-plugin-logger_removed_action:testaction:1" question_ref="ocil:ssg-package_libreport-plugin-logger_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_libreport-plugin-rhtsupport_removed_action:testaction:1" question_ref="ocil:ssg-package_libreport-plugin-rhtsupport_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_nss-tools_installed_action:testaction:1" question_ref="ocil:ssg-package_nss-tools_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_openscap-scanner_installed_action:testaction:1" question_ref="ocil:ssg-package_openscap-scanner_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_python3-abrt-addon_removed_action:testaction:1" question_ref="ocil:ssg-package_python3-abrt-addon_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_rear_installed_action:testaction:1" question_ref="ocil:ssg-package_rear_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_rng-tools_installed_action:testaction:1" question_ref="ocil:ssg-package_rng-tools_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_scap-security-guide_installed_action:testaction:1" question_ref="ocil:ssg-package_scap-security-guide_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_tar_installed_action:testaction:1" question_ref="ocil:ssg-package_tar_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_tuned_removed_action:testaction:1" question_ref="ocil:ssg-package_tuned_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_vim_installed_action:testaction:1" question_ref="ocil:ssg-package_vim_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-clean_components_post_updating_action:testaction:1" question_ref="ocil:ssg-clean_components_post_updating_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dnf-automatic_apply_updates_action:testaction:1" question_ref="ocil:ssg-dnf-automatic_apply_updates_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dnf-automatic_security_updates_only_action:testaction:1" question_ref="ocil:ssg-dnf-automatic_security_updates_only_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ensure_fedora_gpgkey_installed_action:testaction:1" question_ref="ocil:ssg-ensure_fedora_gpgkey_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ensure_gpgcheck_globally_activated_action:testaction:1" question_ref="ocil:ssg-ensure_gpgcheck_globally_activated_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ensure_gpgcheck_local_packages_action:testaction:1" question_ref="ocil:ssg-ensure_gpgcheck_local_packages_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ensure_gpgcheck_never_disabled_action:testaction:1" question_ref="ocil:ssg-ensure_gpgcheck_never_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ensure_gpgcheck_repo_metadata_action:testaction:1" question_ref="ocil:ssg-ensure_gpgcheck_repo_metadata_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_dnf-automatic_installed_action:testaction:1" question_ref="ocil:ssg-package_dnf-automatic_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-timer_dnf-automatic_enabled_action:testaction:1" question_ref="ocil:ssg-timer_dnf-automatic_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-prefer_64bit_os_action:testaction:1" question_ref="ocil:ssg-prefer_64bit_os_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
      </ocil:test_actions>
      <ocil:questions>
        <ocil:boolean_question id="ocil:ssg-package_abrt_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the abrt package is installed:
$ rpm -q abrt
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_at_deny_not_exist_question:question:1">
          <ocil:question_text>The file /etc/at.deny should not exist.
This can be checked by running the following

stat /etc/at.deny

and the output should be

stat: cannot stat `/etc/at.deny': No such file or directory

      Is it the case that the file /etc/at.deny exists?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_cron_deny_not_exist_question:question:1">
          <ocil:question_text>The file /etc/cron.deny should not exist.
This can be checked by runnig the following

stat /etc/cron.deny

and the output should be

stat: cannot stat `/etc/cron.deny': No such file or directory

      Is it the case that the file /etc/cron.deny exists?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-disable_anacron_question:question:1">
          <ocil:question_text>Run the following command to determine if the cronie-anacron package is installed:
$ rpm -q cronie-anacron
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_atd_disabled_question:question:1">
          <ocil:question_text>
To check that the atd service is disabled in system boot configuration,
run the following command:
$ sudo systemctl is-enabled atd
Output should indicate the atd service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ sudo systemctl is-enabled atd disabled

Run the following command to verify atd is not active (i.e. not running) through current runtime configuration:
$ sudo systemctl is-active atd

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the atd is masked, run the following command:
$ sudo systemctl show atd | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that the "atd" is loaded and not masked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_cron_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
cron service:
$ sudo systemctl is-active cron
If the service is running, it should return the following: active
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_crond_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
crond service:
$ sudo systemctl is-active crond
If the service is running, it should return the following: active
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_bind_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the bind package is installed:
$ rpm -q bind
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_fapolicyd_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the fapolicyd package is installed: $ rpm -q fapolicyd
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_vsftpd_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the vsftpd package is installed:
$ rpm -q vsftpd
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ftp_log_transactions_question:question:1">
          <ocil:question_text>Find if logging is applied to the FTP daemon.

Procedures:

If vsftpd is started by xinetd the following command will indicate the xinetd.d startup file:
$ grep vsftpd /etc/xinetd.d/*
$ grep server_args vsftpd xinetd.d startup file
This will indicate the vsftpd config file used when starting through xinetd.
If the server_args line is missing or does not include the vsftpd configuration file, then the default config file (/etc/vsftpd/vsftpd.conf) is used.
$ sudo grep xferlog_enable vsftpd config file
      Is it the case that xferlog_enable is missing, or is not set to yes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ftp_present_banner_question:question:1">
          <ocil:question_text>If FTP services are not installed, this is not applicable.

To verify this configuration, run the following command:

grep "banner_file" /etc/vsftpd/vsftpd.conf


The output should show the value of banner_file is set to /etc/issue, an example of which is shown below:

$ sudo grep "banner_file" /etc/vsftpd/vsftpd.conf

banner_file=/etc/issue
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kerberos_disable_no_keytab_question:question:1">
          <ocil:question_text>Run the following command to see if there are some keytabs
that would potentially allow the use of Kerberos by system daemons.
$ ls -la /etc/*.keytab
The expected result is
ls: cannot access '/etc/*.keytab': No such file or directory
      Is it the case that a keytab file is present on the system?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_openldap-clients_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the openldap-clients package is installed:
$ rpm -q openldap-clients
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-postfix_client_configure_mail_alias_question:question:1">
          <ocil:question_text>Find the list of alias maps used by the Postfix mail server:
$ sudo postconf alias_maps
Query the Postfix alias maps for an alias for the root user:
$ sudo postmap -q root hash:/etc/aliases
The output should return an alias.
      Is it the case that the alias is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-postfix_client_configure_relayhost_question:question:1">
          <ocil:question_text>Run the following command to ensure postfix routes mail to this system:
$ grep relayhost /etc/postfix/main.cf
If properly configured, the output should show only .
      Is it the case that it is not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_sendmail_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the sendmail package is installed:
$ rpm -q sendmail
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-nfs_no_anonymous_question:question:1">
          <ocil:question_text>Inspect the mounts configured in /etc/exports. Each mount should specify a value
greater than UID_MAX and GID_MAX as defined in /etc/login.defs.
      Is it the case that anonuid or anongid are not set to a value greater than UID_MAX (for anonuid) and GID_MAX (for anongid)?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_nfs_disabled_question:question:1">
          <ocil:question_text>
To check that the nfs-server service is disabled in system boot configuration,
run the following command:
$ sudo systemctl is-enabled nfs-server
Output should indicate the nfs-server service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ sudo systemctl is-enabled nfs-server disabled

Run the following command to verify nfs-server is not active (i.e. not running) through current runtime configuration:
$ sudo systemctl is-active nfs-server

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the nfs-server is masked, run the following command:
$ sudo systemctl show nfs-server | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that the "nfs-server" is loaded and not masked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_rpcsvcgssd_disabled_question:question:1">
          <ocil:question_text>
To check that the rpcsvcgssd service is disabled in system boot configuration,
run the following command:
$ sudo systemctl is-enabled rpcsvcgssd
Output should indicate the rpcsvcgssd service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ sudo systemctl is-enabled rpcsvcgssd disabled

Run the following command to verify rpcsvcgssd is not active (i.e. not running) through current runtime configuration:
$ sudo systemctl is-active rpcsvcgssd

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the rpcsvcgssd is masked, run the following command:
$ sudo systemctl show rpcsvcgssd | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that the "rpcsvcgssd" is loaded and not masked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_all_squash_exports_question:question:1">
          <ocil:question_text>To verify all squashing has been disabled, run the following command:
$ grep all_squash /etc/exports
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_insecure_locks_exports_question:question:1">
          <ocil:question_text>To verify insecure file locking has been disabled, run the following command:
$ grep insecure_locks /etc/exports
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_nfs-utils_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the nfs-utils package is installed:
$ rpm -q nfs-utils
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-chronyd_client_only_question:question:1">
          <ocil:question_text>To verify that port has been set properly, perform the following:
$ grep '\bport\b' /etc/chrony.conf
The output should return
port 0
      Is it the case that port is not set or port is set to non-zero value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-chronyd_no_chronyc_network_question:question:1">
          <ocil:question_text>To verify that cmdport has been set properly, perform the following:
$ grep '\bcmdport\b' /etc/chrony.conf
The output should return
cmdport 0
      Is it the case that cmdport is not set or cmdport is set to non-zero value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-chronyd_or_ntpd_set_maxpoll_question:question:1">
          <ocil:question_text>Verify Fedora is securely comparing internal information system clocks at a regular interval with an NTP server with the following commands:

To verify that maxpoll has been set properly, perform the following:
$ sudo grep maxpoll /etc/ntp.conf /etc/chrony.conf
The output should return:
maxpoll .
      Is it the case that maxpoll does not exist or maxpoll has not been set to the expected value of &lt;sub idref="var_time_service_set_maxpoll" /&gt;?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-chronyd_or_ntpd_specify_remote_server_question:question:1">
          <ocil:question_text>To verify that a remote NTP service is configured for time synchronization,
open the following file:

/etc/chrony.conf in the case the system in question is
configured to use the chronyd as the NTP daemon (default setting)
/etc/ntp.conf in the case the system in question is configured
to use the ntpd as the NTP daemon

In the file, there should be a section similar to the following:
server ntpserver
      Is it the case that this is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-chronyd_run_as_chrony_user_question:question:1">
          <ocil:question_text>Run the following command and verify that -u chrony is included in OPTIONS:
# grep "^OPTIONS" /etc/sysconfig/chronyd
OPTIONS="-u chrony"
      Is it the case that chronyd is not running under chrony user account?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-chronyd_server_directive_question:question:1">
          <ocil:question_text>Run the following command and verify that time sources are only configure with server directive:
# grep -E "^(server|pool)" /etc/chrony.conf
A line with the appropriate server should be returned, any line returned starting with pool is a finding.
      Is it the case that a remote time server is not configured or configured with pool directive?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-chronyd_specify_remote_server_question:question:1">
          <ocil:question_text>Run the following command and verify remote server is configured properly:
# grep -E "^(server|pool)" /etc/chrony.conf
      Is it the case that a remote time server is not configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ntpd_configure_restrictions_question:question:1">
          <ocil:question_text>Run the following command and verify output matches:
# grep "^restrict" /etc/ntp.conf

restrict -4 default kod nomodify notrap nopeer noquery
restrict -6 default kod nomodify notrap nopeer noquery

The -4 in the first line is optional and options after default can appear in any order.
Additional restriction lines may exist.
      Is it the case that restrictions are not configured for ntpd?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ntpd_run_as_ntp_user_question:question:1">
          <ocil:question_text>To verify that ntpd is configured to correctly run under the ntp user,
run the following commands:
$ sudo grep "^OPTIONS" /etc/sysconfig/ntpd
The output should contain
OPTIONS="-u ntp:ntp"
$ sudo grep "^ExecStart" /usr/lib/systemd/system/ntpd.service
The output should contain
ExecStart=/usr/sbin/ntpd -u ntp:ntp $OPTIONS
      Is it the case that ntpd is not running under ntp user account?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ntpd_specify_remote_server_question:question:1">
          <ocil:question_text>To verify that a remote NTP service is configured for time synchronization,
open the following file:
/etc/ntp.conf
In the file, there should be a section similar to the following:
server ntpserver
      Is it the case that this is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_chrony_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the chrony package is installed: $ rpm -q chrony
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_ntp_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the ntp package is installed: $ rpm -q ntp
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_chronyd_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
chronyd service:
$ sudo systemctl is-active chronyd
If the service is running, it should return the following: active
      Is it the case that the chronyd process is not running?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_chronyd_or_ntpd_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
chronyd service:
$ sudo systemctl is-active chronyd
If the service is running, it should return the following: active


Run the following command to determine the current status of the
ntpd service:
$ sudo systemctl is-active ntpd
If the service is running, it should return the following: active
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_ntp_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
ntp service:
$ sudo systemctl is-active ntp
If the service is running, it should return the following: active
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_ntpd_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
ntpd service:
$ sudo systemctl is-active ntpd
If the service is running, it should return the following: active
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_rsh_trust_files_question:question:1">
          <ocil:question_text>The existence of the file /etc/hosts.equiv or a file named
.rhosts inside a user home directory indicates the presence
of an Rsh trust relationship.
      Is it the case that these files exist?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_rsyncd_disabled_question:question:1">
          <ocil:question_text>
To check that the rsyncd service is disabled in system boot configuration,
run the following command:
$ sudo systemctl is-enabled rsyncd
Output should indicate the rsyncd service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ sudo systemctl is-enabled rsyncd disabled

Run the following command to verify rsyncd is not active (i.e. not running) through current runtime configuration:
$ sudo systemctl is-active rsyncd

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the rsyncd is masked, run the following command:
$ sudo systemctl show rsyncd | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that the "rsyncd" is loaded and not masked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_rngd_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
rngd service:
$ sudo systemctl is-active rngd
If the service is running, it should return the following: active
      Is it the case that the service is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_net-snmp_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the net-snmp package is installed:
$ rpm -q net-snmp
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-snmpd_no_rwusers_question:question:1">
          <ocil:question_text>To ensure there are no read-write users, run the following command:
$ sudo grep -v "^#" /etc/snmp/snmpd.conf| grep 'rwuser'
There should be no output.
      Is it the case that there are users who can write to SNMP values?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-snmpd_not_default_password_question:question:1">
          <ocil:question_text>To ensure the default password is not set, run the following command:
$ sudo grep -v "^#" /etc/snmp/snmpd.conf| grep -E 'public|private'
There should be no output.
      Is it the case that the default SNMP passwords public and private have not been changed or removed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-snmpd_use_newer_protocol_question:question:1">
          <ocil:question_text>To ensure only SNMPv3 or newer is used, run the following command:
$ sudo grep 'rocommunity\|rwcommunity\|com2sec' /etc/snmp/snmpd.conf | grep -v "^#"
There should be no output.
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-disable_host_auth_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's HostbasedAuthentication option is set, run the following command:

$ sudo grep -i HostbasedAuthentication /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
$ sudo grep -i HostbasedAuthentication /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

If a line indicating no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_allow_only_protocol2_question:question:1">
          <ocil:question_text>To check which SSH protocol version is allowed, check version of openssh-server with following command:

$ rpm -qi openssh-server | grep Version

Versions equal to or higher than 7.4 only allow Protocol 2.
If version is lower than 7.4, run the following command to check configuration:
$ sudo grep Protocol /etc/ssh/sshd_config
If configured properly, output should be Protocol 2
      Is it the case that it is commented out or is not set correctly to Protocol 2?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_compression_question:question:1">
          <ocil:question_text>To check if compression is enabled or set correctly, run the
following command:
$ sudo grep Compression /etc/ssh/sshd_config
If configured properly, output should be no or delayed.
      Is it the case that it is commented out, or is not set to no or delayed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_empty_passwords_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's PermitEmptyPasswords option is set, run the following command:

$ sudo grep -i PermitEmptyPasswords /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
$ sudo grep -i PermitEmptyPasswords /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

If a line indicating no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_gssapi_auth_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's GSSAPIAuthentication option is set, run the following command:

$ sudo grep -i GSSAPIAuthentication /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
$ sudo grep -i GSSAPIAuthentication /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

If a line indicating no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_kerb_auth_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's KerberosAuthentication option is set, run the following command:

$ sudo grep -i KerberosAuthentication /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
$ sudo grep -i KerberosAuthentication /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

If a line indicating no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_pubkey_auth_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's PubkeyAuthentication option is set, run the following command:

$ sudo grep -i PubkeyAuthentication /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf


If a line indicating no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_rhosts_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's IgnoreRhosts option is set, run the following command:

$ sudo grep -i IgnoreRhosts /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
$ sudo grep -i IgnoreRhosts /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

If a line indicating yes is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_rhosts_rsa_question:question:1">
          <ocil:question_text>To check which SSH protocol version is allowed, check version of
openssh-server with following command:
$ rpm -qi openssh-server | grep Version
Versions equal to or higher than 7.4 have deprecated the RhostsRSAAuthentication option.
If version is lower than 7.4, run the following command to check configuration:
To determine how the SSH daemon's RhostsRSAAuthentication option is set, run the following command:

$ sudo grep -i RhostsRSAAuthentication /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf


If a line indicating no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_root_login_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's PermitRootLogin option is set, run the following command:

$ sudo grep -i PermitRootLogin /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf


If a line indicating no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_root_password_login_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's PermitRootLogin option is set, run the following command:

$ sudo grep -i PermitRootLogin /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf


If a line indicating prohibit-password is returned, then the required value is set.
      Is it the case that it is commented out or not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_tcp_forwarding_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's AllowTcpForwarding option is set, run the following command:

$ sudo grep -i AllowTcpForwarding /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf


If a line indicating no is returned, then the required value is set.
      Is it the case that The AllowTcpForwarding option exists and is disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_user_known_hosts_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's IgnoreUserKnownHosts option is set, run the following command:

$ sudo grep -i IgnoreUserKnownHosts /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf


If a line indicating yes is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_x11_forwarding_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's X11Forwarding option is set, run the following command:

$ sudo grep -i X11Forwarding /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
$ sudo grep -i X11Forwarding /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

If a line indicating no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_do_not_permit_user_env_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's PermitUserEnvironment option is set, run the following command:

$ sudo grep -i PermitUserEnvironment /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
$ sudo grep -i PermitUserEnvironment /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

If a line indicating no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_enable_gssapi_auth_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's GSSAPIAuthentication option is set, run the following command:

$ sudo grep -i GSSAPIAuthentication /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf


If a line indicating yes is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_enable_pam_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's UsePAM option is set, run the following command:

$ sudo grep -i UsePAM /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf


If a line indicating yes is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_enable_pubkey_auth_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's PubkeyAuthentication option is set, run the following command:

$ sudo grep -i PubkeyAuthentication /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf


If a line indicating yes is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_enable_strictmodes_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's StrictModes option is set, run the following command:

$ sudo grep -i StrictModes /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
$ sudo grep -i StrictModes /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

If a line indicating yes is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_enable_warning_banner_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's Banner option is set, run the following command:

$ sudo grep -i Banner /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf


If a line indicating /etc/issue is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_enable_warning_banner_net_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's Banner option is set, run the following command:

$ sudo grep -i Banner /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf


If a line indicating /etc/issue.net is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_enable_x11_forwarding_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's X11Forwarding option is set, run the following command:

$ sudo grep -i X11Forwarding /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf


If a line indicating yes is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_limit_user_access_question:question:1">
          <ocil:question_text>To ensure sshd limits the users who can log in, run the following:
$ sudo grep AllowUsers /etc/ssh/sshd_config
If properly configured, the output should be a list of usernames allowed to log in
to this system.
      Is it the case that sshd does not limit the users who can log in?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_print_last_log_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's PrintLastLog option is set, run the following command:

$ sudo grep -i PrintLastLog /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
$ sudo grep -i PrintLastLog /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

If a line indicating yes is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_rekey_limit_question:question:1">
          <ocil:question_text>To check if RekeyLimit is set correctly, run the
following command:

$ sudo grep RekeyLimit /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*

If configured properly, output should be
RekeyLimit  
      Is it the case that it is commented out or is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_idle_timeout_question:question:1">
          <ocil:question_text>Run the following command to see what the timeout interval is:
$ sudo grep ClientAliveInterval /etc/ssh/sshd_config
If properly configured, the output should be:
ClientAliveInterval 
      Is it the case that it is commented out or not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_keepalive_question:question:1">
          <ocil:question_text>To ensure ClientAliveInterval is set correctly, run the following command:
$ sudo grep ClientAliveCountMax /etc/ssh/sshd_config
If properly configured, the output should be:
ClientAliveCountMax 
For SSH earlier than v8.2, a ClientAliveCountMax value of 0 causes an idle timeout precisely when
the ClientAliveInterval is set.  Starting with v8.2, a value of 0 disables the timeout
functionality completely.
If the option is set to a number greater than 0, then the idle session will be disconnected after
ClientAliveInterval * ClientAliveCountMax seconds.
      Is it the case that it is commented out or not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_keepalive_0_question:question:1">
          <ocil:question_text>To ensure ClientAliveInterval is set correctly, run the following command:

$ sudo grep ClientAliveCountMax /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf

If properly configured, the output should be:
ClientAliveCountMax 0

In this case, the SSH idle timeout occurs precisely when
the ClientAliveInterval is set.
      Is it the case that it is commented out or not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_login_grace_time_question:question:1">
          <ocil:question_text>To ensure LoginGraceTime is set correctly, run the following command:
$ sudo grep LoginGraceTime /etc/ssh/sshd_config
If properly configured, the output should be:
LoginGraceTime 
If the option is set to a number greater than 0, then the unauthenticated session will be disconnected
after the configured number seconds.
      Is it the case that it is commented out or not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_loglevel_info_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's LogLevel option is set, run the following command:

$ sudo grep -i LogLevel /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
$ sudo grep -i LogLevel /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

If a line indicating INFO is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_loglevel_verbose_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's LogLevel option is set, run the following command:

$ sudo grep -i LogLevel /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf


If a line indicating VERBOSE is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_max_auth_tries_question:question:1">
          <ocil:question_text>To ensure the MaxAuthTries parameter is set, run the following command:
$ sudo grep MaxAuthTries /etc/ssh/sshd_config
If properly configured, output should be:
MaxAuthTries 
      Is it the case that it is commented out or not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_max_sessions_question:question:1">
          <ocil:question_text>Run the following command to see what the max sessions number is:
$ sudo grep MaxSessions /etc/ssh/sshd_config
If properly configured, the output should be:
MaxSessions 
      Is it the case that MaxSessions is not configured or not configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_maxstartups_question:question:1">
          <ocil:question_text>To check if MaxStartups is configured, run the following command:
$ sudo grep MaxStartups /etc/ssh/sshd_config
If configured, this command should output the configuration.
      Is it the case that maxstartups is not configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_use_directory_configuration_question:question:1">
          <ocil:question_text>To determine whether the SSH server includes configuration files from the right directory, run the following command:
$ sudo grep -i '^Include' /etc/ssh/sshd_config
If a line Include /etc/ssh/sshd_config.d/*.conf is returned, then the configuration file inclusion is set correctly.
      Is it the case that you don't include other configuration files from the main configuration file?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_use_priv_separation_question:question:1">
          <ocil:question_text>To check if UsePrivilegeSeparation is enabled or set correctly, run the
following command:
$ sudo grep UsePrivilegeSeparation /etc/ssh/sshd_config
If configured properly, output should be .
      Is it the case that it is commented out or is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_x11_use_localhost_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's X11UseLocalhost option is set, run the following command:

$ sudo grep -i X11UseLocalhost /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
$ sudo grep -i X11UseLocalhost /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

If a line indicating yes is returned, then the required value is set.
      Is it the case that the display proxy is listening on wildcard address?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_sshd_private_key_question:question:1">
          <ocil:question_text>To check the permissions of /etc/ssh/*_key,
run the command:
$ ls -l /etc/ssh/*_key
If properly configured, the output should indicate the following permissions:
-rw-------
      Is it the case that /etc/ssh/*_key does not have unix mode -rw-------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_sshd_pub_key_question:question:1">
          <ocil:question_text>To check the permissions of /etc/ssh/*.pub,
run the command:
$ ls -l /etc/ssh/*.pub
If properly configured, the output should indicate the following permissions:
-rw-r--r--
      Is it the case that /etc/ssh/*.pub does not have unix mode -rw-r--r--?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_openssh-server_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the openssh-server package is installed: $ rpm -q openssh-server
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_openssh-server_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the openssh-server package is installed: $ rpm -q openssh-server
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_sssd-ipa_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the sssd-ipa package is installed: $ rpm -q sssd-ipa
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sssd_certificate_verification_question:question:1">
          <ocil:question_text>Check to see if Online Certificate Status Protocol (OCSP)
is enabled and using the proper digest value on the system with the following command:
$ sudo grep certificate_verification /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf | grep -v "^#"
If configured properly, output should look like

    certificate_verification = ocsp_dgst=

      Is it the case that certificate_verification in sssd is not configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sssd_enable_certmap_question:question:1">
          <ocil:question_text>To verify Certmap is enabled in SSSD, run the following command:
$ cat sudo cat /etc/sssd/sssd.conf
If configured properly, output should contain section like the following

[certmap/testing.test/rule_name]
matchrule =&lt;SAN&gt;.*EDIPI@mil
maprule = (userCertificate;binary={cert!bin})
domains = testing.test

      Is it the case that Certmap is not configured in SSSD?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sssd_enable_smartcards_question:question:1">
          <ocil:question_text>To verify that smart cards are enabled in SSSD, run the following command:
$ sudo grep pam_cert_auth /etc/sssd/sssd.conf
If configured properly, output should be
pam_cert_auth = true
      Is it the case that smart cards are not enabled in SSSD?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sssd_memcache_timeout_question:question:1">
          <ocil:question_text>To verify that SSSD's in-memory cache expires after a day, run the following command:
$ sudo grep memcache_timeout /etc/sssd/sssd.conf
If configured properly, output should be memcache_timeout = .
      Is it the case that it does not exist or is not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sssd_offline_cred_expiration_question:question:1">
          <ocil:question_text>To verify that SSSD expires offline credentials, run the following command:
$ sudo grep offline_credentials_expiration /etc/sssd/sssd.conf
If configured properly, output should be
offline_credentials_expiration = 1
      Is it the case that it does not exist or is not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sssd_run_as_sssd_user_question:question:1">
          <ocil:question_text>To verify that SSSD is configured to run as user sssd, run the following command:
$ sudo grep -r '\buser\b' /etc/sssd
If configured properly, output should similar to /etc/sssd/conf.d/ospp.conf:user = sssd.
Sanity of SSSD configuration in general can be checked using $ sudo sssctl config-check
      Is it the case that it does not exist or is not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sssd_ssh_known_hosts_timeout_question:question:1">
          <ocil:question_text>To verify that SSSD expires known SSH host keys, run the following command:
$ sudo grep ssh_known_hosts_timeout /etc/sssd/sssd.conf
If configured properly, output should be
ssh_known_hosts_timeout = 
      Is it the case that it does not exist or is not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_usbguard_auditbackend_question:question:1">
          <ocil:question_text>To verify that Linux Audit logging is enabled for the USBGuard daemon,
run the following command:
$ sudo grep AuditBackend /etc/usbguard/usbguard-daemon.conf
The output should be
AuditBackend=LinuxAudit
      Is it the case that AuditBackend is not set to LinuxAudit?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_usbguard_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the usbguard package is installed: $ rpm -q usbguard
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_usbguard_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
usbguard service:
$ sudo systemctl is-active usbguard
If the service is running, it should return the following: active
      Is it the case that the service is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-usbguard_allow_hid_question:question:1">
          <ocil:question_text>To verify that USB Human Interface Devices will be authorized by the USBGuard daemon,
run the following command:
$ sudo grep allow /etc/usbguard/rules.conf
The output lines should include
allow with-interface match-all { 03:*:* }
      Is it the case that USB devices of class 3 are not authorized?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-usbguard_allow_hid_and_hub_question:question:1">
          <ocil:question_text>To verify that USB Human Interface Devices and hubs will be authorized by the USBGuard daemon,
run the following command:
$ sudo grep allow /etc/usbguard/rules.conf
The output lines should include
allow with-interface match-all { 03:*:* 09:00:* }
      Is it the case that USB devices of class 3 and 9:00 are not authorized?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-usbguard_allow_hub_question:question:1">
          <ocil:question_text>To verify that USB hubs will be authorized by the USBGuard daemon,
run the following command:
$ sudo grep allow /etc/usbguard/rules.conf
One of the output lines should be
allow with-interface match-all { 09:00:* }
      Is it the case that USB devices of class 9 are not authorized?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_xorg-x11-server-common_removed_question:question:1">
          <ocil:question_text>To ensure the X Windows package group is removed, run the following command:
$ rpm -qi xorg-x11-server-common
The output should be:
package xorg-x11-server-common is not installed
      Is it the case that the X Windows package group or xorg-x11-server-common has not be removed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-xwindows_runlevel_target_question:question:1">
          <ocil:question_text>To verify the default target is multi-user, run the following command:
$ systemctl get-default
The output should show the following:
multi-user.target
      Is it the case that the X windows display server is running and/or has not been disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_banner_enabled_question:question:1">
          <ocil:question_text>To ensure a login warning banner is enabled, run the following:
$ grep banner-message-enable /etc/dconf/db/distro.d/*
If properly configured, the output should be true.
To ensure a login warning banner is locked and cannot be changed by a user, run the following:
$ grep banner-message-enable /etc/dconf/db/distro.d/locks/*
If properly configured, the output should be /org/gnome/login-screen/banner-message-enable.
      Is it the case that it is not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_login_banner_text_question:question:1">
          <ocil:question_text>
To ensure the login warning banner text is properly set, run the following:
$ grep banner-message-text /etc/dconf/db/distro.d/*
If properly configured, the proper banner text will appear.
To ensure the login warning banner text is locked and cannot be changed by a user, run the following:
$ grep banner-message-text /etc/dconf/db/distro.d/locks/*
If properly configured, the output should be /org/gnome/login-screen/banner-message-text.
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-banner_etc_issue_question:question:1">
          <ocil:question_text>To check if the system login banner is compliant,
run the following command:
$ cat /etc/issue
      Is it the case that it does not display the required banner?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-banner_etc_motd_question:question:1">
          <ocil:question_text>To check if the system login banner is compliant,
run the following command:
$ cat /etc/motd
      Is it the case that it does not display the required banner?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_etc_issue_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/issue,
run the command:
$ ls -lL /etc/issue
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/issue does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_etc_motd_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/motd,
run the command:
$ ls -lL /etc/motd
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/motd does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_etc_issue_question:question:1">
          <ocil:question_text>To check the ownership of /etc/issue,
run the command:
$ ls -lL /etc/issue
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/issue does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_etc_motd_question:question:1">
          <ocil:question_text>To check the ownership of /etc/motd,
run the command:
$ ls -lL /etc/motd
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/motd does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_issue_question:question:1">
          <ocil:question_text>To check the permissions of /etc/issue,
run the command:
$ ls -l /etc/issue
If properly configured, the output should indicate the following permissions:
-rw-r--r--
      Is it the case that /etc/issue does not have unix mode -rw-r--r--?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_motd_question:question:1">
          <ocil:question_text>To check the permissions of /etc/motd,
run the command:
$ ls -l /etc/motd
If properly configured, the output should indicate the following permissions:
-rw-r--r--
      Is it the case that /etc/motd does not have unix mode -rw-r--r--?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_pwhistory_remember_password_auth_question:question:1">
          <ocil:question_text>Check that the operating system prohibits the reuse of a password for
a minimum of  generations with the following command:
# grep pam_pwhistory.so /etc/pam.d/password-auth
password  pam_pwhistory.so remember= use_authtok
If the command does not return a result, or the returned line is commented
out, has a second column value different from , does not contain
"remember" value, or the value is less than
, this is a finding.
      Is it the case that the value of remember is not set equal to or greater than &lt;sub idref="var_password_pam_remember" /&gt;?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_pwhistory_remember_system_auth_question:question:1">
          <ocil:question_text>Check that the operating system prohibits the reuse of a password for a minimum of
 generations with the following command:
# grep pam_pwhistory.so /etc/pam.d/system-auth
password  pam_pwhistory.so remember= use_authtok
If the command does not return a result, or the returned line is commented out, has a second
column value different from ,
does not contain "remember" value, or the value is less than ,
this is a finding.
      Is it the case that the value of remember is not set equal to or greater than &lt;sub idref="var_password_pam_remember" /&gt;?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_unix_remember_question:question:1">
          <ocil:question_text>To verify the password reuse setting is compliant, run the following command:
$ grep remember /etc/pam.d/system-auth
The output should show the following at the end of the line:
remember=
      Is it the case that the value of remember is not equal to or greater than the expected value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_passwords_pam_faillock_deny_question:question:1">
          <ocil:question_text>To ensure the failed password attempt policy is configured correctly, run the following command:

$ grep deny /etc/security/faillock.conf
The output should show deny=.
      Is it the case that limiting the number of failed logon attempts for users is not configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_passwords_pam_faillock_deny_root_question:question:1">
          <ocil:question_text>To ensure that even the root account is locked after a defined number of failed password
attempts, run the following command:

$ grep even_deny_root /etc/security/faillock.conf
The output should show even_deny_root.
      Is it the case that limiting the number of failed logon attempts for the root user is not configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_passwords_pam_faillock_enforce_local_question:question:1">
          <ocil:question_text>To check if only local user are impacted by pam_faillock, run the following command:
$ grep local_users_only /etc/security/faillock.conf
The output should return local_users_only not commented.
      Is it the case that local_users_only is not uncommented or configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_passwords_pam_faillock_interval_question:question:1">
          <ocil:question_text>To ensure the failed password attempt policy is configured correctly, run the following command:

$ grep fail_interval /etc/security/faillock.conf
The output should show fail_interval = &lt;interval-in-seconds&gt; where interval-in-seconds is  or greater.
      Is it the case that fail_interval is less than the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_question:question:1">
          <ocil:question_text>To ensure the failed password attempt policy is configured correctly, run the following command:

$ grep fail_interval /etc/security/faillock.conf
The output should show unlock_time = &lt;interval-in-seconds&gt; where interval-in-seconds is  or greater.

It can also be 0 or never.
      Is it the case that unlock_time is less than the expected value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_dcredit_question:question:1">
          <ocil:question_text>To check how many digits are required in a password, run the following command:
$ grep dcredit /etc/security/pwquality.conf
The dcredit parameter (as a negative number) will indicate how many digits are required.
      Is it the case that dcredit is not found or not equal to or less than the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_dictcheck_question:question:1">
          <ocil:question_text>To check if dictionary words are disallowed run the following command:
$ sudo grep dictcheck /etc/security/pwquality.conf /etc/pwquality.conf.d/*.conf
The dictcheck parameter should be equal to 1. The value should look like
dictcheck=1
      Is it the case that dictcheck is not found or not equal to the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_difok_question:question:1">
          <ocil:question_text>To check how many characters must differ during a password change, run the following command:
$ sudo grep difok /etc/security/pwquality.conf
difok = 

The difok parameter will indicate how many characters must differ.
      Is it the case that difok is not found or set to less than the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_enforce_local_question:question:1">
          <ocil:question_text>To verify if password complexities are only enforce on local users, run the following command:
$ grep local_users_only /etc/security/pwquality.conf
The output should return local_users_only uncommented.
      Is it the case that local_users_only is not uncommented or configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_enforce_root_question:question:1">
          <ocil:question_text>To verify if root user is required to use complex passwords, run the following command:
$ grep enforce_for_root /etc/security/pwquality.conf
The output should return enforce_for_root uncommented.
      Is it the case that enforce_for_root is commented or not present?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_lcredit_question:question:1">
          <ocil:question_text>To check how many lowercase characters are required in a password, run the following command:
$ grep lcredit /etc/security/pwquality.conf
The lcredit parameter (as a negative number) will indicate how many special characters are required.
      Is it the case that lcredit is not found or not less than or equal to the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_maxclassrepeat_question:question:1">
          <ocil:question_text>To check the value for maximum consecutive repeating characters, run the following command:
$ sudo grep maxclassrepeat /etc/security/pwquality.conf
      Is it the case that the value of "maxclassrepeat" is set to "0", more than "&lt;sub idref="var_password_pam_maxclassrepeat" /&gt;" or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_maxrepeat_question:question:1">
          <ocil:question_text>To check the maximum value for consecutive repeating characters, run the following command:
$ sudo grep maxrepeat /etc/security/pwquality.conf
      Is it the case that the value of "maxrepeat" is set to more than "&lt;sub idref="var_password_pam_maxrepeat" /&gt;" or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_minclass_question:question:1">
          <ocil:question_text>To check how many categories of characters must be used in password during a password change,
run the following command:
$ sudo grep minclass /etc/security/pwquality.conf
The minclass parameter will indicate how many character classes must be used. If
the requirement was for the password to contain characters from  different categories,
then this would appear as minclass = .
      Is it the case that the value of "minclass" is set to less than "&lt;sub idref="var_password_pam_minclass" /&gt;" or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_minlen_question:question:1">
          <ocil:question_text>To check how many characters are required in a password, run the following command:
$ grep minlen /etc/security/pwquality.conf
Your output should contain minlen = 
      Is it the case that minlen is not found, or not equal to or greater than the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_ocredit_question:question:1">
          <ocil:question_text>To check how many special characters are required in a password, run the following command:
$ grep ocredit /etc/security/pwquality.conf
The ocredit parameter (as a negative number) will indicate how many special
characters are required.
      Is it the case that value of "ocredit" is a positive number or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_pwquality_password_auth_question:question:1">
          <ocil:question_text>To check if pam_pwhistory.so is enabled in password-auth, run the following command:
$ grep pam_pwquality /etc/pam.d/password-auth
The output should be similar to the following:
password    requisite                                    pam_pwquality.so
      Is it the case that pam_pwquality.so is not enabled in password-auth?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_pwquality_system_auth_question:question:1">
          <ocil:question_text>To check if pam_pwhistory.so is enabled in system-auth, run the following command:
$ grep pam_pwquality /etc/pam.d/system-auth
The output should be similar to the following:
password    requisite                                    pam_pwquality.so
      Is it the case that pam_pwquality.so is not enabled in system-auth?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_retry_question:question:1">
          <ocil:question_text>To check how many retry attempts are permitted on a per-session basis, run the following command:


$ grep pam_pwquality /etc/pam.d/system-auth


The retry parameter will indicate how many attempts are permitted.
The DoD required value is less than or equal to 3.
This would appear as retry=, or a lower value.
      Is it the case that it is not the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_ucredit_question:question:1">
          <ocil:question_text>To check how many uppercase characters are required in a password, run the following command:
$ grep ucredit /etc/security/pwquality.conf
The ucredit parameter (as a negative number) will indicate how many uppercase characters are required.
This would appear as ucredit = -1.
      Is it the case that ucredit is not found or not set to the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-set_password_hashing_algorithm_libuserconf_question:question:1">
          <ocil:question_text>Verify that the libuser is set to encrypt password with a FIPS 140-2 approved cryptographic hashing algorithm.

Check the hashing algorithm that is being used to hash passwords with the following command:

$ sudo grep -i crypt_style /etc/libuser.conf

crypt_style = sha512
      Is it the case that crypt_style is not set to sha512?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-set_password_hashing_algorithm_logindefs_question:question:1">
          <ocil:question_text>Verify that the shadow password suite configuration is set to encrypt password with a FIPS 140-2 approved cryptographic hashing algorithm.

Check the hashing algorithm that is being used to hash passwords with the following command:

$ sudo grep -i ENCRYPT_METHOD /etc/login.defs

ENCRYPT_METHOD SHA512
      Is it the case that ENCRYPT_METHOD is not set to SHA512?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-set_password_hashing_algorithm_passwordauth_question:question:1">
          <ocil:question_text>Inspect the password section of /etc/pam.d/password-auth
and ensure that the pam_unix.so module includes the argument
sha512:
$ grep sha512 /etc/pam.d/password-auth
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-set_password_hashing_algorithm_systemauth_question:question:1">
          <ocil:question_text>Inspect the password section of /etc/pam.d/password-auth
and ensure that the pam_unix.so module  is configured to use the argument
sha512:

$ sudo grep "^password.*pam_unix.so.*sha512" /etc/pam.d/password-auth

password sufficient pam_unix.so sha512
      Is it the case that "sha512" is missing, or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-disallow_bypass_password_sudo_question:question:1">
          <ocil:question_text>Verify the operating system is not configured to bypass password requirements for privilege
escalation. Check the configuration of the "/etc/pam.d/sudo" file with the following command:
$ sudo grep pam_succeed_if /etc/pam.d/sudo
      Is it the case that system is configured to bypass password requirements for privilege escalation?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-display_login_attempts_question:question:1">
          <ocil:question_text>To ensure that last logon/access notification is configured correctly, run
the following command:
$ grep pam_lastlog.so /etc/pam.d/postlogin
The output should show output showfailed and must not contain
silent.
      Is it the case that that is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-enable_pam_namespace_question:question:1">
          <ocil:question_text>To check if pam_namespace.so is required for user login, run the following command:
$ grep pam_namespace.so /etc/pam.d/login
The output should return the following uncommented:
session    required     pam_namespace.so
      Is it the case that pam_namespace.so is not required or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_bashrc_exec_tmux_question:question:1">
          <ocil:question_text>To verify that tmux is configured to execute,
run the following command:
$ grep -A1 -B3 "case ..name. in sshd|login) exec tmux ;; esac" /etc/bashrc /etc/profile.d/*
The output should return the following:
if [ "$PS1" ]; then
  parent=$(ps -o ppid= -p $$)
  name=$(ps -o comm= -p $parent)
  case "$name" in sshd|login) exec tmux ;; esac
fi
      Is it the case that exec tmux is not present at the end of bashrc?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_tmux_lock_after_time_question:question:1">
          <ocil:question_text>To verify that session locking after period of inactivity is configured in tmux,
run the following command:
$ grep lock-after-time /etc/tmux.conf
The output should return the following:
set -g lock-after-time 900
      Is it the case that lock-after-time is not set to 900 or set to zero?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_tmux_lock_command_question:question:1">
          <ocil:question_text>To verify that vlock is configured as a locking mechanism in tmux, run the following command:
$ grep lock-command /etc/tmux.conf
The output should return the following:
set -g lock-command vlock
      Is it the case that lock-command is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_tmux_in_shells_question:question:1">
          <ocil:question_text>To verify that tmux is not listed as allowed shell on the system
run the following command:
$ grep 'tmux$' /etc/shells
The output should be empty.
      Is it the case that tmux is listed in /etc/shells?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_screen_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the screen package is installed: $ rpm -q screen
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_tmux_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the tmux package is installed: $ rpm -q tmux
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_opensc_card_drivers_question:question:1">
          <ocil:question_text>To verify that  is configured
as the smart card driver, run the following command:
$ grep card_drivers /etc/opensc.conf
The output should return something similar to:
card_drivers = ;
      Is it the case that the smart card driver is not configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_opensc_nss_db_question:question:1">
          <ocil:question_text>To verify that opensc is configured in the NSS database,
run the following command:
$ pkcs11-switch
The output should return opensc
      Is it the case that opensc is not in use by the nss database?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-force_opensc_card_drivers_question:question:1">
          <ocil:question_text>To verify that  is configured
as the smart card driver, run the following command:
$ grep force_card_driver /etc/opensc.conf
The output should return something similar to:
force_card_drivers = ;
      Is it the case that the smart card driver is not configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-install_smartcard_packages_question:question:1">
          <ocil:question_text>Check that Fedora has the packages for smart card support installed.

Run the following command to determine if the openssl-pkcs11 package is installed:
$ rpm -q openssl-pkcs11
      Is it the case that smartcard software is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_opensc_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the opensc package is installed: $ rpm -q opensc
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_pcsc-lite_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the pcsc-lite package is installed: $ rpm -q pcsc-lite
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_pcscd_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
pcscd service:
$ sudo systemctl is-active pcscd
If the service is running, it should return the following: active
      Is it the case that the pcscd service is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-smartcard_auth_question:question:1">
          <ocil:question_text>Interview the SA to determine if all accounts not exempted by policy are
using CAC authentication. For DoD systems, the following systems and
accounts are exempt from using smart card (CAC) authentication:

SIPRNET systems
Standalone systems
Application accounts
Temporary employee accounts, such as students or interns, who cannot
easily receive a CAC or PIV
Operational tactical locations that are not collocated with RAPIDS
workstations to issue CAC or ALT
Test systems, such as those with an Interim Approval to Test (IATT) and
use a separate VPN, firewall, or security measure preventing access to
network and system components from outside the protection boundary
documented in the IATT.

      Is it the case that non-exempt accounts are not using CAC authentication?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-disable_ctrlaltdel_reboot_question:question:1">
          <ocil:question_text>To ensure the system is configured to mask the Ctrl-Alt-Del sequence, Check
that the ctrl-alt-del.target is masked and not active with the following
command:
sudo systemctl status ctrl-alt-del.target
The output should indicate that the target is masked and not active. It
might resemble following output:
ctrl-alt-del.target
Loaded: masked (/dev/null; bad)
Active: inactive (dead)
      Is it the case that the system is configured to reboot when Ctrl-Alt-Del is pressed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_disable_interactive_boot_question:question:1">
          <ocil:question_text>Inspect /etc/default/grub for any instances of
systemd.confirm_spawn=(1|yes|true|on) in the kernel boot arguments.
Presence of a systemd.confirm_spawn=(1|yes|true|on) indicates
that interactive boot is enabled at boot time and verify that
GRUB_DISABLE_RECOVERY=true to disable recovery boot.
      Is it the case that Interactive boot is enabled at boot time?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-require_emergency_target_auth_question:question:1">
          <ocil:question_text>To check if authentication is required for emergency mode, run the following command:
$ grep sulogin /usr/lib/systemd/system/emergency.service
The output should be similar to the following, and the line must begin with
ExecStart and /usr/lib/systemd/systemd-sulogin-shell.
    ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency
      Is it the case that the output is different?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-require_singleuser_auth_question:question:1">
          <ocil:question_text>To check if authentication is required for single-user mode, run the following command:
$ grep sulogin /usr/lib/systemd/system/rescue.service
The output should be similar to the following, and the line must begin with
ExecStart and /usr/lib/systemd/systemd-sulogin-shell.
    ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue
      Is it the case that the output is different?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_debug-shell_disabled_question:question:1">
          <ocil:question_text>
To check that the debug-shell service is disabled in system boot configuration,
run the following command:
$ sudo systemctl is-enabled debug-shell
Output should indicate the debug-shell service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ sudo systemctl is-enabled debug-shell disabled

Run the following command to verify debug-shell is not active (i.e. not running) through current runtime configuration:
$ sudo systemctl is-active debug-shell

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the debug-shell is masked, run the following command:
$ sudo systemctl show debug-shell | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that the "debug-shell" is loaded and not masked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-account_disable_post_pw_expiration_question:question:1">
          <ocil:question_text>To verify the INACTIVE setting, run the following command:
$ grep "INACTIVE" /etc/default/useradd
The output should indicate the INACTIVE configuration option is set
to an appropriate integer as shown in the example below:
$ grep "INACTIVE" /etc/default/useradd
INACTIVE=
      Is it the case that the value of INACTIVE is greater than the expected value or is -1?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-account_emergency_expire_date_question:question:1">
          <ocil:question_text>For every emergency account, run the following command
to obtain its account aging and expiration information:
$ sudo chage -l ACCOUNT_NAME
Verify each of these accounts has an expiration date set as documented.
      Is it the case that any emergency accounts have no expiration date set or do not expire within a documented time frame?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-account_temp_expire_date_question:question:1">
          <ocil:question_text>For every temporary account, run the following command
to obtain its account aging and expiration information:
$ sudo chage -l USER
Verify each of these accounts has an expiration date set as documented.
      Is it the case that any temporary accounts have no expiration date set or do not expire within a documented time frame?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-account_unique_name_question:question:1">
          <ocil:question_text>To verify all accounts have unique names, run the following command:
$ sudo getent passwd | awk -F: '{ print $1}' | uniq -d
No output should be returned.
      Is it the case that a line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-account_use_centralized_automated_auth_question:question:1">
          <ocil:question_text>Verify that the system is integrated with a centralized authentication mechanism
such as as Active Directory, Kerberos, Directory Server, etc. that has
automated account mechanisms in place.
      Is it the case that the system is not using a centralized authentication mechanism, or it is not automated?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_maximum_age_login_defs_question:question:1">
          <ocil:question_text>To check the maximum password age, run the command:
$ grep PASS_MAX_DAYS /etc/login.defs
The profile requirement is .
      Is it the case that PASS_MAX_DAYS is not set equal to or greater than the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_minimum_age_login_defs_question:question:1">
          <ocil:question_text>To check the minimum password age, run the command:
$ grep PASS_MIN_DAYS /etc/login.defs
      Is it the case that it is not equal to or greater than the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_minlen_login_defs_question:question:1">
          <ocil:question_text>To check the minimum password length, run the command:
$ grep PASS_MIN_LEN /etc/login.defs
The DoD requirement is 15.
      Is it the case that it is not set to the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_warn_age_login_defs_question:question:1">
          <ocil:question_text>To check the password warning age, run the command:
$ grep PASS_WARN_AGE /etc/login.defs
The DoD requirement is 7.
      Is it the case that it is not set to the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_all_shadowed_question:question:1">
          <ocil:question_text>To check that no password hashes are stored in
/etc/passwd, run the following command:
awk '!/\S:x|\*/ {print}' /etc/passwd
If it produces any output, then a password hash is
stored in /etc/passwd.
      Is it the case that any stored hashes are found in /etc/passwd?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_all_shadowed_sha512_question:question:1">
          <ocil:question_text>Check that the interactive user account passwords are using a strong
password hash with the following command:

$ sudo cut -d: -f2 /etc/shadow

$6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7f5JPV6GaJhNC2aK5F3PZpE/BCCtwrxRc/AInKMNX3CdMw11m9STiql12f/

Password hashes ! or * indicate inactive accounts not
available for logon and are not evaluated.

If any interactive user password hash does not begin with $6,
this is a finding.
      Is it the case that passwords hashed with an unauthorized algorithm are found in /etc/shadow?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_unix_rounds_password_auth_question:question:1">
          <ocil:question_text>To verify the number of rounds for the password hashing algorithm is configured, run the following command:
$ sudo grep rounds /etc/pam.d/password-auth
The output should show the following match:
password sufficient pam_unix.so sha512 rounds=
      Is it the case that rounds is not set to &lt;sub idref="var_password_pam_unix_rounds" /&gt; or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_unix_rounds_system_auth_question:question:1">
          <ocil:question_text>To verify the number of rounds for the password hashing algorithm is configured, run the following command:
$ sudo grep rounds /etc/pam.d/system-auth
The output should show the following match:
password sufficient pam_unix.so sha512 rounds=
      Is it the case that rounds is not set to &lt;sub idref="var_password_pam_unix_rounds" /&gt; or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-gid_passwd_group_same_question:question:1">
          <ocil:question_text>To ensure all GIDs referenced in /etc/passwd are defined in /etc/group,
run the following command:
$ sudo pwck -qr
There should be no output.
      Is it the case that GIDs referenced in /etc/passwd are returned as not defined in /etc/group?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_empty_passwords_question:question:1">
          <ocil:question_text>To verify that null passwords cannot be used, run the following command:

$ grep nullok /etc/pam.d/system-auth

If this produces any output, it may be possible to log into accounts
with empty passwords. Remove any instances of the nullok option to
prevent logins with empty passwords.
      Is it the case that NULL passwords can be used?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_empty_passwords_etc_shadow_question:question:1">
          <ocil:question_text>To verify that null passwords cannot be used, run the following command:
$ sudo awk -F: '!$2 {print $1}' /etc/shadow
If this produces any output, it may be possible to log into accounts
with empty passwords.
Configure all accounts on the system to have a password or lock
the account with the following commands:
Perform a password reset:
$ sudo passwd [username]
Lock an account:
$ sudo passwd -l [username]
      Is it the case that Blank or NULL passwords can be used?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_legacy_plus_entries_etc_group_question:question:1">
          <ocil:question_text>To check for legacy lines in /etc/group, run the following command:
 grep '^\+' /etc/group
The command should not return any output.
      Is it the case that the file contains legacy lines?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_legacy_plus_entries_etc_passwd_question:question:1">
          <ocil:question_text>To check for legacy lines in /etc/passwd, run the following command:
 grep '^\+' /etc/passwd
The command should not return any output.
      Is it the case that the file contains legacy lines?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_legacy_plus_entries_etc_shadow_question:question:1">
          <ocil:question_text>To check for legacy lines in /etc/shadow, run the following command:
 grep '^\+' /etc/shadow
The command should not return any output.
      Is it the case that the file contains legacy lines?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_netrc_files_question:question:1">
          <ocil:question_text>To check the system for the existence of any .netrc files,
run the following command:
$ sudo find /home -xdev -name .netrc
      Is it the case that any .netrc files exist?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_no_uid_except_zero_question:question:1">
          <ocil:question_text>To list all password file entries for accounts with UID 0, run the
following command:
$ awk -F: '($3 == \"0\") {print}' /etc/passwd
This should print only one line, for the user root.

If there is a finding, change the UID of the failing (non-root) user. If
the account is associated with the system commands or applications the UID
should be changed to one greater than 0 but less than
1000. Otherwise assign a UID of greater than 1000 that
has not already been assigned.
      Is it the case that any account other than root has a UID of 0?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_root_gid_zero_question:question:1">
          <ocil:question_text>To verify that root's primary group is zero run the following command:

    grep '^root:' /etc/passwd | cut -d : -f 4

The command should return:

0

      Is it the case that root has a primary gid not equal to zero?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_direct_root_logins_question:question:1">
          <ocil:question_text>To ensure root may not directly login to the system over physical consoles,
run the following command:
cat /etc/securetty
If any output is returned, this is a finding.
      Is it the case that the /etc/securetty file is not empty?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_password_auth_for_systemaccounts_question:question:1">
          <ocil:question_text>To obtain a listing of all users and the contents of their shadow password
field, run the command:
$ sudo awk -F: '$1 !~ /^root$/ &amp;&amp; $2 !~ /^[!*]/ {print $1 ":" $2}' /etc/shadow
Identify the system accounts from this listing. These will primarily be the accounts
with UID numbers less than UID_MIN, other than root. Value of the UID_MIN
directive is set in /etc/login.defs configuration file. In the default
configuration, UID_MIN is set to 500.
      Is it the case that it is not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_root_webbrowsing_question:question:1">
          <ocil:question_text>Check the root home directory for a .mozilla directory. If
one exists, ensure browsing is limited to local service administration.
      Is it the case that this is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_shelllogin_for_systemaccounts_question:question:1">
          <ocil:question_text>To obtain a listing of all users, their UIDs, and their shells, run the
command: $ awk -F: '{print $1 ":" $3 ":" $7}' /etc/passwd Identify
the system accounts from this listing. These will primarily be the accounts
with UID numbers less than UID_MIN, other than root. Value of the UID_MIN
directive is set in /etc/login.defs configuration file. In the default
configuration UID_MIN is set to 1000.
      Is it the case that any system account (other than root) has a login shell?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-restrict_serial_port_logins_question:question:1">
          <ocil:question_text>To check for serial port entries which permit root login,
run the following command:
$ sudo grep ^ttyS/[0-9] /etc/securetty
If any output is returned, then root login over serial ports is permitted.
      Is it the case that root login over serial ports is permitted?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-root_path_default_question:question:1">
          <ocil:question_text>To view the root user's PATH, run the following command:
$ sudo env | grep PATH
If correctly configured, the PATH must: use vendor default settings,
have no empty entries, and have no entries beginning with a character
other than a slash (/).
      Is it the case that any of these conditions are not met?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-securetty_root_login_console_only_question:question:1">
          <ocil:question_text>To check for virtual console entries which permit root login, run the
following command:
$ sudo grep ^vc/[0-9] /etc/securetty
If any output is returned, then root logins over virtual console devices is permitted.
      Is it the case that root login over virtual console devices is permitted?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-use_pam_wheel_for_su_question:question:1">
          <ocil:question_text>Run the following command to check if the line is present:
grep pam_wheel /etc/pam.d/su
The output should contain the following line:
auth             required        pam_wheel.so use_uid
      Is it the case that the line is not in the file or it is commented?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-account_unique_id_question:question:1">
          <ocil:question_text>Run the following command to check for duplicate account names:
Check that the operating system contains no duplicate UIDs for interactive users by running the following command:
# awk -F ":" 'list[$3]++{print $1, $3}' /etc/passwd
If output is produced, this is a finding.
Configure the operating system to contain no duplicate UIDs for interactive users.
Edit the file "/etc/passwd" and provide each interactive user account that has a duplicate UID with a unique UID.
      Is it the case that a line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_authorized_local_users_question:question:1">
          <ocil:question_text>To verify that there are no unauthorized local user accounts, run the following command:
$ less /etc/passwd 
Inspect the results, and if unauthorized local user accounts exist, remove them by running
the following command:
$ sudo userdel unauthorized_user
      Is it the case that there are unauthorized local user accounts on the system?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-group_unique_id_question:question:1">
          <ocil:question_text>Run the following command to check for duplicate group names:
Check that the operating system contains no duplicate group names for interactive users by running the following command:

    cut -d : -f 3 /etc/group | uniq -d

If output is produced, this is a finding.
Configure the operating system to contain no duplicate names for groups.
Edit the file "/etc/group" and provide each group that has a duplicate group id with a unique group id.
      Is it the case that the system has duplicate group ids?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-group_unique_name_question:question:1">
          <ocil:question_text>Run the following command to check for duplicate group names:
Check that the operating system contains no duplicate group names for interactive users by running the following command:

    cut -d : -f 1 /etc/group | uniq -d

If output is produced, this is a finding.
Configure the operating system to contain no duplicate names for groups.
Edit the file "/etc/group" and provide each group that has a duplicate group name with a unique group name.
      Is it the case that has duplicate group names?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_root_path_dirs_no_write_question:question:1">
          <ocil:question_text>To ensure write permissions are disabled for group and other
 for each element in root's path, run the following command:
# ls -ld DIR
      Is it the case that group or other write permissions exist?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_umask_etc_login_defs_question:question:1">
          <ocil:question_text>Verify the UMASK setting is configured correctly in the /etc/login.defs file by
running the following command:
$ sudo grep "UMASK" /etc/login.defs
All output must show the value of UMASK set as shown in the below:
UMASK 
      Is it the case that the above command returns no output, or the umask is configured incorrectly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_umask_etc_profile_question:question:1">
          <ocil:question_text>Verify the umask setting is configured correctly in the /etc/profile file by
running the following command:
$ sudo grep "umask" /etc/profile
All output must show the value of umask set as shown in the below:
umask 
      Is it the case that the above command returns no output, or the umask is configured incorrectly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_have_homedir_login_defs_question:question:1">
          <ocil:question_text>Check if the system is configured to create home directories for local interactive users with the following command:

$ sudo grep create_home /etc/login.defs

      Is it the case that the value of CREATE_HOME is not set to yes, is missing, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_logon_fail_delay_question:question:1">
          <ocil:question_text>Verify the FAIL_DELAY setting is configured correctly in the /etc/login.defs file by
running the following command:
$ sudo grep -i "FAIL_DELAY" /etc/login.defs
All output must show the value of FAIL_DELAY set as shown in the below:
$ sudo grep -i "FAIL_DELAY" /etc/login.defs
FAIL_DELAY 
      Is it the case that the above command returns no output, or FAIL_DELAY is configured less than the expected value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_max_concurrent_login_sessions_question:question:1">
          <ocil:question_text>Run the following command to ensure the maxlogins value is
configured for all users on the system:
# grep "maxlogins" /etc/security/limits.conf /etc/security/limits.d/*.conf
You should receive output similar to the following:
*\t\thard\tmaxlogins\t
      Is it the case that maxlogins is not equal to or less than the expected value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_polyinstantiated_tmp_question:question:1">
          <ocil:question_text>Run the following command to ensure that /tmp is configured as a
polyinstantiated directory:
$ sudo grep /tmp /etc/security/namespace.conf
The output should return the following:
/tmp     /tmp/tmp-inst/            level      root,adm
      Is it the case that is not configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_polyinstantiated_var_tmp_question:question:1">
          <ocil:question_text>Run the following command to ensure that /var/tmp is configured as a
polyinstantiated directory:
$ sudo grep /var/tmp /etc/security/namespace.conf
The output should return the following:
/var/tmp /var/tmp/tmp-inst/    level      root,adm
      Is it the case that is not configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_tmout_question:question:1">
          <ocil:question_text>Run the following command to ensure the TMOUT value is configured for all users
on the system:

$ sudo grep TMOUT /etc/profile /etc/profile.d/*.sh

The output should return the following:
TMOUT=
      Is it the case that value of TMOUT is not less than or equal to expected setting?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_home_dirs_question:question:1">
          <ocil:question_text>To ensure the user home directory is not group-writable or world-readable, run the following:
# ls -ld /home/USER
      Is it the case that the user home directory is group-writable or world-readable?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_chmod_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
chmod system call, run the following command:
$ sudo grep "chmod" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_chown_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
chown system call, run the following command:
$ sudo grep "chown" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_fchmod_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fchmod system call, run the following command:
$ sudo grep "fchmod" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_fchmodat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fchmodat system call, run the following command:
$ sudo grep "fchmodat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_fchown_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fchown system call, run the following command:
$ sudo grep "fchown" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_fchownat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fchownat system call, run the following command:
$ sudo grep "fchownat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_fremovexattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fremovexattr system call, run the following command:
$ sudo grep "fremovexattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_fsetxattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fsetxattr system call, run the following command:
$ sudo grep "fsetxattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_lchown_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
lchown system call, run the following command:
$ sudo grep "lchown" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_lremovexattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
lremovexattr system call, run the following command:
$ sudo grep "lremovexattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_lsetxattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
lsetxattr system call, run the following command:
$ sudo grep "lsetxattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_removexattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
removexattr system call, run the following command:
$ sudo grep "removexattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_setxattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
setxattr system call, run the following command:
$ sudo grep "setxattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_umount_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
umount system call, run the following command:
$ sudo grep "umount" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_umount2_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
umount2 system call, run the following command:
$ sudo grep "umount2" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_execution_chcon_question:question:1">
          <ocil:question_text>To verify that execution of the command is being audited, run the following command:
$ sudo grep "path=/usr/bin/chcon" /etc/audit/audit.rules /etc/audit/rules.d/*
The output should return something similar to:
-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_execution_restorecon_question:question:1">
          <ocil:question_text>To verify that execution of the command is being audited, run the following command:
$ sudo grep "path=/usr/sbin/restorecon" /etc/audit/audit.rules /etc/audit/rules.d/*
The output should return something similar to:
-a always,exit -F path=/usr/sbin/restorecon -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_execution_semanage_question:question:1">
          <ocil:question_text>To verify that execution of the command is being audited, run the following command:
$ sudo grep "path=/usr/sbin/semanage" /etc/audit/audit.rules /etc/audit/rules.d/*
The output should return something similar to:
-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_execution_setsebool_question:question:1">
          <ocil:question_text>To verify that execution of the command is being audited, run the following command:
$ sudo grep "path=/usr/sbin/setsebool" /etc/audit/audit.rules /etc/audit/rules.d/*
The output should return something similar to:
-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_execution_seunshare_question:question:1">
          <ocil:question_text>To verify that execution of the command is being audited, run the following command:
$ sudo grep "path=/usr/sbin/seunshare" /etc/audit/audit.rules /etc/audit/rules.d/*
The output should return something similar to:
-a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_file_deletion_events_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
rmdir system call, run the following command:
$ sudo grep "rmdir" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
To determine if the system is configured to audit calls to the
unlink system call, run the following command:
$ sudo grep "unlink" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
To determine if the system is configured to audit calls to the
unlinkat system call, run the following command:
$ sudo grep "unlinkat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
To determine if the system is configured to audit calls to the
rename system call, run the following command:
$ sudo grep "rename" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
To determine if the system is configured to audit calls to the
renameat system call, run the following command:
$ sudo grep "renameat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_file_deletion_events_rename_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
rename system call, run the following command:
$ sudo grep "rename" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_file_deletion_events_renameat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
renameat system call, run the following command:
$ sudo grep "renameat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_file_deletion_events_rmdir_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
rmdir system call, run the following command:
$ sudo grep "rmdir" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_file_deletion_events_unlink_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
unlink system call, run the following command:
$ sudo grep "unlink" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_file_deletion_events_unlinkat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
unlinkat system call, run the following command:
$ sudo grep "unlinkat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_chmod_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the chmod system call, run the following command:
$ sudo grep "chmod" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_chown_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the chown system call, run the following command:
$ sudo grep "chown" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_creat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the creat system call, run the following command:
$ sudo grep "creat" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_fchmod_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the fchmod system call, run the following command:
$ sudo grep "fchmod" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_fchmodat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the fchmodat system call, run the following command:
$ sudo grep "fchmodat" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_fchown_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the fchown system call, run the following command:
$ sudo grep "fchown" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_fchownat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the fchownat system call, run the following command:
$ sudo grep "fchownat" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_fremovexattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the fremovexattr system call, run the following command:
$ sudo grep "fremovexattr" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_fsetxattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the fsetxattr system call, run the following command:
$ sudo grep "fsetxattr" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_ftruncate_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the ftruncate system call, run the following command:
$ sudo grep "ftruncate" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_lchown_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the lchown system call, run the following command:
$ sudo grep "lchown" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_lremovexattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the lremovexattr system call, run the following command:
$ sudo grep "lremovexattr" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_lsetxattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the lsetxattr system call, run the following command:
$ sudo grep "lsetxattr" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_open_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the open system call, run the following command:
$ sudo grep "open" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the open_by_handle_at system call, run the following command:
$ sudo grep "open_by_handle_at" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_creat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the open_by_handle_at system call, run the following command:
$ sudo grep "open_by_handle_at" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the open_by_handle_at system call, run the following command:
$ sudo grep "open_by_handle_at" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_open_o_creat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the open system call, run the following command:
$ sudo grep "open" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_open_o_trunc_write_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the open system call, run the following command:
$ sudo grep "open" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_openat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the openat system call, run the following command:
$ sudo grep "openat" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_openat_o_creat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the openat system call, run the following command:
$ sudo grep "openat" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_openat_o_trunc_write_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the openat system call, run the following command:
$ sudo grep "openat" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_removexattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the removexattr system call, run the following command:
$ sudo grep "removexattr" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_rename_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the rename system call, run the following command:
$ sudo grep "rename" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_renameat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the renameat system call, run the following command:
$ sudo grep "renameat" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_setxattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the setxattr system call, run the following command:
$ sudo grep "setxattr" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_truncate_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the truncate system call, run the following command:
$ sudo grep "truncate" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_unlink_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the unlink system call, run the following command:
$ sudo grep "unlink" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_unlinkat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the unlinkat system call, run the following command:
$ sudo grep "unlinkat" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_question:question:1">
          <ocil:question_text>To verify that the audit system collects unauthorized file accesses, run the following commands:
$ sudo grep EACCES /etc/audit/audit.rules
$ sudo grep EPERM /etc/audit/audit.rules
      Is it the case that 32-bit and 64-bit system calls to creat, open, openat, open_by_handle_at, truncate, and ftruncate are not audited during EACCES and EPERM?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_chmod_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
chmod system call, run the following command:
$ sudo grep "chmod" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_chown_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
chown system call, run the following command:
$ sudo grep "chown" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_creat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
creat system call, run the following command:
$ sudo grep "creat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmod_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fchmod system call, run the following command:
$ sudo grep "fchmod" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmodat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fchmodat system call, run the following command:
$ sudo grep "fchmodat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchown_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fchown system call, run the following command:
$ sudo grep "fchown" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchownat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fchownat system call, run the following command:
$ sudo grep "fchownat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_fremovexattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fremovexattr system call, run the following command:
$ sudo grep "fremovexattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_fsetxattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fsetxattr system call, run the following command:
$ sudo grep "fsetxattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
ftruncate system call, run the following command:
$ sudo grep "ftruncate" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_lchown_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
lchown system call, run the following command:
$ sudo grep "lchown" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_lremovexattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
lremovexattr system call, run the following command:
$ sudo grep "lremovexattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_lsetxattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
lsetxattr system call, run the following command:
$ sudo grep "lsetxattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open system call, run the following command:
$ sudo grep "open" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open_by_handle_at system call, run the following command:
$ sudo grep "open_by_handle_at" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open_by_handle_at system call, run the following command:
$ sudo grep "open_by_handle_at" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open_by_handle_at system call, run the following command:
$ sudo grep "open_by_handle_at" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open_by_handle_at system call, run the following command:
$ sudo grep "open_by_handle_at" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_creat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open system call, run the following command:
$ sudo grep "open" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open system call, run the following command:
$ sudo grep "open" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_rule_order_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open system call, run the following command:
$ sudo grep "open" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
openat system call, run the following command:
$ sudo grep "openat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
openat system call, run the following command:
$ sudo grep "openat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
openat system call, run the following command:
$ sudo grep "openat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_rule_order_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
openat system call, run the following command:
$ sudo grep "openat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_removexattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
removexattr system call, run the following command:
$ sudo grep "removexattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_rename_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
rename system call, run the following command:
$ sudo grep "rename" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_renameat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
renameat system call, run the following command:
$ sudo grep "renameat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_setxattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
setxattr system call, run the following command:
$ sudo grep "setxattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
truncate system call, run the following command:
$ sudo grep "truncate" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_unlink_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
unlink system call, run the following command:
$ sudo grep "unlink" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_unlinkat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
unlinkat system call, run the following command:
$ sudo grep "unlinkat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_kernel_module_loading_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
init_module system call, run the following command:
$ sudo grep "init_module" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
To determine if the system is configured to audit calls to the
delete_module system call, run the following command:
$ sudo grep "delete_module" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_kernel_module_loading_delete_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
delete_module system call, run the following command:
$ sudo grep "delete_module" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_kernel_module_loading_finit_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
finit_module system call, run the following command:
$ sudo grep "finit_module" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_kernel_module_loading_init_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
init_module system call, run the following command:
$ sudo grep "init_module" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_login_events_faillock_question:question:1">
          <ocil:question_text>To verify that auditing is configured for system administrator actions, run the following command:
$ sudo auditctl -l | grep "watch=/var/run/faillock\|-w /var/run/faillock"
      Is it the case that there is no output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_login_events_lastlog_question:question:1">
          <ocil:question_text>To verify that auditing is configured for system administrator actions, run the following command:
$ sudo auditctl -l | grep "watch=/var/log/lastlog\|-w /var/log/lastlog"
      Is it the case that there is not output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_login_events_tallylog_question:question:1">
          <ocil:question_text>To verify that auditing is configured for system administrator actions, run the following command:
$ sudo auditctl -l | grep "watch=/var/log/tallylog\|-w /var/log/tallylog"
      Is it the case that there is not output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command for each local partition PART to find relevant
setuid / setgid programs:
$ sudo find PART -xdev -type f -perm -4000 -o -type f -perm -2000 2&gt;/dev/null
Run the following command to verify entries in the audit rules for all programs
found with the previous command:
$ sudo grep path /etc/audit/audit.rules
It should be the case that all relevant setuid / setgid programs have a line
in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_at_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep '\bat\b' /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_chage_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep chage /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_chsh_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep chsh /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_crontab_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep crontab /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_gpasswd_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep gpasswd /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_mount_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep mount /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_newgidmap_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep newgidmap /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_newgrp_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep newgrp /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_newuidmap_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep newuidmap /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_passwd_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep passwd /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_pt_chown_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep pt_chown /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_ssh_keysign_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep ssh-keysign /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_su_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep su /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_sudo_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep sudo /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_sudoedit_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep sudoedit /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_umount_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep umount /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_unix_chkpwd_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep unix_chkpwd /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_userhelper_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep userhelper /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_usernetctl_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep usernetctl /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_time_adjtimex_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
adjtimex system call, run the following command:
$ sudo grep "adjtimex" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_time_clock_settime_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
clock_settime system call, run the following command:
$ sudo grep "clock_settime" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_time_settimeofday_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
settimeofday system call, run the following command:
$ sudo grep "settimeofday" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_time_stime_question:question:1">
          <ocil:question_text>If the system is not configured to audit time changes, this is a finding.
If the system is 64-bit only, this is not applicable
ocil: |
To determine if the system is configured to audit calls to the
stime system call, run the following command:
$ sudo grep "stime" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_time_watch_localtime_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit attempts to
alter time via the /etc/localtime file, run the following
command:
$ sudo auditctl -l | grep "watch=/etc/localtime"
If the system is configured to audit this activity, it will return a line.
      Is it the case that the system is not configured to audit time changes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_etc_group_open_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open system call, run the following command:
$ sudo grep "open" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_etc_group_open_by_handle_at_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open_by_handle_at system call, run the following command:
$ sudo grep "open_by_handle_at" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_etc_group_openat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
openat system call, run the following command:
$ sudo grep "openat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_etc_gshadow_open_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open system call, run the following command:
$ sudo grep "open" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_etc_gshadow_open_by_handle_at_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open_by_handle_at system call, run the following command:
$ sudo grep "open_by_handle_at" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_etc_gshadow_openat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
openat system call, run the following command:
$ sudo grep "openat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_etc_passwd_open_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open system call, run the following command:
$ sudo grep "open" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_etc_passwd_open_by_handle_at_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open_by_handle_at system call, run the following command:
$ sudo grep "open_by_handle_at" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_etc_passwd_openat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
openat system call, run the following command:
$ sudo grep "openat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_etc_shadow_open_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open system call, run the following command:
$ sudo grep "open" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_etc_shadow_open_by_handle_at_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open_by_handle_at system call, run the following command:
$ sudo grep "open_by_handle_at" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_etc_shadow_openat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
openat system call, run the following command:
$ sudo grep "openat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_immutable_question:question:1">
          <ocil:question_text>Verify the audit system prevents unauthorized changes with the following command:

$ sudo grep "^\s*[^#]" /etc/audit/audit.rules | tail -1

-e 2
      Is it the case that the audit system is not set to be immutable by adding the "-e 2" option to the "/etc/audit/audit.rules"?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_mac_modification_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit changes to its SELinux
configuration files, run the following command:
$ sudo auditctl -l | grep "dir=/etc/selinux"
If the system is configured to watch for changes to its SELinux
configuration, a line should be returned (including
perm=wa indicating permissions that are watched).
      Is it the case that the system is not configured to audit attempts to change the MAC policy?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_media_export_question:question:1">
          <ocil:question_text>To verify that auditing is configured for all media exportation events, run the following command:
$ sudo auditctl -l | grep syscall | grep mount
      Is it the case that there is no output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_networkconfig_modification_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit changes to its network configuration,
run the following command:
auditctl -l | egrep '(/etc/issue|/etc/issue.net|/etc/hosts|/etc/sysconfig/network)'
If the system is configured to watch for network configuration changes, a line should be returned for
each file specified (and perm=wa should be indicated for each).
      Is it the case that the system is not configured to audit changes of the network configuration?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_sysadmin_actions_question:question:1">
          <ocil:question_text>To verify that auditing is configured for system administrator actions, run the following command:
$ sudo auditctl -l | grep "watch=/etc/sudoers\|watch=/etc/sudoers.d\|-w /etc/sudoers\|-w /etc/sudoers.d"
      Is it the case that there is not output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_usergroup_modification_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit account changes,
run the following command:
auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'
If the system is configured to watch for account changes, lines should be returned for
each file specified (and with perm=wa for each).
      Is it the case that the system is not configured to audit account changes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_usergroup_modification_group_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit account changes,
run the following command:

auditctl -l | egrep '(/etc/group)'

If the system is configured to watch for account changes, lines should be returned for
each file specified (and with perm=wa for each).
      Is it the case that the system is not configured to audit account changes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_usergroup_modification_gshadow_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit account changes,
run the following command:

auditctl -l | egrep '(/etc/gshadow)'

If the system is configured to watch for account changes, lines should be returned for
each file specified (and with perm=wa for each).
      Is it the case that the system is not configured to audit account changes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_usergroup_modification_opasswd_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit account changes,
run the following command:

auditctl -l | egrep '(/etc/security/opasswd)'

If the system is configured to watch for account changes, lines should be returned for
each file specified (and with perm=wa for each).
      Is it the case that the system is not configured to audit account changes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_usergroup_modification_passwd_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit account changes,
run the following command:

auditctl -l | egrep '(/etc/passwd)'

If the system is configured to watch for account changes, lines should be returned for
each file specified (and with perm=wa for each).
      Is it the case that the system is not configured to audit account changes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_usergroup_modification_shadow_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit account changes,
run the following command:

auditctl -l | egrep '(/etc/shadow)'

If the system is configured to watch for account changes, lines should be returned for
each file specified (and with perm=wa for each).
      Is it the case that the system is not configured to audit account changes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_access_var_log_audit_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit accesses to
/var/log/audit directory, run the following command:
$ sudo grep "dir=/var/log/audit" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_permissions_var_log_audit_question:question:1">
          <ocil:question_text>Verify the audit log directories have a correct mode or less permissive mode.

Find the location of the audit logs:

$ sudo grep "^log_file" /etc/audit/auditd.conf

Find the group that owns audit logs:

$ sudo grep "^log_group" /etc/audit/auditd.conf

Run the following command to check the mode of the system audit logs:

$ sudo stat -c "%a %n" [audit_log_directory]

Replace "[audit_log_directory]" to the correct audit log directory path, by default this location is "/var/log/audit".

If the log_group is "root" or is not set, the correct permissions are 0700, otherwise they are 0750.
      Is it the case that audit logs have a more permissive mode?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupownership_audit_configuration_question:question:1">
          <ocil:question_text>
To properly set the group owner of /etc/audit/, run the command:
$ sudo chgrp root /etc/audit/

To properly set the group owner of /etc/audit/rules.d/, run the command:
$ sudo chgrp root /etc/audit/rules.d/
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_ownership_audit_configuration_question:question:1">
          <ocil:question_text>
To properly set the owner of /etc/audit/, run the command:
$ sudo chown root /etc/audit/ 

To properly set the owner of /etc/audit/rules.d/, run the command:
$ sudo chown root /etc/audit/rules.d/ 
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_ownership_var_log_audit_question:question:1">
          <ocil:question_text>
To properly set the owner of /var/log/audit, run the command:
$ sudo chown root /var/log/audit 

To properly set the owner of /var/log/audit/*, run the command:
$ sudo chown root /var/log/audit/* 
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_var_log_audit_question:question:1">
          <ocil:question_text>Run the following command to check the mode of the system audit logs:
$ sudo grep -iw log_file /etc/audit/auditd.conf
log_file=/var/log/audit/audit.log
$ sudo stat -c "%n %a" /var/log/audit/*
$ sudo ls -l /var/log/audit
Audit logs must be mode 0640 or less permissive.
      Is it the case that any permissions are more permissive?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_audispd_configure_remote_server_question:question:1">
          <ocil:question_text>
To verify the audispd plugin off-loads audit records onto a different system or
media from the system being audited, run the following command:

$ sudo grep -i remote_server /etc/audit/audisp-remote.conf

The output should return something similar to
remote_server = 
      Is it the case that audispd is not sending logs to a remote system?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_audispd_encrypt_sent_records_question:question:1">
          <ocil:question_text>To verify the audispd plugin encrypts audit records off-loaded onto a different
system or media from the system being audited, run the following command:

$ sudo grep -i transport /etc/audit/audisp-remote.conf
The output should return the following:
transport = KRB5
      Is it the case that audispd is not encrypting audit records when sent over the network?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_audispd_syslog_plugin_activated_question:question:1">
          <ocil:question_text>To verify the audispd's syslog plugin is active, run the following command:

$ sudo grep active /etc/audit/plugins.d/syslog.conf

If the plugin is active, the output will show yes.
      Is it the case that it is not activated?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_disk_error_action_question:question:1">
          <ocil:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to either log to syslog,
switch to single-user mode, execute a script,
or halt when the disk errors:
disk_error_action single
      Is it the case that the system is not configured to switch to single-user mode for corrective action?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_disk_full_action_question:question:1">
          <ocil:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to either log to syslog,
switch to single-user mode, execute a script,
or halt when the disk is out of space:
disk_full_action single
      Is it the case that the system is not configured to switch to single-user mode for corrective action?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_retention_action_mail_acct_question:question:1">
          <ocil:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to send email to an
account when it needs to notify an administrator:
action_mail_acct = 
      Is it the case that auditd is not configured to send emails per identified actions?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_retention_admin_space_left_action_question:question:1">
          <ocil:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to either suspend, switch to single user mode,
or halt when disk space has run low:
admin_space_left_action single
      Is it the case that the system is not configured to switch to single user mode for corrective action?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_retention_flush_question:question:1">
          <ocil:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to synchronize audit event data
with the log files on the disk:
$ sudo grep flush /etc/audit/auditd.conf
flush = DATA
Acceptable values are DATA, and SYNC. The setting is
case-insensitive.
      Is it the case that auditd is not configured to synchronously write audit event data to disk?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_retention_max_log_file_question:question:1">
          <ocil:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine how much data the system will retain in each audit log file:
$ sudo grep max_log_file /etc/audit/auditd.conf
max_log_file = 6
      Is it the case that the system audit data threshold has not been properly configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_retention_max_log_file_action_question:question:1">
          <ocil:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to rotate logs when they reach their
maximum size:
$ sudo grep max_log_file_action /etc/audit/auditd.conf
max_log_file_action rotate
      Is it the case that the system has not been properly configured to rotate audit logs?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_retention_num_logs_question:question:1">
          <ocil:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine how many logs the system is configured to retain after rotation:
$ sudo grep num_logs /etc/audit/auditd.conf
num_logs = 5
      Is it the case that the system log file retention has not been properly configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_retention_space_left_action_question:question:1">
          <ocil:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to email the administrator when
disk space is starting to run low:
$ sudo grep space_left_action /etc/audit/auditd.conf
space_left_action
Acceptable values are email, suspend, single, and halt.
      Is it the case that the system is not configured to send an email to the system administrator when disk space is starting to run low?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_retention_space_left_percentage_question:question:1">
          <ocil:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured correctly:
space_left PERCENTAGE%
      Is it the case that the system is not configured with a specific percentage to notify administrators of an issue?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_freq_question:question:1">
          <ocil:question_text>To verify that Audit Daemon is configured to flush to disk after
every 50 records, run the following command:
$ sudo grep freq /etc/audit/auditd.conf
The output should return the following:
freq = 50
      Is it the case that freq isn't set to 50?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_local_events_question:question:1">
          <ocil:question_text>To verify that Audit Daemon is configured to include local events, run the
following command:
$ sudo grep local_events /etc/audit/auditd.conf
The output should return the following:
local_events = yes
      Is it the case that local_events isn't set to yes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_log_format_question:question:1">
          <ocil:question_text>To verify that Audit Daemon is configured to resolve all uid, gid, syscall,
architecture, and socket address information before writing the event to disk,
run the following command:
$ sudo grep log_format /etc/audit/auditd.conf
The output should return the following:
log_format = ENRICHED
      Is it the case that log_format isn't set to ENRICHED?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_name_format_question:question:1">
          <ocil:question_text>To verify that Audit Daemon is configured to record the hostname
in audit events, run the following command:
$ sudo grep name_format /etc/audit/auditd.conf
The output should return the following:
name_format = hostname
      Is it the case that name_format isn't set to hostname?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_overflow_action_question:question:1">
          <ocil:question_text>Verify the audit system is configured to take an appropriate action when the internal event queue is full:
$ sudo grep -i overflow_action /etc/audit/auditd.conf

The output should contain be like overflow_action = syslog

If the value of the "overflow_action" option is not set to syslog, 
single, halt or the line is commented out, ask the System Administrator
to indicate how the audit logs are off-loaded to a different system or media. 
      Is it the case that auditd overflow action is not setup correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_write_logs_question:question:1">
          <ocil:question_text>To verify that Audit Daemon is configured to write logs to the disk, run the
following command:
$ sudo grep write_logs /etc/audit/auditd.conf
The output should return the following:
write_logs = yes
      Is it the case that write_logs isn't set to yes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_audit_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /boot/grub2/grubenv.
If they include audit=1, then the parameter
is configured at boot time.
$ sudo grep 'kernelopts.*audit=1.*' GRUBENV_FILE_LOCATION
Fill in GRUBENV_FILE_LOCATION based on information above.
      Is it the case that auditing is not enabled at boot time?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_audit_backlog_limit_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /boot/grub2/grubenv.
If they include audit_backlog_limit=8192, then the parameter
is configured at boot time.
$ sudo grep 'kernelopts.*audit_backlog_limit=8192.*' GRUBENV_FILE_LOCATION
Fill in GRUBENV_FILE_LOCATION based on information above.
      Is it the case that audit backlog limit is not configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_audispd-plugins_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the audispd-plugins package is installed: $ rpm -q audispd-plugins
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_audit-audispd-plugins_installed_question:question:1">
          <ocil:question_text>
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_audit_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the audit package is installed: $ rpm -q audit
      Is it the case that the audit package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_auditd_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
auditd service:
$ sudo systemctl is-active auditd
If the service is running, it should return the following: active
      Is it the case that the auditd service is not running?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_grub2_cfg_question:question:1">
          <ocil:question_text>To check the group ownership of /boot/grub2/grub.cfg,
run the command:
$ ls -lL /boot/grub2/grub.cfg
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /boot/grub2/grub.cfg does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_grub2_cfg_question:question:1">
          <ocil:question_text>To check the ownership of /boot/grub2/grub.cfg,
run the command:
$ ls -lL /boot/grub2/grub.cfg
If properly configured, the output should indicate the following owner:
root
      Is it the case that /boot/grub2/grub.cfg does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_grub2_cfg_question:question:1">
          <ocil:question_text>To check the permissions of /boot/grub2/grub.cfg, run the command:
$ sudo ls -lL /boot/grub2/grub.cfg
If properly configured, the output should indicate the following
permissions: -rw-------
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_admin_username_question:question:1">
          <ocil:question_text>To verify the boot loader superuser account has been set, run the following
command:
sudo grep -A1 "superusers" /etc/grub2.cfg
The output should show the following:
set superusers="superusers-account"
export superusers
where superusers-account is the actual account name different from common names like root,
admin, or administrator.
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_password_question:question:1">
          <ocil:question_text>To verify the boot loader superuser password has been set, run the following
command:

sudo grep "superusers" /etc/grub2.cfg

The output should show the following:
password_pbkdf2 superusers-account ${GRUB2_PASSWORD}
To verify the boot loader superuser account password has been set,
and the password encrypted, run the following command:

sudo cat /boot/grub2/user.cfg
The output should be similar to:
GRUB2_PASSWORD=grub.pbkdf2.sha512.10000.C4E08AC72FBFF7E837FD267BFAD7AEB3D42DDC
2C99F2A94DD5E2E75C2DC331B719FE55D9411745F82D1B6CFD9E927D61925F9BBDD1CFAA0080E0
916F7AB46E0D.1302284FCCC52CD73BA3671C6C12C26FF50BA873293B24EE2A96EE3B57963E6D7
0C83964B473EC8F93B07FE749AA6710269E904A9B08A6BBACB00A2D242AD828
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_efi_grub2_cfg_question:question:1">
          <ocil:question_text>To check the group ownership of /boot/grub2/grub.cfg,
run the command:
$ ls -lL /boot/grub2/grub.cfg
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /boot/grub2/grub.cfg does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_efi_grub2_cfg_question:question:1">
          <ocil:question_text>To check the ownership of /boot/grub2/grub.cfg,
run the command:
$ ls -lL /boot/grub2/grub.cfg
If properly configured, the output should indicate the following owner:
root
      Is it the case that /boot/grub2/grub.cfg does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_efi_grub2_cfg_question:question:1">
          <ocil:question_text>To check the permissions of /boot/grub2/grub.cfg, run the command:
$ sudo ls -lL /boot/grub2/grub.cfg
If properly configured, the output should indicate the following
permissions: -rwx------
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_uefi_admin_username_question:question:1">
          <ocil:question_text>To verify the boot loader superuser account has been set, run the following
command:
sudo grep -A1 "superusers" /etc/grub2-efi.cfg
The output should show the following:
set superusers="superusers-account"
export superusers
where superusers-account is the actual account name different from common names like root,
admin, or administrator.
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_uefi_password_question:question:1">
          <ocil:question_text>To verify the boot loader superuser password has been set, run the following
command:

sudo grep "password" /etc/grub2-efi.cfg

The output should show the following:
password_pbkdf2 superusers-account ${GRUB2_PASSWORD}
To verify the boot loader superuser account password has been set,
and the password encrypted, run the following command:

sudo cat /boot/grub2/user.cfg
The output should be similar to:
GRUB2_PASSWORD=grub.pbkdf2.sha512.10000.C4E08AC72FBFF7E837FD267BFAD7AEB3D42DDC
2C99F2A94DD5E2E75C2DC331B719FE55D9411745F82D1B6CFD9E927D61925F9BBDD1CFAA0080E0
916F7AB46E0D.1302284FCCC52CD73BA3671C6C12C26FF50BA873293B24EE2A96EE3B57963E6D7
0C83964B473EC8F93B07FE749AA6710269E904A9B08A6BBACB00A2D242AD828
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_enable_iommu_force_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /boot/grub2/grubenv.
If they include iommu=force, then the parameter
is configured at boot time.
$ sudo grep 'kernelopts.*iommu=force.*' GRUBENV_FILE_LOCATION
Fill in GRUBENV_FILE_LOCATION based on information above.
      Is it the case that I/OMMU is not activated?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_l1tf_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /boot/grub2/grubenv.
If they include l1tf=xccdf_value(var_l1tf_options), then the parameter
is configured at boot time.
$ sudo grep 'kernelopts.*l1tf=xccdf_value(var_l1tf_options).*' GRUBENV_FILE_LOCATION
Fill in GRUBENV_FILE_LOCATION based on information above.
      Is it the case that l1tf mitigations are not configured appropriately?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_mce_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /boot/grub2/grubenv.
If they include mce=0, then the parameter
is configured at boot time.
$ sudo grep 'kernelopts.*mce=0.*' GRUBENV_FILE_LOCATION
Fill in GRUBENV_FILE_LOCATION based on information above.
      Is it the case that MCE tolerance is not set to zero?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_mds_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /boot/grub2/grubenv.
If they include mds=xccdf_value(var_mds_options), then the parameter
is configured at boot time.
$ sudo grep 'kernelopts.*mds=xccdf_value(var_mds_options).*' GRUBENV_FILE_LOCATION
Fill in GRUBENV_FILE_LOCATION based on information above.
      Is it the case that MDS mitigations are not configured appropriately?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_nosmap_argument_absent_question:question:1">
          <ocil:question_text>Make sure that the kernel is not disabling SMAP with the following
commands.
grep -q nosmap /boot/config-`uname -r`
If the command returns a line, it means that SMAP is being disabled.
      Is it the case that the kernel is configured to disable SMAP?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_nosmep_argument_absent_question:question:1">
          <ocil:question_text>Make sure that the kernel is not disabling SMEP with the following
commands.
grep -q nosmep /boot/config-`uname -r`
If the command returns a line, it means that SMEP is being disabled.
      Is it the case that the kernel is configured to disable SMEP?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_pti_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /boot/grub2/grubenv.
If they include pti=on, then the parameter
is configured at boot time.
$ sudo grep 'kernelopts.*pti=on.*' GRUBENV_FILE_LOCATION
Fill in GRUBENV_FILE_LOCATION based on information above.
      Is it the case that Kernel page-table isolation is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_rng_core_default_quality_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /boot/grub2/grubenv.
If they include rng_core.default_quality=xccdf_value(var_rng_core_default_quality), then the parameter
is configured at boot time.
$ sudo grep 'kernelopts.*rng_core.default_quality=xccdf_value(var_rng_core_default_quality).*' GRUBENV_FILE_LOCATION
Fill in GRUBENV_FILE_LOCATION based on information above.
      Is it the case that trust on hardware random number generator is not configured appropriately?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_slab_nomerge_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /boot/grub2/grubenv.
If they include slab_nomerge=yes, then the parameter
is configured at boot time.
$ sudo grep 'kernelopts.*slab_nomerge=yes.*' GRUBENV_FILE_LOCATION
Fill in GRUBENV_FILE_LOCATION based on information above.
      Is it the case that merging of slabs with similar size is enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_spec_store_bypass_disable_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /boot/grub2/grubenv.
If they include spec_store_bypass_disable=xccdf_value(var_spec_store_bypass_disable_options), then the parameter
is configured at boot time.
$ sudo grep 'kernelopts.*spec_store_bypass_disable=xccdf_value(var_spec_store_bypass_disable_options).*' GRUBENV_FILE_LOCATION
Fill in GRUBENV_FILE_LOCATION based on information above.
      Is it the case that SSB is not configured appropriately?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_spectre_v2_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /boot/grub2/grubenv.
If they include spectre_v2=on, then the parameter
is configured at boot time.
$ sudo grep 'kernelopts.*spectre_v2=on.*' GRUBENV_FILE_LOCATION
Fill in GRUBENV_FILE_LOCATION based on information above.
      Is it the case that spectre_v2 mitigation is not enforced?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_vsyscall_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /boot/grub2/grubenv.
If they include vsyscall=none, then the parameter
is configured at boot time.
$ sudo grep 'kernelopts.*vsyscall=none.*' GRUBENV_FILE_LOCATION
Fill in GRUBENV_FILE_LOCATION based on information above.
      Is it the case that vsyscalls are enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_gcc_plugin_latent_entropy_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_GCC_PLUGIN_LATENT_ENTROPY /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_gcc_plugin_randstruct_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_GCC_PLUGIN_RANDSTRUCT /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_gcc_plugin_stackleak_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_GCC_PLUGIN_STACKLEAK /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_gcc_plugin_structleak_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_GCC_PLUGIN_STRUCTLEAK /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_gcc_plugin_structleak_byref_all_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_acpi_custom_method_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_ACPI_CUSTOM_METHOD /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_arm64_sw_ttbr0_pan_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_ARM64_SW_TTBR0_PAN /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_binfmt_misc_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_BINFMT_MISC /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_bug_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_BUG /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_bug_on_data_corruption_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_BUG_ON_DATA_CORRUPTION /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_compat_brk_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_COMPAT_BRK /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_compat_vdso_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_COMPAT_VDSO /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_debug_credentials_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_DEBUG_CREDENTIALS /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_debug_fs_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_DEBUG_FS /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_debug_list_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_DEBUG_LIST /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_debug_notifiers_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_DEBUG_NOTIFIERS /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_debug_sg_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_DEBUG_SG /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_debug_wx_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_DEBUG_WX /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_default_mmap_min_addr_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_DEFAULT_MMAP_MIN_ADDR /boot/config.*
    
    For each kernel installed, a line with value "65536" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_devkmem_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_DEVKMEM /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_fortify_source_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_FORTIFY_SOURCE /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_hardened_usercopy_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_HARDENED_USERCOPY /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_hardened_usercopy_fallback_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_HARDENED_USERCOPY_FALLBACK /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_hibernation_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_HIBERNATION /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_ia32_emulation_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_IA32_EMULATION /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_ipv6_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_IPV6 /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_kexec_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_KEXEC /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_legacy_ptys_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_LEGACY_PTYS /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_legacy_vsyscall_emulate_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_LEGACY_VSYSCALL_EMULATE /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_legacy_vsyscall_none_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_LEGACY_VSYSCALL_NONE /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_legacy_vsyscall_xonly_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_LEGACY_VSYSCALL_XONLY /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_modify_ldt_syscall_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_MODIFY_LDT_SYSCALL /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_module_sig_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_MODULE_SIG /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_module_sig_all_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_MODULE_SIG_ALL /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_module_sig_force_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_MODULE_SIG_FORCE /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_module_sig_hash_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_MODULE_SIG_HASH /boot/config.*
    
    For each kernel installed, a line with value "" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_module_sig_key_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_MODULE_SIG_KEY /boot/config.*
    
    For each kernel installed, a line with value "" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_module_sig_sha512_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_MODULE_SIG_SHA512 /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_page_poisoning_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_PAGE_POISONING /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_page_poisoning_no_sanity_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_PAGE_POISONING_NO_SANITY /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_page_poisoning_zero_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_PAGE_POISONING_ZERO /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_page_table_isolation_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_PAGE_TABLE_ISOLATION /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_panic_on_oops_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_PANIC_ON_OOPS /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_panic_timeout_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_PANIC_TIMEOUT /boot/config.*
    
    For each kernel installed, a line with value "" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_proc_kcore_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_PROC_KCORE /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_randomize_base_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_RANDOMIZE_BASE /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_randomize_memory_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_RANDOMIZE_MEMORY /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_refcount_full_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_REFCOUNT_FULL /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_retpoline_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_RETPOLINE /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_sched_stack_end_check_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_SCHED_STACK_END_CHECK /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_seccomp_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_SECCOMP /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_seccomp_filter_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_SECCOMP_FILTER /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_security_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_SECURITY /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_security_dmesg_restrict_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_SECURITY_DMESG_RESTRICT /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_security_writable_hooks_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_SECURITY_WRITABLE_HOOKS /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_security_yama_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_SECURITY_YAMA /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_slab_freelist_hardened_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_SLAB_FREELIST_HARDENED /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_slab_freelist_random_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_SLAB_FRELIST_RANDOM /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_slab_merge_default_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_SLAB_MERGE_DEFAULT /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_slub_debug_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_SLUB_DEBUG /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_stackprotector_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_STACKPROTECTOR /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_stackprotector_strong_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_STACKPROTECTOR_STRONG /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_strict_kernel_rwx_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_STRICT_KERNEL_WRX /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_strict_module_rwx_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_STRICT_MODULE_RWX /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_syn_cookies_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_SYN_COOKIES /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_unmap_kernel_at_el0_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_UNMAP_KERNEL_AT_EL0 /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_vmap_stack_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_VMAP_STACK /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_x86_vsyscall_emulation_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_X86_VSYSCALL_EMULATION /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_cron_logging_question:question:1">
          <ocil:question_text>To verify that cron is logging to rsyslog,
run the following command:
grep -rni "cron\.\*" /etc/rsyslog.*
The output should return some similar to:
cron.*                                                  /var/log/cron
      Is it the case that cron is not logging to rsyslog?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode_question:question:1">
          <ocil:question_text>Verify the operating system authenticates the remote logging server for off-loading audit logs with the following command:

$ sudo grep -i '$ActionSendStreamDriverAuthMode' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
The output should be
$/etc/rsyslog.conf:$ActionSendStreamDriverAuthMode x509/name
      Is it the case that $ActionSendStreamDriverAuthMode in /etc/rsyslog.conf is not set to x509/name?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode_question:question:1">
          <ocil:question_text>Verify the operating system encrypts audit records off-loaded onto a different system
or media from the system being audited with the following commands:

$ sudo grep -i '$ActionSendStreamDriverMode' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
The output should be
/etc/rsyslog.conf:$ActionSendStreamDriverMode 1
      Is it the case that rsyslogd ActionSendStreamDriverMode not set to 1?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver_question:question:1">
          <ocil:question_text>Verify the operating system encrypts audit records off-loaded onto a different system
or media from the system being audited with the following commands:

$ sudo grep -i '$DefaultNetstreamDriver' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
The output should be
/etc/rsyslog.conf:$DefaultNetstreamDriver gtls
      Is it the case that rsyslogd DefaultNetstreamDriver not set to gtls?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_files_groupownership_question:question:1">
          <ocil:question_text>The group-owner of all log files written by rsyslog should be .
These log files are determined by the second part of each Rule line in
/etc/rsyslog.conf and typically all appear in /var/log.
To see the group-owner of a given log file, run the following command:
$ ls -l LOGFILE
      Is it the case that the group-owner is not correct?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_files_ownership_question:question:1">
          <ocil:question_text>The owner of all log files written by rsyslog should be .
These log files are determined by the second part of each Rule line in
/etc/rsyslog.conf and typically all appear in /var/log.
To see the owner of a given log file, run the following command:
$ ls -l LOGFILE
      Is it the case that the owner is not correct?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_files_permissions_question:question:1">
          <ocil:question_text>The file permissions for all log files written by rsyslog should
be set to 600, or more restrictive. These log files are determined by the
second part of each Rule line in /etc/rsyslog.conf and typically
all appear in /var/log. To see the permissions of a given log
file, run the following command:
$ ls -l LOGFILE
The permissions should be 600, or more restrictive.
      Is it the case that the permissions are not correct?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_remote_access_monitoring_question:question:1">
          <ocil:question_text>To verify that remote access methods are logging to rsyslog,
run the following command:
grep -rE '(auth.\*|authpriv.\*|daemon.\*)' /etc/rsyslog.*
The output should contain auth.*, authpriv.*, and daemon.*
pointing to a log file.
      Is it the case that remote access methods are not logging to rsyslog?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ensure_logrotate_activated_question:question:1">
          <ocil:question_text>To determine the status and frequency of logrotate, run the following command:
$ sudo grep logrotate /var/log/cron*
If logrotate is configured properly, output should include references to
/etc/cron.daily.
      Is it the case that logrotate is not configured to run daily?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_syslogng_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the syslog-ng-core package is installed: $ rpm -q syslog-ng-core
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_nolisten_question:question:1">
          <ocil:question_text>Display the contents of the configuration file:
cat /etc/rsyslog.conf
Make sure that the following lines are not present in the output:
$ModLoad imtcp
$InputTCPServerRun port
$ModLoad imudp
$UDPServerRun port
$ModLoad imrelp
$InputRELPServerRun port
      Is it the case that rsyslog accepts remote messages?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_syslogng_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
syslog-ng service:
$ sudo systemctl is-active syslog-ng
If the service is running, it should return the following: active
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_remote_loghost_question:question:1">
          <ocil:question_text>To ensure logs are sent to a remote host, examine the file
/etc/rsyslog.conf.
If using UDP, a line similar to the following should be present:
 *.* @
If using TCP, a line similar to the following should be present:
 *.* @@
If using RELP, a line similar to the following should be present:
 *.* :omrelp:
      Is it the case that no evidence that the audit logs are being off-loaded to another system or media?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_remote_tls_question:question:1">
          <ocil:question_text>To verify that rsyslog's Forwarding Output Module is configured
to use TLS for logging to remote server, run the following command:
$ grep omfwd /etc/rsyslog.conf /etc/rsyslog.d/*.conf
The output should include record similar to
action(type="omfwd" protocol="tcp" Target="&lt;remote system&gt;" port="6514"
    StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" streamdriver.CheckExtendedKeyPurpose="on")

where the &lt;remote system&gt; present in the configuration line above must be a valid IP address or a host name of the remote logging server.
      Is it the case that omfwd is not configured with gtls and AuthMode?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_remote_tls_cacert_question:question:1">
          <ocil:question_text>To verify that rsyslog's Forwarding Output Module has CA certificate
configured for its TLS connections to remote server, run the following command:
$ grep DefaultNetstreamDriverCAFile /etc/rsyslog.conf /etc/rsyslog.d/*.conf
The output should include record similar to
global(DefaultNetstreamDriverCAFile="/etc/pki/tls/cert.pem")
where the path to the CA file (/etc/pki/tls/cert.pem in case above) must point to the correct CA certificate.
      Is it the case that CA certificate for rsyslog remote logging via TLS is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_rsyslog-gnutls_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the rsyslog-gnutls package is installed: $ rpm -q rsyslog-gnutls
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_rsyslog_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the rsyslog package is installed: $ rpm -q rsyslog
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_rsyslog_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
rsyslog service:
$ sudo systemctl is-active rsyslog
If the service is running, it should return the following: active
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_firewalld_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
firewalld service:
$ sudo systemctl is-active firewalld
If the service is running, it should return the following: active
      Is it the case that the service is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-set_firewalld_default_zone_question:question:1">
          <ocil:question_text>Inspect the file /etc/firewalld/firewalld.conf to determine
the default zone for the firewalld. It should be set to DefaultZone=drop:
$ sudo grep DefaultZone /etc/firewalld/firewalld.conf
      Is it the case that the default zone is not set to DROP?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-libreswan_approved_tunnels_question:question:1">
          <ocil:question_text>Verify that Fedora does not have unauthorized IP tunnels configured.



If "libreswan" is installed, check to see if the "IPsec" service is active with the following command:

# systemctl status ipsec
ipsec.service - Internet Key Exchange (IKE) Protocol Daemon for IPsec
Loaded: loaded (/usr/lib/systemd/system/ipsec.service; disabled)
Active: inactive (dead)


If the "IPsec" service is active, check for configured IPsec connections (conn), perform the following:
grep -rni conn /etc/ipsec.conf /etc/ipsec.d/
Verify any returned results for organizational approval.
      Is it the case that the IPSec tunnels are not approved?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_libreswan_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the libreswan package is installed: $ rpm -q libreswan
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_ip6tables_enabled_question:question:1">
          <ocil:question_text>If IPv6 is disabled, this is not applicable.



Run the following command to determine the current status of the
ip6tables service:
$ sudo systemctl is-active ip6tables
If the service is running, it should return the following: active
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_iptables_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
iptables service:
$ sudo systemctl is-active iptables
If the service is running, it should return the following: active
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-set_ip6tables_default_rule_question:question:1">
          <ocil:question_text>If IPv6 is disabled, this is not applicable.

Inspect the file /etc/sysconfig/ip6tables to determine
the default policy for the INPUT chain. It should be set to DROP:
$ sudo grep ":INPUT" /etc/sysconfig/ip6tables
      Is it the case that the default policy for the INPUT chain is not set to DROP?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-set_iptables_default_rule_question:question:1">
          <ocil:question_text>Inspect the file /etc/sysconfig/iptables to determine
the default policy for the INPUT chain. It should be set to DROP:
$ sudo grep ":INPUT" /etc/sysconfig/iptables
      Is it the case that the default policy for the INPUT chain is not set to DROP?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-set_iptables_default_rule_forward_question:question:1">
          <ocil:question_text>Run the following command to ensure the default FORWARD policy is DROP:
grep ":FORWARD" /etc/sysconfig/iptables
The output should be similar to the following:
$ sudo grep ":FORWARD" /etc/sysconfig/iptables
:FORWARD DROP [0:0
      Is it the case that the default policy for the FORWARD chain is not set to DROP?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_iptables_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the iptables package is installed: $ rpm -q iptables
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.all.accept_ra_defrtr kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.accept_ra_defrtr
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.all.accept_ra_defrtr\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.all.accept_ra_defrtr = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv6.conf.all.accept_ra_defrtr = 0, and that one assignment
is returned when
$ grep -r net.ipv6.conf.all.accept_ra_defrtr /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.all.accept_ra_pinfo kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.accept_ra_pinfo
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.all.accept_ra_pinfo\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.all.accept_ra_pinfo = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv6.conf.all.accept_ra_pinfo = 0, and that one assignment
is returned when
$ grep -r net.ipv6.conf.all.accept_ra_pinfo /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.all.accept_ra_rtr_pref kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.accept_ra_rtr_pref
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.all.accept_ra_rtr_pref\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.all.accept_ra_rtr_pref = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv6.conf.all.accept_ra_rtr_pref = 0, and that one assignment
is returned when
$ grep -r net.ipv6.conf.all.accept_ra_rtr_pref /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_autoconf_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.all.autoconf kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.autoconf
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.all.autoconf\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.all.autoconf = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv6.conf.all.autoconf = 0, and that one assignment
is returned when
$ grep -r net.ipv6.conf.all.autoconf /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_max_addresses_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.all.max_addresses kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.max_addresses
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.all.max_addresses\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.all.max_addresses = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv6.conf.all.max_addresses = 1, and that one assignment
is returned when
$ grep -r net.ipv6.conf.all.max_addresses /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_router_solicitations_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.all.router_solicitations kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.router_solicitations
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.all.router_solicitations\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.all.router_solicitations = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv6.conf.all.router_solicitations = 0, and that one assignment
is returned when
$ grep -r net.ipv6.conf.all.router_solicitations /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.accept_ra kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.accept_ra
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.default.accept_ra\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.default.accept_ra = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv6.conf.default.accept_ra = 0, and that one assignment
is returned when
$ grep -r net.ipv6.conf.default.accept_ra /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.accept_ra_defrtr kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.accept_ra_defrtr
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.default.accept_ra_defrtr\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.default.accept_ra_defrtr = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv6.conf.default.accept_ra_defrtr = 0, and that one assignment
is returned when
$ grep -r net.ipv6.conf.default.accept_ra_defrtr /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.accept_ra_pinfo kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.accept_ra_pinfo
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.default.accept_ra_pinfo\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.default.accept_ra_pinfo = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv6.conf.default.accept_ra_pinfo = 0, and that one assignment
is returned when
$ grep -r net.ipv6.conf.default.accept_ra_pinfo /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.accept_ra_rtr_pref kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.accept_ra_rtr_pref
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.default.accept_ra_rtr_pref\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.default.accept_ra_rtr_pref = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv6.conf.default.accept_ra_rtr_pref = 0, and that one assignment
is returned when
$ grep -r net.ipv6.conf.default.accept_ra_rtr_pref /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.accept_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.accept_redirects
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.default.accept_redirects\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.default.accept_redirects = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv6.conf.default.accept_redirects = 0, and that one assignment
is returned when
$ grep -r net.ipv6.conf.default.accept_redirects /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_autoconf_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.autoconf kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.autoconf
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.default.autoconf\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.default.autoconf = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv6.conf.default.autoconf = 0, and that one assignment
is returned when
$ grep -r net.ipv6.conf.default.autoconf /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_max_addresses_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.max_addresses kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.max_addresses
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.default.max_addresses\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.default.max_addresses = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv6.conf.default.max_addresses = 1, and that one assignment
is returned when
$ grep -r net.ipv6.conf.default.max_addresses /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_router_solicitations_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.router_solicitations kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.router_solicitations
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.default.router_solicitations\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.default.router_solicitations = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv6.conf.default.router_solicitations = 0, and that one assignment
is returned when
$ grep -r net.ipv6.conf.default.router_solicitations /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_ipv6_disable_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /boot/grub2/grubenv.
If they include ipv6.disable=1, then the parameter
is configured at boot time.
$ sudo grep 'kernelopts.*ipv6.disable=1.*' GRUBENV_FILE_LOCATION
Fill in GRUBENV_FILE_LOCATION based on information above.
      Is it the case that IPv6 is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_ipv6_option_disabled_question:question:1">
          <ocil:question_text>If the system uses IPv6, this is not applicable.

If the system is configured to disable the
ipv6 kernel module, it will contain a line
of the form:
options ipv6 disable=1
Such lines may be inside any file in /etc/modprobe.d or the
deprecated/etc/modprobe.conf.  This permits insertion of the IPv6
kernel module (which other parts of the system expect to be present), but
otherwise keeps it inactive.  Run the following command to search for such
lines in all files in /etc/modprobe.d and the deprecated
/etc/modprobe.conf:
$ grep -r ipv6 /etc/modprobe.conf /etc/modprobe.d
      Is it the case that the ipv6 kernel module is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_question:question:1">
          <ocil:question_text>If the system uses IPv6, this is not applicable.

If the system is configured to prevent the usage of the ipv6 on
network interfaces, it will contain a line of the form:
net.ipv6.conf.all.disable_ipv6 = 1
Such lines may be inside any file in the /etc/sysctl.d directory.
This permits insertion of the IPv6 kernel module (which other parts of the
system expect to be present), but otherwise keeps all network interfaces
from using IPv6. Run the following command to search for such lines in all
files in /etc/sysctl.d:
$ grep -r ipv6 /etc/sysctl.d
      Is it the case that the ipv6 support is disabled on all network interfaces?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_disable_ipv6_question:question:1">
          <ocil:question_text>If the system uses IPv6, this is not applicable.

If the system is configured to prevent the usage of the ipv6 on
network interfaces, it will contain a line of the form:
net.ipv6.conf.default.disable_ipv6 = 1
Such lines may be inside any file in the /etc/sysctl.d directory.
This permits insertion of the IPv6 kernel module (which other parts of the
system expect to be present), but otherwise keeps network interfaces
from using IPv6. Run the following command to search for such lines in all
files in /etc/sysctl.d:
$ grep -r ipv6 /etc/sysctl.d
      Is it the case that the ipv6 support is disabled by default on network interfaces?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_local_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.accept_local kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.accept_local
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.all.accept_local\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.all.accept_local = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv4.conf.all.accept_local = 0, and that one assignment
is returned when
$ grep -r net.ipv4.conf.all.accept_local /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.accept_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.accept_redirects
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.all.accept_redirects\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.all.accept_redirects = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv4.conf.all.accept_redirects = 0, and that one assignment
is returned when
$ grep -r net.ipv4.conf.all.accept_redirects /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.accept_source_route kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.accept_source_route
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.all.accept_source_route\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.all.accept_source_route = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv4.conf.all.accept_source_route = 0, and that one assignment
is returned when
$ grep -r net.ipv4.conf.all.accept_source_route /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.arp_filter kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.arp_filter
The output of the command should indicate a value of .
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.all.arp_filter\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.all.arp_filter = 
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv4.conf.all.arp_filter = , and that one assignment
is returned when
$ grep -r net.ipv4.conf.all.arp_filter /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_arp_ignore_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.arp_ignore kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.arp_ignore
The output of the command should indicate a value of .
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.all.arp_ignore\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.all.arp_ignore = 
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv4.conf.all.arp_ignore = , and that one assignment
is returned when
$ grep -r net.ipv4.conf.all.arp_ignore /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_drop_gratuitous_arp_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.drop_gratuitous_arp kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.drop_gratuitous_arp
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.all.drop_gratuitous_arp\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.all.drop_gratuitous_arp = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv4.conf.all.drop_gratuitous_arp = 1, and that one assignment
is returned when
$ grep -r net.ipv4.conf.all.drop_gratuitous_arp /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.log_martians kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.log_martians
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.all.log_martians\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.all.log_martians = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv4.conf.all.log_martians = 1, and that one assignment
is returned when
$ grep -r net.ipv4.conf.all.log_martians /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_route_localnet_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.route_localnet kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.route_localnet
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.all.route_localnet\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.all.route_localnet = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv4.conf.all.route_localnet = 0, and that one assignment
is returned when
$ grep -r net.ipv4.conf.all.route_localnet /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.rp_filter kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.rp_filter
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.all.rp_filter\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.all.rp_filter = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv4.conf.all.rp_filter = 1, and that one assignment
is returned when
$ grep -r net.ipv4.conf.all.rp_filter /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.secure_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.secure_redirects
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.all.secure_redirects\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.all.secure_redirects = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv4.conf.all.secure_redirects = 0, and that one assignment
is returned when
$ grep -r net.ipv4.conf.all.secure_redirects /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_shared_media_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.shared_media kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.shared_media
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.all.shared_media\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.all.shared_media = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv4.conf.all.shared_media = 0, and that one assignment
is returned when
$ grep -r net.ipv4.conf.all.shared_media /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.default.accept_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.accept_redirects
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.default.accept_redirects\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.default.accept_redirects = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv4.conf.default.accept_redirects = 0, and that one assignment
is returned when
$ grep -r net.ipv4.conf.default.accept_redirects /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.default.accept_source_route kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.accept_source_route
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.default.accept_source_route\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.default.accept_source_route = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv4.conf.default.accept_source_route = 0, and that one assignment
is returned when
$ grep -r net.ipv4.conf.default.accept_source_route /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.default.log_martians kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.log_martians
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.default.log_martians\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.default.log_martians = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv4.conf.default.log_martians = 1, and that one assignment
is returned when
$ grep -r net.ipv4.conf.default.log_martians /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.default.rp_filter kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.rp_filter
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.default.rp_filter\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.default.rp_filter = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv4.conf.default.rp_filter = 1, and that one assignment
is returned when
$ grep -r net.ipv4.conf.default.rp_filter /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.default.secure_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.secure_redirects
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.default.secure_redirects\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.default.secure_redirects = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv4.conf.default.secure_redirects = 0, and that one assignment
is returned when
$ grep -r net.ipv4.conf.default.secure_redirects /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_shared_media_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.default.shared_media kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.shared_media
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.default.shared_media\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.default.shared_media = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv4.conf.default.shared_media = 0, and that one assignment
is returned when
$ grep -r net.ipv4.conf.default.shared_media /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.icmp_echo_ignore_broadcasts kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.icmp_echo_ignore_broadcasts
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.icmp_echo_ignore_broadcasts\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.icmp_echo_ignore_broadcasts = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv4.icmp_echo_ignore_broadcasts = 1, and that one assignment
is returned when
$ grep -r net.ipv4.icmp_echo_ignore_broadcasts /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.icmp_ignore_bogus_error_responses kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.icmp_ignore_bogus_error_responses
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.icmp_ignore_bogus_error_responses\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.icmp_ignore_bogus_error_responses = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv4.icmp_ignore_bogus_error_responses = 1, and that one assignment
is returned when
$ grep -r net.ipv4.icmp_ignore_bogus_error_responses /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_ip_local_port_range_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.ip_local_port_range kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.ip_local_port_range
The output of the command should indicate a value of 32768 65535.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.ip_local_port_range\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.ip_local_port_range = 32768 65535
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv4.ip_local_port_range = 32768 65535, and that one assignment
is returned when
$ grep -r net.ipv4.ip_local_port_range /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_tcp_syncookies_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.tcp_syncookies kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.tcp_syncookies
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.tcp_syncookies\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.tcp_syncookies = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv4.tcp_syncookies = 1, and that one assignment
is returned when
$ grep -r net.ipv4.tcp_syncookies /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.send_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.send_redirects
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.all.send_redirects\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.all.send_redirects = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv4.conf.all.send_redirects = 0, and that one assignment
is returned when
$ grep -r net.ipv4.conf.all.send_redirects /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.default.send_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.send_redirects
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.default.send_redirects\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.default.send_redirects = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv4.conf.default.send_redirects = 0, and that one assignment
is returned when
$ grep -r net.ipv4.conf.default.send_redirects /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_ip_forward_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.ip_forward kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.ip_forward
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.ip_forward\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.ip_forward = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.ipv4.ip_forward = 0, and that one assignment
is returned when
$ grep -r net.ipv4.ip_forward /etc/sysctl.conf /etc/sysctl.d
is executed.
The ability to forward packets is only appropriate for routers.
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_atm_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the atm kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r atm /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_can_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the can kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r can /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_dccp_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the dccp kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r dccp /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_firewire-core_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the firewire-core kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r firewire-core /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_rds_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the rds kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r rds /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_tipc_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the tipc kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r tipc /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_bluetooth_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the bluetooth kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r bluetooth /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_cfg80211_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the cfg80211 kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r cfg80211 /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_iwlmvm_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the iwlmvm kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r iwlmvm /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_iwlwifi_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the iwlwifi kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r iwlwifi /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_mac80211_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the mac80211 kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r mac80211 /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_bluetooth_disabled_question:question:1">
          <ocil:question_text>
To check that the bluetooth service is disabled in system boot configuration,
run the following command:
$ sudo systemctl is-enabled bluetooth
Output should indicate the bluetooth service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ sudo systemctl is-enabled bluetooth disabled

Run the following command to verify bluetooth is not active (i.e. not running) through current runtime configuration:
$ sudo systemctl is-active bluetooth

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the bluetooth is masked, run the following command:
$ sudo systemctl show bluetooth | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that the "bluetooth" is loaded and not masked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-wireless_disable_interfaces_question:question:1">
          <ocil:question_text>Verify that there are no wireless interfaces configured on the system
with the following command:

$ sudo nmcli device
The output should only contain wireless devices in unavailable state, like in the
following example:
wlp0s20f3          wifi      unavailable             -- 
      Is it the case that wireless interfaces are not active?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-network_nmcli_permissions_question:question:1">
          <ocil:question_text>Using a non-privileged account, verify that users cannot modify or change
network settings with the nmcli command with the following command:
$ nmcli general permissions
The output should contain the following:
PERMISSION                                                        VALUE
org.freedesktop.NetworkManager.enable-disable-network             auth
org.freedesktop.NetworkManager.enable-disable-wifi                auth
org.freedesktop.NetworkManager.enable-disable-wwan                auth
org.freedesktop.NetworkManager.enable-disable-wimax               auth
org.freedesktop.NetworkManager.sleep-wake                         auth
org.freedesktop.NetworkManager.network-control                    auth
org.freedesktop.NetworkManager.wifi.share.protected               auth
org.freedesktop.NetworkManager.wifi.share.open                    auth
org.freedesktop.NetworkManager.settings.modify.system             auth
org.freedesktop.NetworkManager.settings.modify.own                auth
org.freedesktop.NetworkManager.settings.modify.hostname           auth
org.freedesktop.NetworkManager.settings.modify.global-dns         auth
org.freedesktop.NetworkManager.reload                             auth
org.freedesktop.NetworkManager.checkpoint-rollback                auth
org.freedesktop.NetworkManager.enable-disable-statistics          auth
org.freedesktop.NetworkManager.enable-disable-connectivity-check  auth
org.freedesktop.NetworkManager.wifi.scan                          auth

      Is it the case that non-privileged users can modify or change network settings?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-network_sniffer_disabled_question:question:1">
          <ocil:question_text>To verify that Promiscuous mode of an interface is disabled, run the following command:
$ ip link | grep PROMISC
The output returned should not return any network device containing PROMISC.
      Is it the case that any network device is in promiscuous mode?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_backup_etc_group_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/group-,
run the command:
$ ls -lL /etc/group-
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/group- does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_backup_etc_gshadow_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/gshadow-,
run the command:
$ ls -lL /etc/gshadow-
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/gshadow- does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_backup_etc_passwd_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/passwd-,
run the command:
$ ls -lL /etc/passwd-
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/passwd- does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_backup_etc_shadow_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/shadow-,
run the command:
$ ls -lL /etc/shadow-
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/shadow- does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_etc_group_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/group,
run the command:
$ ls -lL /etc/group
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/group does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_etc_gshadow_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/gshadow,
run the command:
$ ls -lL /etc/gshadow
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/gshadow does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_etc_passwd_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/passwd,
run the command:
$ ls -lL /etc/passwd
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/passwd does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_etc_shadow_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/shadow,
run the command:
$ ls -lL /etc/shadow
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/shadow does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_backup_etc_group_question:question:1">
          <ocil:question_text>To check the ownership of /etc/group-,
run the command:
$ ls -lL /etc/group-
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/group- does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_backup_etc_gshadow_question:question:1">
          <ocil:question_text>To check the ownership of /etc/gshadow-,
run the command:
$ ls -lL /etc/gshadow-
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/gshadow- does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_backup_etc_passwd_question:question:1">
          <ocil:question_text>To check the ownership of /etc/passwd-,
run the command:
$ ls -lL /etc/passwd-
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/passwd- does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_backup_etc_shadow_question:question:1">
          <ocil:question_text>To check the ownership of /etc/shadow-,
run the command:
$ ls -lL /etc/shadow-
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/shadow- does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_etc_group_question:question:1">
          <ocil:question_text>To check the ownership of /etc/group,
run the command:
$ ls -lL /etc/group
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/group does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_etc_gshadow_question:question:1">
          <ocil:question_text>To check the ownership of /etc/gshadow,
run the command:
$ ls -lL /etc/gshadow
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/gshadow does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_etc_passwd_question:question:1">
          <ocil:question_text>To check the ownership of /etc/passwd,
run the command:
$ ls -lL /etc/passwd
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/passwd does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_etc_shadow_question:question:1">
          <ocil:question_text>To check the ownership of /etc/shadow,
run the command:
$ ls -lL /etc/shadow
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/shadow does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_backup_etc_group_question:question:1">
          <ocil:question_text>To check the permissions of /etc/group-,
run the command:
$ ls -l /etc/group-
If properly configured, the output should indicate the following permissions:
-rw-r--r--
      Is it the case that /etc/group- does not have unix mode -rw-r--r--?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_backup_etc_gshadow_question:question:1">
          <ocil:question_text>To check the permissions of /etc/gshadow-,
run the command:
$ ls -l /etc/gshadow-
If properly configured, the output should indicate the following permissions:
----------
      Is it the case that /etc/gshadow- does not have unix mode ----------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_backup_etc_passwd_question:question:1">
          <ocil:question_text>To check the permissions of /etc/passwd-,
run the command:
$ ls -l /etc/passwd-
If properly configured, the output should indicate the following permissions:
-rw-r--r--
      Is it the case that /etc/passwd- does not have unix mode -rw-r--r--?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_backup_etc_shadow_question:question:1">
          <ocil:question_text>To check the permissions of /etc/shadow-,
run the command:
$ ls -l /etc/shadow-
If properly configured, the output should indicate the following permissions:
----------
      Is it the case that /etc/shadow- does not have unix mode ----------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_group_question:question:1">
          <ocil:question_text>To check the permissions of /etc/passwd,
run the command:
$ ls -l /etc/passwd
If properly configured, the output should indicate the following permissions:
-rw-r--r--
      Is it the case that /etc/group does not have unix mode -rw-r--r--?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_gshadow_question:question:1">
          <ocil:question_text>To check the permissions of /etc/gshadow,
run the command:
$ ls -l /etc/gshadow
If properly configured, the output should indicate the following permissions:
----------
      Is it the case that /etc/gshadow does not have unix mode ----------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_passwd_question:question:1">
          <ocil:question_text>To check the permissions of /etc/passwd,
run the command:
$ ls -l /etc/passwd
If properly configured, the output should indicate the following permissions:
-rw-r--r--
      Is it the case that /etc/passwd does not have unix mode -rw-r--r--?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_shadow_question:question:1">
          <ocil:question_text>To check the permissions of /etc/shadow,
run the command:
$ ls -l /etc/shadow
If properly configured, the output should indicate the following permissions:
----------
      Is it the case that /etc/shadow does not have unix mode ----------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_var_log_question:question:1">
          <ocil:question_text>To check the group ownership of /var/log,
run the command:
$ ls -lL /var/log
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /var/log does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_var_log_messages_question:question:1">
          <ocil:question_text>To check the group ownership of /var/log/messages,
run the command:
$ ls -lL /var/log/messages
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /var/log/messages does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_var_log_syslog_question:question:1">
          <ocil:question_text>To check the group ownership of /var/log/syslog,
run the command:
$ ls -lL /var/log/syslog
If properly configured, the output should indicate the following group-owner:
adm
      Is it the case that /var/log/syslog does not have a group owner of adm?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_var_log_question:question:1">
          <ocil:question_text>To check the ownership of /var/log,
run the command:
$ ls -lL /var/log
If properly configured, the output should indicate the following owner:
root
      Is it the case that /var/log does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_var_log_messages_question:question:1">
          <ocil:question_text>To check the ownership of /var/log/messages,
run the command:
$ ls -lL /var/log/messages
If properly configured, the output should indicate the following owner:
root
      Is it the case that /var/log/messages does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_var_log_syslog_question:question:1">
          <ocil:question_text>To check the ownership of /var/log/syslog,
run the command:
$ ls -lL /var/log/syslog
If properly configured, the output should indicate the following owner:
syslog
      Is it the case that /var/log/syslog does not have an owner of syslog?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_var_log_question:question:1">
          <ocil:question_text>To check the permissions of /var/log,
run the command:
$ ls -l /var/log
If properly configured, the output should indicate the following permissions:
drwxr-xr-x
      Is it the case that /var/log does not have unix mode drwxr-xr-x?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_var_log_messages_question:question:1">
          <ocil:question_text>To check the permissions of /var/log/messages,
run the command:
$ ls -l /var/log/messages
If properly configured, the output should indicate the following permissions:
-rw-r-----
      Is it the case that /var/log/messages does not have unix mode -rw-r-----?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_var_log_syslog_question:question:1">
          <ocil:question_text>To check the permissions of /var/log/syslog,
run the command:
$ ls -l /var/log/syslog
If properly configured, the output should indicate the following permissions:
-rw-r-----
      Is it the case that /var/log/syslog does not have unix mode -rw-r-----?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_group_ownership_library_dirs_question:question:1">
          <ocil:question_text>Verify the system-wide shared library directories are group-owned by "root" with the following command:

$ sudo find /lib /lib64 /usr/lib /usr/lib64 ! -group root -type d -exec stat -c "%n %G" '{}' \;

If any system-wide shared library directory is returned and is not group-owned by a required system account, this is a finding.
      Is it the case that any system-wide shared library directory is returned and is not group-owned by a required system account?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_ownership_binary_dirs_question:question:1">
          <ocil:question_text>System executables are stored in the following directories by default:
/bin
/sbin
/usr/bin
/usr/local/bin
/usr/local/sbin
/usr/sbin
For each of these directories, run the following command to find files
not owned by root:
$ sudo find -L DIR/ ! -user root -type d -exec chown root {} \;
      Is it the case that any system executables directories are found to not be owned by root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_ownership_library_dirs_question:question:1">
          <ocil:question_text>Verify the system-wide shared library directories are owned by "root" with the following command:

$ sudo find /lib /lib64 /usr/lib /usr/lib64 ! -user root -type d -exec stat -c "%n %U" '{}' \;
      Is it the case that any system-wide shared library directory is not owned by root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_permissions_binary_dirs_question:question:1">
          <ocil:question_text>System executables are stored in the following directories by default:
/bin
/sbin
/usr/bin
/usr/sbin
/usr/local/bin
/usr/local/sbin
To find system executables directories that are group-writable or
world-writable, run the following command for each directory DIR
which contains system executables:
$ sudo find -L DIR -perm /022 -type d
      Is it the case that any of these files are group-writable or world-writable?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_permissions_library_dirs_question:question:1">
          <ocil:question_text>Shared libraries are stored in the following directories:
/lib
/lib64
/usr/lib
/usr/lib64

To find shared libraries that are group-writable or world-writable,
run the following command for each directory DIR which contains shared libraries:
$ sudo find -L DIR -perm /022 -type d
      Is it the case that any of these files are group-writable or world-writable?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupownership_system_commands_dirs_question:question:1">
          <ocil:question_text>Verify the system commands contained in the following directories are group-owned by "root", or a required system account, with the following command:

$ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -group root -exec ls -l {} \;
      Is it the case that any system commands are returned and is not group-owned by a required system account?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_ownership_binary_dirs_question:question:1">
          <ocil:question_text>Verify the system commands contained in the following directories are owned by "root" with the following command:

$ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/local/bin /usr/local/sbin ! -user root -exec ls -l {} \;
      Is it the case that any system commands are found to not be owned by root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_ownership_library_dirs_question:question:1">
          <ocil:question_text>Verify the system-wide shared library files are owned by "root" with the following command:

$ sudo find -L /lib /lib64 /usr/lib /usr/lib64 ! -user root -exec ls -l {} \;
      Is it the case that any system wide shared library file is not owned by root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_binary_dirs_question:question:1">
          <ocil:question_text>Verify the system commands contained in the following directories have mode "755" or less permissive with the following command:

$ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/local/bin /usr/local/sbin -perm /022 -exec ls -l {} \;
      Is it the case that any system commands are found to be group-writable or world-writable?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_library_dirs_question:question:1">
          <ocil:question_text>Verify the system-wide shared library files contained in the following directories have mode "755" or less permissive with the following command:

$ sudo find -L /lib /lib64 /usr/lib /usr/lib64 -perm /022 -type f -exec ls -l {} \;
      Is it the case that any system-wide shared library file is found to be group-writable or world-writable?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-root_permissions_syslibrary_files_question:question:1">
          <ocil:question_text>Verify the system-wide shared library files are group-owned by "root" with the following command:

$ sudo find -L /lib /lib64 /usr/lib /usr/lib64 ! -group root -exec ls -l {} \;
      Is it the case that any system wide shared library file is returned and is not group-owned by a required system account?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_perms_world_writable_root_owned_question:question:1">
          <ocil:question_text>The following command will discover and print world-writable directories that
are not owned by root.  Run it once for each local partition PART:
$ sudo find PART -xdev -type d -perm -0002 -uid +0 -print
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_perms_world_writable_sticky_bits_question:question:1">
          <ocil:question_text>To find world-writable directories that lack the sticky bit, run the following command:
$ sudo find / -type d \( -perm -0002 -a ! -perm -1000 \) -print 2&gt;/dev/null
      Is it the case that any world-writable directories are missing the sticky bit?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_perms_world_writable_system_owned_question:question:1">
          <ocil:question_text>The following command will discover and print world-writable directories that
are not owned by a system account, given the assumption that only system
accounts have a uid lower than 500.  Run it once for each local partition PART:
$ sudo find PART -xdev -type d -perm -0002 -uid +499 -print
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_perms_world_writable_system_owned_group_question:question:1">
          <ocil:question_text>The following command will discover and print world-writable directories that
are not group owned by a system account, given the assumption that only system
accounts have a gid lower than 1000.  Run it once for each local partition PART:
$ sudo find PART -xdev -type d -perm -0002 -gid +999 -print
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_audit_auditd_question:question:1">
          <ocil:question_text>To check the permissions of /etc/audit/auditd.conf,
run the command:
$ ls -l /etc/audit/auditd.conf
If properly configured, the output should indicate the following permissions:
-rw-r-----
      Is it the case that /etc/audit/auditd.conf does not have unix mode -rw-r-----?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_audit_rulesd_question:question:1">
          <ocil:question_text>To check the permissions of /etc/audit/rules.d/*.rules,
run the command:
$ ls -l /etc/audit/rules.d/*.rules
If properly configured, the output should indicate the following permissions:
-rw-r-----
      Is it the case that /etc/audit/rules.d/*.rules does not have unix mode -rw-r-----?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_systemmap_question:question:1">
          <ocil:question_text>To check the permissions of /boot/Sysem.map-*,
run the command:
$ ls -l /boot/Sysem.map-*
If properly configured, the output should indicate the following permissions:
-rw-------
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_unauthorized_sgid_question:question:1">
          <ocil:question_text>To find SGID files, run the following command:
$ sudo find / -xdev -type f -perm -2000
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_unauthorized_suid_question:question:1">
          <ocil:question_text>To find SUID files, run the following command:
$ sudo find / -xdev -type f -perm -4000
      Is it the case that only authorized files appear in the output of the find command?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_unauthorized_world_writable_question:question:1">
          <ocil:question_text>To find world-writable files, run the following command:
$ sudo find / -xdev -type f -perm -002
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_ungroupowned_question:question:1">
          <ocil:question_text>The following command will discover and print any
files on local partitions which do not belong to a valid group.
$ df --local -P | awk '{if (NR!=1) print $6}' | sudo xargs -I '{}' find '{}' -xdev -nogroup

Either remove all files and directories from the system that do not have a valid group,
or assign a valid group with the chgrp command:
$ sudo chgrp group file
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_files_unowned_by_user_question:question:1">
          <ocil:question_text>The following command will discover and print any
files on local partitions which do not belong to a valid user.
$ df --local -P | awk {'if (NR!=1) print $6'} | sudo xargs -I '{}' find '{}' -xdev -nouser

Either remove all files and directories from the system that do not have a
valid user, or assign a valid user to all unowned files and directories on
the system with the chown command:
$ sudo chown user file
      Is it the case that files exist that are not owned by a valid user?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_fs_protected_fifos_question:question:1">
          <ocil:question_text>The runtime status of the fs.protected_fifos kernel parameter can be queried
by running the following command:
$ sysctl fs.protected_fifos
The output of the command should indicate a value of 2.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*fs.protected_fifos\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
fs.protected_fifos = 2
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains fs.protected_fifos = 2, and that one assignment
is returned when
$ grep -r fs.protected_fifos /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_fs_protected_hardlinks_question:question:1">
          <ocil:question_text>The runtime status of the fs.protected_hardlinks kernel parameter can be queried
by running the following command:
$ sysctl fs.protected_hardlinks
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*fs.protected_hardlinks\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
fs.protected_hardlinks = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains fs.protected_hardlinks = 1, and that one assignment
is returned when
$ grep -r fs.protected_hardlinks /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_fs_protected_regular_question:question:1">
          <ocil:question_text>The runtime status of the fs.protected_regular kernel parameter can be queried
by running the following command:
$ sysctl fs.protected_regular
The output of the command should indicate a value of 2.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*fs.protected_regular\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
fs.protected_regular = 2
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains fs.protected_regular = 2, and that one assignment
is returned when
$ grep -r fs.protected_regular /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_fs_protected_symlinks_question:question:1">
          <ocil:question_text>The runtime status of the fs.protected_symlinks kernel parameter can be queried
by running the following command:
$ sysctl fs.protected_symlinks
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*fs.protected_symlinks\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
fs.protected_symlinks = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains fs.protected_symlinks = 1, and that one assignment
is returned when
$ grep -r fs.protected_symlinks /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_cramfs_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the cramfs kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r cramfs /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_usb-storage_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the usb-storage kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r usb-storage /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_autofs_disabled_question:question:1">
          <ocil:question_text>
To check that the autofs service is disabled in system boot configuration,
run the following command:
$ sudo systemctl is-enabled autofs
Output should indicate the autofs service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ sudo systemctl is-enabled autofs disabled

Run the following command to verify autofs is not active (i.e. not running) through current runtime configuration:
$ sudo systemctl is-active autofs

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the autofs is masked, run the following command:
$ sudo systemctl show autofs | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that the "autofs" is loaded and not masked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_boot_noauto_question:question:1">
          <ocil:question_text>To verify the noauto option is configured for the /boot mount point,
    run the following command:
    $ sudo mount | grep '\s/boot\s'
    The output should show the corresponding mount point along with the noauto setting in parentheses.

      Is it the case that the "/boot" file system does not have the "noauto" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_boot_nodev_question:question:1">
          <ocil:question_text>To verify the nodev option is configured for the /boot mount point,
    run the following command:
    $ sudo mount | grep '\s/boot\s'
    The output should show the corresponding mount point along with the nodev setting in parentheses.

      Is it the case that the "/boot" file system does not have the "nodev" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_boot_noexec_question:question:1">
          <ocil:question_text>To verify the noexec option is configured for the /boot mount point,
    run the following command:
    $ sudo mount | grep '\s/boot\s'
    The output should show the corresponding mount point along with the noexec setting in parentheses.

      Is it the case that the "/boot" file system does not have the "noexec" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_boot_nosuid_question:question:1">
          <ocil:question_text>To verify the nosuid option is configured for the /boot mount point,
    run the following command:
    $ sudo mount | grep '\s/boot\s'
    The output should show the corresponding mount point along with the nosuid setting in parentheses.

      Is it the case that the "/boot" file system does not have the "nosuid" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_dev_shm_nodev_question:question:1">
          <ocil:question_text>To verify the nodev option is configured for the /dev/shm mount point,
    run the following command:
    $ sudo mount | grep '\s/dev/shm\s'
    The output should show the corresponding mount point along with the nodev setting in parentheses.

      Is it the case that the "/dev/shm" file system does not have the "nodev" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_dev_shm_noexec_question:question:1">
          <ocil:question_text>To verify the noexec option is configured for the /dev/shm mount point,
    run the following command:
    $ sudo mount | grep '\s/dev/shm\s'
    The output should show the corresponding mount point along with the noexec setting in parentheses.

      Is it the case that the "/dev/shm" file system does not have the "noexec" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_dev_shm_nosuid_question:question:1">
          <ocil:question_text>To verify the nosuid option is configured for the /dev/shm mount point,
    run the following command:
    $ sudo mount | grep '\s/dev/shm\s'
    The output should show the corresponding mount point along with the nosuid setting in parentheses.

      Is it the case that the "/dev/shm" file system does not have the "nosuid" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_home_noexec_question:question:1">
          <ocil:question_text>To verify the noexec option is configured for the /home mount point,
    run the following command:
    $ sudo mount | grep '\s/home\s'
    The output should show the corresponding mount point along with the noexec setting in parentheses.

      Is it the case that the "/home" file system does not have the "noexec" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_nodev_nonroot_local_partitions_question:question:1">
          <ocil:question_text>To verify the nodev option is configured for non-root local partitions, run the following command:
$ sudo mount | grep '^/dev\S* on /\S' | grep --invert-match 'nodev'
The output shows local non-root partitions mounted without the nodev option, and there should be no output at all.

      Is it the case that some mounts appear among output lines?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_noexec_removable_partitions_question:question:1">
          <ocil:question_text>To verify that binaries cannot be directly executed from removable media, run the following command:
$ grep -v noexec /etc/fstab
The resulting output will show partitions which do not have the noexec flag. Verify all partitions
in the output are not removable media.
      Is it the case that removable media partitions are present?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_opt_nosuid_question:question:1">
          <ocil:question_text>To verify the nosuid option is configured for the /opt mount point,
    run the following command:
    $ sudo mount | grep '\s/opt\s'
    The output should show the corresponding mount point along with the nosuid setting in parentheses.

      Is it the case that the "/opt" file system does not have the "nosuid" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_proc_hidepid_question:question:1">
          <ocil:question_text>To verify the hidepid=value option is configured for the /proc mount point,
    run the following command:
    $ sudo mount | grep '\s/proc\s'
    The output should show the corresponding mount point along with the hidepid=value setting in parentheses.

      Is it the case that the "/proc" file system does not have the "hidepid=value" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_srv_nosuid_question:question:1">
          <ocil:question_text>To verify the nosuid option is configured for the /srv mount point,
    run the following command:
    $ sudo mount | grep '\s/srv\s'
    The output should show the corresponding mount point along with the nosuid setting in parentheses.

      Is it the case that the "/srv" file system does not have the "nosuid" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_tmp_nodev_question:question:1">
          <ocil:question_text>To verify the nodev option is configured for the /tmp mount point,
    run the following command:
    $ sudo mount | grep '\s/tmp\s'
    The output should show the corresponding mount point along with the nodev setting in parentheses.

      Is it the case that the "/tmp" file system does not have the "nodev" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_tmp_noexec_question:question:1">
          <ocil:question_text>To verify the noexec option is configured for the /tmp mount point,
    run the following command:
    $ sudo mount | grep '\s/tmp\s'
    The output should show the corresponding mount point along with the noexec setting in parentheses.

      Is it the case that the "/tmp" file system does not have the "noexec" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_tmp_nosuid_question:question:1">
          <ocil:question_text>To verify the nosuid option is configured for the /tmp mount point,
    run the following command:
    $ sudo mount | grep '\s/tmp\s'
    The output should show the corresponding mount point along with the nosuid setting in parentheses.

      Is it the case that the "/tmp" file system does not have the "nosuid" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_log_audit_nodev_question:question:1">
          <ocil:question_text>To verify the nodev option is configured for the /var/log/audit mount point,
    run the following command:
    $ sudo mount | grep '\s/var/log/audit\s'
    The output should show the corresponding mount point along with the nodev setting in parentheses.

      Is it the case that the "/var/log/audit" file system does not have the "nodev" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_log_audit_noexec_question:question:1">
          <ocil:question_text>To verify the noexec option is configured for the /var/log/audit mount point,
    run the following command:
    $ sudo mount | grep '\s/var/log/audit\s'
    The output should show the corresponding mount point along with the noexec setting in parentheses.

      Is it the case that the "/var/log/audit" file system does not have the "noexec" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_log_audit_nosuid_question:question:1">
          <ocil:question_text>To verify the nosuid option is configured for the /var/log/audit mount point,
    run the following command:
    $ sudo mount | grep '\s/var/log/audit\s'
    The output should show the corresponding mount point along with the nosuid setting in parentheses.

      Is it the case that the "/var/log/audit" file system does not have the "nosuid" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_log_nodev_question:question:1">
          <ocil:question_text>To verify the nodev option is configured for the /var/log mount point,
    run the following command:
    $ sudo mount | grep '\s/var/log\s'
    The output should show the corresponding mount point along with the nodev setting in parentheses.

      Is it the case that the "/var/log" file system does not have the "nodev" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_log_noexec_question:question:1">
          <ocil:question_text>To verify the noexec option is configured for the /var/log mount point,
    run the following command:
    $ sudo mount | grep '\s/var/log\s'
    The output should show the corresponding mount point along with the noexec setting in parentheses.

      Is it the case that the "/var/log" file system does not have the "noexec" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_log_nosuid_question:question:1">
          <ocil:question_text>To verify the nosuid option is configured for the /var/log mount point,
    run the following command:
    $ sudo mount | grep '\s/var/log\s'
    The output should show the corresponding mount point along with the nosuid setting in parentheses.

      Is it the case that the "/var/log" file system does not have the "nosuid" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_nodev_question:question:1">
          <ocil:question_text>To verify the nodev option is configured for the /var mount point,
    run the following command:
    $ sudo mount | grep '\s/var\s'
    The output should show the corresponding mount point along with the nodev setting in parentheses.

      Is it the case that the "/var" file system does not have the "nodev" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_noexec_question:question:1">
          <ocil:question_text>To verify the noexec option is configured for the /var mount point,
    run the following command:
    $ sudo mount | grep '\s/var\s'
    The output should show the corresponding mount point along with the noexec setting in parentheses.

      Is it the case that the "/var" file system does not have the "noexec" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_nosuid_question:question:1">
          <ocil:question_text>To verify the nosuid option is configured for the /var mount point,
    run the following command:
    $ sudo mount | grep '\s/var\s'
    The output should show the corresponding mount point along with the nosuid setting in parentheses.

      Is it the case that the "/var" file system does not have the "nosuid" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-coredump_disable_backtraces_question:question:1">
          <ocil:question_text>To verify that logging core dump backtraces is disabled, run the
following command:
$ grep ProcessSizeMax /etc/systemd/coredump.conf
The output should be:
ProcessSizeMax=0
      Is it the case that ProcessSizeMax is not set to zero?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-coredump_disable_storage_question:question:1">
          <ocil:question_text>To verify that storing core dumps are disabled, run the following command:
$ grep Storage /etc/systemd/coredump.conf
The output should be:
Storage=none
      Is it the case that Storage is not set to none?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-disable_users_coredumps_question:question:1">
          <ocil:question_text>To verify that core dumps are disabled for all users, run the following command:
$ grep core /etc/security/limits.conf
The output should be:
*     hard   core    0
      Is it the case that it is not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_systemd-coredump_disabled_question:question:1">
          <ocil:question_text>To verify that acquiring, saving, and processing core dumps is disabled, run the
following command:
$ systemctl status systemd-coredump.socket
The output should be similar to:
● systemd-coredump.socket
   Loaded: masked (Reason: Unit systemd-coredump.socket is masked.)
   Active: inactive (dead) ...

      Is it the case that unit systemd-coredump.socket is not masked or running?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_fs_suid_dumpable_question:question:1">
          <ocil:question_text>The runtime status of the fs.suid_dumpable kernel parameter can be queried
by running the following command:
$ sysctl fs.suid_dumpable
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*fs.suid_dumpable\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
fs.suid_dumpable = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains fs.suid_dumpable = 0, and that one assignment
is returned when
$ grep -r fs.suid_dumpable /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-umask_for_daemons_question:question:1">
          <ocil:question_text>To check the value of the umask, run the following command:
$ grep umask /etc/init.d/functions
The output should show .
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_exec_shield_question:question:1">
          <ocil:question_text>To verify ExecShield is enabled on 64-bit Fedora systems,
run the following command:
$ dmesg | grep '[NX|DX]*protection'
The output should not contain 'disabled by kernel command line option'.
Inspect the form of default GRUB 2 command line for the Linux operating system
in /boot/grub2/grubenv.
If they include noexec=off, then the parameter
is configured at boot time.
$ sudo grep 'kernelopts.*noexec=off.*' GRUBENV_FILE_LOCATION
Fill in GRUBENV_FILE_LOCATION based on information above.
      Is it the case that ExecShield is not supported by the hardware, is not enabled, or has been disabled by the kernel configuration.?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_kptr_restrict_question:question:1">
          <ocil:question_text>The runtime status of the kernel.kptr_restrict kernel parameter can be queried
by running the following command:
$ sysctl kernel.kptr_restrict
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.kptr_restrict\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.kptr_restrict = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains kernel.kptr_restrict = 1, and that one assignment
is returned when
$ grep -r kernel.kptr_restrict /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_randomize_va_space_question:question:1">
          <ocil:question_text>The runtime status of the kernel.randomize_va_space kernel parameter can be queried
by running the following command:
$ sysctl kernel.randomize_va_space
The output of the command should indicate a value of 2.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.randomize_va_space\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.randomize_va_space = 2
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains kernel.randomize_va_space = 2, and that one assignment
is returned when
$ grep -r kernel.randomize_va_space /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-bios_enable_execution_restrictions_question:question:1">
          <ocil:question_text>Verify the NX (no-execution) bit flag is set on the system.

Check that the no-execution bit flag is set with the following commands:

$ sudo dmesg | grep NX

[ 0.000000] NX (Execute Disable) protection: active

If "dmesg" does not show "NX (Execute Disable) protection" active, check the cpuinfo settings with the following command:

$ sudo grep flags /proc/cpuinfo
flags : fpu vme de pse tsc ms nx rdtscp lm constant_ts

The output should contain the "nx" flag.

Then, verify that there are no log messsages stating that NX is disabled in the system log. Run the following command:
$ sudo grep -P "^.+protection: disabled.+" /var/log/dmesg
The output should be empty.

Then, check that NX is not disabled in the kernel command line.
$ sudo grep -P ".+noexec[0-9]*=off.+" /proc/cmdline
The output should be empty.
      Is it the case that NX is disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_page_poison_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /boot/grub2/grubenv.
If they include page_poison=1, then the parameter
is configured at boot time.
$ sudo grep 'kernelopts.*page_poison=1.*' GRUBENV_FILE_LOCATION
Fill in GRUBENV_FILE_LOCATION based on information above.
      Is it the case that page allocator poisoning is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_slub_debug_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /boot/grub2/grubenv.
If they include slub_debug=P, then the parameter
is configured at boot time.
$ sudo grep 'kernelopts.*slub_debug=P.*' GRUBENV_FILE_LOCATION
Fill in GRUBENV_FILE_LOCATION based on information above.
      Is it the case that SLUB/SLAB poisoning is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_core_pattern_question:question:1">
          <ocil:question_text>The runtime status of the kernel.core_pattern kernel parameter can be queried
by running the following command:
$ sysctl kernel.core_pattern
The output of the command should indicate a value of |/bin/false.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.core_pattern\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.core_pattern = |/bin/false
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains kernel.core_pattern = |/bin/false, and that one assignment
is returned when
$ grep -r kernel.core_pattern /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_dmesg_restrict_question:question:1">
          <ocil:question_text>The runtime status of the kernel.dmesg_restrict kernel parameter can be queried
by running the following command:
$ sysctl kernel.dmesg_restrict
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.dmesg_restrict\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.dmesg_restrict = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains kernel.dmesg_restrict = 1, and that one assignment
is returned when
$ grep -r kernel.dmesg_restrict /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_kexec_load_disabled_question:question:1">
          <ocil:question_text>The runtime status of the kernel.kexec_load_disabled kernel parameter can be queried
by running the following command:
$ sysctl kernel.kexec_load_disabled
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.kexec_load_disabled\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.kexec_load_disabled = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains kernel.kexec_load_disabled = 1, and that one assignment
is returned when
$ grep -r kernel.kexec_load_disabled /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_modules_disabled_question:question:1">
          <ocil:question_text>The runtime status of the kernel.modules_disabled kernel parameter can be queried
by running the following command:
$ sysctl kernel.modules_disabled
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.modules_disabled\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.modules_disabled = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains kernel.modules_disabled = 1, and that one assignment
is returned when
$ grep -r kernel.modules_disabled /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_panic_on_oops_question:question:1">
          <ocil:question_text>The runtime status of the kernel.panic_on_oops kernel parameter can be queried
by running the following command:
$ sysctl kernel.panic_on_oops
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.panic_on_oops\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.panic_on_oops = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains kernel.panic_on_oops = 1, and that one assignment
is returned when
$ grep -r kernel.panic_on_oops /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_perf_cpu_time_max_percent_question:question:1">
          <ocil:question_text>The runtime status of the kernel.perf_cpu_time_max_percent kernel parameter can be queried
by running the following command:
$ sysctl kernel.perf_cpu_time_max_percent
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.perf_cpu_time_max_percent\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.perf_cpu_time_max_percent = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains kernel.perf_cpu_time_max_percent = 1, and that one assignment
is returned when
$ grep -r kernel.perf_cpu_time_max_percent /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_perf_event_max_sample_rate_question:question:1">
          <ocil:question_text>The runtime status of the kernel.perf_event_max_sample_rate kernel parameter can be queried
by running the following command:
$ sysctl kernel.perf_event_max_sample_rate
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.perf_event_max_sample_rate\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.perf_event_max_sample_rate = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains kernel.perf_event_max_sample_rate = 1, and that one assignment
is returned when
$ grep -r kernel.perf_event_max_sample_rate /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_perf_event_paranoid_question:question:1">
          <ocil:question_text>The runtime status of the kernel.perf_event_paranoid kernel parameter can be queried
by running the following command:
$ sysctl kernel.perf_event_paranoid
The output of the command should indicate a value of 2.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.perf_event_paranoid\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.perf_event_paranoid = 2
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains kernel.perf_event_paranoid = 2, and that one assignment
is returned when
$ grep -r kernel.perf_event_paranoid /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_pid_max_question:question:1">
          <ocil:question_text>The runtime status of the kernel.pid_max kernel parameter can be queried
by running the following command:
$ sysctl kernel.pid_max
The output of the command should indicate a value of 65536.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.pid_max\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.pid_max = 65536
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains kernel.pid_max = 65536, and that one assignment
is returned when
$ grep -r kernel.pid_max /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_sysrq_question:question:1">
          <ocil:question_text>The runtime status of the kernel.sysrq kernel parameter can be queried
by running the following command:
$ sysctl kernel.sysrq
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.sysrq\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.sysrq = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains kernel.sysrq = 0, and that one assignment
is returned when
$ grep -r kernel.sysrq /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_question:question:1">
          <ocil:question_text>The runtime status of the kernel.unprivileged_bpf_disabled kernel parameter can be queried
by running the following command:
$ sysctl kernel.unprivileged_bpf_disabled
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.unprivileged_bpf_disabled\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.unprivileged_bpf_disabled = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains kernel.unprivileged_bpf_disabled = 1, and that one assignment
is returned when
$ grep -r kernel.unprivileged_bpf_disabled /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_yama_ptrace_scope_question:question:1">
          <ocil:question_text>The runtime status of the kernel.yama.ptrace_scope kernel parameter can be queried
by running the following command:
$ sysctl kernel.yama.ptrace_scope
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.yama.ptrace_scope\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.yama.ptrace_scope = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains kernel.yama.ptrace_scope = 1, and that one assignment
is returned when
$ grep -r kernel.yama.ptrace_scope /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_core_bpf_jit_harden_question:question:1">
          <ocil:question_text>The runtime status of the net.core.bpf_jit_harden kernel parameter can be queried
by running the following command:
$ sysctl net.core.bpf_jit_harden
The output of the command should indicate a value of 2.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.core.bpf_jit_harden\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.core.bpf_jit_harden = 2
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains net.core.bpf_jit_harden = 2, and that one assignment
is returned when
$ grep -r net.core.bpf_jit_harden /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_user_max_user_namespaces_question:question:1">
          <ocil:question_text>The runtime status of the user.max_user_namespaces kernel parameter can be queried
by running the following command:
$ sysctl user.max_user_namespaces
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*user.max_user_namespaces\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
user.max_user_namespaces = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains user.max_user_namespaces = 0, and that one assignment
is returned when
$ grep -r user.max_user_namespaces /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_vm_mmap_min_addr_question:question:1">
          <ocil:question_text>The runtime status of the vm.mmap_min_addr kernel parameter can be queried
by running the following command:
$ sysctl vm.mmap_min_addr
The output of the command should indicate a value of 65536.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*vm.mmap_min_addr\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
vm.mmap_min_addr = 65536
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in
/etc/sysctl.d contains vm.mmap_min_addr = 65536, and that one assignment
is returned when
$ grep -r vm.mmap_min_addr /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-coreos_enable_selinux_kernel_argument_question:question:1">
          <ocil:question_text>Inspect /proc/cmdline for any instances of selinux=0
in the kernel boot arguments.  Presence of selinux=0 indicates
that SELinux is disabled at boot time.

If it would be disabled anywhere, make sure to enable it via a
MachineConfig object.
      Is it the case that SELinux is disabled at boot time?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_enable_selinux_question:question:1">
          <ocil:question_text>Inspect /etc/default/grub for any instances of selinux=0
in the kernel boot arguments.  Presence of selinux=0 indicates
that SELinux is disabled at boot time.
      Is it the case that SELinux is disabled at boot time?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_libselinux_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the libselinux package is installed: $ rpm -q libselinux
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_policycoreutils_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the policycoreutils package is installed: $ rpm -q policycoreutils
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_setroubleshoot-plugins_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the setroubleshoot-plugins package is installed:
$ rpm -q setroubleshoot-plugins
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_setroubleshoot-server_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the setroubleshoot-server package is installed:
$ rpm -q setroubleshoot-server
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-selinux_all_devicefiles_labeled_question:question:1">
          <ocil:question_text>To check for incorrectly labeled device files, run following commands:
$ sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n"
$ sudo find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n"
It should produce no output in a well-configured system.
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-selinux_confinement_of_daemons_question:question:1">
          <ocil:question_text>Ensure there are no unconfined daemons running on the system,
the following command should produce no output:
$ sudo ps -eZ | grep "unconfined_service_t"
      Is it the case that There are unconfined daemons running on the system?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-selinux_policytype_question:question:1">
          <ocil:question_text>Ensure that Fedora verifies correct operation of security functions.

Check the file /etc/selinux/config and ensure the following line appears:
SELINUXTYPE=
      Is it the case that SELINUXTYPE is set to the wrong value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-selinux_state_question:question:1">
          <ocil:question_text>Ensure that Fedora verifies correct operation of security functions.

Check if "SELinux" is active and in "" mode with the following command:

$ sudo getenforce

      Is it the case that SELINUX is not set to enforcing?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-encrypt_partitions_question:question:1">
          <ocil:question_text>Check the system partitions to determine if they are encrypted with the following command:
blkid

Output will be similar to:
/dev/sda1: UUID=" ab12c3de-4f56-789a-8f33-3850cc8ce3a2
" TYPE="crypto_LUKS"
/dev/sda2: UUID=" bc98d7ef-6g54-321h-1d24-9870de2ge1a2
" TYPE="crypto_LUKS"

The boot partition and pseudo-file systems, such as /proc, /sys, and tmpfs,
are not required to use disk encryption and are not a finding.
      Is it the case that partitions do not have a type of crypto_LUKS?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_boot_question:question:1">
          <ocil:question_text>Run the following command to determine if /boot
is on its own partition or logical volume:
$ mount | grep "on /boot"
If /boot has its own partition or volume group, a line will be returned.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_home_question:question:1">
          <ocil:question_text>Run the following command to determine if /home
is on its own partition or logical volume:
$ mount | grep "on /home"
If /home has its own partition or volume group, a line will be returned.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_opt_question:question:1">
          <ocil:question_text>Run the following command to determine if /opt
is on its own partition or logical volume:
$ mount | grep "on /opt"
If /opt has its own partition or volume group, a line will be returned.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_srv_question:question:1">
          <ocil:question_text>Run the following command to determine if /srv
is on its own partition or logical volume:
$ mount | grep "on /srv"
If /srv has its own partition or volume group, a line will be returned.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_tmp_question:question:1">
          <ocil:question_text>Run the following command to determine if /tmp
is on its own partition or logical volume:
$ mount | grep "on /tmp"
If /tmp has its own partition or volume group, a line will be returned.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_usr_question:question:1">
          <ocil:question_text>Run the following command to determine if /usr
is on its own partition or logical volume:
$ mount | grep "on /usr"
If /usr has its own partition or volume group, a line will be returned.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_var_question:question:1">
          <ocil:question_text>Run the following command to determine if /var
is on its own partition or logical volume:
$ mount | grep "on /var"
If /var has its own partition or volume group, a line will be returned.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_var_log_question:question:1">
          <ocil:question_text>Run the following command to determine if /var/log
is on its own partition or logical volume:
$ mount | grep "on /var/log"
If /var/log has its own partition or volume group, a line will be returned.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_var_log_audit_question:question:1">
          <ocil:question_text>Run the following command to determine if /var/log/audit
is on its own partition or logical volume:
$ mount | grep "on /var/log/audit"
If /var/log/audit has its own partition or volume group, a line will be returned.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_restart_shutdown_question:question:1">
          <ocil:question_text>To ensure disable and restart on the login screen are disabled, run the following command:
$ grep disable-restart-buttons /etc/dconf/db/distro.d/*
The output should be true.
To ensure that users cannot enable disable and restart on the login screen, run the following:
$ grep disable-restart-buttons /etc/dconf/db/distro.d/locks/*
If properly configured, the output should be /org/gnome/login-screen/disable-restart-buttons
      Is it the case that disable-restart-buttons has not been configured or is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_user_list_question:question:1">
          <ocil:question_text>To ensure the user list is disabled, run the following command:
$ grep disable-user-list /etc/dconf/db/distro.d/*
The output should be true.
To ensure that users cannot enable displaying the user list, run the following:
$ grep disable-user-list /etc/dconf/db/distro.d/locks/*
If properly configured, the output should be /org/gnome/login-screen/disable-user-list
      Is it the case that disable-user-list has not been configured or is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_enable_smartcard_auth_question:question:1">
          <ocil:question_text>To ensure smart card authentication on the login screen is enabled, run the following command:
$ grep enable-smartcard-authentication /etc/dconf/db/distro.d/*
The output should be true.
To ensure that users cannot disable smart card authentication on the login screen, run the following:
$ grep enable-smartcard-authentication /etc/dconf/db/distro.d/locks/*
If properly configured, the output should be /org/gnome/login-screen/enable-smartcard-authentication
      Is it the case that enable-smartcard-authentication has not been configured or is disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_lock_screen_on_smartcard_removal_question:question:1">
          <ocil:question_text>To ensure screen locking on smartcard removal is enabled, run the following command:
$ grep removal-action /etc/dconf/db/local.d/*
The output should be 'lock-screen'.
To ensure that users cannot disable screen locking on smartcard removal, run the following:
$ grep removal-action /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/settings-daemon/peripherals/smartcard/removal-action
      Is it the case that removal-action has not been configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_login_retries_question:question:1">
          <ocil:question_text>To ensure the login screen resets after a specified number of failures,
run the following command:
$ grep allowed-failures /etc/dconf/db/distro.d/*
The output should be 3 or less.
To ensure that users cannot change or configure the resets after a specified
number of failures on the login screen, run the following:
$ grep allowed-failures /etc/dconf/db/distro.d/locks/*
If properly configured, the output should be /org/gnome/login-screen/allowed-failures
      Is it the case that allowed-failures is not equal to or less than the expected value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-gnome_gdm_disable_automatic_login_question:question:1">
          <ocil:question_text>To verify that automatic logins are disabled, run the following command:
$ grep -Pzoi "^\[daemon]\\nautomaticlogin.*" /etc/gdm/custom.conf
The output should show the following:
[daemon]
AutomaticLoginEnable=false
      Is it the case that GDM allows users to automatically login?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-gnome_gdm_disable_guest_login_question:question:1">
          <ocil:question_text>To verify that timed logins are disabled, run the following command:
$ grep -Pzoi "^\[daemon]\\ntimedlogin.*" /etc/gdm/custom.conf
The output should show the following:
[daemon]
TimedLoginEnable=false
      Is it the case that GDM allows a guest to login without credentials?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-gnome_gdm_disable_xdmcp_question:question:1">
          <ocil:question_text>To ensure that XDMCP is disabled in /etc/gdm/custom.conf, run the following command:
grep -Pzo "\[xdmcp\]\nEnable=false" /etc/gdm/custom.conf
The output should return the following:

[xdmcp]
Enable=false

      Is it the case that the Enable is not set to false or is missing in the xdmcp section of the /etc/gdm/custom.conf gdm configuration file?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_automount_question:question:1">
          <ocil:question_text>These settings can be verified by running the following:
$ gsettings get org.gnome.desktop.media-handling automount
If properly configured, the output for automount should be false.
To ensure that users cannot enable automount in GNOME3, run the following:
$ grep 'automount' /etc/dconf/db/local.d/locks/*
If properly configured, the output for automount should be /org/gnome/desktop/media-handling/automount
      Is it the case that GNOME automounting is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_automount_open_question:question:1">
          <ocil:question_text>These settings can be verified by running the following:
$ gsettings get org.gnome.desktop.media-handling automount-open
If properly configured, the output for automount-openshould be false.
To ensure that users cannot enable automount opening in GNOME3, run the following:
$ grep 'automount-open' /etc/dconf/db/local.d/locks/*
If properly configured, the output for automount-open should be /org/gnome/desktop/media-handling/automount-open
      Is it the case that GNOME automounting is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_autorun_question:question:1">
          <ocil:question_text>These settings can be verified by running the following:
$ gsettings get org.gnome.desktop.media-handling autorun-never
If properly configured, the output for autorun-nevershould be true.
To ensure that users cannot enable autorun in GNOME3, run the following:
$ grep 'autorun-never' /etc/dconf/db/local.d/locks/*
If properly configured, the output for autorun-never should be /org/gnome/desktop/media-handling/autorun-never
      Is it the case that GNOME autorun is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_thumbnailers_question:question:1">
          <ocil:question_text>These settings can be verified by running the following:
$ gsettings get org.gnome.desktop.thumbnailers disable-all
If properly configured, the output should be true.
To ensure that users cannot how long until the screensaver locks, run the following:
$ grep disable-all /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/desktop/thumbnailers/disable-all
      Is it the case that GNOME thumbnailers are not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_wifi_create_question:question:1">
          <ocil:question_text>To ensure that WIFI connections caanot be created, run the following command:
$ gsettings get org.gnome.nm-applet disable-wifi-create
If properly configured, the output should be true.
To ensure that users cannot enable WIFI connection creation, run the following:
$ grep wifi-create /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/nm-applet/disable-wifi-create
      Is it the case that WIFI connections can be created through GNOME?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_wifi_notification_question:question:1">
          <ocil:question_text>To ensure that wireless network notification is disabled, run the following command:
$ gsettings get org.gnome.nm-applet suppress-wireless-networks-available
If properly configured, the output should be true.
To ensure that users cannot enable wireless notification, run the following:
$ grep wireless-networks-available /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/nm-applet/suppress-wireless-networks-available
      Is it the case that wireless network notification is enabled and not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_remote_access_credential_prompt_question:question:1">
          <ocil:question_text>To ensure that remote access requires credentials, run the following command:
$ gsettings get org.gnome.Vino authentication-methods
If properly configured, the output should be false.
To ensure that users cannot disable credentials for remote access, run the following:
$ grep authentication-methods /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/Vino/authentication-methods
      Is it the case that wireless network notification is enabled and not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_remote_access_encryption_question:question:1">
          <ocil:question_text>To ensure that remote access connections are encrypted, run the following command:
$ gsettings get org.gnome.Vino require-encrpytion
If properly configured, the output should be true.
To ensure that users cannot disable encrypted remote connections, run the following:
$ grep require-encryption /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/Vino/require-encryption
      Is it the case that remote access connections are not encrypted?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_screensaver_idle_activation_enabled_question:question:1">
          <ocil:question_text>To check the screensaver mandatory use status, run the following command:
$ gsettings get org.gnome.desktop.screensaver idle-activation-enabled
If properly configured, the output should be true.
To ensure that users cannot disable the screensaver idle inactivity setting, run the following:
$ grep idle-activation-enabled /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/desktop/screensaver/idle-activation-enabled
      Is it the case that idle-activation-enabled is not enabled or configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_screensaver_idle_activation_locked_question:question:1">
          <ocil:question_text>To ensure that users cannot disable the screensaver idle inactivity setting, run the following:
$ grep idle-activation-enabled /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/desktop/screensaver/idle-activation-enabled
      Is it the case that idle-activation-enabled is not locked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_screensaver_idle_delay_question:question:1">
          <ocil:question_text>To check the current idle time-out value, run the following command:
$ gsettings get org.gnome.desktop.session idle-delay
If properly configured, the output should be 'uint32 '.
To ensure that users cannot change the screensaver inactivity timeout setting, run the following:
$ grep idle-delay /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/desktop/session/idle-delay
      Is it the case that idle-delay is set to 0 or a value greater than &lt;sub idref="inactivity_timeout_value" /&gt;?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_screensaver_lock_delay_question:question:1">
          <ocil:question_text>To check that the screen locks immediately when activated, run the following command:
$ gsettings get org.gnome.desktop.screensaver lock-delay
If properly configured, the output should be 'uint32 '.
      Is it the case that the screensaver lock delay is missing, or is set to a value greater than &lt;sub idref="var_screensaver_lock_delay" /&gt;?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_screensaver_lock_enabled_question:question:1">
          <ocil:question_text>To check the status of the idle screen lock activation, run the following command:

$ gsettings get org.gnome.desktop.screensaver lock-enabled
If properly configured, the output should be true.
To ensure that users cannot change how long until the screensaver locks, run the following:
$ grep lock-enabled /etc/dconf/db/local.d/locks/*
If properly configured, the output for lock-enabled should be /org/gnome/desktop/screensaver/lock-enabled
      Is it the case that screensaver locking is not enabled and/or has not been set or configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_screensaver_lock_locked_question:question:1">
          <ocil:question_text>To ensure that users cannot change how long until the screensaver locks, run the following:
$ grep lock-enabled /etc/dconf/db/local.d/locks/*
If properly configured, the output for lock-enabled should be /org/gnome/desktop/screensaver/lock-enabled
      Is it the case that screensaver locking is not locked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_screensaver_mode_blank_question:question:1">
          <ocil:question_text>To ensure the screensaver is configured to be blank, run the following command:
$ gsettings get org.gnome.desktop.screensaver picture-uri
If properly configured, the output should be ''.

To ensure that users cannot set the screensaver background, run the following:
$ grep picture-uri /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/desktop/screensaver/picture-uri
      Is it the case that it is not set or configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_screensaver_user_info_question:question:1">
          <ocil:question_text>To ensure the splash screen is configured not to show user name, run the following command:
$ gsettings get org.gnome.desktop.screensaver show-full-name-in-top-bar
If properly configured, the output should be false.
To ensure that users cannot enable user name on the lock screen, run the following:
$ grep show-full-name-in-top-bar /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/desktop/screensaver/show-full-name-in-top-bar
      Is it the case that it is not set or configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_screensaver_user_locks_question:question:1">
          <ocil:question_text>To ensure that users cannot change session idle and lock settings, run the following:
$ grep 'lock-delay' /etc/dconf/db/local.d/locks/*
If properly configured, the output should return:
/org/gnome/desktop/screensaver/lock-delay
      Is it the case that GNOME3 session settings are not locked or configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_session_idle_user_locks_question:question:1">
          <ocil:question_text>To ensure that users cannot change session idle and lock settings, run the following:
$ grep 'idle-delay' /etc/dconf/db/local.d/locks/*
If properly configured, the output should return:
/org/gnome/desktop/session/idle-delay
      Is it the case that idle-delay is not locked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_ctrlaltdel_reboot_question:question:1">
          <ocil:question_text>To ensure the system is configured to ignore the Ctrl-Alt-Del sequence,
run the following command:
$ gsettings get org.gnome.settings-daemon.plugins.media-keys logout
If properly configured, the output should be ''.
To ensure that users cannot enable the Ctrl-Alt-Del sequence, run the following:
$ grep logout /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/settings-daemon/plugins/media-keys/logout
      Is it the case that GNOME3 is configured to reboot when Ctrl-Alt-Del is pressed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_geolocation_question:question:1">
          <ocil:question_text>To ensure that system location tracking is not active, run the following command:
$ gsettings get org.gnome.system.location enabled
$ gsettings get org.gnome.clocks geolocation
If properly configured, the output should be false.
To ensure that users cannot enable system location tracking, run the following:
$ grep location /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/system/location/enabled and /org/gnome/clocks/geolocation.
      Is it the case that geolocation is enabled and not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_power_settings_question:question:1">
          <ocil:question_text>To ensure that the GUI power settings are not active, run the following command:
$ gsettings get org.gnome.settings-daemon.plugins.power active
If properly configured, the output should be false.
To ensure that users cannot enable the power settings, run the following:
$ grep power /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/settings-daemon/plugins/power/active
      Is it the case that power settings are enabled and are not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_user_admin_question:question:1">
          <ocil:question_text>To ensure the GUI does not allow user administratrion capabilities to all users,
run the following command:
$ gsettings get org.gnome.desktop.lockdown user-administration-disabled
If properly configured, the output should be true.
To ensure that users cannot enable user administration, run the following:
$ grep user-administration /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/desktop/lockdown/user-administration-disabled
      Is it the case that user administration is not configured or disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_db_up_to_date_question:question:1">
          <ocil:question_text>In order to be sure that the databases are up-to-date, run the
dconf update
command as the administrator.
      Is it the case that The system-wide dconf databases are up-to-date with regards to respective keyfiles?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-enable_dconf_user_profile_question:question:1">
          <ocil:question_text>To verify that the DConf User profile is configured correctly, run the following
command:

$ cat /etc/dconf/profile/user
The output should show the following:
user-db:user
system-db:local
system-db:site
system-db:distro
      Is it the case that DConf User profile does not exist or is not configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_gdm_removed_question:question:1">
          <ocil:question_text>To ensure the gdm package group is removed, run the following command:
$ rpm -qi gdm
The output should be:
package gdm is not installed
      Is it the case that gdm has not been removed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-installed_OS_is_FIPS_certified_question:question:1">
          <ocil:question_text>To verify that the installed operating system is supported or certified, run
the following command:

The output should contain something similar to:
Fedora
      Is it the case that the installed operating system is not FIPS 140-2 certified?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-installed_OS_is_vendor_supported_question:question:1">
          <ocil:question_text>To verify that the installed operating system is supported, run
the following command:

The output should contain something similar to:
Fedora
      Is it the case that the installed operating system is not supported?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_bind_crypto_policy_question:question:1">
          <ocil:question_text>To verify that BIND uses the system crypto policy, check out that the BIND config file
/etc/named.conf contains the include "/etc/crypto-policies/back-ends/bind.config";
directive:
$ sudo grep 'include "/etc/crypto-policies/back-ends/bind.config";' /etc/named.conf
Verify that the directive is at the bottom of the options section of the config file.
      Is it the case that BIND is installed and the BIND config file doesn't contain the
&lt;pre&gt;include "/etc/crypto-policies/back-ends/bind.config";&lt;/pre&gt; directive?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_crypto_policy_question:question:1">
          <ocil:question_text>To verify that cryptography policy has been configured correctly, run the
following command:
$ update-crypto-policies --show
The output should return .
Run the command to check if the policy is correctly applied:
$ update-crypto-policies --is-applied
The output should be The configured policy is applied.
Moreover, check if settings for selected crypto policy are as expected.
List all libraries for which it holds that their crypto policies do not have symbolic link in /etc/crypto-policies/back-ends.
$ ls -l /etc/crypto-policies/back-ends/ | grep '^[^l]' | tail -n +2 | awk -F' ' '{print $NF}' | awk -F'.' '{print $1}' | sort
Subsequently, check if matching libraries have drop in files in the /etc/crypto-policies/local.d directory.
$ ls /etc/crypto-policies/local.d/ | awk -F'-' '{print $1}' | uniq | sort
Outputs of two previous commands should match.
      Is it the case that cryptographic policy is not configured or is configured incorrectly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_gnutls_tls_crypto_policy_question:question:1">
          <ocil:question_text>To verify if GnuTLS uses defined DoD-approved TLS Crypto Policy, run:
$ sudo grep
'+VERS-ALL:-VERS-DTLS0.9:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS1.0'
/etc/crypto-policies/back-ends/gnutls.config and verify that a match exists.
      Is it the case that cryptographic policy for gnutls is not configured or is configured incorrectly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_kerberos_crypto_policy_question:question:1">
          <ocil:question_text>Check that the symlink exists and target the correct Kerberos crypto policy, with the following command:
file /etc/krb5.conf.d/crypto-policies
If command ouput shows the following line, Kerberos is configured to use the system-wide crypto policy.
/etc/krb5.conf.d/crypto-policies: symbolic link to /etc/crypto-policies/back-ends/krb5.config
      Is it the case that the symlink does not exist or points to a different target?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_libreswan_crypto_policy_question:question:1">
          <ocil:question_text>To verify that Libreswan uses the system crypto policy, run the following command:
$ grep include /etc/ipsec.conf
The output should return something similar to:
include /etc/crypto-policies/back-ends/libreswan.config
      Is it the case that Libreswan is installed and &lt;tt&gt;/etc/ipsec.conf&lt;/tt&gt; does not contain &lt;tt&gt;include /etc/crypto-policies/back-ends/libreswan.config&lt;/tt&gt;?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_openssl_crypto_policy_question:question:1">
          <ocil:question_text>To verify that OpenSSL uses the system crypto policy, check out that the OpenSSL config file
/etc/pki/tls/openssl.cnf contains the [ crypto_policy ] section with the
.include /etc/crypto-policies/back-ends/opensslcnf.config directive:
grep '\.include\s* /etc/crypto-policies/back-ends/opensslcnf.config$' /etc/pki/tls/openssl.cnf.
      Is it the case that the OpenSSL config file doesn't contain the whole section,
or that the section doesn't have the &lt;pre&gt;.include /etc/crypto-policies/back-ends/opensslcnf.config&lt;/pre&gt; directive?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_ssh_crypto_policy_question:question:1">
          <ocil:question_text>Check that the CRYPTO_POLICY variable is not set or is commented in the
/etc/sysconfig/sshd.
      Is it the case that the CRYPTO_POLICY variable is not set or is commented in the /etc/sysconfig/sshd?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-harden_ssh_client_crypto_policy_question:question:1">
          <ocil:question_text>To verify if the OpenSSH Client uses defined Crypto Policy, run:
$ cat /etc/ssh/ssh_config.d/02-ospp.conf
and verify that the line matches
Match final all
RekeyLimit 512M 1h
GSSAPIAuthentication no
Ciphers aes256-ctr,aes256-cbc,aes128-ctr,aes128-cbc
PubkeyAcceptedKeyTypes ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256
MACs hmac-sha2-512,hmac-sha2-256
KexAlgorithms ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1
      Is it the case that Crypto Policy for OpenSSH Client is not configured according to CC requirements?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy_question:question:1">
          <ocil:question_text>To verify if the OpenSSH client uses defined Cipher suite in the Crypto Policy, run:
$ grep -i ciphers /etc/crypto-policies/back-ends/openssh.config
and verify that the line matches:
Ciphers 
      Is it the case that Crypto Policy for OpenSSH client is not configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-harden_sshd_crypto_policy_question:question:1">
          <ocil:question_text>To verify if the OpenSSH server uses defined Crypto Policy, run:
$ grep 'CRYPTO_POLICY' /etc/crypto-policies/back-ends/opensshserver.config | tail -n 1
and verify that the line matches
CRYPTO_POLICY='-oCiphers=aes256-ctr,aes128-ctr,aes256-cbc,aes128-cbc -oMACs=hmac-sha2-512,hmac-sha2-256 -oGSSAPIKeyExchange=no -oKexAlgorithms=ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256 -oPubkeyAcceptedKeyTypes=rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256'
      Is it the case that Crypto Policy for OpenSSH Server is not configured according to CC requirements?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-harden_sshd_macs_openssh_conf_crypto_policy_question:question:1">
          <ocil:question_text>To verify if the OpenSSH client uses defined MACs in the Crypto Policy, run:
$ grep -i macs /etc/crypto-policies/back-ends/openssh.config
and verify that the line matches:
MACs hmac-sha2-512,hmac-sha2-256
      Is it the case that Crypto Policy for OpenSSH client is not configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_MFEhiplsm_installed_question:question:1">
          <ocil:question_text>To verify that McAfee HIPS is installed, run the following command(s):
$ rpm -q MFEhiplsm
      Is it the case that the HBSS HIPS module is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_user_data_backups_question:question:1">
          <ocil:question_text>Verify that the system backups user data.
      Is it the case that it is not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-install_antivirus_question:question:1">
          <ocil:question_text>Verify an anti-virus solution is installed on the system. The anti-virus solution may be
bundled with an approved host-based security solution.
      Is it the case that there is no anti-virus solution installed on the system?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-install_hids_question:question:1">
          <ocil:question_text>Inspect the system to determine if intrusion detection software has been installed.
Verify this intrusion detection software is active.
      Is it the case that no host-based intrusion detection tools are installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-enable_dracut_fips_module_question:question:1">
          <ocil:question_text>To verify that the Dracut FIPS module is enabled, run the following command:
grep "add_dracutmodules" /etc/dracut.conf.d/40-fips.conf
The output should look like this:
add_dracutmodules+=" fips "
      Is it the case that the Dracut FIPS module is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-enable_fips_mode_question:question:1">
          <ocil:question_text>To verify that FIPS mode is enabled properly, run the following command:
fips-mode-setup --check
The output should contain the following:
FIPS mode is enabled.
To verify that the cryptographic policy has been configured correctly, run the
following command:
$ update-crypto-policies --show
The output should return .
      Is it the case that FIPS mode is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-etc_system_fips_exists_question:question:1">
          <ocil:question_text>To verify /etc/system-fips exists, run the following command:
ls -l /etc/system-fips
The output should be similar to the following:
-rw-r--r--. 1 root root 36 Nov 26 11:31 /etc/system-fips
      Is it the case that /etc/system-fips does not exist?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_crypto_fips_enabled_question:question:1">
          <ocil:question_text>To verify that kernel parameter 'crypto.fips_enabled' is set properly, run the following command:
sysctl crypto.fips_enabled
The output should contain the following:
crypto.fips_enabled = 1
      Is it the case that crypto.fips_enabled is not 1?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-aide_build_database_question:question:1">
          <ocil:question_text>To find the location of the AIDE databse file, run the following command:
$ sudo ls -l DBDIR/database_file_name
      Is it the case that there is no database file?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-aide_check_audit_tools_question:question:1">
          <ocil:question_text>Check that AIDE is properly configured to protect the integrity of the
audit tools by running the following command:

# sudo cat /etc/aide.conf | grep /usr/sbin/au

/usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
/usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
/usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
/usr/sbin/aureport p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
/usr/sbin/autrace p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
/usr/sbin/audispd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512


/usr/sbin/augenrules p+i+n+u+g+s+b+acl+selinux+xattrs+sha512


If AIDE is configured properly to protect the integrity of the audit tools,
all lines listed above will be returned from the command.

If one or more lines are missing, this is a finding.
      Is it the case that integrity checks of the audit tools are missing or incomplete?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-aide_periodic_cron_checking_question:question:1">
          <ocil:question_text>Verify the operating system routinely checks the baseline configuration for unauthorized changes.

To determine that periodic AIDE execution has been scheduled, run the following command:
$ grep aide /etc/crontab
The output should return something similar to the following:

05 4 * * * root  --check


NOTE: The usage of special cron times, such as @daily or @weekly, is acceptable.
      Is it the case that AIDE is not configured to scan periodically?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_aide_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the aide package is installed: $ rpm -q aide
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rpm_verify_hashes_question:question:1">
          <ocil:question_text>The following command will list which files on the system
have file hashes different from what is expected by the RPM database.
$ rpm -Va --noconfig | awk '$1 ~ /..5/ &amp;&amp; $2 != "c"'
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rpm_verify_permissions_question:question:1">
          <ocil:question_text>The following command will list which files on the system have permissions different from what
is expected by the RPM database:
$ rpm -Va | awk '{ if (substr($0,2,1)=="M") print $NF }'
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_sudo_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the sudo package is installed: $ rpm -q sudo
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_add_noexec_question:question:1">
          <ocil:question_text>To determine if NOEXEC has been configured for sudo, run the following command:
$ sudo grep -ri "^[\s]*Defaults.*\bnoexec\b.*" /etc/sudoers /etc/sudoers.d/
The command should return a matching output.
      Is it the case that noexec is not enabled in sudo?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_add_requiretty_question:question:1">
          <ocil:question_text>To determine if requiretty has been configured for sudo, run the following command:
$ sudo grep -ri "^[\s]*Defaults.*\brequiretty\b.*" /etc/sudoers /etc/sudoers.d/
The command should return a matching output.
      Is it the case that requiretty is not enabled in sudo?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_add_use_pty_question:question:1">
          <ocil:question_text>To determine if use_pty has been configured for sudo, run the following command:
$ sudo grep -ri "^[\s]*Defaults.*\buse_pty\b.*" /etc/sudoers /etc/sudoers.d/
The command should return a matching output.
      Is it the case that use_pty is not enabled in sudo?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_custom_logfile_question:question:1">
          <ocil:question_text>To determine if logfile has been configured for sudo, run the following command:
$ sudo grep -ri "^[\s]*Defaults.*\blogfile\b.*" /etc/sudoers /etc/sudoers.d/
The command should return a matching output.
      Is it the case that logfile is not enabled in sudo?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_remove_no_authenticate_question:question:1">
          <ocil:question_text>To determine if !authenticate has not been configured for sudo, run the following command:
$ sudo grep -r \!authenticate /etc/sudoers /etc/sudoers.d/
The command should return no output.
      Is it the case that !authenticate is specified in the sudo config files?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_remove_nopasswd_question:question:1">
          <ocil:question_text>To determine if NOPASSWD has been configured for sudo, run the following command:
$ sudo grep -ri nopasswd /etc/sudoers /etc/sudoers.d/
The command should return no output.
      Is it the case that nopasswd is specified in the sudo config files?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_require_authentication_question:question:1">
          <ocil:question_text>To determine if NOPASSWD or !authenticate have been configured for
sudo, run the following command:
$ sudo grep -ri "nopasswd\|\!authenticate" /etc/sudoers /etc/sudoers.d/
The command should return no output.
      Is it the case that nopasswd and/or !authenticate is enabled in sudo?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_vdsm_nopasswd_question:question:1">
          <ocil:question_text>To determine if NOPASSWD has been configured for the vdsm user for sudo,
run the following command:
$ sudo grep -ri nopasswd /etc/sudoers.d/
The command should return output only for the vdsm user.
      Is it the case that nopasswd is set for any users beyond vdsm?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudoers_default_includedir_question:question:1">
          <ocil:question_text>To determine whether sudo command includes configuration files from the appropriate directory,
run the following command:
$ sudo grep -rP '^#include(dir)?' /etc/sudoers /etc/sudoers.d
If only the line /etc/sudoers:#includedir /etc/sudoers.d is returned, then the drop-in include configuration is set correctly.
Any other line returned is a finding.
      Is it the case that the /etc/sudoers doesn't include /etc/sudores.d or includes other directories??
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudoers_explicit_command_args_question:question:1">
          <ocil:question_text>To determine if arguments that commands can be executed with are restricted, run the following command:
$ sudo grep -PR '^(?:\s*[^#=]+)=(?:\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,\s]+(?:[ \t]+[^,\s]+)+[ \t]*,)*(\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,\s]+[ \t]*(?:,|$))' /etc/sudoers /etc/sudoers.d/
The command should return no output.
      Is it the case that /etc/sudoers file contains user specifications that allow execution of commands with any arguments?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudoers_no_command_negation_question:question:1">
          <ocil:question_text>To determine if negation is used to define commands users are allowed to execute using sudo, run the following command:
$ sudo grep -PR '^(?:\s*[^#=]+)=(?:\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,!\n][^,\n]+,)*\s*(?:\([^\)]+\))?\s*(?!\s*\()(!\S+).*' /etc/sudoers /etc/sudoers.d/
The command should return no output.
      Is it the case that /etc/sudoers file contains rules that define the set of allowed commands using negation?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudoers_no_root_target_question:question:1">
          <ocil:question_text>To determine if the users are allowed to run commands as root, run the following commands:
$ sudo grep -PR '^\s*((?!root\b)[\w]+)\s*(\w+)\s*=\s*(.*,)?\s*[^\(\s]' /etc/sudoers /etc/sudoers.d/
and
$ sudo grep -PR '^\s*((?!root\b)[\w]+)\s*(\w+)\s*=\s*(.*,)?\s*\([\w\s]*\b(root|ALL)\b[\w\s]*\)' /etc/sudoers /etc/sudoers.d/
Both commands should return no output.
      Is it the case that /etc/sudoers file contains rules that allow non-root users to run commands as root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudoers_validate_passwd_question:question:1">
          <ocil:question_text>Run the following command to Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalation:
 sudo egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#'
If no results are returned, this is a finding.
If results are returned from more than one file location, this is a finding.
If "Defaults !targetpw" is not defined, this is a finding.
If "Defaults !rootpw" is not defined, this is a finding.
If "Defaults !runaspw" is not defined, this is a finding.
      Is it the case that invoke user passwd when using sudo?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_abrt-addon-ccpp_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the abrt-addon-ccpp package is installed:
$ rpm -q abrt-addon-ccpp
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_abrt-addon-kerneloops_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the abrt-addon-kerneloops package is installed:
$ rpm -q abrt-addon-kerneloops
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_abrt-cli_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the abrt-cli package is installed:
$ rpm -q abrt-cli
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_abrt-plugin-logger_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the abrt-plugin-logger package is installed:
$ rpm -q abrt-plugin-logger
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_abrt-plugin-rhtsupport_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the abrt-plugin-rhtsupport package is installed:
$ rpm -q abrt-plugin-rhtsupport
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_abrt-plugin-sosreport_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the abrt-plugin-sosreport package is installed:
$ rpm -q abrt-plugin-sosreport
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_binutils_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the binutils package is installed: $ rpm -q binutils
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_cryptsetup-luks_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the cryptsetup-luks package is installed: $ rpm -q cryptsetup-luks
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_geolite2-city_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the geolite2-city package is installed:
$ rpm -q geolite2-city
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_geolite2-country_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the geolite2-country package is installed:
$ rpm -q geolite2-country
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_gnutls-utils_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the gnutls-utils package is installed: $ rpm -q gnutls-utils
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_gssproxy_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the gssproxy package is installed:
$ rpm -q gssproxy
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_iprutils_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the iprutils package is installed:
$ rpm -q iprutils
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_krb5-workstation_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the krb5-workstation package is installed:
$ rpm -q krb5-workstation
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_libcap-ng-utils_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the libcap-ng-utils package is installed: $ rpm -q libcap-ng-utils
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_libreport-plugin-logger_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the libreport-plugin-logger package is installed:
$ rpm -q libreport-plugin-logger
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_libreport-plugin-rhtsupport_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the libreport-plugin-rhtsupport package is installed:
$ rpm -q libreport-plugin-rhtsupport
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_nss-tools_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the nss-tools package is installed: $ rpm -q nss-tools
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_openscap-scanner_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the openscap-scanner package is installed: $ rpm -q openscap-scanner
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_python3-abrt-addon_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the python3-abrt-addon package is installed:
$ rpm -q python3-abrt-addon
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_rear_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the rear package is installed: $ rpm -q rear
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_rng-tools_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the rng-tools package is installed: $ rpm -q rng-tools
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_scap-security-guide_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the scap-security-guide package is installed: $ rpm -q scap-security-guide
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_tar_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the tar package is installed: $ rpm -q tar
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_tuned_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the tuned package is installed:
$ rpm -q tuned
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_vim_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the vim-enhanced package is installed: $ rpm -q vim-enhanced
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-clean_components_post_updating_question:question:1">
          <ocil:question_text>Verify Fedora removes all software components after updated versions have been installed.


To verify that clean_requirements_on_remove is configured properly, run the
following command:
$ grep clean_requirements_on_remove /etc/dnf/dnf.conf
The output should return something similar to:
clean_requirements_on_remove=1
      Is it the case that 
'clean_requirements_on_remove is not enabled or configured correctly'?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dnf-automatic_apply_updates_question:question:1">
          <ocil:question_text>To verify that packages comprising the available updates will be automatically installed by dnf-automatic, run the following command:
$ sudo grep apply_updates /etc/dnf/automatic.conf
The output should return the following:
apply_updates = yes
      Is it the case that apply_updates is not set to yes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dnf-automatic_security_updates_only_question:question:1">
          <ocil:question_text>To verify that only security updates will be automatically installed by dnf-automatic, run the following command:
$ sudo grep upgrade_type /etc/dnf/automatic.conf
The output should return the following:
upgrade_type = security
      Is it the case that the upgrade_type is not set to security?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ensure_fedora_gpgkey_installed_question:question:1">
          <ocil:question_text>To ensure that the GPG key is installed, run:
$ rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey
The command should return one of the strings below:
gpg(Fedora 35 (35) &lt;fedora-35@fedoraproject.org&gt;)
gpg(Fedora 34 (34) &lt;fedora-34@fedoraproject.org&gt;)
      Is it the case that the Fedora GPG Key is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ensure_gpgcheck_globally_activated_question:question:1">
          <ocil:question_text>To determine whether dnf is configured to use gpgcheck,
inspect /etc/dnf/dnf.conf and ensure the following appears in the
[main] section:
gpgcheck=1
A value of 1 indicates that gpgcheck is enabled. Absence of a
gpgcheck line or a setting of 0 indicates that it is
disabled.
      Is it the case that GPG checking is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ensure_gpgcheck_local_packages_question:question:1">
          <ocil:question_text>To verify that localpkg_gpgcheck is configured properly, run the following
command:
$ grep localpkg_gpgcheck /etc/dnf/dnf.conf
The output should return something similar to:
localpkg_gpgcheck=1
      Is it the case that gpgcheck is not enabled or configured correctly to verify local packages?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ensure_gpgcheck_never_disabled_question:question:1">
          <ocil:question_text>To determine whether dnf has been configured to disable
gpgcheck for any repos,  inspect all files in
/etc/yum.repos.d and ensure the following does not appear in any
sections:
gpgcheck=0
A value of 0 indicates that gpgcheck has been disabled for that repo.
      Is it the case that GPG checking is disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ensure_gpgcheck_repo_metadata_question:question:1">
          <ocil:question_text>To verify that repo_gpgcheck is configured properly, run the following
command:
$ grep repo_gpgcheck /etc/dnf/dnf.conf
The output should return something similar to:
repo_gpgcheck=1
      Is it the case that gpgcheck is not enabled or configured correctly to verify repository metadata?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_dnf-automatic_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the dnf-automatic package is installed: $ rpm -q dnf-automatic
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-timer_dnf-automatic_enabled_question:question:1">
          <ocil:question_text> Run the following command to determine the current status of the dnf-automatic timer: $ sudo systemctl is-active dnf-automatic.timer If the timer is running, it should return the following: active
      Is it the case that the dnf-automatic.timer is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-prefer_64bit_os_question:question:1">
          <ocil:question_text>To check if the installed Operating System is 64-bit, run the following command:
$ uname -m
The output should be one of the following: x86_64, aarch64, ppc64le or s390x.
If the output is i686 or i386 the operating system is 32-bit.
Check if the installed CPU supports 64-bit operating systems by running the following command:
$ lscpu | grep "CPU op-mode"
If the output contains 64bit, the CPU supports 64-bit operating systems.
      Is it the case that the installed operating sytem is 32-bit but the CPU supports operation in 64-bit?
      </ocil:question_text>
        </ocil:boolean_question>
      </ocil:questions>
    </ocil:ocil>
  </ds:component>
  <ds:component id="scap_org.open-scap_comp_ssg-fedora-cpe-oval.xml" timestamp="2022-07-23T00:00:00">
    <oval-def:oval_definitions xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
      <oval-def:generator>
        <oval:product_name>combine_ovals.py from SCAP Security Guide</oval:product_name>
        <oval:product_version>ssg: [0, 1, 62], python: 3.11.0b4</oval:product_version>
        <oval:schema_version>5.11</oval:schema_version>
        <oval:timestamp>2022-07-23T00:00:00</oval:timestamp>
      </oval-def:generator>
      <oval-def:definitions>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_centos6:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>CentOS 6</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:centos:centos:6" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      CentOS 6</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="CentOS6 is installed" test_ref="oval:ssg-test_centos6:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_centos7:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>CentOS 7</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:centos:centos:7" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      CentOS 7</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="CentOS7 is installed" test_ref="oval:ssg-test_centos7:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_centos8:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>CentOS 8</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:centos:centos:8" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      CentOS 8</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="OS is CentOS" test_ref="oval:ssg-test_centos8_name:tst:1"/>
            <oval-def:criterion comment="OS version is 8" test_ref="oval:ssg-test_centos8_version:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_centos9:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>CentOS Stream 9</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:centos:centos:9" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      CentOS Stream 9</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="OS is CentOS Stream" test_ref="oval:ssg-test_centos9_name:tst:1"/>
            <oval-def:criterion comment="OS version is 9" test_ref="oval:ssg-test_centos9_version:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_debian:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Debian</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The operating system installed is a Debian System</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="System is Debian" operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="Debian is installed" test_ref="oval:ssg-test_debian:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_debian10:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Debian Linux 10</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:debian:debian_linux:10" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Debian 10</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Debian Linux is version 10" operator="AND">
            <oval-def:extend_definition comment="Debian is installed" definition_ref="oval:ssg-installed_OS_is_debian:def:1"/>
            <oval-def:criterion comment="Debian10 is installed" test_ref="oval:ssg-test_debian_10:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_debian11:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Debian Linux 11</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:debian:debian_linux:11" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Debian 11</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Debian Linux is version 11" operator="AND">
            <oval-def:extend_definition comment="Debian is installed" definition_ref="oval:ssg-installed_OS_is_debian:def:1"/>
            <oval-def:criterion comment="Debian11 is installed" test_ref="oval:ssg-test_debian_11:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_debian9:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Debian 9</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:debian:debian_linux:9" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Debian 9</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="current Debian version is Debian Stretch" operator="AND">
            <oval-def:extend_definition comment="Debian is installed" definition_ref="oval:ssg-installed_OS_is_debian:def:1"/>
            <oval-def:criterion comment="Debian9 is installed" test_ref="oval:ssg-test_debian_9:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_fedora:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Installed operating system is Fedora</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:fedoraproject:fedora:33" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:fedoraproject:fedora:34" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:fedoraproject:fedora:35" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:fedoraproject:fedora:36" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Fedora</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="fedora-release RPM packages are installed" test_ref="oval:ssg-test_fedora_release_rpm:tst:1"/>
            <oval-def:criterion comment="CPE vendor is 'fedoraproject' and product is 'fedora'" test_ref="oval:ssg-test_fedora_vendor_product:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ol7_family:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Oracle Linux 7</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:oracle:linux:7" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Oracle Linux 7</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Oracle Linux 7 System is installed" test_ref="oval:ssg-test_ol7_system:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ol8_family:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Oracle Linux 8</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:oracle:linux:8" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Oracle Linux 8</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Oracle Linux 8 System is installed" test_ref="oval:ssg-test_ol8_system:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ol9_family:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Oracle Linux 9</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:oracle:linux:9" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Oracle Linux 9</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Oracle Linux 9 System is installed" test_ref="oval:ssg-test_ol9_system:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_opensuse:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>openSUSE</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The operating system installed on the system is openSUSE.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="openSUSE is installed" test_ref="oval:ssg-test_opensuse_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_opensuse_leap15:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>openSUSE Leap 15</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:opensuse:leap:15.0" source="CPE"/>
            <oval-def:description>The operating system installed on the system is openSUSE Leap 15.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="openSUSE is installed" definition_ref="oval:ssg-installed_OS_is_opensuse:def:1"/>
            <oval-def:criterion comment="openSUSE Leap 15 is installed" test_ref="oval:ssg-test_opensuse_leap15_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_opensuse_leap42:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>openSUSE Leap 42</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:opensuse:leap:42.1" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:opensuse:leap:42.2" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:opensuse:leap:42.3" source="CPE"/>
            <oval-def:description>The operating system installed on the system is openSUSE Leap 42.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="openSUSE is installed" definition_ref="oval:ssg-installed_OS_is_opensuse:def:1"/>
            <oval-def:criterion comment="openSUSE Leap 42 is installed" test_ref="oval:ssg-test_opensuse_leap42_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Installed operating system is part of the Unix family</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The operating system installed on the system is part of the Unix OS family</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_unix_family:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhcos4:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux CoreOS</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux_coreos:4" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Red Hat Enterprise Linux CoreOS release 4</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="RHCOS is installed" test_ref="oval:ssg-test_rhcos:tst:1"/>
              <oval-def:criterion comment="RHCOS version 4 is installed" test_ref="oval:ssg-test_rhcos4:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel7:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 7</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:7" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Red Hat Enterprise Linux 7</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_rhel7_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="RHEL 7 Client is installed" test_ref="oval:ssg-test_rhel7_client:tst:1"/>
              <oval-def:criterion comment="RHEL 7 Workstation is installed" test_ref="oval:ssg-test_rhel7_workstation:tst:1"/>
              <oval-def:criterion comment="RHEL 7 Server is installed" test_ref="oval:ssg-test_rhel7_server:tst:1"/>
              <oval-def:criterion comment="RHEL 7 Compute Node is installed" test_ref="oval:ssg-test_rhel7_computenode:tst:1"/>
              <oval-def:criteria operator="AND" comment="Red Hat Enterprise Virtualization Host is installed">
                <oval-def:criterion comment="Red Hat Virtualization Host (RHVH)" test_ref="oval:ssg-test_rhvh4_version:tst:1"/>
                <oval-def:criterion comment="Red Hat Enterprise Virtualization Host is based on RHEL 7" test_ref="oval:ssg-test_rhevh_rhel7_version:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Red Hat Enterprise Linux 8</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_rhel8_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="RHEL 8 is installed" test_ref="oval:ssg-test_rhel8:tst:1"/>
              <oval-def:criteria operator="AND" comment="Red Hat Enterprise Virtualization Host is installed">
                <oval-def:criterion comment="Red Hat Virtualization Host (RHVH)" test_ref="oval:ssg-test_rhvh4_version:tst:1"/>
                <oval-def:criterion comment="Red Hat Enterprise Virtualization Host is based on RHEL 8" test_ref="oval:ssg-test_rhevh_rhel8_version:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_0:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.0</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.0" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.0</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.0 is installed" test_ref="oval:ssg-test_rhel8_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_1:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.1</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.1" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.1</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.1 is installed" test_ref="oval:ssg-test_rhel8_1:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_2:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.2</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.2" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.2</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.2 is installed" test_ref="oval:ssg-test_rhel8_2:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_3:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.3</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.3" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.3</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.3 is installed" test_ref="oval:ssg-test_rhel8_3:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_4:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.4</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.4" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.4</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.4 is installed" test_ref="oval:ssg-test_rhel8_4:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_5:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.5</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.5" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.5</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.5 is installed" test_ref="oval:ssg-test_rhel8_5:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_6:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.6</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.6" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.6</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.6 is installed" test_ref="oval:ssg-test_rhel8_6:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_7:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.7</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.7" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.7</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.7 is installed" test_ref="oval:ssg-test_rhel8_7:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_8:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.8</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.8" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.8</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.8 is installed" test_ref="oval:ssg-test_rhel8_8:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_9:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.9</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.9" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.9</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.9 is installed" test_ref="oval:ssg-test_rhel8_9:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_10:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.10</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.10" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.10</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.10 is installed" test_ref="oval:ssg-test_rhel8_10:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel9:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 9</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:9" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Red Hat Enterprise Linux 9</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_rhel9_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="RHEL 9 is installed" test_ref="oval:ssg-test_rhel9:tst:1"/>
              <oval-def:criteria operator="AND" comment="Red Hat Enterprise Virtualization Host is installed">
                <oval-def:criterion comment="Red Hat Virtualization Host (RHVH)" test_ref="oval:ssg-test_rhvh4_version:tst:1"/>
                <oval-def:criterion comment="Red Hat Enterprise Virtualization Host is based on RHEL 9" test_ref="oval:ssg-test_rhevh_rhel9_version:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhv4:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Virtualization 4</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:virtualization:4" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Red Hat Virtualization Host 4.4+ or Red Hat Enterprise Host.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="RHEL8 OS installed" definition_ref="oval:ssg-installed_OS_is_rhel8:def:1"/>
            <oval-def:criterion comment="Red Hat Virtualization Host (RHVH)" test_ref="oval:ssg-test_rhvh4_version:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_sl6:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Scientific Linux 6</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:scientificlinux:scientificlinux:6" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Scientific Linux 6</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="Scientific Linux 6 is installed" test_ref="oval:ssg-test_sl6:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_sl7:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Scientific Linux 7</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:scientificlinux:scientificlinux:7" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Scientific Linux 7</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="Scientific Linux 7 is installed" test_ref="oval:ssg-test_sl7:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_sle12:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>SUSE Linux Enterprise 12</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:suse:linux_enterprise_server:12" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:suse:linux_enterprise_desktop:12" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      SUSE Linux Enterprise 12.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_sle12_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="SLE 12 Desktop is installed" test_ref="oval:ssg-test_sle12_desktop:tst:1"/>
              <oval-def:criterion comment="SLE 12 Server is installed" test_ref="oval:ssg-test_sle12_server:tst:1"/>
              <oval-def:criterion comment="SLES 12 for SAP Applications is installed" test_ref="oval:ssg-test_sles_12_for_sap:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_sle15:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>SUSE Linux Enterprise 15</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:suse:linux_enterprise_server:15" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:suse:linux_enterprise_desktop:15" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      SUSE Linux Enterprise 15.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_sle15_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="SLE 15 Desktop is installed" test_ref="oval:ssg-test_sle15_desktop:tst:1"/>
              <oval-def:criterion comment="SLE 15 Server is installed" test_ref="oval:ssg-test_sle15_server:tst:1"/>
              <oval-def:criterion comment="SLES 15 for SAP Applications is installed" test_ref="oval:ssg-test_sles_15_for_sap:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ubuntu:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ubuntu</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The operating system installed is an Ubuntu System</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="System is Ubuntu" operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="lsb-based distrib" test_ref="oval:ssg-test_lsb:tst:1"/>
            <oval-def:criterion comment="Ubuntu is installed" test_ref="oval:ssg-test_ubuntu:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ubuntu1604:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ubuntu 1604</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:canonical:ubuntu_linux:16.04" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Ubuntu 1604</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="current Ubuntu version is Xenial" operator="AND">
            <oval-def:extend_definition comment="Ubuntu is installed" definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1"/>
            <oval-def:criterion comment="Xenial is installed" test_ref="oval:ssg-test_ubuntu_xenial:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ubuntu1804:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ubuntu 1804</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:canonical:ubuntu_linux:18.04" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Ubuntu 1804</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="current Ubuntu version is Bionic" operator="AND">
            <oval-def:extend_definition comment="Ubuntu is installed" definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1"/>
            <oval-def:criterion comment="Bionic is installed" test_ref="oval:ssg-test_ubuntu_bionic:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ubuntu2004:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ubuntu 2004</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:canonical:ubuntu_linux:20.04" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Ubuntu 2004</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="current Ubuntu version is Focal" operator="AND">
            <oval-def:extend_definition comment="Ubuntu is installed" definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1"/>
            <oval-def:criterion comment="Focal is installed" test_ref="oval:ssg-test_ubuntu_focal:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_wrlinux1019:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>WRLinux 1019</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:windriver:wrlinux" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Wind River Linux 1019</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_unix_wrlinux1019:tst:1"/>
            <oval-def:criterion comment="Produce name is WRLinux" test_ref="oval:ssg-test_wrlinux1019_name:tst:1"/>
            <oval-def:criterion comment="WRLinux version is 1019" test_ref="oval:ssg-test_wrlinux1019_version:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_wrlinux8:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>WRLinux 8</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:windriver:wrlinux" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Wind River Linux 8</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="current WRLinux version is WRLinux8" operator="AND">
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_unix_wrlinux8:tst:1"/>
            <oval-def:criterion comment="WRLinux 8 is installed" test_ref="oval:ssg-test_wrlinux8_version:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_app_is_rhv4:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Virtualization 4</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/a:redhat:virtualization:4" source="CPE"/>
            <oval-def:description>The application installed installed on the system is
      Red Hat Virtualization 4.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="RHEL7 OS installed" definition_ref="oval:ssg-installed_OS_is_rhel7:def:1"/>
            <oval-def:criterion comment="Red Hat Virtualization Manager (RHVM)" test_ref="oval:ssg-test_rhevm4_version:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_audit_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package audit is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package audit is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:audit" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package audit is installed" test_ref="oval:ssg-test_env_has_audit_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_chrony_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package chrony is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package chrony is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:chrony" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package chrony is installed" test_ref="oval:ssg-test_env_has_chrony_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_gdm_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package gdm is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package gdm is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:gdm" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package gdm is installed" test_ref="oval:ssg-test_env_has_gdm_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_grub2_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package grub2 is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package grub2-common is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:grub2" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Package grub2-common is installed" test_ref="oval:ssg-test_env_has_grub2_installed:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Test for ppcle64 architecture" test_ref="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" negate="true"/>
              <oval-def:criterion comment="Test if OPAL is not used" test_ref="oval:ssg-test_system_using_opal:tst:1" negate="true"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_libuser_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package libuser is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package libuser is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:libuser" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package libuser is installed" test_ref="oval:ssg-test_env_has_libuser_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_login_defs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package providing /etc/login.defs is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package providing /etc/login.defs and is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:login_defs" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package providing /etc/login.defs is installed" test_ref="oval:ssg-test_env_has_login_defs_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_net-snmp_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package net-snmp is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package net-snmp is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:net-snmp" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package net-snmp is installed" test_ref="oval:ssg-test_env_has_net-snmp_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_no_ovirt:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Check if the system doesn't act as an oVirt host or manager</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if the system has neither ovirt-host nor ovirt-engine installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="Package ovirt-host is not installed" definition_ref="oval:ssg-installed_env_has_ovirt:def:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_nss-pam-ldapd_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package nss-pam-ldapd is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package nss-pam-ldapd is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:nss-pam-ldapd" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package nss-pam-ldapd is installed" test_ref="oval:ssg-test_env_has_nss-pam-ldapd_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_ntp_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package ntp is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package ntp is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:ntp" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package ntp is installed" test_ref="oval:ssg-test_env_has_ntp_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_ovirt:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Check if the system acts as an oVirt host or manager</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if the system has ovirt-host or ovirt-engine installed</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:ovirt-host" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Package ovirt-host is installed" test_ref="oval:ssg-test_env_has_ovirt-host_installed:tst:1"/>
            <oval-def:criterion comment="Package ovirt-engine is installed" test_ref="oval:ssg-test_env_has_ovirt-engine_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_pam_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package pam is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package pam is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:pam" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package pam is installed" test_ref="oval:ssg-test_env_has_pam_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_polkit_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package polkit is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package polkit is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:polkit" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package polkit is installed" test_ref="oval:ssg-test_env_has_polkit_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_postfix_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package postfix is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package postfix is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:postfix" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package postfix is installed" test_ref="oval:ssg-test_env_has_postfix_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_sssd-common_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package sssd-common is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package sssd-common is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:sssd" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package sssd-common is installed" test_ref="oval:ssg-test_env_has_sssd-common_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_sudo_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package sudo is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package sudo is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:sudo" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package sudo is installed" test_ref="oval:ssg-test_env_has_sudo_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_systemd_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package systemd is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package systemd is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:systemd" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package systemd is installed" test_ref="oval:ssg-test_env_has_systemd_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_tftp_server_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package tftp-server is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package tftp-server is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:tftp-server" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package tftp-server is installed" test_ref="oval:ssg-test_env_has_tftp_server_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_usbguard_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package usbguard is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package usbguard is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:usbguard" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package usbguard is installed" test_ref="oval:ssg-test_env_has_usbguard_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_wifi_interface:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>WiFi interface is present</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if any wifi interface is present.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:wifi-iface" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="WiFi interface is present" test_ref="oval:ssg-test_proc_net_wireless_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_yum_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package yum is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package yum is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:yum" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package yum is installed" test_ref="oval:ssg-test_env_has_yum_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_zipl_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>System uses zIPL</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if system uses zIPL bootloader.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:zipl" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package s390utils-base is installed" test_ref="oval:ssg-test_env_has_zipl_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_is_a_container:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Check if the scan target is a container</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check for presence of files characterizing container filesystems.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:container" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Check if /.dockerenv exists" test_ref="oval:ssg-test_installed_env_is_a_docker_container:tst:1"/>
            <oval-def:criterion comment="Check if /run/.containerenv exists" test_ref="oval:ssg-test_installed_env_is_a_podman_container:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_is_a_machine:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Check if the scan target is a machine</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check for absence of files characterizing container filesystems.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:machine" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="If environment is not a container, it is machine" definition_ref="oval:ssg-installed_env_is_a_container:def:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-proc_sys_kernel_osrelease_arch_aarch64:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Test that the architecture is aarch64</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that architecture of kernel in /proc/sys/kernel/osrelease is aarch64</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Architecture is aarch64" test_ref="oval:ssg-test_proc_sys_kernel_osrelease_arch_aarch64:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-proc_sys_kernel_osrelease_arch_not_aarch64:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Test for different architecture than aarch64</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that architecture of kernel in /proc/sys/kernel/osrelease is not aarch64</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="Architecture is not aarch64" definition_ref="oval:ssg-proc_sys_kernel_osrelease_arch_aarch64:def:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-proc_sys_kernel_osrelease_arch_not_s390x:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Test for different architecture than s390x</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that architecture of kernel in /proc/sys/kernel/osrelease is not s390x</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="Architecture is not s390x" definition_ref="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Test that the architecture is s390x</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that architecture of kernel in /proc/sys/kernel/osrelease is s390x</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Architecture is s390x" test_ref="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-sssd_conf_uses_ldap:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>SSSD is configured to use LDAP</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Identification provider is not set to ad within /etc/sssd/sssd.conf</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:sssd-ldap" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Identification provider is not set to ad within /etc/sssd/sssd.conf" test_ref="oval:ssg-test_id_provider_is_set_to_ad:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-system_boot_mode_is_non_uefi:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Non-UEFI system boot mode check</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if System boot mode is non-UEFI.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:non-uefi" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition definition_ref="oval:ssg-system_boot_mode_is_uefi:def:1" negate="true" comment="Pass if System boot mode is non-UEFI"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-system_boot_mode_is_uefi:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>UEFI system boot mode check</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if system boot mode is UEFI.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:uefi" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_efi_dir_existence:tst:1" comment="check if /sys/firmware/efi folder exists"/>
          </oval-def:criteria>
        </oval-def:definition>
      </oval-def:definitions>
      <oval-def:tests>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="centos-release is version 6" id="oval:ssg-test_centos6:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_centos6:obj:1"/>
          <linux:state state_ref="oval:ssg-state_centos6:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="centos-release is version 7" id="oval:ssg-test_centos7:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_centos7:obj:1"/>
          <linux:state state_ref="oval:ssg-state_centos7:ste:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check os-release ID" id="oval:ssg-test_centos8_name:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_name_centos8:obj:1"/>
          <ind:state state_ref="oval:ssg-state_name_centos8:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="Check os-release VERSION_ID" id="oval:ssg-test_centos8_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_version_centos8:obj:1"/>
          <ind:state state_ref="oval:ssg-state_version_centos8:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check os-release ID" id="oval:ssg-test_centos9_name:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_name_centos9:obj:1"/>
          <ind:state state_ref="oval:ssg-state_name_centos9:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="Check os-release VERSION_ID" id="oval:ssg-test_centos9_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_version_centos9:obj:1"/>
          <ind:state state_ref="oval:ssg-state_version_centos9:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="all_exist" comment="/etc/debian_version exists" id="oval:ssg-test_debian:tst:1" version="1">
          <unix:object object_ref="oval:ssg-obj_debian:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Debian version" id="oval:ssg-test_debian_10:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_debian_10:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Debian version" id="oval:ssg-test_debian_11:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_debian_11:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Debian version" id="oval:ssg-test_debian_9:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_debian_9:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="fedora-release RPM packages are installed" id="oval:ssg-test_fedora_release_rpm:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_fedora_release_rpm:obj:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" comment="CPE vendor is 'fedoraproject' and 'product' is fedora" id="oval:ssg-test_fedora_vendor_product:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_fedora_vendor_product:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="oraclelinux-release is version 7" id="oval:ssg-test_ol7_system:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_ol7_system:obj:1"/>
          <linux:state state_ref="oval:ssg-state_ol7_system:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="oraclelinux-release is version 8" id="oval:ssg-test_ol8_system:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_ol8_system:obj:1"/>
          <linux:state state_ref="oval:ssg-state_ol8_system:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="oraclelinux-release is version 9" id="oval:ssg-test_ol9_system:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_ol9_system:obj:1"/>
          <linux:state state_ref="oval:ssg-state_ol9_system:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="openSUSE is installed" id="oval:ssg-test_opensuse_installed:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_opensuse_installed:obj:1"/>
          <linux:state state_ref="oval:ssg-state_opensuse_installed:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="openSUSE Leap 15 is installed" id="oval:ssg-test_opensuse_leap15_installed:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_opensuse_leap15_installed:obj:1"/>
          <linux:state state_ref="oval:ssg-state_opensuse_leap15_installed:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="openSUSE Leap 42 is installed" id="oval:ssg-test_opensuse_leap42_installed:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_opensuse_leap42_installed:obj:1"/>
          <linux:state state_ref="oval:ssg-state_opensuse_leap42_installed:ste:1"/>
        </linux:rpminfo_test>
        <ind:family_test id="oval:ssg-test_unix_family:tst:1" check="all" check_existence="at_least_one_exists" comment="Test installed OS is part of the unix family" version="1">
          <ind:object object_ref="oval:ssg-object_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_unix_family:ste:1"/>
        </ind:family_test>
        <ind:textfilecontent54_test check="all" comment="os-release is rhcos" id="oval:ssg-test_rhcos:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhcos:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhcos:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="rhcoreos is version 4" id="oval:ssg-test_rhcos4:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhcos4:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhcos4:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_rhel7_unix_family:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhel7_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhel7_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-client is version 7" id="oval:ssg-test_rhel7_client:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel7_client:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel7_client:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-workstation is version 7" id="oval:ssg-test_rhel7_workstation:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel7_workstation:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel7_workstation:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-server is version 7" id="oval:ssg-test_rhel7_server:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel7_server:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel7_server:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-computenode is version 7" id="oval:ssg-test_rhel7_computenode:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel7_computenode:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel7_computenode:ste:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" comment="RHEVH base RHEL is version 7" id="oval:ssg-test_rhevh_rhel7_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhevh_rhel7_version:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhevh_rhel7_version:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_rhel8_unix_family:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhel8_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhel8_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8" id="oval:ssg-test_rhel8:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.0" id="oval:ssg-test_rhel8_0:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_0:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_0:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.1" id="oval:ssg-test_rhel8_1:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_1:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_1:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.2" id="oval:ssg-test_rhel8_2:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_2:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_2:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.3" id="oval:ssg-test_rhel8_3:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_3:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_3:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.4" id="oval:ssg-test_rhel8_4:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_4:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_4:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.5" id="oval:ssg-test_rhel8_5:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_5:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_5:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.6" id="oval:ssg-test_rhel8_6:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_6:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_6:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.7" id="oval:ssg-test_rhel8_7:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_7:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_7:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.8" id="oval:ssg-test_rhel8_8:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_8:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_8:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.9" id="oval:ssg-test_rhel8_9:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_9:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_9:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.10" id="oval:ssg-test_rhel8_10:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_10:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_10:ste:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" comment="RHEVH base RHEL is version 8" id="oval:ssg-test_rhevh_rhel8_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhevh_rhel8_version:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhevh_rhel8_version:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_rhel9_unix_family:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhel9_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhel9_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 9" id="oval:ssg-test_rhel9:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel9:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel9:ste:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" comment="RHEVH base RHEL is version 9" id="oval:ssg-test_rhevh_rhel9_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhevh_rhel9_version:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhevh_rhel9_version:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test check="all" check_existence="only_one_exists" comment="redhat-release-virtualization-host RPM package is installed" id="oval:ssg-test_rhvh4_version:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhvh4_version:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhvh4_version:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sl-release is version 6" id="oval:ssg-test_sl6:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sl6:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sl6:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sl-release is version 7" id="oval:ssg-test_sl7:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sl7:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sl7:ste:1"/>
        </linux:rpminfo_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_sle12_unix_family:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sle12_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sle12_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sled-release is version 6" id="oval:ssg-test_sle12_desktop:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sle12_desktop:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sle12_desktop:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sles-release is version 6" id="oval:ssg-test_sle12_server:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sle12_server:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sle12_server:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="SLES_SAP-release is version 12" id="oval:ssg-test_sles_12_for_sap:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sles_12_for_sap:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sles_12_for_sap:ste:1"/>
        </linux:rpminfo_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_sle15_unix_family:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sle15_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sle15_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sled-release is version 15" id="oval:ssg-test_sle15_desktop:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sle15_desktop:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sle15_desktop:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sles-release is version 15" id="oval:ssg-test_sle15_server:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sle15_server:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sle15_server:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="SLES_SAP-release is version 15" id="oval:ssg-test_sles_15_for_sap:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sles_15_for_sap:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sles_15_for_sap:ste:1"/>
        </linux:rpminfo_test>
        <unix:file_test check="all" check_existence="all_exist" comment="/etc/lsb-release exists" id="oval:ssg-test_lsb:tst:1" version="1">
          <unix:object object_ref="oval:ssg-obj_lsb:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Ubuntu" id="oval:ssg-test_ubuntu:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ubuntu:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Ubuntu version" id="oval:ssg-test_ubuntu_xenial:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ubuntu_xenial:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Ubuntu version" id="oval:ssg-test_ubuntu_bionic:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ubuntu_bionic:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Ubuntu version" id="oval:ssg-test_ubuntu_focal:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ubuntu_focal:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_unix_wrlinux1019:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_unix_wrlinux1019:obj:1"/>
          <ind:state state_ref="oval:ssg-state_unix_wrlinux1019:ste:1"/>
        </ind:family_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check WRLinux10.19 version" id="oval:ssg-test_wrlinux1019_name:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_name_wrlinux1019:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check WRLinux10.19 version" id="oval:ssg-test_wrlinux1019_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_version_wrlinux1019:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_unix_wrlinux8:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_unix_wrlinux8:obj:1"/>
          <ind:state state_ref="oval:ssg-state_unix_wrlinux8:ste:1"/>
        </ind:family_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check WRLinux8 version" id="oval:ssg-test_wrlinux8_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_version_wrlinux8:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="rhevm4-appliance is installed" id="oval:ssg-test_rhevm4_version:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhevm4_version:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhevm4_version:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_audit_installed:tst:1" version="1" comment="system has package audit installed">
          <linux:object object_ref="oval:ssg-obj_env_has_audit_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_env_has_chrony_installed:tst:1" version="1" comment="package chrony is installed">
          <linux:object object_ref="oval:ssg-obj_test_env_has_chrony_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_gdm_installed:tst:1" version="1" comment="system has package gdm installed">
          <linux:object object_ref="oval:ssg-obj_env_has_gdm_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_grub2_installed:tst:1" version="1" comment="system has package grub2-common installed">
          <linux:object object_ref="oval:ssg-obj_env_has_grub2_installed:obj:1"/>
        </linux:rpminfo_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Check if /sys/firmware/opal exists" id="oval:ssg-test_system_using_opal:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_system_using_opal:obj:1"/>
        </unix:file_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_libuser_installed:tst:1" version="1" comment="system has package libuser installed">
          <linux:object object_ref="oval:ssg-obj_env_has_libuser_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_login_defs_installed:tst:1" version="1" comment="system has package shadow-utils installed, which provides the /etc/login.defs file.">
          <linux:object object_ref="oval:ssg-obj_env_has_login_defs_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_net-snmp_installed:tst:1" version="1" comment="system has package net-snmp installed">
          <linux:object object_ref="oval:ssg-obj_env_has_net-snmp_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_nss-pam-ldapd_installed:tst:1" version="1" comment="system has package nss-pam-ldapd installed">
          <linux:object object_ref="oval:ssg-obj_env_has_nss-pam-ldapd_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_env_has_ntp_installed:tst:1" version="1" comment="package ntp is installed">
          <linux:object object_ref="oval:ssg-obj_test_env_has_ntp_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_ovirt-host_installed:tst:1" version="1" comment="system has package ovirt-host installed">
          <linux:object object_ref="oval:ssg-obj_env_has_ovirt-host_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_ovirt-engine_installed:tst:1" version="1" comment="system has package ovirt-engine installed">
          <linux:object object_ref="oval:ssg-obj_env_has_ovirt-engine_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_pam_installed:tst:1" version="1" comment="system has package pam installed">
          <linux:object object_ref="oval:ssg-obj_env_has_pam_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_env_has_polkit_installed:tst:1" version="1" comment="package polkit is installed">
          <linux:object object_ref="oval:ssg-obj_test_env_has_polkit_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_env_has_postfix_installed:tst:1" version="1" comment="package postfix is installed">
          <linux:object object_ref="oval:ssg-obj_test_env_has_postfix_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_sssd-common_installed:tst:1" version="1" comment="system has package sssd-common installed">
          <linux:object object_ref="oval:ssg-obj_env_has_sssd-common_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_sudo_installed:tst:1" version="1" comment="system has package sudo installed">
          <linux:object object_ref="oval:ssg-obj_env_has_sudo_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_systemd_installed:tst:1" version="1" comment="system has package systemd installed">
          <linux:object object_ref="oval:ssg-obj_env_has_systemd_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_tftp_server_installed:tst:1" version="1" comment="system has package tftp-server installed">
          <linux:object object_ref="oval:ssg-obj_env_has_tftp_server_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_usbguard_installed:tst:1" version="1" comment="system has package usbguard installed">
          <linux:object object_ref="oval:ssg-obj_env_has_usbguard_installed:obj:1"/>
        </linux:rpminfo_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Test if /proc/net/wireless exists" id="oval:ssg-test_proc_net_wireless_exists:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_proc_net_wireless_exists:obj:1"/>
        </unix:file_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_yum_installed:tst:1" version="1" comment="system has package yum installed">
          <linux:object object_ref="oval:ssg-obj_env_has_yum_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_zipl_installed:tst:1" version="1" comment="system has package zipl installed">
          <linux:object object_ref="oval:ssg-obj_env_has_zipl_installed:obj:1"/>
        </linux:rpminfo_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Check if /.dockerenv exists" id="oval:ssg-test_installed_env_is_a_docker_container:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_installed_env_is_a_docker_container:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Check if /run/.containerenv exists" id="oval:ssg-test_installed_env_is_a_podman_container:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_installed_env_is_a_podman_container:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="proc_sys_kernel is for aarch64 architecture" id="oval:ssg-test_proc_sys_kernel_osrelease_arch_aarch64:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_proc_sys_kernel_osrelease_arch_aarch64:obj:1"/>
          <ind:state state_ref="oval:ssg-state_proc_sys_kernel_osrelease_arch_aarch64:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="proc_sys_kernel is for s390x architecture" id="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_proc_sys_kernel_osrelease_arch_s390x:obj:1"/>
          <ind:state state_ref="oval:ssg-state_proc_sys_kernel_osrelease_arch_s390x:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="SSSD Configuration is set to use Active Directory" id="oval:ssg-test_id_provider_is_set_to_ad:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_id_provider_is_set_to_ad:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="Verify if /sys/firmware/efi folder exists" id="oval:ssg-test_efi_dir_existence:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_sys_firmware_efi:obj:1"/>
        </unix:file_test>
        <unix:uname_test check="all" comment="64 bit architecture" id="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_system_info_architecture_ppcle_64:obj:1"/>
          <unix:state state_ref="oval:ssg-state_system_info_architecture_ppcle_64:ste:1"/>
        </unix:uname_test>
      </oval-def:tests>
      <oval-def:objects>
        <linux:rpminfo_object id="oval:ssg-obj_centos6:obj:1" version="1">
          <linux:name>centos-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_centos7:obj:1" version="1">
          <linux:name>centos-release</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_name_centos8:obj:1" version="1" comment="Check os-release ID">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^ID="(\w+)"$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_version_centos8:obj:1" version="1" comment="Check os-release VERSION_ID">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION_ID="(\d)"$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_name_centos9:obj:1" version="1" comment="Check os-release ID">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^ID="(\w+)"$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_version_centos9:obj:1" version="1" comment="Check os-release VERSION_ID">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION_ID="(\d)"$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object comment="check /etc/debian_version file" id="oval:ssg-obj_debian:obj:1" version="1">
          <unix:filepath>/etc/debian_version</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_debian_10:obj:1" version="1" comment="Check Debian version">
          <ind:filepath>/etc/debian_version</ind:filepath>
          <ind:pattern operation="pattern match">^10.[0-9]+$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_debian_11:obj:1" version="1" comment="Check Debian version">
          <ind:filepath>/etc/debian_version</ind:filepath>
          <ind:pattern operation="pattern match">^11.[0-9]+$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_debian_9:obj:1" version="1" comment="Check Debian version">
          <ind:filepath>/etc/debian_version</ind:filepath>
          <ind:pattern operation="pattern match">^9.[0-9]+$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-object_fedora_release_rpm:obj:1" version="1">
          <linux:name operation="pattern match">fedora-release.*</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-object_fedora_vendor_product:obj:1" version="1">
          <ind:filepath>/etc/system-release-cpe</ind:filepath>
          <ind:pattern operation="pattern match">^cpe:\/o:fedoraproject:fedora:[\d]+$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_ol7_system:obj:1" version="1">
          <linux:name>oraclelinux-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_ol8_system:obj:1" version="1">
          <linux:name>oraclelinux-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_ol9_system:obj:1" version="1">
          <linux:name>oraclelinux-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_opensuse_installed:obj:1" version="1">
          <linux:name>openSUSE-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_opensuse_leap15_installed:obj:1" version="1">
          <linux:name>openSUSE-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_opensuse_leap42_installed:obj:1" version="1">
          <linux:name>openSUSE-release</linux:name>
        </linux:rpminfo_object>
        <ind:family_object id="oval:ssg-object_unix_family:obj:1" version="1"/>
        <ind:textfilecontent54_object id="oval:ssg-obj_rhcos:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^ID="(\w+)"$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rhcos4:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION_ID="(\d)\.\d+"$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:family_object id="oval:ssg-obj_rhel7_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_rhel7_client:obj:1" version="1">
          <linux:name>redhat-release-client</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel7_workstation:obj:1" version="1">
          <linux:name>redhat-release-workstation</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel7_server:obj:1" version="1">
          <linux:name>redhat-release-server</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel7_computenode:obj:1" version="1">
          <linux:name>redhat-release-computenode</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel7_version:obj:1" version="1">
          <ind:filepath>/etc/redhat-release</ind:filepath>
          <ind:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:family_object id="oval:ssg-obj_rhel8_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_0:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_1:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_2:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_3:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_4:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_5:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_6:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_7:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_8:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_9:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_10:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel8_version:obj:1" version="1">
          <ind:filepath>/etc/redhat-release</ind:filepath>
          <ind:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:family_object id="oval:ssg-obj_rhel9_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_rhel9:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel9_version:obj:1" version="1">
          <ind:filepath>/etc/redhat-release</ind:filepath>
          <ind:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhvh4_version:obj:1" version="1">
          <linux:name>redhat-release-virtualization-host</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sl6:obj:1" version="1">
          <linux:name>sl-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sl7:obj:1" version="1">
          <linux:name>sl-release</linux:name>
        </linux:rpminfo_object>
        <ind:family_object id="oval:ssg-obj_sle12_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_sle12_desktop:obj:1" version="1">
          <linux:name>sled-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sle12_server:obj:1" version="1">
          <linux:name>sles-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sles_12_for_sap:obj:1" version="1">
          <linux:name>SLES_SAP-release</linux:name>
        </linux:rpminfo_object>
        <ind:family_object id="oval:ssg-obj_sle15_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_sle15_desktop:obj:1" version="1">
          <linux:name>sled-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sle15_server:obj:1" version="1">
          <linux:name>sles-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sles_15_for_sap:obj:1" version="1">
          <linux:name>SLES_SAP-release</linux:name>
        </linux:rpminfo_object>
        <unix:file_object comment="check /etc/lsb-release file" id="oval:ssg-obj_lsb:obj:1" version="1">
          <unix:filepath>/etc/lsb-release</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ubuntu:obj:1" version="1" comment="Check Ubuntu">
          <ind:filepath>/etc/lsb-release</ind:filepath>
          <ind:pattern operation="pattern match">^DISTRIB_ID=Ubuntu$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ubuntu_xenial:obj:1" version="1" comment="Check Ubuntu version">
          <ind:filepath>/etc/lsb-release</ind:filepath>
          <ind:pattern operation="pattern match">^DISTRIB_CODENAME=xenial$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ubuntu_bionic:obj:1" version="1" comment="Check Ubuntu version">
          <ind:filepath>/etc/lsb-release</ind:filepath>
          <ind:pattern operation="pattern match">^DISTRIB_CODENAME=bionic$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ubuntu_focal:obj:1" version="1" comment="Check Ubuntu version">
          <ind:filepath>/etc/lsb-release</ind:filepath>
          <ind:pattern operation="pattern match">^DISTRIB_CODENAME=focal$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:family_object id="oval:ssg-obj_unix_wrlinux1019:obj:1" version="1"/>
        <ind:textfilecontent54_object id="oval:ssg-obj_name_wrlinux1019:obj:1" version="1" comment="Check WRLinux1019 produce name">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^NAME=.Wind[\s]+River[\s]+Linux.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_version_wrlinux1019:obj:1" version="1" comment="Check WRLinux1019 version">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION=.10\.19.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:family_object id="oval:ssg-obj_unix_wrlinux8:obj:1" version="1"/>
        <ind:textfilecontent54_object id="oval:ssg-obj_version_wrlinux8:obj:1" version="1" comment="Check WRLinux8 version">
          <ind:filepath>/etc/wrlinux-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION=.8\.0.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhevm4_version:obj:1" version="1">
          <linux:name>rhvm-appliance</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_audit_installed:obj:1" version="1">
          <linux:name>audit</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_env_has_chrony_installed:obj:1" version="1">
          <linux:name>chrony</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_gdm_installed:obj:1" version="1">
          <linux:name>gdm</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_grub2_installed:obj:1" version="1">
          <linux:name>grub2-common</linux:name>
        </linux:rpminfo_object>
        <unix:file_object id="oval:ssg-object_system_using_opal:obj:1" version="1">
          <unix:filepath>/sys/firmware/opal</unix:filepath>
        </unix:file_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_libuser_installed:obj:1" version="1">
          <linux:name>libuser</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_login_defs_installed:obj:1" version="1">
          <linux:name>shadow-utils</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_net-snmp_installed:obj:1" version="1">
          <linux:name>net-snmp</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_nss-pam-ldapd_installed:obj:1" version="1">
          <linux:name>nss-pam-ldapd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_env_has_ntp_installed:obj:1" version="1">
          <linux:name>ntp</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_ovirt-host_installed:obj:1" version="1">
          <linux:name>ovirt-host</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_ovirt-engine_installed:obj:1" version="1">
          <linux:name>ovirt-engine</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_pam_installed:obj:1" version="1">
          <linux:name>pam</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_env_has_polkit_installed:obj:1" version="1">
          <linux:name>polkit</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_env_has_postfix_installed:obj:1" version="1">
          <linux:name>postfix</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_sssd-common_installed:obj:1" version="1">
          <linux:name>sssd-common</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_sudo_installed:obj:1" version="1">
          <linux:name>sudo</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_systemd_installed:obj:1" version="1">
          <linux:name>systemd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_tftp_server_installed:obj:1" version="1">
          <linux:name>tftp-server</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_usbguard_installed:obj:1" version="1">
          <linux:name>usbguard</linux:name>
        </linux:rpminfo_object>
        <unix:file_object comment="/proc/net/wireless file" id="oval:ssg-object_proc_net_wireless_exists:obj:1" version="1">
          <unix:filepath>/proc/net/wireless</unix:filepath>
        </unix:file_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_yum_installed:obj:1" version="1">
          <linux:name>yum</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_zipl_installed:obj:1" version="1">
          <linux:name>s390utils-base</linux:name>
        </linux:rpminfo_object>
        <unix:file_object comment="Check file /.dockerenv" id="oval:ssg-object_installed_env_is_a_docker_container:obj:1" version="1">
          <unix:filepath datatype="string">/.dockerenv</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="Check file /run/.containerenv" id="oval:ssg-object_installed_env_is_a_podman_container:obj:1" version="1">
          <unix:filepath datatype="string">/run/.containerenv</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_proc_sys_kernel_osrelease_arch_aarch64:obj:1" version="1">
          <ind:filepath>/proc/sys/kernel/osrelease</ind:filepath>
          <ind:pattern operation="pattern match">^.*\.(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_proc_sys_kernel_osrelease_arch_s390x:obj:1" version="1">
          <ind:filepath>/proc/sys/kernel/osrelease</ind:filepath>
          <ind:pattern operation="pattern match">^.*\.(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_id_provider_is_set_to_ad:obj:1" version="1">
          <ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\[domain\/[^]]*]([^\n\[\]]*\n+)+?[\s]*id_provider[ \t]*=[ \t]*((?i)ad)[ \t]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object comment="/sys/firmware/efi" id="oval:ssg-object_file_sys_firmware_efi:obj:1" version="1">
          <unix:path>/sys/firmware/efi</unix:path>
          <unix:filename xsi:nil="true"/>
        </unix:file_object>
        <unix:uname_object comment="64 bit architecture" id="oval:ssg-object_system_info_architecture_ppcle_64:obj:1" version="1"/>
      </oval-def:objects>
      <oval-def:states>
        <linux:rpminfo_state id="oval:ssg-state_centos6:ste:1" version="1">
          <linux:version operation="pattern match">^6.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_centos7:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_name_centos8:ste:1" version="1">
          <ind:subexpression>centos</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_version_centos8:ste:1" version="1">
          <ind:subexpression>8</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_name_centos9:ste:1" version="1">
          <ind:subexpression>centos</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_version_centos9:ste:1" version="1">
          <ind:subexpression>9</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:rpminfo_state id="oval:ssg-state_ol7_system:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_ol8_system:ste:1" version="1">
          <linux:version operation="pattern match">^8.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_ol9_system:ste:1" version="1">
          <linux:version operation="pattern match">^9.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_opensuse_installed:ste:1" version="1">
          <linux:name operation="pattern match">openSUSE-release</linux:name>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_opensuse_leap15_installed:ste:1" version="1">
          <linux:version operation="pattern match">^15.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_opensuse_leap42_installed:ste:1" version="1">
          <linux:version operation="pattern match">^42.*$</linux:version>
        </linux:rpminfo_state>
        <ind:family_state id="oval:ssg-state_unix_family:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rhcos:ste:1" version="1">
          <ind:subexpression operation="pattern match">rhcos</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rhcos4:ste:1" version="1">
          <ind:subexpression operation="pattern match">4</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:family_state id="oval:ssg-state_rhel7_unix_family:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel7_client:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel7_workstation:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel7_server:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel7_computenode:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rhevh_rhel7_version:ste:1" version="1">
          <ind:subexpression operation="pattern match">7</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:family_state id="oval:ssg-state_rhel8_unix_family:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8:ste:1" version="1">
          <linux:version operation="pattern match">^8.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_0:ste:1" version="1">
          <linux:version operation="pattern match">^8.0*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_1:ste:1" version="1">
          <linux:version operation="pattern match">^8.1*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_2:ste:1" version="1">
          <linux:version operation="pattern match">^8.2*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_3:ste:1" version="1">
          <linux:version operation="pattern match">^8.3*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_4:ste:1" version="1">
          <linux:version operation="pattern match">^8.4*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_5:ste:1" version="1">
          <linux:version operation="pattern match">^8.5*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_6:ste:1" version="1">
          <linux:version operation="pattern match">^8.6*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_7:ste:1" version="1">
          <linux:version operation="pattern match">^8.7*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_8:ste:1" version="1">
          <linux:version operation="pattern match">^8.8*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_9:ste:1" version="1">
          <linux:version operation="pattern match">^8.9*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_10:ste:1" version="1">
          <linux:version operation="pattern match">^8.10*$</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rhevh_rhel8_version:ste:1" version="1">
          <ind:subexpression operation="pattern match">8</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:family_state id="oval:ssg-state_rhel9_unix_family:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel9:ste:1" version="1">
          <linux:version operation="pattern match">^9.*$</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rhevh_rhel9_version:ste:1" version="1">
          <ind:subexpression operation="pattern match">9</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:rpminfo_state id="oval:ssg-state_rhvh4_version:ste:1" version="1">
          <linux:evr datatype="evr_string" operation="greater than or equal">0:4.4</linux:evr>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sl6:ste:1" version="1">
          <linux:version operation="pattern match">^6.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sl7:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <ind:family_state id="oval:ssg-state_sle12_unix_family:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_sle12_desktop:ste:1" version="1">
          <linux:version operation="pattern match">^12.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sle12_server:ste:1" version="1">
          <linux:version operation="pattern match">^12.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sles_12_for_sap:ste:1" version="1">
          <linux:version operation="pattern match">^12.*$</linux:version>
        </linux:rpminfo_state>
        <ind:family_state id="oval:ssg-state_sle15_unix_family:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_sle15_desktop:ste:1" version="1">
          <linux:version operation="pattern match">^15.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sle15_server:ste:1" version="1">
          <linux:version operation="pattern match">^15.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sles_15_for_sap:ste:1" version="1">
          <linux:version operation="pattern match">^15.*$</linux:version>
        </linux:rpminfo_state>
        <ind:family_state id="oval:ssg-state_unix_wrlinux1019:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <ind:family_state id="oval:ssg-state_unix_wrlinux8:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_rhevm4_version:ste:1" version="1">
          <linux:version operation="pattern match">^4.*$</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_proc_sys_kernel_osrelease_arch_aarch64:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^aarch64$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_proc_sys_kernel_osrelease_arch_s390x:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^s390x$</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:uname_state comment="64 bit architecture" id="oval:ssg-state_system_info_architecture_ppcle_64:ste:1" version="1">
          <unix:processor_type operation="equals">ppc64le</unix:processor_type>
        </unix:uname_state>
      </oval-def:states>
    </oval-def:oval_definitions>
  </ds:component>
</ds:data-stream-collection>
      </arf:content>
    </arf:report-request>
  </arf:report-requests>
  <arf:assets>
    <arf:asset id="asset0">
      <ai:computing-device>
        <ai:connections>
          <ai:connection>
            <ai:ip-address>
              <ai:ip-v4>127.0.0.1</ai:ip-v4>
            </ai:ip-address>
          </ai:connection>
          <ai:connection>
            <ai:ip-address>
              <ai:ip-v4>192.168.122.178</ai:ip-v4>
            </ai:ip-address>
          </ai:connection>
          <ai:connection>
            <ai:ip-address>
              <ai:ip-v6>0:0:0:0:0:0:0:1</ai:ip-v6>
            </ai:ip-address>
          </ai:connection>
          <ai:connection>
            <ai:ip-address>
              <ai:ip-v6>fe80:0:0:0:8000:d679:2b11:8d8</ai:ip-v6>
            </ai:ip-address>
          </ai:connection>
          <ai:connection>
            <ai:mac-address>00:00:00:00:00:00</ai:mac-address>
          </ai:connection>
          <ai:connection>
            <ai:mac-address>52:54:00:43:3D:D8</ai:mac-address>
          </ai:connection>
        </ai:connections>
        <ai:fqdn>localhost-live</ai:fqdn>
        <ai:hostname>localhost-live</ai:hostname>
      </ai:computing-device>
    </arf:asset>
  </arf:assets>
  <arf:reports>
    <arf:report id="xccdf1">
      <arf:content>
        <TestResult xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_org.open-scap_testresult_xccdf_org.ssgproject.content_profile_ospp" start-time="2022-08-01T16:21:57+01:00" end-time="2022-08-01T16:24:08+01:00" version="0.1.62" test-system="cpe:/a:redhat:openscap:1.3.6">
          <benchmark href="#scap_org.open-scap_comp_ssg-fedora-xccdf-1.2.xml" id="xccdf_org.ssgproject.content_benchmark_FEDORA"/>
          <title>OSCAP Scan Result</title>
          <identity authenticated="false" privileged="false">h</identity>
          <profile idref="xccdf_org.ssgproject.content_profile_ospp"/>
          <target>localhost-live</target>
          <target-address>127.0.0.1</target-address>
          <target-address>192.168.122.178</target-address>
          <target-address>0:0:0:0:0:0:0:1</target-address>
          <target-address>fe80:0:0:0:8000:d679:2b11:8d8</target-address>
          <target-facts>
            <fact name="urn:xccdf:fact:scanner:name" type="string">OpenSCAP</fact>
            <fact name="urn:xccdf:fact:scanner:version" type="string">1.3.6</fact>
            <fact name="urn:xccdf:fact:asset:identifier:fqdn" type="string">localhost-live</fact>
            <fact name="urn:xccdf:fact:asset:identifier:host_name" type="string">localhost-live</fact>
            <fact name="urn:xccdf:fact:ethernet:MAC" type="string">00:00:00:00:00:00</fact>
            <fact name="urn:xccdf:fact:asset:identifier:mac" type="string">00:00:00:00:00:00</fact>
            <fact name="urn:xccdf:fact:ethernet:MAC" type="string">52:54:00:43:3D:D8</fact>
            <fact name="urn:xccdf:fact:asset:identifier:mac" type="string">52:54:00:43:3D:D8</fact>
            <fact name="urn:xccdf:fact:asset:identifier:ipv4" type="string">127.0.0.1</fact>
            <fact name="urn:xccdf:fact:asset:identifier:ipv4" type="string">192.168.122.178</fact>
            <fact name="urn:xccdf:fact:asset:identifier:ipv6" type="string">::1</fact>
            <fact name="urn:xccdf:fact:asset:identifier:ipv6" type="string">fe80::8000:d679:2b11:8d8</fact>
          </target-facts>
          <target-id-ref system="http://scap.nist.gov/schema/asset-identification/1.1" name="asset0" href=""/>
          <platform idref="#grub2"/>
          <platform idref="#yum"/>
          <platform idref="#audit"/>
          <platform idref="#sssd"/>
          <platform idref="cpe:/o:fedoraproject:fedora:34"/>
          <platform idref="cpe:/o:fedoraproject:fedora:35"/>
          <platform idref="cpe:/o:fedoraproject:fedora:36"/>
          <platform idref="cpe:/o:fedoraproject:fedora:37"/>
          <platform idref="#pam"/>
          <platform idref="#gdm"/>
          <platform idref="#machine"/>
          <platform idref="#non-uefi"/>
          <platform idref="#login_defs"/>
          <set-value idref="xccdf_org.ssgproject.content_value_var_aide_scan_notification_email">root@localhost</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ssh_client_rekey_limit_size">512M</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ssh_client_rekey_limit_time">1h</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy">FIPS</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mcafee_antivirus_definition_expire">2592000</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_inactivity_timeout_value">900</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_screensaver_lock_delay">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sudo_dedicated_group">root</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sudo_logfile">/var/log/sudo.log</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sudo_passwd_timeout">5</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sudo_timestamp_timeout">5</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sudo_umask">0022</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_login_banner_text">^\-\-[\s\n]+WARNING[\s\n]+\-\-[\s\n]+This[\s\n]+system[\s\n]+is[\s\n]+for[\s\n]+the[\s\n]+use[\s\n]+of[\s\n]+authorized[\s\n]+users[\s\n]+only\.[\s\n]+Individuals[\s\n]+using[\s\n]+this[\s\n]+computer[\s\n]+system[\s\n]+without[\s\n]+authority[\s\n]+or[\s\n]+in[\s\n]+excess[\s\n]+of[\s\n]+their[\s\n]+authority[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+having[\s\n]+all[\s\n]+their[\s\n]+activities[\s\n]+on[\s\n]+this[\s\n]+system[\s\n]+monitored[\s\n]+and[\s\n]+recorded[\s\n]+by[\s\n]+system[\s\n]+personnel\.[\s\n]+Anyone[\s\n]+using[\s\n]+this[\s\n]+system[\s\n]+expressly[\s\n]+consents[\s\n]+to[\s\n]+such[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+advised[\s\n]+that[\s\n]+if[\s\n]+such[\s\n]+monitoring[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+criminal[\s\n]+activity[\s\n]+system[\s\n]+personal[\s\n]+may[\s\n]+provide[\s\n]+the[\s\n]+evidence[\s\n]+of[\s\n]+such[\s\n]+monitoring[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.$</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm">SHA512</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember">5</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny">3</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval">900</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_delay">4000000</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_remember">5</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag">requisite</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_tally2">3</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_dcredit">-1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_dictcheck">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_difok">8</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_lcredit">-1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat">4</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat">3</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass">3</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen">12</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_ocredit">-1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_retry">3</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_ucredit">-1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers">default</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_authorized_local_users_regex">^(abrt|adm|avahi|bin|chrony|clevis|cockpit-ws|cockpit-wsinstance|colord|daemon|dbus|dnsmasq|flatpak|ftp|games|gdm|geoclue|gluster|gnome-initial-setup|halt|libstoragemgmt|lp|mail|nfsnobody|nobody|ntp|operator|oprofile|oracle|pcp|pegasus|pipewire|polkitd|postfix|pulse|qemu|radvd|rngd|root|rpc|rpcuser|rtkit|saned|saslauth|setroubleshoot|shutdown|sshd|sssd|sync|systemd-bus-proxy|systemd-coredump|systemd-network|systemd-resolve|tcpdump|tss|unbound|usbmuxd$|uuidd)$</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration">35</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs">60</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs">7</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs">15</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs">7</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds">5000</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_fail_delay">4</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_max_concurrent_login_sessions">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_tmout">600</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask">027</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_audispd_disk_full_action">single</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_audispd_network_failure_action">single</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_audispd_remote_server">logcollector</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct">root</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action">single</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_disk_error_action">single</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_disk_full_action">single</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_flush">data</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file">6</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action">rotate</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_num_logs">5</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_space_left">100</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_action">email</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_percentage">25</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_l1tf_options">flush</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mds_options">full</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_rng_core_default_quality">500</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_spec_store_bypass_disable_options">prctl</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_kernel_config_module_sig_hash">sha512</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_kernel_config_module_sig_key">certs/signing_key.pem</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_kernel_config_panic_timeout">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_file_groupowner_logfiles_value">root</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_file_owner_logfiles_value">root</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address">logcollector</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysconfig_network_IPV6_AUTOCONF_value">no</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_defrtr_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_pinfo_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_redirects_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_source_route_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_autoconf_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_forwarding_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_max_addresses_value">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_router_solicitations_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_defrtr_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_pinfo_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_source_route_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_autoconf_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_forwarding_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_max_addresses_value">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_router_solicitations_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_filter_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_ignore_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_rp_filter_value">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_shared_media_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_shared_media_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_invalid_ratelimit_value">500</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_rfc1337_value">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mount_option_proc_hidepid">2</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_removable_partition">/dev/cdrom</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_umask_for_daemons">022</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_kernel_kptr_restrict_value">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_slub_debug_options">P</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name">targeted</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinux_state">enforcing</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_abrt_anon_write">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_abrt_handle_event">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_abrt_upload_watch_anon_write">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_antivirus_can_scan_system">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_antivirus_use_jit">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_auditadm_exec_content">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_authlogin_nsswitch_use_ldap">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_authlogin_radius">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_authlogin_yubikey">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_awstats_purge_apache_log_files">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_boinc_execmem">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cdrecord_read_content">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cluster_can_network_connect">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cluster_manage_all_files">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cluster_use_execmem">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cobbler_anon_write">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cobbler_can_network_connect">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cobbler_use_cifs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cobbler_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_collectd_tcp_network_connect">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_condor_tcp_network_connect">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_conman_can_network">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_container_connect_any">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cron_can_relabel">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cron_system_cronjob_use_shares">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cron_userdomain_transition">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cups_execmem">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cvs_read_shadow">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_daemons_dump_core">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_daemons_enable_cluster_mode">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_daemons_use_tcp_wrapper">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_daemons_use_tty">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_dbadm_exec_content">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_dbadm_manage_user_files">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_dbadm_read_user_files">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_deny_execmem">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_deny_ptrace">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_dhcpc_exec_iptables">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_dhcpd_use_ldap">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_domain_fd_use">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_domain_kernel_load_modules">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_entropyd_use_audio">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_exim_can_connect_db">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_exim_manage_user_files">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_exim_read_user_files">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_fcron_crond">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_fenced_can_network_connect">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_fenced_can_ssh">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_fips_mode">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ftpd_anon_write">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ftpd_connect_all_unreserved">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ftpd_connect_db">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ftpd_full_access">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ftpd_use_cifs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ftpd_use_fusefs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ftpd_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ftpd_use_passive_mode">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_git_cgi_enable_homedirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_git_cgi_use_cifs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_git_cgi_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_git_session_bind_all_unreserved_ports">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_git_session_users">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_git_system_enable_homedirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_git_system_use_cifs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_git_system_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_gitosis_can_sendmail">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_glance_api_can_network">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_glance_use_execmem">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_glance_use_fusefs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_global_ssp">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_gluster_anon_write">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_gluster_export_all_ro">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_gluster_export_all_rw">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_gpg_web_anon_write">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_gssd_read_tmp">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_guest_exec_content">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_haproxy_connect_any">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_anon_write">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_builtin_scripting">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_check_spam">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_connect_ftp">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_connect_ldap">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_connect_mythtv">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_connect_zabbix">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_network_connect">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_network_connect_cobbler">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_network_connect_db">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_network_memcache">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_network_relay">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_sendmail">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_dbus_avahi">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_dbus_sssd">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_dontaudit_search_dirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_enable_cgi">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_enable_ftp_server">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_enable_homedirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_execmem">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_graceful_shutdown">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_manage_ipa">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_mod_auth_ntlm_winbind">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_mod_auth_pam">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_read_user_content">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_run_ipa">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_run_preupgrade">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_run_stickshift">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_serve_cobbler_files">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_setrlimit">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_ssi_exec">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_sys_script_anon_write">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_tmp_exec">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_tty_comm">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_unified">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_use_cifs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_use_fusefs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_use_gpg">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_use_openstack">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_use_sasl">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_verify_dns">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_icecast_use_any_tcp_ports">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_irc_use_any_tcp_ports">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_irssi_use_full_network">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_kdumpgui_run_bootloader">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_kerberos_enabled">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ksmtuned_use_cifs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ksmtuned_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_logadm_exec_content">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_logging_syslogd_can_sendmail">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_logging_syslogd_run_nagios_plugins">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_logging_syslogd_use_tty">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_login_console_enabled">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_logrotate_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_logwatch_can_network_connect_mail">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_lsmd_plugin_connect_any">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mailman_use_fusefs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mcelog_client">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mcelog_exec_scripts">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mcelog_foreground">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mcelog_server">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_minidlna_read_generic_user_content">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mmap_low_allowed">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mock_enable_homedirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mount_anyfile">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mozilla_plugin_bind_unreserved_ports">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mozilla_plugin_can_network_connect">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mozilla_plugin_use_bluejeans">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mozilla_plugin_use_gps">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mozilla_plugin_use_spice">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mozilla_read_content">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mpd_enable_homedirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mpd_use_cifs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mpd_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mplayer_execstack">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mysql_connect_any">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_nagios_run_pnp4nagios">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_nagios_run_sudo">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_named_tcp_bind_http_port">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_named_write_master_zones">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_neutron_can_network">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_nfs_export_all_ro">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_nfs_export_all_rw">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_nfsd_anon_write">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_nis_enabled">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_nscd_use_shm">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_openshift_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_openvpn_can_network_connect">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_openvpn_enable_homedirs">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_openvpn_run_unconfined">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_pcp_bind_all_unreserved_ports">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_pcp_read_generic_logs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_piranha_lvs_can_network_connect">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_polipo_connect_all_unreserved">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_polipo_session_bind_all_unreserved_ports">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_polipo_session_users">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_polipo_use_cifs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_polipo_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_polyinstantiation_enabled">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_postfix_local_write_mail_spool">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_postgresql_can_rsync">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_postgresql_selinux_transmit_client_label">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_postgresql_selinux_unconfined_dbadm">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_postgresql_selinux_users_ddl">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_pppd_can_insmod">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_pppd_for_user">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_privoxy_connect_any">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_prosody_bind_http_port">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_puppetagent_manage_all_files">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_puppetmaster_use_db">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_racoon_read_shadow">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_rsync_anon_write">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_rsync_client">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_rsync_export_all_ro">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_rsync_full_access">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_samba_create_home_dirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_samba_domain_controller">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_samba_enable_home_dirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_samba_export_all_ro">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_samba_export_all_rw">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_samba_load_libgfapi">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_samba_portmapper">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_samba_run_unconfined">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_samba_share_fusefs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_samba_share_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sanlock_use_fusefs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sanlock_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sanlock_use_samba">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_saslauthd_read_shadow">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_secadm_exec_content">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_secure_mode">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_secure_mode_insmod">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_secure_mode_policyload">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_direct_dri_enabled">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_execheap">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_execmod">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_execstack">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_mysql_connect_enabled">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_ping">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_postgresql_connect_enabled">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_rw_noexattrfile">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_share_music">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_tcp_server">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_udp_server">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_use_ssh_chroot">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sge_domain_can_network_connect">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sge_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_smartmon_3ware">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_smbd_anon_write">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_spamassassin_can_network">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_spamd_enable_home_dirs">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_squid_connect_any">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_squid_use_tproxy">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ssh_chroot_rw_homedirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ssh_keysign">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ssh_sysadm_login">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_staff_exec_content">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_staff_use_svirt">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_swift_can_network">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sysadm_exec_content">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_telepathy_connect_all_ports">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_telepathy_tcp_connect_generic_network_ports">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_tftp_anon_write">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_tftp_home_dir">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_tmpreaper_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_tmpreaper_use_samba">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_tor_bind_all_unreserved_ports">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_tor_can_network_relay">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_unconfined_chrome_sandbox_transition">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_unconfined_login">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_unconfined_mozilla_plugin_transition">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_unprivuser_use_svirt">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_use_ecryptfs_home_dirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_use_fusefs_home_dirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_use_lpd_server">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_use_nfs_home_dirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_use_samba_home_dirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_user_exec_content">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_varnishd_connect_any">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_read_qemu_ga_data">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_rw_qemu_ga_data">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_all_caps">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_audit">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_mknod">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_netlink">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_sys_admin">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_transition_userdomain">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_comm">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_execmem">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_fusefs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_rawip">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_samba">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_sanlock">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_usb">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_xserver">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_webadm_manage_user_files">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_webadm_read_user_files">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_wine_mmap_zero_ignore">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xdm_bind_vnc_tcp_port">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xdm_exec_bootloader">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xdm_sysadm_login">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xdm_write_home">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xen_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xend_run_blktap">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xend_run_qemu">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xguest_connect_network">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xguest_exec_content">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xguest_mount_media">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xguest_use_bluetooth">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xserver_clients_write_xshm">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xserver_execmem">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xserver_object_manager">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_zabbix_can_network">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_zarafa_setrlimit">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_zebra_write_config">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_zoneminder_anon_write">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_zoneminder_run_sudo">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_loglevel">warn</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_max_keepalive_requests">100</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_web_login_banner_text">^(You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\)\,[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including\,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to\,[\s\n]+penetration[\s\n]+testing\,[\s\n]+COMSEC[\s\n]+monitoring\,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense\,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\)\,[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\)\,[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time\,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using\,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on\,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private\,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring\,[\s\n]+interception\,[\s\n]+and[\s\n]+search\,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.\,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above\,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM\,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications\,[\s\n]+or[\s\n]+work[\s\n]+product\,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys\,[\s\n]+psychotherapists\,[\s\n]+or[\s\n]+clergy\,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.|I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.)$</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_postfix_inet_interfaces">loopback-only</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_postfix_relayhost">smtp.$mydomain</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_postfix_root_mail_alias">system.administrator@mail.mil</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers">0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_time_service_set_maxpoll">10</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_tftpd_secure_directory">/var/lib/tftpboot</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_snmpd_ro_string">changemero</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_snmpd_rw_string">changemerw</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_firewalld_sshd_zone">public</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sshd_approved_ciphers">aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sshd_approved_macs">hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value">300</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sshd_listening_port">22</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value">4</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sshd_required">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sshd_max_sessions">10</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_rekey_limit_size">512M</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_rekey_limit_time">1h</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sshd_disable_compression">no</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sshd_priv_separation">sandbox</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sshd_set_login_grace_time">60</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sshd_set_maxstartups">10:30:100</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sssd_certificate_verification_digest_function">sha1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sssd_memcache_timeout">300</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sssd_ssh_known_hosts_timeout">180</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sssd_ldap_tls_ca_dir">/etc/openldap/cacerts</set-value>
          <rule-result idref="xccdf_org.ssgproject.content_rule_prefer_64bit_os" role="full" time="2022-08-01T16:21:57+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_rpm_verify_hashes" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-rpm_verify_hashes:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_rpm_verify_permissions" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_aide_installed" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_aide_build_database" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_aide_check_audit_tools" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_enable_dracut_fips_module" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_enable_fips_mode" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_system_crypto_policy:var:1" value-id="xccdf_org.ssgproject.content_value_var_system_crypto_policy"/>
              <check-content-ref name="oval:ssg-enable_fips_mode:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_etc_system_fips_exists" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_crypto_fips_enabled" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_configure_bind_crypto_policy" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-configure_bind_crypto_policy:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_configure_crypto_policy" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_system_crypto_policy:var:1" value-id="xccdf_org.ssgproject.content_value_var_system_crypto_policy"/>
              <check-content-ref name="oval:ssg-configure_crypto_policy:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_configure_gnutls_tls_crypto_policy" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-configure_kerberos_crypto_policy:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_configure_libreswan_crypto_policy" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-configure_libreswan_crypto_policy:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-configure_openssl_crypto_policy:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-configure_ssh_crypto_policy:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_harden_ssh_client_crypto_policy" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_openssh_conf_crypto_policy" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_harden_sshd_crypto_policy" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_harden_sshd_macs_openssh_conf_crypto_policy" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_installed_OS_is_FIPS_certified" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_installed_OS_is_vendor_supported" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-installed_OS_is_vendor_supported:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_configure_user_data_backups" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_install_antivirus" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_install_hids" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_MFEhiplsm_installed" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_encrypt_partitions" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_boot" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_home" role="full" time="2022-08-01T16:24:04+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_opt" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_srv" role="full" time="2022-08-01T16:24:04+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_tmp" role="full" time="2022-08-01T16:24:04+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_usr" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_var" role="full" time="2022-08-01T16:24:04+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_var_log" role="full" time="2022-08-01T16:24:04+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_var_log_audit" role="full" time="2022-08-01T16:24:04+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_gdm_removed" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_db_up_to_date" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_db_up_to_date:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_enable_dconf_user_profile" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_restart_shutdown" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_enable_smartcard_auth" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_lock_screen_on_smartcard_removal" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_login_retries" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_login_retries:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_automatic_login" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-gnome_gdm_disable_automatic_login:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_guest_login" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-gnome_gdm_disable_guest_login:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_xdmcp" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount_open" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_autorun" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_thumbnailers" role="full" time="2022-08-01T16:24:04+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_create" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_notification" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_credential_prompt" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_encryption" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_screensaver_idle_activation_enabled:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_locked" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-inactivity_timeout_value:var:1" value-id="xccdf_org.ssgproject.content_value_inactivity_timeout_value"/>
              <check-content-ref name="oval:ssg-dconf_gnome_screensaver_idle_delay:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_screensaver_lock_delay:var:1" value-id="xccdf_org.ssgproject.content_value_var_screensaver_lock_delay"/>
              <check-content-ref name="oval:ssg-dconf_gnome_screensaver_lock_delay:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_screensaver_lock_enabled:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_locked" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_screensaver_mode_blank:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_info" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_screensaver_user_info:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_locks" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_screensaver_user_locks:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_session_idle_user_locks" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_session_idle_user_locks:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_ctrlaltdel_reboot" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_geolocation" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_power_settings" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_admin" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_sudo_installed" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sudo_add_noexec" role="full" time="2022-08-01T16:24:04+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sudo_add_requiretty" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sudo_add_use_pty" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sudo_custom_logfile" role="full" time="2022-08-01T16:24:04+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sudo_remove_no_authenticate" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sudo_require_authentication" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sudo_vdsm_nopasswd" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sudoers_default_includedir" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sudoers_explicit_command_args" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sudoers_no_command_negation" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sudoers_no_root_target" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sudoers_validate_passwd" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_binutils_installed" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_cryptsetup-luks_installed" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_gnutls-utils_installed" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_libcap-ng-utils_installed" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_nss-tools_installed" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_openscap-scanner_installed" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_rear_installed" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_rng-tools_installed" role="full" time="2022-08-01T16:24:04+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_scap-security-guide_installed" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_tar_installed" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_vim_installed" role="full" time="2022-08-01T16:24:04+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_abrt-addon-ccpp_removed" role="full" time="2022-08-01T16:24:04+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_abrt-addon-kerneloops_removed" role="full" time="2022-08-01T16:24:04+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_abrt-cli_removed" role="full" time="2022-08-01T16:24:04+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_abrt-plugin-logger_removed" role="full" time="2022-08-01T16:24:04+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_abrt-plugin-rhtsupport_removed" role="full" time="2022-08-01T16:24:04+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_abrt-plugin-sosreport_removed" role="full" time="2022-08-01T16:24:04+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_geolite2-city_removed" role="full" time="2022-08-01T16:24:04+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_geolite2-country_removed" role="full" time="2022-08-01T16:24:04+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_gssproxy_removed" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_iprutils_removed" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_krb5-workstation_removed" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_libreport-plugin-logger_removed" role="full" time="2022-08-01T16:24:04+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_libreport-plugin-rhtsupport_removed" role="full" time="2022-08-01T16:24:04+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_python3-abrt-addon_removed" role="full" time="2022-08-01T16:24:04+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_tuned_removed" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-package_dnf-automatic_installed:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_clean_components_post_updating" role="full" time="2022-08-01T16:24:04+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dnf-automatic_apply_updates" role="full" time="2022-08-01T16:24:04+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dnf-automatic_apply_updates:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dnf-automatic_security_updates_only" role="full" time="2022-08-01T16:24:04+01:00" severity="low" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dnf-automatic_security_updates_only:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_ensure_fedora_gpgkey_installed" role="full" time="2022-08-01T16:24:05+01:00" severity="high" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-ensure_fedora_gpgkey_installed:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" role="full" time="2022-08-01T16:24:05+01:00" severity="high" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-ensure_gpgcheck_globally_activated:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_local_packages" role="full" time="2022-08-01T16:24:05+01:00" severity="high" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-ensure_gpgcheck_local_packages:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled" role="full" time="2022-08-01T16:24:05+01:00" severity="high" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-ensure_gpgcheck_never_disabled:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_repo_metadata" role="full" time="2022-08-01T16:24:05+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_security_patches_up_to_date" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_timer_dnf-automatic_enabled" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-timer_dnf-automatic_enabled:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_banner_etc_issue" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-login_banner_text:var:1" value-id="xccdf_org.ssgproject.content_value_login_banner_text"/>
              <check-content-ref name="oval:ssg-banner_etc_issue:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_banner_etc_motd" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_motd" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_etc_issue" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_etc_motd" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_issue" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_motd" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-dconf_gnome_banner_enabled:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-login_banner_text:var:1" value-id="xccdf_org.ssgproject.content_value_login_banner_text"/>
              <check-content-ref name="oval:ssg-dconf_gnome_login_banner_text:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_disallow_bypass_password_sudo" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_display_login_attempts" role="full" time="2022-08-01T16:24:05+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_enable_pam_namespace" role="full" time="2022-08-01T16:24:05+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny"/>
              <check-content-ref name="oval:ssg-accounts_passwords_pam_faillock_deny:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-accounts_passwords_pam_faillock_deny_root:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval"/>
              <check-content-ref name="oval:ssg-accounts_passwords_pam_faillock_interval:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time"/>
              <check-content-ref name="oval:ssg-accounts_passwords_pam_faillock_unlock_time:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_password_pam_dcredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_dcredit"/>
              <check-content-ref name="oval:ssg-accounts_password_pam_dcredit:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_dictcheck" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_difok" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_enforce_local" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_enforce_root" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_password_pam_lcredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_lcredit"/>
              <check-content-ref name="oval:ssg-accounts_password_pam_lcredit:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_maxclassrepeat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_maxrepeat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_minclass" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_password_pam_minlen:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_minlen"/>
              <check-content-ref name="oval:ssg-accounts_password_pam_minlen:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_ocredit" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_password_pam_ocredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_ocredit"/>
              <check-content-ref name="oval:ssg-accounts_password_pam_ocredit:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_password_auth" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_retry" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_password_pam_retry:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_retry"/>
              <check-content-ref name="oval:ssg-accounts_password_pam_retry:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_password_pam_ucredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_ucredit"/>
              <check-content-ref name="oval:ssg-accounts_password_pam_ucredit:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_libuserconf" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_debug-shell_disabled" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-service_debug-shell_disabled:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot" role="full" time="2022-08-01T16:24:05+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_disable_interactive_boot" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-grub2_disable_interactive_boot:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_require_emergency_target_auth" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_require_singleuser_auth" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-require_singleuser_auth:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_screen_installed" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-package_screen_installed:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_tmux_installed" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_configure_bashrc_exec_tmux" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_configure_tmux_lock_after_time" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_configure_tmux_lock_command" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_no_tmux_in_shells" role="full" time="2022-08-01T16:24:05+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_opensc_installed" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_install_smartcard_packages" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_pcscd_enabled" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_configure_opensc_card_drivers" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_configure_opensc_nss_db" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_force_opensc_card_drivers" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_smartcard_auth" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_account_unique_id" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_authorized_local_users" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_group_unique_id" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_group_unique_name" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_account_emergency_expire_date" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_account_temp_expire_date" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_account_unique_name" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_account_use_centralized_automated_auth" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_password_minlen_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs"/>
              <check-content-ref name="oval:ssg-accounts_password_minlen_login_defs:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed_sha512" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_gid_passwd_group_same" role="full" time="2022-08-01T16:24:05+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_no_empty_passwords" role="full" time="2022-08-01T16:24:05+01:00" severity="high" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-no_empty_passwords:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_no_empty_passwords_etc_shadow" role="full" time="2022-08-01T16:24:05+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_no_legacy_plus_entries_etc_group" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_no_legacy_plus_entries_etc_passwd" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_no_legacy_plus_entries_etc_shadow" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_no_netrc_files" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero" role="full" time="2022-08-01T16:24:05+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_root_gid_zero" role="full" time="2022-08-01T16:24:05+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_no_direct_root_logins" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_no_password_auth_for_systemaccounts" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_no_root_webbrowsing" role="full" time="2022-08-01T16:24:05+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_restrict_serial_port_logins" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_root_path_default" role="full" time="2022-08-01T16:24:05+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_securetty_root_login_console_only" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_use_pam_wheel_for_su" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_have_homedir_login_defs" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_logon_fail_delay" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_max_concurrent_login_sessions" role="full" time="2022-08-01T16:24:05+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_polyinstantiated_tmp" role="full" time="2022-08-01T16:24:05+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_polyinstantiated_var_tmp" role="full" time="2022-08-01T16:24:05+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_tmout" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_tmout:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_tmout"/>
              <check-content-ref name="oval:ssg-accounts_tmout:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_home_dirs" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_root_path_dirs_no_write" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_root_path_no_dot" role="full" time="2022-08-01T16:24:05+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_login_defs" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_audispd-plugins_installed" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_audit-audispd-plugins_installed" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_audit_installed" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_auditd_enabled" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_audit_argument" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-grub2_audit_argument:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_audit_backlog_limit_argument" role="full" time="2022-08-01T16:24:05+01:00" severity="low" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-grub2_audit_backlog_limit_argument:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_etc_group_open:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_etc_group_open_by_handle_at:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_etc_group_openat:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_etc_gshadow_open:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open_by_handle_at" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_etc_gshadow_open_by_handle_at:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_openat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_etc_gshadow_openat:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_etc_passwd_open:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open_by_handle_at" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_etc_passwd_open_by_handle_at:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_openat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_etc_passwd_openat:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_etc_shadow_open:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open_by_handle_at" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_etc_shadow_open_by_handle_at:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_openat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_etc_shadow_openat:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_immutable" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_immutable:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_mac_modification:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_media_export" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_session_events" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_session_events:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_sysadmin_actions" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_sysadmin_actions:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_usergroup_modification_group:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_usergroup_modification_gshadow:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_usergroup_modification_opasswd:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_usergroup_modification_passwd:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_usergroup_modification_shadow:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_directory_access_var_log_audit" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-directory_access_var_log_audit:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_directory_permissions_var_log_audit" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupownership_audit_configuration" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_ownership_audit_configuration" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_var_log_audit" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_chmod:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_chown:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_fchmod:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_fchmodat:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_fchown:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_fchownat:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_fremovexattr:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_fsetxattr:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_lchown:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_lremovexattr:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_lsetxattr:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_removexattr:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_dac_modification_setxattr:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_umount" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_umount2" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_chcon" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_execution_chcon:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_restorecon" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_execution_restorecon:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_semanage" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_execution_semanage:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_setsebool" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_execution_setsebool:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_seunshare" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_execution_seunshare:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_file_deletion_events_rename:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_renameat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_file_deletion_events_renameat:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rmdir" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_file_deletion_events_rmdir:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlink" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_file_deletion_events_unlink:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlinkat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_file_deletion_events_unlinkat:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_chmod" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_chown" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_creat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_fchmod" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_fchmodat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_fchown" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_fchownat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_fremovexattr" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_fsetxattr" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_ftruncate" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_lchown" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_lremovexattr" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_lsetxattr" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_open" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_open_by_handle_at" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_open_by_handle_at_o_creat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_open_o_creat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_open_o_trunc_write" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_openat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_openat_o_creat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_openat_o_trunc_write" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_removexattr" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_rename" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_renameat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_setxattr" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_truncate" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_unlink" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_successful_file_modification_unlinkat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_chmod" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_chmod:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_chown" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_chown:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_creat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_creat:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchmod" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_fchmod:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchmodat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_fchmodat:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchown" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_fchown:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchownat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_fchownat:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fremovexattr" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_fremovexattr:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fsetxattr" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_fsetxattr:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_ftruncate" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_ftruncate:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_lchown" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_lchown:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_lremovexattr" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_lremovexattr:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_lsetxattr" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_lsetxattr:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_o_creat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open_o_creat:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_o_trunc_write" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_rule_order" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open_rule_order:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_openat:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat_o_creat" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat_o_trunc_write" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat_rule_order" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_openat_rule_order:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_removexattr" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_removexattr:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_rename" role="full" time="2022-08-01T16:24:05+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_rename:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_renameat" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_renameat:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_setxattr" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_setxattr:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_truncate" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_truncate:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_unlink" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_unlink:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_unlinkat" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_unlinkat:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_kernel_module_loading_delete:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_finit" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_kernel_module_loading_init:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_faillock" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_login_events_faillock:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_lastlog" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_login_events_lastlog:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_tallylog" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_login_events_tallylog:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_at" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_at:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chage" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_chage:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chsh" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_chsh:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_crontab" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_crontab:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_gpasswd" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_gpasswd:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_mount" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_mount:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgidmap" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_newgidmap:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgrp" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_newgrp:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newuidmap" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_newuidmap:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_passwd" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_passwd:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_pt_chown" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_pt_chown:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_ssh_keysign" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_ssh_keysign:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_su" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_su:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudo" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_sudo:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudoedit" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_sudoedit:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_umount" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_umount:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_chkpwd" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_unix_chkpwd:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_userhelper" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_userhelper:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_usernetctl" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-audit_rules_privileged_commands_usernetctl:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_time_settimeofday" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_time_stime" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_time_watch_localtime" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_audispd_configure_remote_server" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_audispd_remote_server:var:1" value-id="xccdf_org.ssgproject.content_value_var_audispd_remote_server"/>
              <check-content-ref name="oval:ssg-auditd_audispd_configure_remote_server:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_audispd_encrypt_sent_records" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-auditd_audispd_encrypt_sent_records:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_audispd_syslog_plugin_activated" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-auditd_audispd_syslog_plugin_activated:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_disk_error_action" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_disk_full_action" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_flush" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_num_logs" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_percentage" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_freq" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-auditd_freq:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_local_events" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-auditd_local_events:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_log_format" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-auditd_log_format:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_name_format" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-auditd_name_format:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_overflow_action" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_write_logs" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-auditd_write_logs:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_enable_iommu_force" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_l1tf_argument" role="full" time="2022-08-01T16:24:06+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_mce_argument" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_mds_argument" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_nosmap_argument_absent" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_nosmep_argument_absent" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_pti_argument" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-grub2_pti_argument:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_rng_core_default_quality_argument" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_slab_nomerge_argument" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_spec_store_bypass_disable_argument" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_spectre_v2_argument" role="full" time="2022-08-01T16:24:06+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-grub2_vsyscall_argument:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_admin_username" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_password" role="full" time="2022-08-01T16:24:06+01:00" severity="high" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-grub2_password:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_efi_grub2_cfg" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_efi_grub2_cfg" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_efi_grub2_cfg" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_uefi_admin_username" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_uefi_password" role="full" time="2022-08-01T16:24:06+01:00" severity="high" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_disable_entropy_contribution_for_solid_state_drives" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_acpi_custom_method" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_arm64_sw_ttbr0_pan" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_binfmt_misc" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_bug" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_bug_on_data_corruption" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_compat_brk" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_compat_vdso" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_debug_credentials" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_debug_fs" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_debug_list" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_debug_notifiers" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_debug_sg" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_debug_wx" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_default_mmap_min_addr" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_devkmem" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_fortify_source" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_hardened_usercopy" role="full" time="2022-08-01T16:24:06+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_hardened_usercopy_fallback" role="full" time="2022-08-01T16:24:06+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_hibernation" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_ia32_emulation" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_ipv6" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_kexec" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_legacy_ptys" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_legacy_vsyscall_emulate" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_legacy_vsyscall_none" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_legacy_vsyscall_xonly" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_modify_ldt_syscall" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_module_sig" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_module_sig_all" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_module_sig_force" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_module_sig_hash" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_module_sig_key" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_module_sig_sha512" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_page_poisoning" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_page_poisoning_no_sanity" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_page_poisoning_zero" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_page_table_isolation" role="full" time="2022-08-01T16:24:06+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_panic_on_oops" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_panic_timeout" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_proc_kcore" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_randomize_base" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_randomize_memory" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_refcount_full" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_retpoline" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_sched_stack_end_check" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_seccomp" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_seccomp_filter" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_security" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_security_dmesg_restrict" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_security_writable_hooks" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_security_yama" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_slab_freelist_hardened" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_slab_freelist_random" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_slab_merge_default" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_slub_debug" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_stackprotector" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_stackprotector_strong" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_strict_kernel_rwx" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_strict_module_rwx" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_syn_cookies" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_unmap_kernel_at_el0" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_vmap_stack" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_x86_vsyscall_emulation" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_gcc_plugin_latent_entropy" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_gcc_plugin_randstruct" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_gcc_plugin_stackleak" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_gcc_plugin_structleak" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_config_gcc_plugin_structleak_byref_all" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_rsyslog_installed" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_rsyslog_enabled" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_disable_logwatch_for_logserver" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_logwatch_configured_hostlimit" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_logwatch_configured_splithosts" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_cron_logging" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-rsyslog_cron_logging:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdriverauthmode" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdrivermode" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_defaultnetstreamdriver" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_files_ownership" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_files_permissions" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_access_monitoring" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_ensure_logrotate_activated" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_syslogng_installed" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_syslogng_enabled" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_accept_remote_messages_tcp" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_accept_remote_messages_udp" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_nolisten" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-rsyslog_remote_loghost:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_tls" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_tls_cacert" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_network_disable_zeroconf" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_network_nmcli_permissions" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_network_sniffer_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_firewalld_enabled" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-service_firewalld_enabled:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_set_firewalld_default_zone" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-set_firewalld_default_zone:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_libreswan_installed" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_libreswan_approved_tunnels" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_iptables_installed" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_ip6tables_enabled" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_iptables_enabled" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_set_ip6tables_default_rule" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_set_iptables_default_rule" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_set_iptables_default_rule_forward" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_ipv6_disable_argument" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_ipv6_option_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_network_ipv6_disable_interfaces" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_network_ipv6_disable_rpc" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_disable_ipv6" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_disable_ipv6" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_network_ipv6_default_gateway" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_network_ipv6_privacy_extensions" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_network_ipv6_static_address" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra_defrtr" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra_pinfo" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_autoconf" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_max_addresses" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_router_solicitations" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra_defrtr" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra_pinfo" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_autoconf" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_max_addresses" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_router_solicitations" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_local" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_arp_filter" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_arp_ignore" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_drop_gratuitous_arp" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_route_localnet" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_shared_media" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_shared_media" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_local_port_range" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_forward" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_atm_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-kernel_module_atm_disabled:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_can_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-kernel_module_can_disabled:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_dccp_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_firewire-core_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-kernel_module_firewire-core_disabled:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_rds_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_tipc_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-kernel_module_tipc_disabled:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_bluetooth_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_bluetooth_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_cfg80211_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_iwlmvm_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_iwlwifi_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_mac80211_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_wireless_disable_in_bios" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_wireless_disable_interfaces" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_root_owned" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_system_owned" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_system_owned_group" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_audit_auditd" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_audit_rulesd" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_systemmap" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_sgid" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_suid" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_world_writable" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_ungroupowned" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_no_files_unowned_by_user" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_fifos" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_hardlinks" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_regular" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_symlinks" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_group" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_gshadow" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_passwd" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_shadow" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_group" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_group" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_gshadow" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_passwd" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_shadow" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_etc_group" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_etc_gshadow" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_etc_passwd" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_etc_shadow" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_group" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_gshadow" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_passwd" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_shadow" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_group" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_gshadow" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_var_log" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_var_log_messages" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_var_log_syslog" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_var_log" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_var_log_messages" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_var_log_syslog" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_var_log" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_var_log_messages" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_var_log_syslog" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dir_group_ownership_library_dirs" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dir_ownership_binary_dirs" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dir_ownership_library_dirs" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dir_permissions_binary_dirs" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dir_permissions_library_dirs" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupownership_system_commands_dirs" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_ownership_binary_dirs" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_ownership_library_dirs" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_binary_dirs" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_library_dirs" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_root_permissions_syslibrary_files" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_autofs_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_bios_assign_password" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_bios_disable_usb_boot" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_nousb_argument" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_freevxfs_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_hfs_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_hfsplus_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_jffs2_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_squashfs_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_udf_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_vfat_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_boot_noauto" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_boot_nodev" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_boot_noexec" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_boot_nosuid" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-mount_option_dev_shm_nodev:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-mount_option_dev_shm_noexec:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-mount_option_dev_shm_nosuid:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_home_noexec" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_nodev_removable_partitions" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_noexec_removable_partitions" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_nosuid_removable_partitions" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_opt_nosuid" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_proc_hidepid" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_srv_nosuid" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_nodev" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_noexec" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_nosuid" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_bind" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_core_pattern" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_kernel_core_pattern:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_dmesg_restrict" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_kernel_dmesg_restrict:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_kexec_load_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_kernel_kexec_load_disabled:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_modules_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_panic_on_oops" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_cpu_time_max_percent" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_event_max_sample_rate" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_event_paranoid" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_kernel_perf_event_paranoid:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_pid_max" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_sysrq" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_unprivileged_bpf_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_kernel_unprivileged_bpf_disabled:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_kernel_yama_ptrace_scope:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_core_bpf_jit_harden" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_net_core_bpf_jit_harden:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_user_max_user_namespaces" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_user_max_user_namespaces:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_vm_mmap_min_addr" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_systemd-coredump_disabled" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-service_systemd-coredump_disabled:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_coredump_disable_backtraces" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-coredump_disable_backtraces:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_coredump_disable_storage" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-coredump_disable_storage:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_disable_users_coredumps" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_fs_suid_dumpable" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_umask_for_daemons" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_exec_shield" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_kptr_restrict" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_kernel_kptr_restrict_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_kernel_kptr_restrict_value"/>
              <check-content-ref name="oval:ssg-sysctl_kernel_kptr_restrict:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_bios_enable_execution_restrictions" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_install_PAE_kernel_on_x86-32" role="full" time="2022-08-01T16:24:06+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_page_poison_argument" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-grub2_page_poison_argument:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_slub_debug_argument" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_slub_debug_options:var:1" value-id="xccdf_org.ssgproject.content_value_var_slub_debug_options"/>
              <check-content-ref name="oval:ssg-grub2_slub_debug_argument:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_libselinux_installed" role="full" time="2022-08-01T16:24:06+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_policycoreutils_installed" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_mcstrans_removed" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_setroubleshoot-plugins_removed" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_setroubleshoot-server_removed" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_setroubleshoot_removed" role="full" time="2022-08-01T16:24:06+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_coreos_enable_selinux_kernel_argument" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_enable_selinux" role="full" time="2022-08-01T16:24:06+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_selinux_all_devicefiles_labeled" role="full" time="2022-08-01T16:24:07+01:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-selinux_all_devicefiles_labeled:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_selinux_confinement_of_daemons" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-selinux_confinement_of_daemons:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_selinux_policytype" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_selinux_policy_name:var:1" value-id="xccdf_org.ssgproject.content_value_var_selinux_policy_name"/>
              <check-content-ref name="oval:ssg-selinux_policytype:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_selinux_state" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_selinux_state:var:1" value-id="xccdf_org.ssgproject.content_value_var_selinux_state"/>
              <check-content-ref name="oval:ssg-selinux_state:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_avahi_disable_publishing" role="full" time="2022-08-01T16:24:08+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_abrt_removed" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-package_abrt_removed:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_cron_installed" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_cron_enabled" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_crond_enabled" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_atd_disabled" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_disable_anacron" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_at_deny_not_exist" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_cron_deny_not_exist" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed" role="full" time="2022-08-01T16:24:08+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_nis_removed" role="full" time="2022-08-01T16:24:08+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_ntpdate_removed" role="full" time="2022-08-01T16:24:08+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_telnetd-ssl_removed" role="full" time="2022-08-01T16:24:08+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_telnetd_removed" role="full" time="2022-08-01T16:24:08+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dhcp_client_restrict_options" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dhcp_server_minimize_served_info" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_bind_removed" role="full" time="2022-08-01T16:24:08+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_fapolicyd_installed" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-package_fapolicyd_installed:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_vsftpd_removed" role="full" time="2022-08-01T16:24:08+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_ftp_configure_firewall" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_ftp_disable_uploads" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_ftp_home_partition" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_ftp_log_transactions" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_ftp_present_banner" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_ftp_limit_users" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_ftp_restrict_to_anon" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_vsftpd_installed" role="full" time="2022-08-01T16:24:08+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_kerberos_disable_no_keytab" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_openldap-clients_removed" role="full" time="2022-08-01T16:24:08+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_sendmail_removed" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-package_sendmail_removed:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_postfix_client_configure_mail_alias" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_postfix_client_configure_relayhost" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_nfs-utils_removed" role="full" time="2022-08-01T16:24:08+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_netfs_disabled" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_nfslock_disabled" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_rpcgssd_disabled" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_rpcidmapd_disabled" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_nfs_fixed_lockd_tcp_port" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_nfs_fixed_lockd_udp_port" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_nfs_fixed_mountd_port" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_nfs_fixed_statd_port" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_nfs_disabled" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_rpcsvcgssd_disabled" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_nfs_no_anonymous" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_no_all_squash_exports" role="full" time="2022-08-01T16:24:08+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_no_insecure_locks_exports" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_restrict_nfs_clients_to_privileged_ports" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_use_root_squashing_all_exports" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_chrony_installed" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_ntp_installed" role="full" time="2022-08-01T16:24:08+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_chronyd_enabled" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_chronyd_or_ntpd_enabled" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_ntp_enabled" role="full" time="2022-08-01T16:24:08+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_ntpd_enabled" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_chronyd_client_only" role="full" time="2022-08-01T16:24:08+01:00" severity="low" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-chronyd_client_only:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network" role="full" time="2022-08-01T16:24:08+01:00" severity="low" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-chronyd_no_chronyc_network:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_set_maxpoll" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_multiple_servers" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_remote_server" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_chronyd_run_as_chrony_user" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_chronyd_server_directive" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_chronyd_specify_remote_server" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_ntpd_configure_restrictions" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_ntpd_run_as_ntp_user" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_ntpd_specify_multiple_servers" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_ntpd_specify_remote_server" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_rsyncd_disabled" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_no_rsh_trust_files" role="full" time="2022-08-01T16:24:08+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_rngd_enabled" role="full" time="2022-08-01T16:24:08+01:00" severity="low" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-service_rngd_enabled:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_net-snmp_removed" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_snmpd_no_rwusers" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_snmpd_not_default_password" role="full" time="2022-08-01T16:24:08+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_snmpd_use_newer_protocol" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_openssh-server_installed" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_openssh-server_removed" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_sshd_disabled" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_iptables_sshd_disabled" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive_0" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_disable_host_auth" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
              <check-content-ref name="oval:ssg-disable_host_auth:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_allow_only_protocol2" role="full" time="2022-08-01T16:24:08+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_compression" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" role="full" time="2022-08-01T16:24:08+01:00" severity="high" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
              <check-content-ref name="oval:ssg-sshd_disable_empty_passwords:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_gssapi_auth" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
              <check-content-ref name="oval:ssg-sshd_disable_gssapi_auth:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_kerb_auth" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
              <check-content-ref name="oval:ssg-sshd_disable_kerb_auth:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_pubkey_auth" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_rhosts" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_rhosts_rsa" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
              <check-content-ref name="oval:ssg-sshd_disable_root_login:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_root_password_login" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_tcp_forwarding" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_user_known_hosts" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_x11_forwarding" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_do_not_permit_user_env" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_enable_gssapi_auth" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_enable_pam" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_enable_pubkey_auth" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_enable_strictmodes" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
              <check-content-ref name="oval:ssg-sshd_enable_warning_banner:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner_net" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_enable_x11_forwarding" role="full" time="2022-08-01T16:24:08+01:00" severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_limit_user_access" role="full" time="2022-08-01T16:24:08+01:00" severity="unknown" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_print_last_log" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_rekey_limit" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_rekey_limit_time:var:1" value-id="xccdf_org.ssgproject.content_value_var_rekey_limit_time"/>
              <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
              <check-export export-name="oval:ssg-var_rekey_limit_size:var:1" value-id="xccdf_org.ssgproject.content_value_var_rekey_limit_size"/>
              <check-content-ref name="oval:ssg-sshd_rekey_limit:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_login_grace_time" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_loglevel_info" role="full" time="2022-08-01T16:24:08+01:00" severity="low" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_loglevel_verbose" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_max_auth_tries" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_max_sessions" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_maxstartups" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_use_directory_configuration" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_use_priv_separation" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_x11_use_localhost" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_sssd-ipa_installed" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sssd_certificate_verification" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sssd_enable_certmap" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sssd_enable_smartcards" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sssd_memcache_timeout" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sssd_offline_cred_expiration" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sssd_run_as_sssd_user" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sssd_run_as_sssd_user:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sssd_ssh_known_hosts_timeout" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_usbguard_installed" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_usbguard_enabled" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_configure_usbguard_auditbackend" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_usbguard_allow_hid" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_usbguard_allow_hid_and_hub" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_usbguard_allow_hub" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_xorg-x11-server-common_removed" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_xwindows_runlevel_target" role="full" time="2022-08-01T16:24:08+01:00" severity="medium" weight="1.000000">
            <result>notselected</result>
          </rule-result>
          <score system="urn:xccdf:scoring:default" maximum="100.000000">19.365080</score>
        </TestResult>
      </arf:content>
    </arf:report>
    <arf:report id="oval0">
      <arf:content>
        <oval_results xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns="http://oval.mitre.org/XMLSchema/oval-results-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-results-5 oval-results-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
          <generator>
            <oval:product_name>cpe:/a:open-scap:oscap</oval:product_name>
            <oval:product_version>1.3.6</oval:product_version>
            <oval:schema_version>5.11</oval:schema_version>
            <oval:timestamp>2022-08-01T16:21:57</oval:timestamp>
          </generator>
          <directives>
            <definition_true reported="true" content="full"/>
            <definition_false reported="true" content="full"/>
            <definition_unknown reported="true" content="full"/>
            <definition_error reported="true" content="full"/>
            <definition_not_evaluated reported="true" content="full"/>
            <definition_not_applicable reported="true" content="full"/>
          </directives>
          <oval_definitions xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:win-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" xmlns:mac-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#windows windows-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#macos macos-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
            <generator>
              <oval:product_name>combine_ovals.py from SCAP Security Guide</oval:product_name>
              <oval:product_version>ssg: [0, 1, 62], python: 3.11.0b4</oval:product_version>
              <oval:schema_version>5.11</oval:schema_version>
              <oval:timestamp>2022-07-23T00:00:00</oval:timestamp>
            </generator>
            <definitions>
              <definition id="oval:ssg-xwindows_runlevel_target:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable X Windows Startup By Setting Default Target</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="xwindows_runlevel_target"/>
                  <description>Ensure that the default runlevel target is set to multi-user.target.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_disable_xwindows_runlevel_target:tst:1" comment="default.target systemd softlink exists"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-wireless_disable_interfaces:def:1" version="1" class="compliance">
                <metadata>
                  <title>Deactivate Wireless Network Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="wireless_disable_interfaces"/>
                  <description>All wireless interfaces should be disabled.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_wireless_disable_interfaces:tst:1" negate="true" comment="check if wifi interfaces are disabled"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-var_umask_for_daemons_as_number:def:1" version="1" class="compliance">
                <metadata>
                  <title>Value of 'var_umask_for_daemons' variable represented as octal number</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="var_umask_for_daemons_as_number"/>
                  <description>Value of 'var_umask_for_daemons' variable represented as octal number</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_existence_of_var_umask_for_daemons_as_number_variable:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1" version="1" class="compliance">
                <metadata>
                  <title>Value of 'var_removable_partition' variable is set to '/dev/cdrom'</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="var_removable_partition_is_cd_dvd_drive"/>
                  <description>Verify if value of 'var_removable_partition' variable is set
      to '/dev/cdrom'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_var_removable_partition_is_cd_dvd_drive:tst:1" comment="Check if removable partition value represents CD/DVD drive"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-var_accounts_user_umask_as_number:def:1" version="1" class="compliance">
                <metadata>
                  <title>Value of 'var_accounts_user_umask' variable represented as octal number</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="var_accounts_user_umask_as_number"/>
                  <description>Value of 'var_accounts_user_umask' variable represented as octal number</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-use_pam_wheel_for_su:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enforce usage of pam_wheel for su authentication</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="use_pam_wheel_for_su"/>
                  <description>Only members of the wheel group should be able to authenticate through the su command.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_use_pam_wheel_for_su:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-usbguard_rules_not_empty_not_missing:def:1" version="1" class="compliance">
                <metadata>
                  <title>Check that file storing USBGuard rules exists and is not empty</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="usbguard_rules_not_empty_not_missing"/>
                  <description>Check that file storing USBGuard rules at /etc/usbguard/rules.conf exists and is not empty</description>
                </metadata>
                <criteria comment="Check that file storing USBGuard rules exists and is not empty">
                  <criterion test_ref="oval:ssg-test_usbguard_rules_nonempty:tst:1" comment="Check that the usbguard rules in either /etc/usbguard/rules.conf or /etc/usbguard/rules.d/ contain at least one non white space character."/>
                </criteria>
              </definition>
              <definition id="oval:ssg-usbguard_allow_hub:def:1" version="1" class="compliance">
                <metadata>
                  <title>Authorize USB hubs in USBGuard daemon</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="usbguard_allow_hub"/>
                  <description>Check that /etc/usbguard/rules.conf contains at least one non whitespace character and exists.</description>
                </metadata>
                <criteria comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character.">
                  <extend_definition definition_ref="oval:ssg-usbguard_rules_not_empty_not_missing:def:1" comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character."/>
                </criteria>
              </definition>
              <definition id="oval:ssg-usbguard_allow_hid_and_hub:def:1" version="1" class="compliance">
                <metadata>
                  <title>Authorize Human Interface Devices and USB hubs in USBGuard daemon</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="usbguard_allow_hid_and_hub"/>
                  <description>Check that /etc/usbguard/rules.conf contains at least one non whitespace character and exists.</description>
                </metadata>
                <criteria comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character.">
                  <extend_definition definition_ref="oval:ssg-usbguard_rules_not_empty_not_missing:def:1" comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character."/>
                </criteria>
              </definition>
              <definition id="oval:ssg-usbguard_allow_hid:def:1" version="1" class="compliance">
                <metadata>
                  <title>Authorize Human Interface Devices in USBGuard daemon</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="usbguard_allow_hid"/>
                  <description>Check that /etc/usbguard/rules.conf exists and that it contains at least one non white space character.</description>
                </metadata>
                <criteria comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character.">
                  <extend_definition definition_ref="oval:ssg-usbguard_rules_not_empty_not_missing:def:1" comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character."/>
                </criteria>
              </definition>
              <definition id="oval:ssg-umask_for_daemons:def:1" version="2" class="compliance">
                <metadata>
                  <title>Set Daemon Umask</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="umask_for_daemons"/>
                  <description>The daemon umask should be set as appropriate</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-var_umask_for_daemons_as_number:def:1" comment="Get value of var_accounts_user_umask variable as octal number"/>
                  <criterion test_ref="oval:ssg-tst_umask_for_daemons:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-timer_dnf-automatic_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable dnf-automatic Timer</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="timer_dnf-automatic_enabled"/>
                  <description>The dnf-automatic timer should be enabled if possible.</description>
                </metadata>
                <criteria comment="package dnf-automatic installed and timer dnf-automatic is configured to start">
                  <extend_definition definition_ref="oval:ssg-package_dnf-automatic_installed:def:1" comment="dnf-automatic installed"/>
                  <criteria comment="timer dnf-automatic is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_timer_running_dnf-automatic:tst:1" comment="dnf-automatic is running"/>
                    <criterion test_ref="oval:ssg-test_multi_user_wants_dnf-automatic:tst:1" comment="multi-user.target wants dnf-automatic"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-system_info_architecture_x86_64:def:1" version="1" class="compliance">
                <metadata>
                  <title>Test for x86_64 Architecture</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="system_info_architecture_x86_64"/>
                  <description>Generic test for x86_64 architecture to be used by other tests</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_system_info_architecture_x86_64:tst:1" comment="Generic test for x86_64 architecture"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-system_info_architecture_x86:def:1" version="1" class="compliance">
                <metadata>
                  <title>Test for x86 Architecture</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="system_info_architecture_x86"/>
                  <description>Generic test for x86 architecture to be used by other tests</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_system_info_architecture_x86:tst:1" comment="Generic test for x86 architecture"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-system_info_architecture_s390_64:def:1" version="1" class="compliance">
                <metadata>
                  <title>Test for s390_64 Architecture</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="system_info_architecture_s390_64"/>
                  <description>Generic test for s390_64 architecture to be used by other tests</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_system_info_architecture_s390_64:tst:1" comment="Generic test for s390_64 architecture"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-system_info_architecture_ppc_64:def:1" version="1" class="compliance">
                <metadata>
                  <title>Test for PPC and PPCLE Architecture</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="system_info_architecture_ppc_64"/>
                  <description>Generic test for PPC PPC64LE architecture to be used by other tests</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_system_info_architecture_ppc_64:tst:1" comment="Generic test for ppc64 architecture"/>
                  <criterion test_ref="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" comment="Generic test for ppcle64 architecture"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-system_info_architecture_aarch_64:def:1" version="1" class="compliance">
                <metadata>
                  <title>Test for aarch_64 Architecture</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="system_info_architecture_aarch_64"/>
                  <description>Generic test for aarch_64 architecture to be used by other tests</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_system_info_architecture_aarch_64:tst:1" comment="Generic test for aarch_64 architecture"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-system_info_architecture_64bit:def:1" version="1" class="compliance">
                <metadata>
                  <title>Test for 64-bit Architecture</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="system_info_architecture_64bit"/>
                  <description>Generic test for 64-bit architectures to be used by other tests</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-system_info_architecture_x86_64:def:1" comment="Generic test for x86_64 architecture"/>
                  <extend_definition definition_ref="oval:ssg-system_info_architecture_ppc_64:def:1" comment="Generic test for ppc64 architecture"/>
                  <extend_definition definition_ref="oval:ssg-system_info_architecture_aarch_64:def:1" comment="Generic test for aarch64 architecture"/>
                  <extend_definition definition_ref="oval:ssg-system_info_architecture_s390_64:def:1" comment="Generic test for s390x architecture"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-system_boot_mode_is_uefi:def:1" version="1" class="inventory">
                <metadata>
                  <title>UEFI system boot mode check</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:uefi"/>
                  <reference source="ssg" ref_id="system_boot_mode_is_uefi"/>
                  <description>Check if system boot mode is UEFI.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_efi_dir_existence:tst:1" comment="check if /sys/firmware/efi folder exists"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-system_boot_mode_is_non_uefi:def:1" version="1" class="inventory">
                <metadata>
                  <title>Non-UEFI system boot mode check</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:non-uefi"/>
                  <reference source="ssg" ref_id="system_boot_mode_is_non_uefi"/>
                  <description>Check if System boot mode is non-UEFI.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-system_boot_mode_is_uefi:def:1" negate="true" comment="Pass if System boot mode is non-UEFI"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_vm_mmap_min_addr:def:1" version="3" class="compliance">
                <metadata>
                  <title>Prevent applications from mapping low portion of virtual memory</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_vm_mmap_min_addr"/>
                  <description>The 'vm.mmap_min_addr' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_vm_mmap_min_addr:def:1" comment="vm.mmap_min_addr configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_vm_mmap_min_addr:def:1" comment="vm.mmap_min_addr runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_user_max_user_namespaces:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable the use of user namespaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_user_max_user_namespaces"/>
                  <description>The 'user.max_user_namespaces' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_user_max_user_namespaces:def:1" comment="user.max_user_namespaces configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_user_max_user_namespaces:def:1" comment="user.max_user_namespaces runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_vm_mmap_min_addr:def:1" version="3" class="compliance">
                <metadata>
                  <title>Prevent applications from mapping low portion of virtual memory</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_vm_mmap_min_addr"/>
                  <description>The kernel 'vm.mmap_min_addr' parameter should be set to 65536 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_vm_mmap_min_addr:tst:1" comment="kernel static parameter vm.mmap_min_addr set to 65536 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_vm_mmap_min_addr:tst:1" comment="kernel static parameter vm.mmap_min_addr set to 65536 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_vm_mmap_min_addr:tst:1" comment="kernel static parameter vm.mmap_min_addr set to 65536 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_vm_mmap_min_addr:tst:1" comment="kernel static parameter vm.mmap_min_addr set to 65536 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_vm_mmap_min_addr_defined_in_one_file:tst:1" comment="Check that vm_mmap_min_addr is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_user_max_user_namespaces:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable the use of user namespaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_user_max_user_namespaces"/>
                  <description>The kernel 'user.max_user_namespaces' parameter should be set to 0 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_user_max_user_namespaces:tst:1" comment="kernel static parameter user.max_user_namespaces set to 0 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_user_max_user_namespaces:tst:1" comment="kernel static parameter user.max_user_namespaces set to 0 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_user_max_user_namespaces:tst:1" comment="kernel static parameter user.max_user_namespaces set to 0 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_user_max_user_namespaces:tst:1" comment="kernel static parameter user.max_user_namespaces set to 0 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_user_max_user_namespaces_defined_in_one_file:tst:1" comment="Check that user_max_user_namespaces is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_default_router_solicitations:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Denying Router Solicitations on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_default_router_solicitations"/>
                  <description>The kernel 'net.ipv6.conf.default.router_solicitations' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_router_solicitations:tst:1" comment="kernel static parameter net.ipv6.conf.default.router_solicitations set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" comment="kernel static parameter net.ipv6.conf.default.router_solicitations set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" comment="kernel static parameter net.ipv6.conf.default.router_solicitations set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" comment="kernel static parameter net.ipv6.conf.default.router_solicitations set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_router_solicitations_defined_in_one_file:tst:1" comment="Check that net_ipv6_conf_default_router_solicitations is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_default_max_addresses:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_default_max_addresses"/>
                  <description>The kernel 'net.ipv6.conf.default.max_addresses' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_max_addresses:tst:1" comment="kernel static parameter net.ipv6.conf.default.max_addresses set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_max_addresses:tst:1" comment="kernel static parameter net.ipv6.conf.default.max_addresses set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_max_addresses:tst:1" comment="kernel static parameter net.ipv6.conf.default.max_addresses set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_max_addresses:tst:1" comment="kernel static parameter net.ipv6.conf.default.max_addresses set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_max_addresses_defined_in_one_file:tst:1" comment="Check that net_ipv6_conf_default_max_addresses is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_default_disable_ipv6:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable IPv6 Addressing on IPv6 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_default_disable_ipv6"/>
                  <description>The kernel 'net.ipv6.conf.default.disable_ipv6' parameter should be set to 1 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_disable_ipv6:tst:1" comment="kernel static parameter net.ipv6.conf.default.disable_ipv6 set to 1 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" comment="kernel static parameter net.ipv6.conf.default.disable_ipv6 set to 1 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" comment="kernel static parameter net.ipv6.conf.default.disable_ipv6 set to 1 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" comment="kernel static parameter net.ipv6.conf.default.disable_ipv6 set to 1 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_disable_ipv6_defined_in_one_file:tst:1" comment="Check that net_ipv6_conf_default_disable_ipv6 is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_default_autoconf:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Auto Configuration on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_default_autoconf"/>
                  <description>The kernel 'net.ipv6.conf.default.autoconf' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_autoconf:tst:1" comment="kernel static parameter net.ipv6.conf.default.autoconf set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_autoconf:tst:1" comment="kernel static parameter net.ipv6.conf.default.autoconf set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_autoconf:tst:1" comment="kernel static parameter net.ipv6.conf.default.autoconf set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_autoconf:tst:1" comment="kernel static parameter net.ipv6.conf.default.autoconf set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_autoconf_defined_in_one_file:tst:1" comment="Check that net_ipv6_conf_default_autoconf is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_default_accept_redirects"/>
                  <description>The kernel 'net.ipv6.conf.default.accept_redirects' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_redirects:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_redirects set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_redirects set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_redirects set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_defined_in_one_file:tst:1" comment="Check that net_ipv6_conf_default_accept_redirects is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_default_accept_ra_rtr_pref"/>
                  <description>The kernel 'net.ipv6.conf.default.accept_ra_rtr_pref' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_defined_in_one_file:tst:1" comment="Check that net_ipv6_conf_default_accept_ra_rtr_pref is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_pinfo:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_default_accept_ra_pinfo"/>
                  <description>The kernel 'net.ipv6.conf.default.accept_ra_pinfo' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_pinfo:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_pinfo_defined_in_one_file:tst:1" comment="Check that net_ipv6_conf_default_accept_ra_pinfo is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_defrtr:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_default_accept_ra_defrtr"/>
                  <description>The kernel 'net.ipv6.conf.default.accept_ra_defrtr' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_defrtr:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_defrtr_defined_in_one_file:tst:1" comment="Check that net_ipv6_conf_default_accept_ra_defrtr is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Accepting Router Advertisements on all IPv6 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_default_accept_ra"/>
                  <description>The kernel 'net.ipv6.conf.default.accept_ra' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_defined_in_one_file:tst:1" comment="Check that net_ipv6_conf_default_accept_ra is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_all_router_solicitations:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Denying Router Solicitations on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_all_router_solicitations"/>
                  <description>The kernel 'net.ipv6.conf.all.router_solicitations' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_router_solicitations:tst:1" comment="kernel static parameter net.ipv6.conf.all.router_solicitations set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" comment="kernel static parameter net.ipv6.conf.all.router_solicitations set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" comment="kernel static parameter net.ipv6.conf.all.router_solicitations set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" comment="kernel static parameter net.ipv6.conf.all.router_solicitations set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_router_solicitations_defined_in_one_file:tst:1" comment="Check that net_ipv6_conf_all_router_solicitations is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_all_max_addresses:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_all_max_addresses"/>
                  <description>The kernel 'net.ipv6.conf.all.max_addresses' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_max_addresses:tst:1" comment="kernel static parameter net.ipv6.conf.all.max_addresses set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_max_addresses:tst:1" comment="kernel static parameter net.ipv6.conf.all.max_addresses set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_max_addresses:tst:1" comment="kernel static parameter net.ipv6.conf.all.max_addresses set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_max_addresses:tst:1" comment="kernel static parameter net.ipv6.conf.all.max_addresses set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_max_addresses_defined_in_one_file:tst:1" comment="Check that net_ipv6_conf_all_max_addresses is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_all_disable_ipv6:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable IPv6 Addressing on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_all_disable_ipv6"/>
                  <description>The kernel 'net.ipv6.conf.all.disable_ipv6' parameter should be set to 1 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_disable_ipv6:tst:1" comment="kernel static parameter net.ipv6.conf.all.disable_ipv6 set to 1 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" comment="kernel static parameter net.ipv6.conf.all.disable_ipv6 set to 1 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" comment="kernel static parameter net.ipv6.conf.all.disable_ipv6 set to 1 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" comment="kernel static parameter net.ipv6.conf.all.disable_ipv6 set to 1 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_defined_in_one_file:tst:1" comment="Check that net_ipv6_conf_all_disable_ipv6 is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_all_autoconf:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Auto Configuration on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_all_autoconf"/>
                  <description>The kernel 'net.ipv6.conf.all.autoconf' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_autoconf:tst:1" comment="kernel static parameter net.ipv6.conf.all.autoconf set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_autoconf:tst:1" comment="kernel static parameter net.ipv6.conf.all.autoconf set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_autoconf:tst:1" comment="kernel static parameter net.ipv6.conf.all.autoconf set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_autoconf:tst:1" comment="kernel static parameter net.ipv6.conf.all.autoconf set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_autoconf_defined_in_one_file:tst:1" comment="Check that net_ipv6_conf_all_autoconf is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_all_accept_ra_rtr_pref"/>
                  <description>The kernel 'net.ipv6.conf.all.accept_ra_rtr_pref' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" comment="kernel static parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" comment="kernel static parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" comment="kernel static parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" comment="kernel static parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_defined_in_one_file:tst:1" comment="Check that net_ipv6_conf_all_accept_ra_rtr_pref is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_pinfo:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_all_accept_ra_pinfo"/>
                  <description>The kernel 'net.ipv6.conf.all.accept_ra_pinfo' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_pinfo:tst:1" comment="kernel static parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" comment="kernel static parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" comment="kernel static parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" comment="kernel static parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_pinfo_defined_in_one_file:tst:1" comment="Check that net_ipv6_conf_all_accept_ra_pinfo is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_defrtr:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_all_accept_ra_defrtr"/>
                  <description>The kernel 'net.ipv6.conf.all.accept_ra_defrtr' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_defrtr:tst:1" comment="kernel static parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" comment="kernel static parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" comment="kernel static parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" comment="kernel static parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_defrtr_defined_in_one_file:tst:1" comment="Check that net_ipv6_conf_all_accept_ra_defrtr is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_tcp_syncookies:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_tcp_syncookies"/>
                  <description>The kernel 'net.ipv4.tcp_syncookies' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_tcp_syncookies:tst:1" comment="kernel static parameter net.ipv4.tcp_syncookies set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_tcp_syncookies:tst:1" comment="kernel static parameter net.ipv4.tcp_syncookies set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_tcp_syncookies:tst:1" comment="kernel static parameter net.ipv4.tcp_syncookies set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:tst:1" comment="kernel static parameter net.ipv4.tcp_syncookies set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_defined_in_one_file:tst:1" comment="Check that net_ipv4_tcp_syncookies is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_ip_local_port_range:def:1" version="3" class="compliance">
                <metadata>
                  <title>Set Kernel Parameter to Increase Local Port Range</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_ip_local_port_range"/>
                  <description>The kernel 'net.ipv4.ip_local_port_range' parameter should be set to 32768 65535 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_ip_local_port_range:tst:1" comment="kernel static parameter net.ipv4.ip_local_port_range set to 32768 65535 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_local_port_range:tst:1" comment="kernel static parameter net.ipv4.ip_local_port_range set to 32768 65535 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_ip_local_port_range:tst:1" comment="kernel static parameter net.ipv4.ip_local_port_range set to 32768 65535 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_local_port_range:tst:1" comment="kernel static parameter net.ipv4.ip_local_port_range set to 32768 65535 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_ip_local_port_range_defined_in_one_file:tst:1" comment="Check that net_ipv4_ip_local_port_range is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_ip_forward:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_ip_forward"/>
                  <description>The kernel 'net.ipv4.ip_forward' parameter should be set to 0 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_ip_forward:tst:1" comment="kernel static parameter net.ipv4.ip_forward set to 0 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_forward:tst:1" comment="kernel static parameter net.ipv4.ip_forward set to 0 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_ip_forward:tst:1" comment="kernel static parameter net.ipv4.ip_forward set to 0 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_forward:tst:1" comment="kernel static parameter net.ipv4.ip_forward set to 0 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_ip_forward_defined_in_one_file:tst:1" comment="Check that net_ipv4_ip_forward is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_icmp_ignore_bogus_error_responses:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_icmp_ignore_bogus_error_responses"/>
                  <description>The kernel 'net.ipv4.icmp_ignore_bogus_error_responses' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" comment="kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" comment="kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" comment="kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" comment="kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_defined_in_one_file:tst:1" comment="Check that net_ipv4_icmp_ignore_bogus_error_responses is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_icmp_echo_ignore_broadcasts:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_icmp_echo_ignore_broadcasts"/>
                  <description>The kernel 'net.ipv4.icmp_echo_ignore_broadcasts' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" comment="kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" comment="kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" comment="kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" comment="kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_defined_in_one_file:tst:1" comment="Check that net_ipv4_icmp_echo_ignore_broadcasts is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_default_shared_media:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Sending and Accepting Shared Media Redirects by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_default_shared_media"/>
                  <description>The kernel 'net.ipv4.conf.default.shared_media' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_shared_media:tst:1" comment="kernel static parameter net.ipv4.conf.default.shared_media set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_shared_media:tst:1" comment="kernel static parameter net.ipv4.conf.default.shared_media set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_shared_media:tst:1" comment="kernel static parameter net.ipv4.conf.default.shared_media set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_shared_media:tst:1" comment="kernel static parameter net.ipv4.conf.default.shared_media set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_shared_media_defined_in_one_file:tst:1" comment="Check that net_ipv4_conf_default_shared_media is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_default_send_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_default_send_redirects"/>
                  <description>The kernel 'net.ipv4.conf.default.send_redirects' parameter should be set to 0 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_send_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.default.send_redirects set to 0 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_send_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.default.send_redirects set to 0 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_send_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.default.send_redirects set to 0 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.default.send_redirects set to 0 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_defined_in_one_file:tst:1" comment="Check that net_ipv4_conf_default_send_redirects is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_default_secure_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Kernel Parameter for Accepting Secure Redirects By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_default_secure_redirects"/>
                  <description>The kernel 'net.ipv4.conf.default.secure_redirects' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_secure_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.default.secure_redirects set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.default.secure_redirects set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.default.secure_redirects set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.default.secure_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_defined_in_one_file:tst:1" comment="Check that net_ipv4_conf_default_secure_redirects is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_default_rp_filter:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_default_rp_filter"/>
                  <description>The kernel 'net.ipv4.conf.default.rp_filter' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_rp_filter:tst:1" comment="kernel static parameter net.ipv4.conf.default.rp_filter set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_rp_filter:tst:1" comment="kernel static parameter net.ipv4.conf.default.rp_filter set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_rp_filter:tst:1" comment="kernel static parameter net.ipv4.conf.default.rp_filter set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:tst:1" comment="kernel static parameter net.ipv4.conf.default.rp_filter set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_defined_in_one_file:tst:1" comment="Check that net_ipv4_conf_default_rp_filter is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_default_log_martians:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_default_log_martians"/>
                  <description>The kernel 'net.ipv4.conf.default.log_martians' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_log_martians:tst:1" comment="kernel static parameter net.ipv4.conf.default.log_martians set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_log_martians:tst:1" comment="kernel static parameter net.ipv4.conf.default.log_martians set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_log_martians:tst:1" comment="kernel static parameter net.ipv4.conf.default.log_martians set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:tst:1" comment="kernel static parameter net.ipv4.conf.default.log_martians set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_defined_in_one_file:tst:1" comment="Check that net_ipv4_conf_default_log_martians is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_source_route:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_default_accept_source_route"/>
                  <description>The kernel 'net.ipv4.conf.default.accept_source_route' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_source_route:tst:1" comment="kernel static parameter net.ipv4.conf.default.accept_source_route set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" comment="kernel static parameter net.ipv4.conf.default.accept_source_route set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" comment="kernel static parameter net.ipv4.conf.default.accept_source_route set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" comment="kernel static parameter net.ipv4.conf.default.accept_source_route set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_defined_in_one_file:tst:1" comment="Check that net_ipv4_conf_default_accept_source_route is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_default_accept_redirects"/>
                  <description>The kernel 'net.ipv4.conf.default.accept_redirects' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.default.accept_redirects set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.default.accept_redirects set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.default.accept_redirects set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.default.accept_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_defined_in_one_file:tst:1" comment="Check that net_ipv4_conf_default_accept_redirects is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_all_shared_media:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Sending and Accepting Shared Media Redirects for All IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_all_shared_media"/>
                  <description>The kernel 'net.ipv4.conf.all.shared_media' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_shared_media:tst:1" comment="kernel static parameter net.ipv4.conf.all.shared_media set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_shared_media:tst:1" comment="kernel static parameter net.ipv4.conf.all.shared_media set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_shared_media:tst:1" comment="kernel static parameter net.ipv4.conf.all.shared_media set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_shared_media:tst:1" comment="kernel static parameter net.ipv4.conf.all.shared_media set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_shared_media_defined_in_one_file:tst:1" comment="Check that net_ipv4_conf_all_shared_media is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_all_send_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_all_send_redirects"/>
                  <description>The kernel 'net.ipv4.conf.all.send_redirects' parameter should be set to 0 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_send_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.all.send_redirects set to 0 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_send_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.all.send_redirects set to 0 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_send_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.all.send_redirects set to 0 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.all.send_redirects set to 0 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_defined_in_one_file:tst:1" comment="Check that net_ipv4_conf_all_send_redirects is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_all_secure_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_all_secure_redirects"/>
                  <description>The kernel 'net.ipv4.conf.all.secure_redirects' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_secure_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.all.secure_redirects set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.all.secure_redirects set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.all.secure_redirects set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.all.secure_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_defined_in_one_file:tst:1" comment="Check that net_ipv4_conf_all_secure_redirects is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_all_rp_filter:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_all_rp_filter"/>
                  <description>The kernel 'net.ipv4.conf.all.rp_filter' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_rp_filter:tst:1" comment="kernel static parameter net.ipv4.conf.all.rp_filter set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_rp_filter:tst:1" comment="kernel static parameter net.ipv4.conf.all.rp_filter set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_rp_filter:tst:1" comment="kernel static parameter net.ipv4.conf.all.rp_filter set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:tst:1" comment="kernel static parameter net.ipv4.conf.all.rp_filter set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_defined_in_one_file:tst:1" comment="Check that net_ipv4_conf_all_rp_filter is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_all_route_localnet:def:1" version="3" class="compliance">
                <metadata>
                  <title>Prevent Routing External Traffic to Local Loopback on All IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_all_route_localnet"/>
                  <description>The kernel 'net.ipv4.conf.all.route_localnet' parameter should be set to 0 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_route_localnet:tst:1" comment="kernel static parameter net.ipv4.conf.all.route_localnet set to 0 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_route_localnet:tst:1" comment="kernel static parameter net.ipv4.conf.all.route_localnet set to 0 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_route_localnet:tst:1" comment="kernel static parameter net.ipv4.conf.all.route_localnet set to 0 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_route_localnet:tst:1" comment="kernel static parameter net.ipv4.conf.all.route_localnet set to 0 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_route_localnet_defined_in_one_file:tst:1" comment="Check that net_ipv4_conf_all_route_localnet is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_all_log_martians:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_all_log_martians"/>
                  <description>The kernel 'net.ipv4.conf.all.log_martians' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_log_martians:tst:1" comment="kernel static parameter net.ipv4.conf.all.log_martians set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_log_martians:tst:1" comment="kernel static parameter net.ipv4.conf.all.log_martians set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_log_martians:tst:1" comment="kernel static parameter net.ipv4.conf.all.log_martians set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:tst:1" comment="kernel static parameter net.ipv4.conf.all.log_martians set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_defined_in_one_file:tst:1" comment="Check that net_ipv4_conf_all_log_martians is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_all_drop_gratuitous_arp:def:1" version="3" class="compliance">
                <metadata>
                  <title>Drop Gratuitious ARP frames on All IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_all_drop_gratuitous_arp"/>
                  <description>The kernel 'net.ipv4.conf.all.drop_gratuitous_arp' parameter should be set to 1 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" comment="kernel static parameter net.ipv4.conf.all.drop_gratuitous_arp set to 1 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" comment="kernel static parameter net.ipv4.conf.all.drop_gratuitous_arp set to 1 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" comment="kernel static parameter net.ipv4.conf.all.drop_gratuitous_arp set to 1 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" comment="kernel static parameter net.ipv4.conf.all.drop_gratuitous_arp set to 1 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_defined_in_one_file:tst:1" comment="Check that net_ipv4_conf_all_drop_gratuitous_arp is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_all_arp_ignore:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Response Mode of ARP Requests for All IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_all_arp_ignore"/>
                  <description>The kernel 'net.ipv4.conf.all.arp_ignore' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_arp_ignore:tst:1" comment="kernel static parameter net.ipv4.conf.all.arp_ignore set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_arp_ignore:tst:1" comment="kernel static parameter net.ipv4.conf.all.arp_ignore set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_arp_ignore:tst:1" comment="kernel static parameter net.ipv4.conf.all.arp_ignore set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_arp_ignore:tst:1" comment="kernel static parameter net.ipv4.conf.all.arp_ignore set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_ignore_defined_in_one_file:tst:1" comment="Check that net_ipv4_conf_all_arp_ignore is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_all_arp_filter:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure ARP filtering for All IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_all_arp_filter"/>
                  <description>The kernel 'net.ipv4.conf.all.arp_filter' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_arp_filter:tst:1" comment="kernel static parameter net.ipv4.conf.all.arp_filter set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_arp_filter:tst:1" comment="kernel static parameter net.ipv4.conf.all.arp_filter set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_arp_filter:tst:1" comment="kernel static parameter net.ipv4.conf.all.arp_filter set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_arp_filter:tst:1" comment="kernel static parameter net.ipv4.conf.all.arp_filter set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_filter_defined_in_one_file:tst:1" comment="Check that net_ipv4_conf_all_arp_filter is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_source_route:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_all_accept_source_route"/>
                  <description>The kernel 'net.ipv4.conf.all.accept_source_route' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_source_route:tst:1" comment="kernel static parameter net.ipv4.conf.all.accept_source_route set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" comment="kernel static parameter net.ipv4.conf.all.accept_source_route set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" comment="kernel static parameter net.ipv4.conf.all.accept_source_route set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" comment="kernel static parameter net.ipv4.conf.all.accept_source_route set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_defined_in_one_file:tst:1" comment="Check that net_ipv4_conf_all_accept_source_route is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Accepting ICMP Redirects for All IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_all_accept_redirects"/>
                  <description>The kernel 'net.ipv4.conf.all.accept_redirects' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.all.accept_redirects set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.all.accept_redirects set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.all.accept_redirects set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.all.accept_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_defined_in_one_file:tst:1" comment="Check that net_ipv4_conf_all_accept_redirects is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_local:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Accepting Packets Routed Between Local Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_all_accept_local"/>
                  <description>The kernel 'net.ipv4.conf.all.accept_local' parameter should be set to 0 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_local:tst:1" comment="kernel static parameter net.ipv4.conf.all.accept_local set to 0 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_local:tst:1" comment="kernel static parameter net.ipv4.conf.all.accept_local set to 0 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_local:tst:1" comment="kernel static parameter net.ipv4.conf.all.accept_local set to 0 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_local:tst:1" comment="kernel static parameter net.ipv4.conf.all.accept_local set to 0 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_local_defined_in_one_file:tst:1" comment="Check that net_ipv4_conf_all_accept_local is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_core_bpf_jit_harden:def:1" version="3" class="compliance">
                <metadata>
                  <title>Harden the operation of the BPF just-in-time compiler</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_core_bpf_jit_harden"/>
                  <description>The kernel 'net.core.bpf_jit_harden' parameter should be set to 2 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_core_bpf_jit_harden:tst:1" comment="kernel static parameter net.core.bpf_jit_harden set to 2 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_core_bpf_jit_harden:tst:1" comment="kernel static parameter net.core.bpf_jit_harden set to 2 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_core_bpf_jit_harden:tst:1" comment="kernel static parameter net.core.bpf_jit_harden set to 2 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_core_bpf_jit_harden:tst:1" comment="kernel static parameter net.core.bpf_jit_harden set to 2 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_net_core_bpf_jit_harden_defined_in_one_file:tst:1" comment="Check that net_core_bpf_jit_harden is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_yama_ptrace_scope:def:1" version="3" class="compliance">
                <metadata>
                  <title>Restrict usage of ptrace to descendant processes</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_yama_ptrace_scope"/>
                  <description>The kernel 'kernel.yama.ptrace_scope' parameter should be set to 1 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_yama_ptrace_scope:tst:1" comment="kernel static parameter kernel.yama.ptrace_scope set to 1 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_yama_ptrace_scope:tst:1" comment="kernel static parameter kernel.yama.ptrace_scope set to 1 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_yama_ptrace_scope:tst:1" comment="kernel static parameter kernel.yama.ptrace_scope set to 1 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_yama_ptrace_scope:tst:1" comment="kernel static parameter kernel.yama.ptrace_scope set to 1 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_kernel_yama_ptrace_scope_defined_in_one_file:tst:1" comment="Check that kernel_yama_ptrace_scope is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_unprivileged_bpf_disabled:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Access to Network bpf() Syscall From Unprivileged Processes</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_unprivileged_bpf_disabled"/>
                  <description>The kernel 'kernel.unprivileged_bpf_disabled' parameter should be set to 1 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_unprivileged_bpf_disabled:tst:1" comment="kernel static parameter kernel.unprivileged_bpf_disabled set to 1 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_unprivileged_bpf_disabled:tst:1" comment="kernel static parameter kernel.unprivileged_bpf_disabled set to 1 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_unprivileged_bpf_disabled:tst:1" comment="kernel static parameter kernel.unprivileged_bpf_disabled set to 1 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:tst:1" comment="kernel static parameter kernel.unprivileged_bpf_disabled set to 1 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_kernel_unprivileged_bpf_disabled_defined_in_one_file:tst:1" comment="Check that kernel_unprivileged_bpf_disabled is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_sysrq:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disallow magic SysRq key</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_sysrq"/>
                  <description>The kernel 'kernel.sysrq' parameter should be set to 0 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_sysrq:tst:1" comment="kernel static parameter kernel.sysrq set to 0 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_sysrq:tst:1" comment="kernel static parameter kernel.sysrq set to 0 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_sysrq:tst:1" comment="kernel static parameter kernel.sysrq set to 0 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_sysrq:tst:1" comment="kernel static parameter kernel.sysrq set to 0 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_kernel_sysrq_defined_in_one_file:tst:1" comment="Check that kernel_sysrq is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_randomize_va_space:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Randomized Layout of Virtual Address Space</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_randomize_va_space"/>
                  <description>The kernel 'kernel.randomize_va_space' parameter should be set to 2 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_randomize_va_space:tst:1" comment="kernel static parameter kernel.randomize_va_space set to 2 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_randomize_va_space:tst:1" comment="kernel static parameter kernel.randomize_va_space set to 2 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_randomize_va_space:tst:1" comment="kernel static parameter kernel.randomize_va_space set to 2 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_randomize_va_space:tst:1" comment="kernel static parameter kernel.randomize_va_space set to 2 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_kernel_randomize_va_space_defined_in_one_file:tst:1" comment="Check that kernel_randomize_va_space is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_pid_max:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure maximum number of process identifiers</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_pid_max"/>
                  <description>The kernel 'kernel.pid_max' parameter should be set to 65536 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_pid_max:tst:1" comment="kernel static parameter kernel.pid_max set to 65536 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_pid_max:tst:1" comment="kernel static parameter kernel.pid_max set to 65536 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_pid_max:tst:1" comment="kernel static parameter kernel.pid_max set to 65536 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_pid_max:tst:1" comment="kernel static parameter kernel.pid_max set to 65536 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_kernel_pid_max_defined_in_one_file:tst:1" comment="Check that kernel_pid_max is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_perf_event_paranoid:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disallow kernel profiling by unprivileged users</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_perf_event_paranoid"/>
                  <description>The kernel 'kernel.perf_event_paranoid' parameter should be set to 2 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_perf_event_paranoid:tst:1" comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_event_paranoid:tst:1" comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_event_paranoid:tst:1" comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_paranoid:tst:1" comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_kernel_perf_event_paranoid_defined_in_one_file:tst:1" comment="Check that kernel_perf_event_paranoid is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_perf_event_max_sample_rate:def:1" version="3" class="compliance">
                <metadata>
                  <title>Limit sampling frequency of the Perf system</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_perf_event_max_sample_rate"/>
                  <description>The kernel 'kernel.perf_event_max_sample_rate' parameter should be set to 1 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_perf_event_max_sample_rate:tst:1" comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_event_max_sample_rate:tst:1" comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_event_max_sample_rate:tst:1" comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:tst:1" comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_kernel_perf_event_max_sample_rate_defined_in_one_file:tst:1" comment="Check that kernel_perf_event_max_sample_rate is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_perf_cpu_time_max_percent:def:1" version="3" class="compliance">
                <metadata>
                  <title>Limit CPU consumption of the Perf system</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_perf_cpu_time_max_percent"/>
                  <description>The kernel 'kernel.perf_cpu_time_max_percent' parameter should be set to 1 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_perf_cpu_time_max_percent:tst:1" comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_cpu_time_max_percent:tst:1" comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_cpu_time_max_percent:tst:1" comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:tst:1" comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_kernel_perf_cpu_time_max_percent_defined_in_one_file:tst:1" comment="Check that kernel_perf_cpu_time_max_percent is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_panic_on_oops:def:1" version="3" class="compliance">
                <metadata>
                  <title>Kernel panic on oops</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_panic_on_oops"/>
                  <description>The kernel 'kernel.panic_on_oops' parameter should be set to 1 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_panic_on_oops:tst:1" comment="kernel static parameter kernel.panic_on_oops set to 1 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_panic_on_oops:tst:1" comment="kernel static parameter kernel.panic_on_oops set to 1 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_panic_on_oops:tst:1" comment="kernel static parameter kernel.panic_on_oops set to 1 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_panic_on_oops:tst:1" comment="kernel static parameter kernel.panic_on_oops set to 1 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_kernel_panic_on_oops_defined_in_one_file:tst:1" comment="Check that kernel_panic_on_oops is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_modules_disabled:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable loading and unloading of kernel modules</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_modules_disabled"/>
                  <description>The kernel 'kernel.modules_disabled' parameter should be set to 1 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_modules_disabled:tst:1" comment="kernel static parameter kernel.modules_disabled set to 1 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_modules_disabled:tst:1" comment="kernel static parameter kernel.modules_disabled set to 1 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_modules_disabled:tst:1" comment="kernel static parameter kernel.modules_disabled set to 1 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_modules_disabled:tst:1" comment="kernel static parameter kernel.modules_disabled set to 1 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_kernel_modules_disabled_defined_in_one_file:tst:1" comment="Check that kernel_modules_disabled is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_kptr_restrict:def:1" version="3" class="compliance">
                <metadata>
                  <title>Restrict Exposed Kernel Pointer Addresses Access</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_kptr_restrict"/>
                  <description>The kernel 'kernel.kptr_restrict' parameter should be set to the appropriate value in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_kptr_restrict:tst:1" comment="kernel static parameter kernel.kptr_restrict set to the appropriate value in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_kptr_restrict:tst:1" comment="kernel static parameter kernel.kptr_restrict set to the appropriate value in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_kptr_restrict:tst:1" comment="kernel static parameter kernel.kptr_restrict set to the appropriate value in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_kptr_restrict:tst:1" comment="kernel static parameter kernel.kptr_restrict set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_kernel_kptr_restrict_defined_in_one_file:tst:1" comment="Check that kernel_kptr_restrict is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_kexec_load_disabled:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Image Loading</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_kexec_load_disabled"/>
                  <description>The kernel 'kernel.kexec_load_disabled' parameter should be set to 1 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_kexec_load_disabled:tst:1" comment="kernel static parameter kernel.kexec_load_disabled set to 1 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_kexec_load_disabled:tst:1" comment="kernel static parameter kernel.kexec_load_disabled set to 1 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_kexec_load_disabled:tst:1" comment="kernel static parameter kernel.kexec_load_disabled set to 1 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_kexec_load_disabled:tst:1" comment="kernel static parameter kernel.kexec_load_disabled set to 1 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_kernel_kexec_load_disabled_defined_in_one_file:tst:1" comment="Check that kernel_kexec_load_disabled is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_dmesg_restrict:def:1" version="3" class="compliance">
                <metadata>
                  <title>Restrict Access to Kernel Message Buffer</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_dmesg_restrict"/>
                  <description>The kernel 'kernel.dmesg_restrict' parameter should be set to 1 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_dmesg_restrict:tst:1" comment="kernel static parameter kernel.dmesg_restrict set to 1 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_dmesg_restrict:tst:1" comment="kernel static parameter kernel.dmesg_restrict set to 1 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_dmesg_restrict:tst:1" comment="kernel static parameter kernel.dmesg_restrict set to 1 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_dmesg_restrict:tst:1" comment="kernel static parameter kernel.dmesg_restrict set to 1 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_kernel_dmesg_restrict_defined_in_one_file:tst:1" comment="Check that kernel_dmesg_restrict is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_core_pattern:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable storing core dumps</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_core_pattern"/>
                  <description>The kernel 'kernel.core_pattern' parameter should be set to |/bin/false in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_core_pattern:tst:1" comment="kernel static parameter kernel.core_pattern set to |/bin/false in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_core_pattern:tst:1" comment="kernel static parameter kernel.core_pattern set to |/bin/false in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_core_pattern:tst:1" comment="kernel static parameter kernel.core_pattern set to |/bin/false in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_core_pattern:tst:1" comment="kernel static parameter kernel.core_pattern set to |/bin/false in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_kernel_core_pattern_defined_in_one_file:tst:1" comment="Check that kernel_core_pattern is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_fs_suid_dumpable:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Core Dumps for SUID programs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_fs_suid_dumpable"/>
                  <description>The kernel 'fs.suid_dumpable' parameter should be set to 0 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_fs_suid_dumpable:tst:1" comment="kernel static parameter fs.suid_dumpable set to 0 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_fs_suid_dumpable:tst:1" comment="kernel static parameter fs.suid_dumpable set to 0 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_fs_suid_dumpable:tst:1" comment="kernel static parameter fs.suid_dumpable set to 0 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_suid_dumpable:tst:1" comment="kernel static parameter fs.suid_dumpable set to 0 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_fs_suid_dumpable_defined_in_one_file:tst:1" comment="Check that fs_suid_dumpable is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_fs_protected_symlinks:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Enforce DAC on Symlinks</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_fs_protected_symlinks"/>
                  <description>The kernel 'fs.protected_symlinks' parameter should be set to 1 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_fs_protected_symlinks:tst:1" comment="kernel static parameter fs.protected_symlinks set to 1 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_symlinks:tst:1" comment="kernel static parameter fs.protected_symlinks set to 1 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_fs_protected_symlinks:tst:1" comment="kernel static parameter fs.protected_symlinks set to 1 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_symlinks:tst:1" comment="kernel static parameter fs.protected_symlinks set to 1 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_fs_protected_symlinks_defined_in_one_file:tst:1" comment="Check that fs_protected_symlinks is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_fs_protected_regular:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Enforce DAC on Regular files</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_fs_protected_regular"/>
                  <description>The kernel 'fs.protected_regular' parameter should be set to 2 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_fs_protected_regular:tst:1" comment="kernel static parameter fs.protected_regular set to 2 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_regular:tst:1" comment="kernel static parameter fs.protected_regular set to 2 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_fs_protected_regular:tst:1" comment="kernel static parameter fs.protected_regular set to 2 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_regular:tst:1" comment="kernel static parameter fs.protected_regular set to 2 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_fs_protected_regular_defined_in_one_file:tst:1" comment="Check that fs_protected_regular is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_fs_protected_hardlinks:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Enforce DAC on Hardlinks</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_fs_protected_hardlinks"/>
                  <description>The kernel 'fs.protected_hardlinks' parameter should be set to 1 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_fs_protected_hardlinks:tst:1" comment="kernel static parameter fs.protected_hardlinks set to 1 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_hardlinks:tst:1" comment="kernel static parameter fs.protected_hardlinks set to 1 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_fs_protected_hardlinks:tst:1" comment="kernel static parameter fs.protected_hardlinks set to 1 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_hardlinks:tst:1" comment="kernel static parameter fs.protected_hardlinks set to 1 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_fs_protected_hardlinks_defined_in_one_file:tst:1" comment="Check that fs_protected_hardlinks is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_fs_protected_fifos:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Enforce DAC on FIFOs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_fs_protected_fifos"/>
                  <description>The kernel 'fs.protected_fifos' parameter should be set to 2 in the system configuration.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_static_sysctl_fs_protected_fifos:tst:1" comment="kernel static parameter fs.protected_fifos set to 2 in /etc/sysctl.conf"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_fifos:tst:1" comment="kernel static parameter fs.protected_fifos set to 2 in /etc/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_fs_protected_fifos:tst:1" comment="kernel static parameter fs.protected_fifos set to 2 in /run/sysctl.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_fifos:tst:1" comment="kernel static parameter fs.protected_fifos set to 2 in /usr/lib/sysctl.d/*.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_fs_protected_fifos_defined_in_one_file:tst:1" comment="Check that fs_protected_fifos is defined in only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_vm_mmap_min_addr:def:1" version="3" class="compliance">
                <metadata>
                  <title>Prevent applications from mapping low portion of virtual memory</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_vm_mmap_min_addr"/>
                  <description>The kernel 'vm.mmap_min_addr' parameter should be set to 65536 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_vm_mmap_min_addr:tst:1" comment="kernel runtime parameter vm.mmap_min_addr set to 65536"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_user_max_user_namespaces:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable the use of user namespaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_user_max_user_namespaces"/>
                  <description>The kernel 'user.max_user_namespaces' parameter should be set to 0 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_user_max_user_namespaces:tst:1" comment="kernel runtime parameter user.max_user_namespaces set to 0"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_router_solicitations:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Denying Router Solicitations on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_default_router_solicitations"/>
                  <description>The kernel 'net.ipv6.conf.default.router_solicitations' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_router_solicitations:tst:1" comment="kernel runtime parameter net.ipv6.conf.default.router_solicitations set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_max_addresses:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_default_max_addresses"/>
                  <description>The kernel 'net.ipv6.conf.default.max_addresses' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_max_addresses:tst:1" comment="kernel runtime parameter net.ipv6.conf.default.max_addresses set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_disable_ipv6:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable IPv6 Addressing on IPv6 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_default_disable_ipv6"/>
                  <description>The kernel 'net.ipv6.conf.default.disable_ipv6' parameter should be set to 1 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:tst:1" comment="kernel runtime parameter net.ipv6.conf.default.disable_ipv6 set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_autoconf:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Auto Configuration on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_default_autoconf"/>
                  <description>The kernel 'net.ipv6.conf.default.autoconf' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_autoconf:tst:1" comment="kernel runtime parameter net.ipv6.conf.default.autoconf set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_default_accept_redirects"/>
                  <description>The kernel 'net.ipv6.conf.default.accept_redirects' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_redirects:tst:1" comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref"/>
                  <description>The kernel 'net.ipv6.conf.default.accept_ra_rtr_pref' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo"/>
                  <description>The kernel 'net.ipv6.conf.default.accept_ra_pinfo' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:tst:1" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr"/>
                  <description>The kernel 'net.ipv6.conf.default.accept_ra_defrtr' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:tst:1" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Accepting Router Advertisements on all IPv6 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_default_accept_ra"/>
                  <description>The kernel 'net.ipv6.conf.default.accept_ra' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra:tst:1" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_router_solicitations:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Denying Router Solicitations on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_all_router_solicitations"/>
                  <description>The kernel 'net.ipv6.conf.all.router_solicitations' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_router_solicitations:tst:1" comment="kernel runtime parameter net.ipv6.conf.all.router_solicitations set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_max_addresses:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_all_max_addresses"/>
                  <description>The kernel 'net.ipv6.conf.all.max_addresses' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_max_addresses:tst:1" comment="kernel runtime parameter net.ipv6.conf.all.max_addresses set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_disable_ipv6:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable IPv6 Addressing on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_all_disable_ipv6"/>
                  <description>The kernel 'net.ipv6.conf.all.disable_ipv6' parameter should be set to 1 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:tst:1" comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_autoconf:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Auto Configuration on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_all_autoconf"/>
                  <description>The kernel 'net.ipv6.conf.all.autoconf' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_autoconf:tst:1" comment="kernel runtime parameter net.ipv6.conf.all.autoconf set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref"/>
                  <description>The kernel 'net.ipv6.conf.all.accept_ra_rtr_pref' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo"/>
                  <description>The kernel 'net.ipv6.conf.all.accept_ra_pinfo' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:tst:1" comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr"/>
                  <description>The kernel 'net.ipv6.conf.all.accept_ra_defrtr' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:tst:1" comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_tcp_syncookies:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_tcp_syncookies"/>
                  <description>The kernel 'net.ipv4.tcp_syncookies' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_tcp_syncookies:tst:1" comment="kernel runtime parameter net.ipv4.tcp_syncookies set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_ip_local_port_range:def:1" version="3" class="compliance">
                <metadata>
                  <title>Set Kernel Parameter to Increase Local Port Range</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_ip_local_port_range"/>
                  <description>The kernel 'net.ipv4.ip_local_port_range' parameter should be set to 32768 65535 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_ip_local_port_range:tst:1" comment="kernel runtime parameter net.ipv4.ip_local_port_range set to 32768 65535"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_ip_forward:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_ip_forward"/>
                  <description>The kernel 'net.ipv4.ip_forward' parameter should be set to 0 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_ip_forward:tst:1" comment="kernel runtime parameter net.ipv4.ip_forward set to 0"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses"/>
                  <description>The kernel 'net.ipv4.icmp_ignore_bogus_error_responses' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" comment="kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts"/>
                  <description>The kernel 'net.ipv4.icmp_echo_ignore_broadcasts' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" comment="kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_shared_media:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Sending and Accepting Shared Media Redirects by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_default_shared_media"/>
                  <description>The kernel 'net.ipv4.conf.default.shared_media' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_shared_media:tst:1" comment="kernel runtime parameter net.ipv4.conf.default.shared_media set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_send_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_default_send_redirects"/>
                  <description>The kernel 'net.ipv4.conf.default.send_redirects' parameter should be set to 0 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_send_redirects:tst:1" comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_secure_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Kernel Parameter for Accepting Secure Redirects By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_default_secure_redirects"/>
                  <description>The kernel 'net.ipv4.conf.default.secure_redirects' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_secure_redirects:tst:1" comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_rp_filter:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_default_rp_filter"/>
                  <description>The kernel 'net.ipv4.conf.default.rp_filter' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_rp_filter:tst:1" comment="kernel runtime parameter net.ipv4.conf.default.rp_filter set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_log_martians:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_default_log_martians"/>
                  <description>The kernel 'net.ipv4.conf.default.log_martians' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_log_martians:tst:1" comment="kernel runtime parameter net.ipv4.conf.default.log_martians set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_source_route:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_default_accept_source_route"/>
                  <description>The kernel 'net.ipv4.conf.default.accept_source_route' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_source_route:tst:1" comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_default_accept_redirects"/>
                  <description>The kernel 'net.ipv4.conf.default.accept_redirects' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_redirects:tst:1" comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_shared_media:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Sending and Accepting Shared Media Redirects for All IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_all_shared_media"/>
                  <description>The kernel 'net.ipv4.conf.all.shared_media' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_shared_media:tst:1" comment="kernel runtime parameter net.ipv4.conf.all.shared_media set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_send_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_all_send_redirects"/>
                  <description>The kernel 'net.ipv4.conf.all.send_redirects' parameter should be set to 0 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_send_redirects:tst:1" comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_secure_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_all_secure_redirects"/>
                  <description>The kernel 'net.ipv4.conf.all.secure_redirects' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_secure_redirects:tst:1" comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_rp_filter:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_all_rp_filter"/>
                  <description>The kernel 'net.ipv4.conf.all.rp_filter' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_rp_filter:tst:1" comment="kernel runtime parameter net.ipv4.conf.all.rp_filter set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_route_localnet:def:1" version="3" class="compliance">
                <metadata>
                  <title>Prevent Routing External Traffic to Local Loopback on All IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_all_route_localnet"/>
                  <description>The kernel 'net.ipv4.conf.all.route_localnet' parameter should be set to 0 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_route_localnet:tst:1" comment="kernel runtime parameter net.ipv4.conf.all.route_localnet set to 0"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_log_martians:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_all_log_martians"/>
                  <description>The kernel 'net.ipv4.conf.all.log_martians' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_log_martians:tst:1" comment="kernel runtime parameter net.ipv4.conf.all.log_martians set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_drop_gratuitous_arp:def:1" version="3" class="compliance">
                <metadata>
                  <title>Drop Gratuitious ARP frames on All IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_all_drop_gratuitous_arp"/>
                  <description>The kernel 'net.ipv4.conf.all.drop_gratuitous_arp' parameter should be set to 1 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" comment="kernel runtime parameter net.ipv4.conf.all.drop_gratuitous_arp set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_arp_ignore:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Response Mode of ARP Requests for All IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_all_arp_ignore"/>
                  <description>The kernel 'net.ipv4.conf.all.arp_ignore' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_arp_ignore:tst:1" comment="kernel runtime parameter net.ipv4.conf.all.arp_ignore set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_arp_filter:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure ARP filtering for All IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_all_arp_filter"/>
                  <description>The kernel 'net.ipv4.conf.all.arp_filter' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_arp_filter:tst:1" comment="kernel runtime parameter net.ipv4.conf.all.arp_filter set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_source_route:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_all_accept_source_route"/>
                  <description>The kernel 'net.ipv4.conf.all.accept_source_route' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_source_route:tst:1" comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Accepting ICMP Redirects for All IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_all_accept_redirects"/>
                  <description>The kernel 'net.ipv4.conf.all.accept_redirects' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_redirects:tst:1" comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_local:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Accepting Packets Routed Between Local Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_all_accept_local"/>
                  <description>The kernel 'net.ipv4.conf.all.accept_local' parameter should be set to 0 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_local:tst:1" comment="kernel runtime parameter net.ipv4.conf.all.accept_local set to 0"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_core_bpf_jit_harden:def:1" version="3" class="compliance">
                <metadata>
                  <title>Harden the operation of the BPF just-in-time compiler</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_core_bpf_jit_harden"/>
                  <description>The kernel 'net.core.bpf_jit_harden' parameter should be set to 2 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_core_bpf_jit_harden:tst:1" comment="kernel runtime parameter net.core.bpf_jit_harden set to 2"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_yama_ptrace_scope:def:1" version="3" class="compliance">
                <metadata>
                  <title>Restrict usage of ptrace to descendant processes</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_yama_ptrace_scope"/>
                  <description>The kernel 'kernel.yama.ptrace_scope' parameter should be set to 1 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_yama_ptrace_scope:tst:1" comment="kernel runtime parameter kernel.yama.ptrace_scope set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_unprivileged_bpf_disabled:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Access to Network bpf() Syscall From Unprivileged Processes</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_unprivileged_bpf_disabled"/>
                  <description>The kernel 'kernel.unprivileged_bpf_disabled' parameter should be set to 1 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_unprivileged_bpf_disabled:tst:1" comment="kernel runtime parameter kernel.unprivileged_bpf_disabled set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_sysrq:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disallow magic SysRq key</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_sysrq"/>
                  <description>The kernel 'kernel.sysrq' parameter should be set to 0 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_sysrq:tst:1" comment="kernel runtime parameter kernel.sysrq set to 0"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_randomize_va_space:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Randomized Layout of Virtual Address Space</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_randomize_va_space"/>
                  <description>The kernel 'kernel.randomize_va_space' parameter should be set to 2 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_randomize_va_space:tst:1" comment="kernel runtime parameter kernel.randomize_va_space set to 2"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_pid_max:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure maximum number of process identifiers</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_pid_max"/>
                  <description>The kernel 'kernel.pid_max' parameter should be set to 65536 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_pid_max:tst:1" comment="kernel runtime parameter kernel.pid_max set to 65536"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_perf_event_paranoid:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disallow kernel profiling by unprivileged users</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_perf_event_paranoid"/>
                  <description>The kernel 'kernel.perf_event_paranoid' parameter should be set to 2 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_perf_event_paranoid:tst:1" comment="kernel runtime parameter kernel.perf_event_paranoid set to 2"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_perf_event_max_sample_rate:def:1" version="3" class="compliance">
                <metadata>
                  <title>Limit sampling frequency of the Perf system</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_perf_event_max_sample_rate"/>
                  <description>The kernel 'kernel.perf_event_max_sample_rate' parameter should be set to 1 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_perf_event_max_sample_rate:tst:1" comment="kernel runtime parameter kernel.perf_event_max_sample_rate set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_perf_cpu_time_max_percent:def:1" version="3" class="compliance">
                <metadata>
                  <title>Limit CPU consumption of the Perf system</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_perf_cpu_time_max_percent"/>
                  <description>The kernel 'kernel.perf_cpu_time_max_percent' parameter should be set to 1 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_perf_cpu_time_max_percent:tst:1" comment="kernel runtime parameter kernel.perf_cpu_time_max_percent set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_panic_on_oops:def:1" version="3" class="compliance">
                <metadata>
                  <title>Kernel panic on oops</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_panic_on_oops"/>
                  <description>The kernel 'kernel.panic_on_oops' parameter should be set to 1 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_panic_on_oops:tst:1" comment="kernel runtime parameter kernel.panic_on_oops set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_modules_disabled:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable loading and unloading of kernel modules</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_modules_disabled"/>
                  <description>The kernel 'kernel.modules_disabled' parameter should be set to 1 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_modules_disabled:tst:1" comment="kernel runtime parameter kernel.modules_disabled set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_kptr_restrict:def:1" version="3" class="compliance">
                <metadata>
                  <title>Restrict Exposed Kernel Pointer Addresses Access</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_kptr_restrict"/>
                  <description>The kernel 'kernel.kptr_restrict' parameter should be set to the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_kptr_restrict:tst:1" comment="kernel runtime parameter kernel.kptr_restrict set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_kexec_load_disabled:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Image Loading</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_kexec_load_disabled"/>
                  <description>The kernel 'kernel.kexec_load_disabled' parameter should be set to 1 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_kexec_load_disabled:tst:1" comment="kernel runtime parameter kernel.kexec_load_disabled set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_dmesg_restrict:def:1" version="3" class="compliance">
                <metadata>
                  <title>Restrict Access to Kernel Message Buffer</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_dmesg_restrict"/>
                  <description>The kernel 'kernel.dmesg_restrict' parameter should be set to 1 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_dmesg_restrict:tst:1" comment="kernel runtime parameter kernel.dmesg_restrict set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_core_pattern:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable storing core dumps</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_core_pattern"/>
                  <description>The kernel 'kernel.core_pattern' parameter should be set to |/bin/false in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_core_pattern:tst:1" comment="kernel runtime parameter kernel.core_pattern set to |/bin/false"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_fs_suid_dumpable:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Core Dumps for SUID programs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_fs_suid_dumpable"/>
                  <description>The kernel 'fs.suid_dumpable' parameter should be set to 0 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_fs_suid_dumpable:tst:1" comment="kernel runtime parameter fs.suid_dumpable set to 0"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_fs_protected_symlinks:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Enforce DAC on Symlinks</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_fs_protected_symlinks"/>
                  <description>The kernel 'fs.protected_symlinks' parameter should be set to 1 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_fs_protected_symlinks:tst:1" comment="kernel runtime parameter fs.protected_symlinks set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_fs_protected_regular:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Enforce DAC on Regular files</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_fs_protected_regular"/>
                  <description>The kernel 'fs.protected_regular' parameter should be set to 2 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_fs_protected_regular:tst:1" comment="kernel runtime parameter fs.protected_regular set to 2"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_fs_protected_hardlinks:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Enforce DAC on Hardlinks</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_fs_protected_hardlinks"/>
                  <description>The kernel 'fs.protected_hardlinks' parameter should be set to 1 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_fs_protected_hardlinks:tst:1" comment="kernel runtime parameter fs.protected_hardlinks set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_fs_protected_fifos:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Enforce DAC on FIFOs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_fs_protected_fifos"/>
                  <description>The kernel 'fs.protected_fifos' parameter should be set to 2 in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_fs_protected_fifos:tst:1" comment="kernel runtime parameter fs.protected_fifos set to 2"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure Denying Router Solicitations on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_default_router_solicitations"/>
                  <description>The kernel 'net.ipv6.conf.default.router_solicitations' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.default.router_solicitations set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_router_solicitations:def:1" comment="net.ipv6.conf.default.router_solicitations configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_router_solicitations:def:1" comment="net.ipv6.conf.default.router_solicitations runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_default_max_addresses"/>
                  <description>The kernel 'net.ipv6.conf.default.max_addresses' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.default.max_addresses set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_max_addresses:def:1" comment="net.ipv6.conf.default.max_addresses configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_max_addresses:def:1" comment="net.ipv6.conf.default.max_addresses runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_default_disable_ipv6:def:1" version="4" class="compliance">
                <metadata>
                  <title>Disable IPv6 Addressing on IPv6 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_default_disable_ipv6"/>
                  <description>The kernel 'net.ipv6.conf.default.disable_ipv6' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.default.disable_ipv6 set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_disable_ipv6:def:1" comment="net.ipv6.conf.default.disable_ipv6 configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_disable_ipv6:def:1" comment="net.ipv6.conf.default.disable_ipv6 runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_default_autoconf:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure Auto Configuration on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_default_autoconf"/>
                  <description>The kernel 'net.ipv6.conf.default.autoconf' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.default.autoconf set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_autoconf:def:1" comment="net.ipv6.conf.default.autoconf configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_autoconf:def:1" comment="net.ipv6.conf.default.autoconf runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects:def:1" version="4" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_default_accept_redirects"/>
                  <description>The kernel 'net.ipv6.conf.default.accept_redirects' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.default.accept_redirects set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_redirects:def:1" comment="net.ipv6.conf.default.accept_redirects configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_redirects:def:1" comment="net.ipv6.conf.default.accept_redirects runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_default_accept_ra_rtr_pref"/>
                  <description>The kernel 'net.ipv6.conf.default.accept_ra_rtr_pref' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.default.accept_ra_rtr_pref set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" comment="net.ipv6.conf.default.accept_ra_rtr_pref configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" comment="net.ipv6.conf.default.accept_ra_rtr_pref runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_default_accept_ra_pinfo"/>
                  <description>The kernel 'net.ipv6.conf.default.accept_ra_pinfo' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.default.accept_ra_pinfo set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_pinfo:def:1" comment="net.ipv6.conf.default.accept_ra_pinfo configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:def:1" comment="net.ipv6.conf.default.accept_ra_pinfo runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_default_accept_ra_defrtr"/>
                  <description>The kernel 'net.ipv6.conf.default.accept_ra_defrtr' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.default.accept_ra_defrtr set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_defrtr:def:1" comment="net.ipv6.conf.default.accept_ra_defrtr configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:def:1" comment="net.ipv6.conf.default.accept_ra_defrtr runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra:def:1" version="4" class="compliance">
                <metadata>
                  <title>Disable Accepting Router Advertisements on all IPv6 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_default_accept_ra"/>
                  <description>The kernel 'net.ipv6.conf.default.accept_ra' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.default.accept_ra set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra:def:1" comment="net.ipv6.conf.default.accept_ra configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra:def:1" comment="net.ipv6.conf.default.accept_ra runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure Denying Router Solicitations on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_all_router_solicitations"/>
                  <description>The kernel 'net.ipv6.conf.all.router_solicitations' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.all.router_solicitations set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_router_solicitations:def:1" comment="net.ipv6.conf.all.router_solicitations configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_router_solicitations:def:1" comment="net.ipv6.conf.all.router_solicitations runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_all_max_addresses"/>
                  <description>The kernel 'net.ipv6.conf.all.max_addresses' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.all.max_addresses set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_max_addresses:def:1" comment="net.ipv6.conf.all.max_addresses configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_max_addresses:def:1" comment="net.ipv6.conf.all.max_addresses runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_all_disable_ipv6:def:1" version="4" class="compliance">
                <metadata>
                  <title>Disable IPv6 Addressing on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_all_disable_ipv6"/>
                  <description>The kernel 'net.ipv6.conf.all.disable_ipv6' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.all.disable_ipv6 set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_disable_ipv6:def:1" comment="net.ipv6.conf.all.disable_ipv6 configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_disable_ipv6:def:1" comment="net.ipv6.conf.all.disable_ipv6 runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_all_autoconf:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure Auto Configuration on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_all_autoconf"/>
                  <description>The kernel 'net.ipv6.conf.all.autoconf' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.all.autoconf set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_autoconf:def:1" comment="net.ipv6.conf.all.autoconf configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_autoconf:def:1" comment="net.ipv6.conf.all.autoconf runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_all_accept_ra_rtr_pref"/>
                  <description>The kernel 'net.ipv6.conf.all.accept_ra_rtr_pref' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.all.accept_ra_rtr_pref set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" comment="net.ipv6.conf.all.accept_ra_rtr_pref configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" comment="net.ipv6.conf.all.accept_ra_rtr_pref runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_all_accept_ra_pinfo"/>
                  <description>The kernel 'net.ipv6.conf.all.accept_ra_pinfo' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.all.accept_ra_pinfo set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_pinfo:def:1" comment="net.ipv6.conf.all.accept_ra_pinfo configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:def:1" comment="net.ipv6.conf.all.accept_ra_pinfo runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_all_accept_ra_defrtr"/>
                  <description>The kernel 'net.ipv6.conf.all.accept_ra_defrtr' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.all.accept_ra_defrtr set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_defrtr:def:1" comment="net.ipv6.conf.all.accept_ra_defrtr configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:def:1" comment="net.ipv6.conf.all.accept_ra_defrtr runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_tcp_syncookies:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_tcp_syncookies"/>
                  <description>The 'net.ipv4.tcp_syncookies' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_tcp_syncookies:def:1" comment="net.ipv4.tcp_syncookies configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_tcp_syncookies:def:1" comment="net.ipv4.tcp_syncookies runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_ip_local_port_range:def:1" version="3" class="compliance">
                <metadata>
                  <title>Set Kernel Parameter to Increase Local Port Range</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_ip_local_port_range"/>
                  <description>The 'net.ipv4.ip_local_port_range' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_ip_local_port_range:def:1" comment="net.ipv4.ip_local_port_range configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_ip_local_port_range:def:1" comment="net.ipv4.ip_local_port_range runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_ip_forward:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_ip_forward"/>
                  <description>The 'net.ipv4.ip_forward' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_ip_forward:def:1" comment="net.ipv4.ip_forward configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_ip_forward:def:1" comment="net.ipv4.ip_forward runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses"/>
                  <description>The 'net.ipv4.icmp_ignore_bogus_error_responses' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_icmp_ignore_bogus_error_responses:def:1" comment="net.ipv4.icmp_ignore_bogus_error_responses configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:def:1" comment="net.ipv4.icmp_ignore_bogus_error_responses runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts"/>
                  <description>The 'net.ipv4.icmp_echo_ignore_broadcasts' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_icmp_echo_ignore_broadcasts:def:1" comment="net.ipv4.icmp_echo_ignore_broadcasts configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:def:1" comment="net.ipv4.icmp_echo_ignore_broadcasts runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_default_shared_media:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Sending and Accepting Shared Media Redirects by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_default_shared_media"/>
                  <description>The 'net.ipv4.conf.default.shared_media' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_shared_media:def:1" comment="net.ipv4.conf.default.shared_media configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_shared_media:def:1" comment="net.ipv4.conf.default.shared_media runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_default_send_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_default_send_redirects"/>
                  <description>The 'net.ipv4.conf.default.send_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_send_redirects:def:1" comment="net.ipv4.conf.default.send_redirects configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_send_redirects:def:1" comment="net.ipv4.conf.default.send_redirects runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Kernel Parameter for Accepting Secure Redirects By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_default_secure_redirects"/>
                  <description>The 'net.ipv4.conf.default.secure_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_secure_redirects:def:1" comment="net.ipv4.conf.default.secure_redirects configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_secure_redirects:def:1" comment="net.ipv4.conf.default.secure_redirects runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_default_rp_filter"/>
                  <description>The 'net.ipv4.conf.default.rp_filter' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_rp_filter:def:1" comment="net.ipv4.conf.default.rp_filter configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_rp_filter:def:1" comment="net.ipv4.conf.default.rp_filter runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_default_log_martians:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_default_log_martians"/>
                  <description>The 'net.ipv4.conf.default.log_martians' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_log_martians:def:1" comment="net.ipv4.conf.default.log_martians configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_log_martians:def:1" comment="net.ipv4.conf.default.log_martians runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_default_accept_source_route"/>
                  <description>The 'net.ipv4.conf.default.accept_source_route' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_source_route:def:1" comment="net.ipv4.conf.default.accept_source_route configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_source_route:def:1" comment="net.ipv4.conf.default.accept_source_route runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_default_accept_redirects"/>
                  <description>The 'net.ipv4.conf.default.accept_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_redirects:def:1" comment="net.ipv4.conf.default.accept_redirects configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_redirects:def:1" comment="net.ipv4.conf.default.accept_redirects runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_all_shared_media:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Sending and Accepting Shared Media Redirects for All IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_all_shared_media"/>
                  <description>The 'net.ipv4.conf.all.shared_media' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_shared_media:def:1" comment="net.ipv4.conf.all.shared_media configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_shared_media:def:1" comment="net.ipv4.conf.all.shared_media runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_all_send_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_all_send_redirects"/>
                  <description>The 'net.ipv4.conf.all.send_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_send_redirects:def:1" comment="net.ipv4.conf.all.send_redirects configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_send_redirects:def:1" comment="net.ipv4.conf.all.send_redirects runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_all_secure_redirects"/>
                  <description>The 'net.ipv4.conf.all.secure_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_secure_redirects:def:1" comment="net.ipv4.conf.all.secure_redirects configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_secure_redirects:def:1" comment="net.ipv4.conf.all.secure_redirects runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_all_rp_filter"/>
                  <description>The 'net.ipv4.conf.all.rp_filter' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_rp_filter:def:1" comment="net.ipv4.conf.all.rp_filter configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_rp_filter:def:1" comment="net.ipv4.conf.all.rp_filter runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_all_route_localnet:def:1" version="3" class="compliance">
                <metadata>
                  <title>Prevent Routing External Traffic to Local Loopback on All IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_all_route_localnet"/>
                  <description>The 'net.ipv4.conf.all.route_localnet' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_route_localnet:def:1" comment="net.ipv4.conf.all.route_localnet configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_route_localnet:def:1" comment="net.ipv4.conf.all.route_localnet runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_all_log_martians:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_all_log_martians"/>
                  <description>The 'net.ipv4.conf.all.log_martians' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_log_martians:def:1" comment="net.ipv4.conf.all.log_martians configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_log_martians:def:1" comment="net.ipv4.conf.all.log_martians runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_all_drop_gratuitous_arp:def:1" version="3" class="compliance">
                <metadata>
                  <title>Drop Gratuitious ARP frames on All IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_all_drop_gratuitous_arp"/>
                  <description>The 'net.ipv4.conf.all.drop_gratuitous_arp' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_drop_gratuitous_arp:def:1" comment="net.ipv4.conf.all.drop_gratuitous_arp configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_drop_gratuitous_arp:def:1" comment="net.ipv4.conf.all.drop_gratuitous_arp runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_all_arp_ignore:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Response Mode of ARP Requests for All IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_all_arp_ignore"/>
                  <description>The 'net.ipv4.conf.all.arp_ignore' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_arp_ignore:def:1" comment="net.ipv4.conf.all.arp_ignore configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_arp_ignore:def:1" comment="net.ipv4.conf.all.arp_ignore runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_all_arp_filter:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure ARP filtering for All IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_all_arp_filter"/>
                  <description>The 'net.ipv4.conf.all.arp_filter' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_arp_filter:def:1" comment="net.ipv4.conf.all.arp_filter configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_arp_filter:def:1" comment="net.ipv4.conf.all.arp_filter runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_all_accept_source_route"/>
                  <description>The 'net.ipv4.conf.all.accept_source_route' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_source_route:def:1" comment="net.ipv4.conf.all.accept_source_route configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_source_route:def:1" comment="net.ipv4.conf.all.accept_source_route runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Accepting ICMP Redirects for All IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_all_accept_redirects"/>
                  <description>The 'net.ipv4.conf.all.accept_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_redirects:def:1" comment="net.ipv4.conf.all.accept_redirects configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_redirects:def:1" comment="net.ipv4.conf.all.accept_redirects runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_all_accept_local:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Accepting Packets Routed Between Local Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_all_accept_local"/>
                  <description>The 'net.ipv4.conf.all.accept_local' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_local:def:1" comment="net.ipv4.conf.all.accept_local configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_local:def:1" comment="net.ipv4.conf.all.accept_local runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_core_bpf_jit_harden:def:1" version="3" class="compliance">
                <metadata>
                  <title>Harden the operation of the BPF just-in-time compiler</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_core_bpf_jit_harden"/>
                  <description>The 'net.core.bpf_jit_harden' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_core_bpf_jit_harden:def:1" comment="net.core.bpf_jit_harden configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_core_bpf_jit_harden:def:1" comment="net.core.bpf_jit_harden runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_yama_ptrace_scope:def:1" version="3" class="compliance">
                <metadata>
                  <title>Restrict usage of ptrace to descendant processes</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_yama_ptrace_scope"/>
                  <description>The 'kernel.yama.ptrace_scope' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_yama_ptrace_scope:def:1" comment="kernel.yama.ptrace_scope configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_yama_ptrace_scope:def:1" comment="kernel.yama.ptrace_scope runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_unprivileged_bpf_disabled:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Access to Network bpf() Syscall From Unprivileged Processes</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_unprivileged_bpf_disabled"/>
                  <description>The 'kernel.unprivileged_bpf_disabled' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_unprivileged_bpf_disabled:def:1" comment="kernel.unprivileged_bpf_disabled configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_unprivileged_bpf_disabled:def:1" comment="kernel.unprivileged_bpf_disabled runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_sysrq:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disallow magic SysRq key</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_sysrq"/>
                  <description>The 'kernel.sysrq' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_sysrq:def:1" comment="kernel.sysrq configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_sysrq:def:1" comment="kernel.sysrq runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_randomize_va_space:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Randomized Layout of Virtual Address Space</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_randomize_va_space"/>
                  <description>The 'kernel.randomize_va_space' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_randomize_va_space:def:1" comment="kernel.randomize_va_space configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_randomize_va_space:def:1" comment="kernel.randomize_va_space runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_pid_max:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure maximum number of process identifiers</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_pid_max"/>
                  <description>The 'kernel.pid_max' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_pid_max:def:1" comment="kernel.pid_max configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_pid_max:def:1" comment="kernel.pid_max runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_perf_event_paranoid:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disallow kernel profiling by unprivileged users</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_perf_event_paranoid"/>
                  <description>The 'kernel.perf_event_paranoid' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_perf_event_paranoid:def:1" comment="kernel.perf_event_paranoid configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_perf_event_paranoid:def:1" comment="kernel.perf_event_paranoid runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_perf_event_max_sample_rate:def:1" version="3" class="compliance">
                <metadata>
                  <title>Limit sampling frequency of the Perf system</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_perf_event_max_sample_rate"/>
                  <description>The 'kernel.perf_event_max_sample_rate' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_perf_event_max_sample_rate:def:1" comment="kernel.perf_event_max_sample_rate configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_perf_event_max_sample_rate:def:1" comment="kernel.perf_event_max_sample_rate runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_perf_cpu_time_max_percent:def:1" version="3" class="compliance">
                <metadata>
                  <title>Limit CPU consumption of the Perf system</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_perf_cpu_time_max_percent"/>
                  <description>The 'kernel.perf_cpu_time_max_percent' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_perf_cpu_time_max_percent:def:1" comment="kernel.perf_cpu_time_max_percent configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_perf_cpu_time_max_percent:def:1" comment="kernel.perf_cpu_time_max_percent runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_panic_on_oops:def:1" version="3" class="compliance">
                <metadata>
                  <title>Kernel panic on oops</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_panic_on_oops"/>
                  <description>The 'kernel.panic_on_oops' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_panic_on_oops:def:1" comment="kernel.panic_on_oops configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_panic_on_oops:def:1" comment="kernel.panic_on_oops runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_modules_disabled:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable loading and unloading of kernel modules</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_modules_disabled"/>
                  <description>The 'kernel.modules_disabled' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_modules_disabled:def:1" comment="kernel.modules_disabled configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_modules_disabled:def:1" comment="kernel.modules_disabled runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_kptr_restrict:def:1" version="3" class="compliance">
                <metadata>
                  <title>Restrict Exposed Kernel Pointer Addresses Access</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_kptr_restrict"/>
                  <description>The 'kernel.kptr_restrict' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_kptr_restrict:def:1" comment="kernel.kptr_restrict configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_kptr_restrict:def:1" comment="kernel.kptr_restrict runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_kexec_load_disabled:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Image Loading</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_kexec_load_disabled"/>
                  <description>The 'kernel.kexec_load_disabled' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_kexec_load_disabled:def:1" comment="kernel.kexec_load_disabled configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_kexec_load_disabled:def:1" comment="kernel.kexec_load_disabled runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" class="compliance">
                <metadata>
                  <title>Kernel Runtime Parameter IPv6 Check</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_ipv6_disable"/>
                  <description>Disables IPv6 for all network interfaces.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.all.disable_ipv6 set correctly">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_disable_ipv6:def:1" comment="net.ipv6.conf.all.disable_ipv6 configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_disable_ipv6:def:1" comment="net.ipv6.conf.all.disable_ipv6 runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_exec_shield:def:1" version="2" class="compliance">
                <metadata>
                  <title>Enable ExecShield via sysctl</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_exec_shield"/>
                  <description>The kernel runtime parameter 'kernel.exec-shield' should not be disabled and set to 1 on 32-bit systems.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" comment="64-bit system"/>
                    <criterion test_ref="oval:ssg-test_nx_disabled_grub:tst:1" comment="NX is supported and is not disabled"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_dmesg_restrict:def:1" version="3" class="compliance">
                <metadata>
                  <title>Restrict Access to Kernel Message Buffer</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_dmesg_restrict"/>
                  <description>The 'kernel.dmesg_restrict' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_dmesg_restrict:def:1" comment="kernel.dmesg_restrict configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_dmesg_restrict:def:1" comment="kernel.dmesg_restrict runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_core_pattern:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable storing core dumps</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_core_pattern"/>
                  <description>The 'kernel.core_pattern' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_core_pattern:def:1" comment="kernel.core_pattern configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_core_pattern:def:1" comment="kernel.core_pattern runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_fs_suid_dumpable:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Core Dumps for SUID programs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_fs_suid_dumpable"/>
                  <description>The 'fs.suid_dumpable' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_fs_suid_dumpable:def:1" comment="fs.suid_dumpable configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_fs_suid_dumpable:def:1" comment="fs.suid_dumpable runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_fs_protected_symlinks:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Enforce DAC on Symlinks</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_fs_protected_symlinks"/>
                  <description>The 'fs.protected_symlinks' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_fs_protected_symlinks:def:1" comment="fs.protected_symlinks configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_fs_protected_symlinks:def:1" comment="fs.protected_symlinks runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_fs_protected_regular:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Enforce DAC on Regular files</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_fs_protected_regular"/>
                  <description>The 'fs.protected_regular' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_fs_protected_regular:def:1" comment="fs.protected_regular configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_fs_protected_regular:def:1" comment="fs.protected_regular runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_fs_protected_hardlinks:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Enforce DAC on Hardlinks</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_fs_protected_hardlinks"/>
                  <description>The 'fs.protected_hardlinks' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_fs_protected_hardlinks:def:1" comment="fs.protected_hardlinks configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_fs_protected_hardlinks:def:1" comment="fs.protected_hardlinks runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_fs_protected_fifos:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Enforce DAC on FIFOs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_fs_protected_fifos"/>
                  <description>The 'fs.protected_fifos' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_fs_protected_fifos:def:1" comment="fs.protected_fifos configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_fs_protected_fifos:def:1" comment="fs.protected_fifos runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_crypto_fips_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set kernel parameter 'crypto.fips_enabled' to 1</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_crypto_fips_enabled"/>
                  <description>The kernel 'crypto.fips_enabled' parameter should be set to '1' in system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_crypto_fips_enabled:tst:1" comment="kernel runtime parameter crypto.fips_enabled set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudoers_validate_passwd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure invoking users password for privilege escalation when using sudo</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudoers_validate_passwd"/>
                  <description>Ensure invoking user's password for privilege escalation when using sudo</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sudoers_targetpw_config:tst:1" comment="Check Defaults !targetpw exists in /etc/sudoers file"/>
                  <criterion test_ref="oval:ssg-test_sudoers_rootpw_config:tst:1" comment="Check Defaults !rootpw exists in /etc/sudoers file"/>
                  <criterion test_ref="oval:ssg-test_sudoers_runaspw_config:tst:1" comment="Check Defaults !runaspw exists in /etc/sudoers file"/>
                  <criterion test_ref="oval:ssg-test_sudoers_passwd_n_files:tst:1" comment="Verify that results come from only one file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudoers_no_root_target:def:1" version="1" class="compliance">
                <metadata>
                  <title>Don't target root user in the sudoers file</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudoers_no_root_target"/>
                  <description>Check that sudoers doesn't allow users to run commands as root</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_no_root_or_ALL_in_runas_spec:tst:1" comment="Make sure that no user spec in sudoers has a runas spec that includes root or ALL"/>
                  <criterion test_ref="oval:ssg-test_no_user_spec_rules:tst:1" comment="Make sure that all user specs in sudoers feature a runas spec"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudoers_no_command_negation:def:1" version="1" class="compliance">
                <metadata>
                  <title>Don't define allowed commands in sudoers by means of exclusion</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudoers_no_command_negation"/>
                  <description>Check that sudoers doesn't contain command negations</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sudoers_no_command_negation:tst:1" comment="Make sure that no command in user spec contains negation"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudoers_explicit_command_args:def:1" version="1" class="compliance">
                <metadata>
                  <title>Explicit arguments in sudo specifications</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudoers_explicit_command_args"/>
                  <description>Check that sudoers doesn't contain commands without arguments specified</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sudoers_explicit_command_args:tst:1" comment="Make sure that no commands are without arguments"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudoers_default_includedir:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure sudo only includes the default configuration directory</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudoers_default_includedir"/>
                  <description>Check if sudo includes only the default includedir</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sudoers_default_includedir:tst:1" comment="Check /etc/sudoers for #includedir"/>
                  <criterion test_ref="oval:ssg-test_sudoers_without_include:tst:1" comment="Check /etc/sudoers for #include"/>
                  <criterion test_ref="oval:ssg-test_sudoersd_without_includes:tst:1" comment="Check /etc/sudoers.d for includes"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudo_vdsm_nopasswd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Only the VDSM User Can Use sudo NOPASSWD</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudo_vdsm_nopasswd"/>
                  <description>Checks sudo usage for the vdsm user without a password</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_vdsm_nopasswd_etc_sudoers:tst:1" comment="NOPASSWD only exists for vdsm user in /etc/sudoers"/>
                  <criterion test_ref="oval:ssg-test_vdsm_nopasswd_etc_sudoers_d:tst:1" comment="NOPASSWD only exists for vdsm user in /etc/sudoers.d"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudo_require_authentication:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Users Re-Authenticate for Privilege Escalation - sudo</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudo_require_authentication"/>
                  <description>Checks sudo usage without password</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sudo_remove_no_authenticate:def:1"/>
                  <extend_definition definition_ref="oval:ssg-sudo_remove_nopasswd:def:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudo_remove_nopasswd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudo_remove_nopasswd"/>
                  <description>Checks sudo usage without password</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_nopasswd_etc_sudoers:tst:1" comment="NOPASSWD is not configured in /etc/sudoers"/>
                  <criterion test_ref="oval:ssg-test_nopasswd_etc_sudoers_d:tst:1" comment="NOPASSWD is not configured in /etc/sudoers.d"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudo_remove_no_authenticate:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudo_remove_no_authenticate"/>
                  <description>Checks sudo usage without authentication</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_no_authenticate_etc_sudoers:tst:1" comment="!authenticate does not exist in /etc/sudoers"/>
                  <criterion test_ref="oval:ssg-test_no_authenticate_etc_sudoers_d:tst:1" comment="!authenticate does not exist in /etc/sudoers.d"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudo_custom_logfile:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Sudo Logfile Exists - sudo logfile</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudo_custom_logfile"/>
                  <description>Checks sudoers Defaults {{ OPTION }} configuration</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_logfile_sudoers:tst:1" comment="logfile is configured in /etc/sudoers or /etc/sudoers.d/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudo_add_use_pty:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudo_add_use_pty"/>
                  <description>Checks sudoers Defaults {{ OPTION }} configuration</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_use_pty_sudoers:tst:1" comment="use_pty is configured in /etc/sudoers or /etc/sudoers.d/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudo_add_requiretty:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo requiretty</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudo_add_requiretty"/>
                  <description>Checks sudoers Defaults {{ OPTION }} configuration</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_requiretty_sudoers:tst:1" comment="requiretty is configured in /etc/sudoers or /etc/sudoers.d/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudo_add_noexec:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudo_add_noexec"/>
                  <description>Checks sudoers Defaults {{ OPTION }} configuration</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_noexec_sudoers:tst:1" comment="noexec is configured in /etc/sudoers or /etc/sudoers.d/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sssd_ssh_known_hosts_timeout:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure SSSD to Expire SSH Known Hosts</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sssd_ssh_known_hosts_timeout"/>
                  <description>SSSD should be configured to expire keys from known SSH hosts after 1 day.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria operator="OR">
                    <extend_definition definition_ref="oval:ssg-service_sssd_disabled:def:1" comment="Check if sssd service is disabled"/>
                    <extend_definition definition_ref="oval:ssg-sssd_conf_exists:def:1" negate="true" comment="Check if /etc/sssd/sssd.conf is configured for usage"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sssd_ssh_known_hosts_timeout:tst:1" comment="Check ssh_known_hosts_timeout in /etc/sssd/sssd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sssd_run_as_sssd_user:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure SSSD to run as user sssd</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sssd_run_as_sssd_user"/>
                  <description>SSSD processes should be configured to run as user sssd, not root.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sssd_run_as_sssd_user:tst:1" comment="Check user setting in SSSD configuration"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sssd_offline_cred_expiration:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure SSSD to Expire Offline Credentials</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sssd_offline_cred_expiration"/>
                  <description>SSSD should be configured to expire offline credentials after 1 day.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria operator="OR">
                    <extend_definition definition_ref="oval:ssg-service_sssd_disabled:def:1" comment="Check if sssd service is disabled"/>
                    <extend_definition definition_ref="oval:ssg-sssd_conf_exists:def:1" negate="true" comment="Check if /etc/sssd/sssd.conf is configured for usage"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sssd_offline_cred_expiration:tst:1" comment="Check offline_credentials_expiration in /etc/sssd/sssd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sssd_memcache_timeout:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure SSSD's Memory Cache to Expire</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sssd_memcache_timeout"/>
                  <description>SSSD's memory cache should be configured to set to expire records after 1 day.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria operator="OR">
                    <extend_definition definition_ref="oval:ssg-service_sssd_disabled:def:1" comment="Check if sssd service is disabled"/>
                    <extend_definition definition_ref="oval:ssg-sssd_conf_exists:def:1" negate="true" comment="Check if /etc/sssd/sssd.conf is configured for usage"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sssd_memcache_timeout:tst:1" comment="Check memcache_timeout in /etc/sssd/sssd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sssd_enable_smartcards:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable Smartcards in SSSD</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sssd_enable_smartcards"/>
                  <description>SSSD should be configured to authenticate access to the system
    using smart cards.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria operator="OR">
                    <extend_definition definition_ref="oval:ssg-service_sssd_disabled:def:1" comment="Check if sssd service is disabled"/>
                    <extend_definition definition_ref="oval:ssg-sssd_conf_exists:def:1" negate="true" comment="Check if /etc/sssd/sssd.conf is configured for usage"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sssd_enable_smartcards:tst:1" comment="Check pam_cert_auth in /etc/sssd/sssd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sssd_enable_certmap:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable Certmap in SSSD</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sssd_enable_certmap"/>
                  <description>Check presence of ^\[certmap\/.+\/.+\]$ in /etc/sssd/sssd.conf</description>
                </metadata>
                <criteria comment="Test conditions - presence of the file plus 0 extra definitions.">
                  <criterion test_ref="oval:ssg-test_sssd_enable_certmap:tst:1" comment="Check that /etc/sssd/sssd.conf contains a line with certain text"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sssd_conf_uses_ldap:def:1" version="1" class="inventory">
                <metadata>
                  <title>SSSD is configured to use LDAP</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:sssd-ldap"/>
                  <reference source="ssg" ref_id="sssd_conf_uses_ldap"/>
                  <description>Identification provider is not set to ad within /etc/sssd/sssd.conf</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_id_provider_is_set_to_ad:tst:1" negate="true" comment="Identification provider is not set to ad within /etc/sssd/sssd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sssd_conf_exists:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify The SSSD Configuration File Exists</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sssd_conf_exists"/>
                  <description>The /etc/sssd/sssd.conf file should exist if it is
      in use.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sssd_conf_exists:tst:1" comment="Check if sssd_conf_exists"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sssd_certificate_verification:def:1" version="1" class="compliance">
                <metadata>
                  <title>Certificate status checking in SSSD</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sssd_certificate_verification"/>
                  <description>SSSD should be configured with the correct ocsp_dgst
            digest function</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sssd_certificate_verification:tst:1" comment="check value of certificate_verification in sssd configuration"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_x11_use_localhost:def:1" version="1" class="compliance">
                <metadata>
                  <title>Prevent remote hosts from connecting to the proxy display</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_x11_use_localhost"/>
                  <description>Ensure 'X11UseLocalhost' is configured with value 'yes' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_x11_use_localhost:tst:1" comment="Check the X11UseLocalhost in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_x11_use_localhost_config_dir:tst:1" comment="Check the X11UseLocalhost in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_version_equal_or_higher_than_74:def:1" version="1" class="compliance">
                <metadata>
                  <title>OpenSSH Server is 7.4 or newer</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_version_equal_or_higher_than_74"/>
                  <description>Check if version of OpenSSH Server is equal or higher than 7.4</description>
                </metadata>
                <criteria operator="OR" comment="OpenSSH Server version is equal or higher than 7.4">
                  <criterion test_ref="oval:ssg-test_openssh-server_version:tst:1" comment="Check if OpenSSH Server is equal or higher than 7.4"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_use_priv_separation:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable Use of Privilege Separation</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_use_priv_separation"/>
                  <description>Ensure 'UsePrivilegeSeparation' is configured with value 'sandbox' in '/etc/ssh/sshd_config'</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sshd_use_priv_separation:tst:1" comment="Check the UsePrivilegeSeparation in /etc/ssh/sshd_config"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_use_directory_configuration:def:1" version="1" class="compliance">
                <metadata>
                  <title>Distribute the SSH Server configuration to multiple files in a config directory.</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_use_directory_configuration"/>
                  <description>foo</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria comment="sshd is configured correctly">
                      <extend_definition definition_ref="oval:ssg-sshd_includes_config_files:def:1" comment="sshd includes config files from its .d directory"/>
                      <criterion test_ref="oval:ssg-test_sshd_use_directory_configuration_default_not_overriden:tst:1" comment="Check the absence of match in /etc/ssh/sshd_config"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_set_maxstartups:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure SSH MaxStartups is configured</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_set_maxstartups"/>
                  <description>Ensure 'MaxStartups' is configured in
      '/etc/ssh/sshd_config'</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria>
                    <criterion test_ref="oval:ssg-tst_maxstartups_start_parameter:tst:1" comment="SSH MaxStartups start parameter is less than or equal to 10"/>
                    <criterion test_ref="oval:ssg-tst_maxstartups_rate_parameter:tst:1" comment="SSH MaxStartups rate parameter is greater than or equal to 30"/>
                    <criterion test_ref="oval:ssg-tst_maxstartups_full_parameter:tst:1" comment="SSH MaxStartups full parameter is less than or equal to 100"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_set_max_sessions:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set SSH MaxSessions limit</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_set_max_sessions"/>
                  <description>The SSH number of max sessions should be set to an
      appropriate value.</description>
                </metadata>
                <criteria operator="OR" comment="SSH is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criterion test_ref="oval:ssg-test_sshd_max_sessions:tst:1" comment="Check MaxSessions in /etc/ssh/sshd_config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_set_max_auth_tries:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set SSH authentication attempt limit</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_set_max_auth_tries"/>
                  <description>The SSH MaxAuthTries should be set to an
      appropriate value.</description>
                </metadata>
                <criteria operator="OR" comment="SSH is not being used or conditions are met">
                  <extend_definition definition_ref="oval:ssg-service_sshd_disabled:def:1" comment="sshd service is disabled"/>
                  <criterion test_ref="oval:ssg-test_sshd_max_auth_tries:tst:1" comment="Check MaxAuthTries in /etc/ssh/sshd_config"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_set_loglevel_verbose:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set SSH Daemon LogLevel to VERBOSE</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_set_loglevel_verbose"/>
                  <description>Ensure 'LogLevel' is configured with value 'VERBOSE' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_set_loglevel_verbose:tst:1" comment="Check the LogLevel in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_set_loglevel_verbose_config_dir:tst:1" comment="Check the LogLevel in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_set_loglevel_info:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set LogLevel to INFO</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_set_loglevel_info"/>
                  <description>Ensure 'LogLevel' is configured with value 'INFO' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_set_loglevel_info:tst:1" comment="Check the LogLevel in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_set_loglevel_info_config_dir:tst:1" comment="Check the LogLevel in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_set_login_grace_time:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure SSH LoginGraceTime is configured</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_set_login_grace_time"/>
                  <description>The SSH number seconds for login grace time should be set to an
      appropriate value.</description>
                </metadata>
                <criteria operator="OR" comment="SSH is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criterion test_ref="oval:ssg-test_sshd_login_grace_time:tst:1" comment="Check LoginGraceTime in /etc/ssh/sshd_config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_set_keepalive_0:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set SSH Client Alive Count Max to zero</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_set_keepalive_0"/>
                  <description>Ensure 'ClientAliveCountMax' is configured with value '0' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_set_keepalive_0:tst:1" comment="Check the ClientAliveCountMax in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_set_keepalive_0_config_dir:tst:1" comment="Check the ClientAliveCountMax in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_set_keepalive:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set SSH Client Alive Count Max</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_set_keepalive"/>
                  <description>The SSH ClientAliveCountMax should be set to an appropriate
      value (and dependencies are met)</description>
                </metadata>
                <criteria operator="OR" comment="SSH is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured">
                      <criterion test_ref="oval:ssg-test_sshd_clientalivecountmax:tst:1" comment="Check ClientAliveCountMax in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_clientalivecountmax_dir:tst:1" comment="Check ClientAliveCountMax in /etc/ssh/sshd_config.d/ files"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_set_idle_timeout:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set SSH Idle Timeout Interval</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_set_idle_timeout"/>
                  <description>The SSH idle timeout interval should be set to an
      appropriate value.</description>
                </metadata>
                <criteria operator="OR" comment="SSH is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="ClientAliveInterval is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_idle_timeout:tst:1" comment="Check ClientAliveInterval in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_idle_timeout_config_dir:tst:1" comment="Check ClientAliveInterval in /etc/ssh/sshd_config.d/"/>
                    </criteria>
                    <extend_definition definition_ref="oval:ssg-sshd_set_keepalive:def:1" comment="The SSH ClientAliveCountMax is set to zero"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_requirement_unset:def:1" version="1" class="compliance">
                <metadata>
                  <title>It doesn't matter if sshd is installed or not</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_requirement_unset"/>
                  <description>Test if value sshd_required is 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sshd_requirement_unset:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_required_or_unset:def:1" version="1" class="compliance">
                <metadata>
                  <title>SSHD is required to be installed or requirement not set</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_required_or_unset"/>
                  <description>If SSHD is required, we check it is installed. If SSH requirement is unset, we are good.</description>
                </metadata>
                <criteria operator="OR" comment="SSH required or not set">
                  <criterion test_ref="oval:ssg-test_sshd_required:tst:1"/>
                  <extend_definition definition_ref="oval:ssg-sshd_requirement_unset:def:1" comment="SSH requirement is unset"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_rekey_limit:def:1" version="1" class="compliance">
                <metadata>
                  <title>Force frequent session key renegotiation</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_rekey_limit"/>
                  <description>Ensure {{{ parameter }}} is configured with the appropriate value in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured corectly">
                      <criterion test_ref="oval:ssg-test_sshd_rekey_limit:tst:1" comment="Check the RekeyLimit in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_rekey_limit_config_dir:tst:1" comment="Check the RekeyLimit in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_print_last_log:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable SSH Print Last Log</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_print_last_log"/>
                  <description>Ensure 'PrintLastLog' is configured with value 'yes' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_print_last_log:tst:1" comment="Check the PrintLastLog in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_print_last_log_config_dir:tst:1" comment="Check the PrintLastLog in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_not_required_or_unset:def:1" version="1" class="compliance">
                <metadata>
                  <title>SSHD is not required to be installed or requirement not set</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_not_required_or_unset"/>
                  <description>If SSHD is not required, we check it is not installed. If SSH requirement is unset, we are good.</description>
                </metadata>
                <criteria operator="OR" comment="SSH not required or not set">
                  <criterion test_ref="oval:ssg-test_sshd_not_required:tst:1"/>
                  <extend_definition definition_ref="oval:ssg-sshd_requirement_unset:def:1" comment="SSH requirement is unset"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_includes_config_files:def:1" version="1" class="compliance">
                <metadata>
                  <title>sshd_includes_config_files</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_includes_config_files"/>
                  <description>Check presence of Include /etc/ssh/sshd_config.d/*.conf in /etc/ssh/sshd_config</description>
                </metadata>
                <criteria comment="Test conditions - presence of the file plus 0 extra definitions.">
                  <criterion test_ref="oval:ssg-test_sshd_includes_config_files:tst:1" comment="Check that /etc/ssh/sshd_config contains a line with certain text"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_enable_x11_forwarding:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable Encrypted X11 Forwarding</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_enable_x11_forwarding"/>
                  <description>Ensure 'X11Forwarding' is configured with value 'yes' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_enable_x11_forwarding:tst:1" comment="Check the X11Forwarding in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_enable_x11_forwarding_config_dir:tst:1" comment="Check the X11Forwarding in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_enable_warning_banner_net:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable SSH Warning Banner</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_enable_warning_banner_net"/>
                  <description>Ensure 'Banner' is configured with value '/etc/issue.net' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_enable_warning_banner_net:tst:1" comment="Check the Banner in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_enable_warning_banner_net_config_dir:tst:1" comment="Check the Banner in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_enable_warning_banner:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable SSH Warning Banner</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_enable_warning_banner"/>
                  <description>Ensure 'Banner' is configured with value '/etc/issue' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_enable_warning_banner:tst:1" comment="Check the Banner in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_enable_warning_banner_config_dir:tst:1" comment="Check the Banner in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_enable_strictmodes:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable Use of Strict Mode Checking</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_enable_strictmodes"/>
                  <description>Ensure 'StrictModes' is configured with value 'yes' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_enable_strictmodes:tst:1" comment="Check the StrictModes in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_enable_strictmodes_config_dir:tst:1" comment="Check the StrictModes in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_enable_pubkey_auth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable Public Key Authentication</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_enable_pubkey_auth"/>
                  <description>Ensure 'PubkeyAuthentication' is configured with value 'yes' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_enable_pubkey_auth:tst:1" comment="Check the PubkeyAuthentication in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_enable_pubkey_auth_config_dir:tst:1" comment="Check the PubkeyAuthentication in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_enable_pam:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable PAM</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_enable_pam"/>
                  <description>Ensure 'UsePAM' is configured with value 'yes' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_enable_pam:tst:1" comment="Check the UsePAM in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_enable_pam_config_dir:tst:1" comment="Check the UsePAM in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_enable_gssapi_auth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable GSSAPI Authentication</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_enable_gssapi_auth"/>
                  <description>Ensure 'GSSAPIAuthentication' is configured with value 'yes' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_enable_gssapi_auth:tst:1" comment="Check the GSSAPIAuthentication in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_enable_gssapi_auth_config_dir:tst:1" comment="Check the GSSAPIAuthentication in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_do_not_permit_user_env:def:1" version="1" class="compliance">
                <metadata>
                  <title>Do Not Allow SSH Environment Options</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_do_not_permit_user_env"/>
                  <description>Ensure 'PermitUserEnvironment' is configured with value 'no' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_do_not_permit_user_env:tst:1" comment="Check the PermitUserEnvironment in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_do_not_permit_user_env_config_dir:tst:1" comment="Check the PermitUserEnvironment in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_disable_x11_forwarding:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable X11 Forwarding</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_disable_x11_forwarding"/>
                  <description>Ensure 'X11Forwarding' is configured with value 'no' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_disable_x11_forwarding:tst:1" comment="Check the X11Forwarding in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_disable_x11_forwarding_config_dir:tst:1" comment="Check the X11Forwarding in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_disable_user_known_hosts:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable SSH Support for User Known Hosts</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_disable_user_known_hosts"/>
                  <description>Ensure 'IgnoreUserKnownHosts' is configured with value 'yes' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_disable_user_known_hosts:tst:1" comment="Check the IgnoreUserKnownHosts in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_disable_user_known_hosts_config_dir:tst:1" comment="Check the IgnoreUserKnownHosts in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_disable_tcp_forwarding:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable SSH TCP Forwarding</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_disable_tcp_forwarding"/>
                  <description>Ensure 'AllowTcpForwarding' is configured with value 'no' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_disable_tcp_forwarding:tst:1" comment="Check the AllowTcpForwarding in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_disable_tcp_forwarding_config_dir:tst:1" comment="Check the AllowTcpForwarding in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_disable_root_password_login:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable SSH root Login with a Password (Insecure)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_disable_root_password_login"/>
                  <description>Ensure 'PermitRootLogin' is configured with value 'prohibit-password' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_disable_root_password_login:tst:1" comment="Check the PermitRootLogin in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_disable_root_password_login_config_dir:tst:1" comment="Check the PermitRootLogin in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_disable_root_login:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable SSH Root Login</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_disable_root_login"/>
                  <description>Ensure 'PermitRootLogin' is configured with value 'no' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_disable_root_login:tst:1" comment="Check the PermitRootLogin in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_disable_root_login_config_dir:tst:1" comment="Check the PermitRootLogin in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_disable_rhosts_rsa:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable SSH Support for Rhosts RSA Authentication</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_disable_rhosts_rsa"/>
                  <description>SSH can allow authentication through the obsolete rsh command
      through the use of the authenticating user's SSH keys. This should be disabled.</description>
                </metadata>
                <criteria operator="OR" comment="SSH is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="SSH version is equal or higher than 7.4 has deprecated RhostsRSAAuthentication">
                      <extend_definition definition_ref="oval:ssg-sshd_version_equal_or_higher_than_74:def:1" comment="OpenSSH version 7.4 or higher has deprecated RhostsRSAAuthentication"/>
                      <criterion test_ref="oval:ssg-test_sshd_disable_rhosts_rsa:tst:1" negate="true" comment="Check RhostsRSAAuthentication in /etc/ssh/sshd_config"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_disable_rhosts:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable SSH Support for .rhosts Files</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_disable_rhosts"/>
                  <description>Ensure 'IgnoreRhosts' is configured with value 'yes' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_disable_rhosts:tst:1" comment="Check the IgnoreRhosts in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_disable_rhosts_config_dir:tst:1" comment="Check the IgnoreRhosts in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_disable_pubkey_auth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable PubkeyAuthentication Authentication</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_disable_pubkey_auth"/>
                  <description>Ensure 'PubkeyAuthentication' is configured with value 'no' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_disable_pubkey_auth:tst:1" comment="Check the PubkeyAuthentication in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_disable_pubkey_auth_config_dir:tst:1" comment="Check the PubkeyAuthentication in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_disable_kerb_auth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Kerberos Authentication</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_disable_kerb_auth"/>
                  <description>Ensure 'KerberosAuthentication' is configured with value 'no' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_disable_kerb_auth:tst:1" comment="Check the KerberosAuthentication in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_disable_kerb_auth_config_dir:tst:1" comment="Check the KerberosAuthentication in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_disable_gssapi_auth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable GSSAPI Authentication</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_disable_gssapi_auth"/>
                  <description>Ensure 'GSSAPIAuthentication' is configured with value 'no' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_disable_gssapi_auth:tst:1" comment="Check the GSSAPIAuthentication in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_disable_gssapi_auth_config_dir:tst:1" comment="Check the GSSAPIAuthentication in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_disable_empty_passwords:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable SSH Access via Empty Passwords</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_disable_empty_passwords"/>
                  <description>Ensure 'PermitEmptyPasswords' is configured with value 'no' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_disable_empty_passwords:tst:1" comment="Check the PermitEmptyPasswords in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_disable_empty_passwords_config_dir:tst:1" comment="Check the PermitEmptyPasswords in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_disable_compression:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Compression Or Set Compression to delayed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_disable_compression"/>
                  <description>SSH should either have compression disabled or set to delayed.</description>
                </metadata>
                <criteria operator="OR" comment="SSH is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criterion test_ref="oval:ssg-test_sshd_disable_compression:tst:1" comment="Check Compression in /etc/ssh/sshd_config"/>
                  </criteria>
                  <extend_definition definition_ref="oval:ssg-sshd_version_equal_or_higher_than_74:def:1" comment="OpenSSH version 7.4 or higher contains fix for authentication Compression exploit"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_allow_only_protocol2:def:1" version="1" class="compliance">
                <metadata>
                  <title>Allow Only SSH Protocol 2</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_allow_only_protocol2"/>
                  <description>The OpenSSH daemon should be running protocol 2.</description>
                </metadata>
                <criteria operator="OR" comment="SSH is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="SSH version is equal or higher than 7.4 or it is configured with protocol 2">
                      <extend_definition definition_ref="oval:ssg-sshd_version_equal_or_higher_than_74:def:1" comment="OpenSSH version 7.4 or higher supports only protocol 2"/>
                      <criterion test_ref="oval:ssg-test_sshd_allow_only_protocol2:tst:1" comment="Check Protocol in /etc/ssh/sshd_config"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-snmpd_use_newer_protocol:def:1" version="2" class="compliance">
                <metadata>
                  <title>Configure SNMP Service to Use Only SNMPv3 or Newer</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="snmpd_use_newer_protocol"/>
                  <description>SNMP version 1 and 2c must not be enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_net-snmp_removed:def:1" comment="SNMP installed"/>
                  <criterion test_ref="oval:ssg-test_snmp_versions:tst:1" comment="SNMP protocols"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-snmpd_not_default_password:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure Default SNMP Password Is Not Used</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="snmpd_not_default_password"/>
                  <description>SNMP default communities must be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_snmp_default_communities:tst:1" comment="SNMP communities"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-smartcard_auth:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Smart Card Login</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="smartcard_auth"/>
                  <description>Enable Smart Card logins</description>
                </metadata>
                <criteria comment="smart card authentication is configured">
                  <extend_definition definition_ref="oval:ssg-install_smartcard_packages:def:1" comment="packages needed for smartcard support are installed"/>
                  <extend_definition definition_ref="oval:ssg-service_pcscd_enabled:def:1" comment="pcscd service is enabled"/>
                  <criteria operator="OR">
                    <extend_definition definition_ref="oval:ssg-package_esc_installed:def:1" comment="esc package is installed"/>
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_pam_pkcs11_cert_policy_ocsp_on:tst:1" comment="cert_policy directive contains oscp_on"/>
                  <criteria operator="OR" comment="smart card authentication is enabled or required in system-auth">
                    <criterion test_ref="oval:ssg-test_smart_card_enabled_system_auth:tst:1" comment="smart card authentication is enabled in /etc/pam.d/system-auth"/>
                    <criterion test_ref="oval:ssg-test_smart_card_required_system_auth:tst:1" comment="smart card is required in /etc/pam.d/system-auth"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_smart_card_required_smartcard_auth:tst:1" comment="smart card is required in /etc/pam.d/smartcard-auth"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-set_password_hashing_algorithm_systemauth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set PAM's Password Hashing Algorithm</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="set_password_hashing_algorithm_systemauth"/>
                  <description>The password hashing algorithm should be set correctly in /etc/pam.d/system-auth.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_pam_unix_sha512:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-set_password_hashing_algorithm_passwordauth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set PAM's Password Hashing Algorithm - password-auth</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="set_password_hashing_algorithm_passwordauth"/>
                  <description>The password hashing algorithm should be set correctly in /etc/pam.d/password-auth.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_pam_unix_passwordauth_sha512:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-set_password_hashing_algorithm_logindefs:def:1" version="2" class="compliance">
                <metadata>
                  <title>Set Password Hashing Algorithm in /etc/login.defs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="set_password_hashing_algorithm_logindefs"/>
                  <description>The password hashing algorithm should be set correctly in /etc/login.defs.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_etc_login_defs_encrypt_method:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-set_password_hashing_algorithm_libuserconf:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set Password Hashing Algorithm in /etc/libuser.conf</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="set_password_hashing_algorithm_libuserconf"/>
                  <description>The password hashing algorithm should be set correctly in /etc/libuser.conf.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_etc_libuser_conf_cryptstyle:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-set_firewalld_default_zone:def:1" version="2" class="compliance">
                <metadata>
                  <title>Set Default firewalld Zone for Incoming Packets</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="set_firewalld_default_zone"/>
                  <description>Change the default firewalld zone to drop.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_firewalld_input_drop:tst:1" comment="Set default zone to drop"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_usbguard_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable the USBGuard Service</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_usbguard_enabled"/>
                  <description>The usbguard service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package usbguard installed and service usbguard is configured to start">
                  <criterion test_ref="oval:ssg-test_service_usbguard_package_usbguard_installed:tst:1" comment="usbguard installed"/>
                  <criteria comment="service usbguard is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_usbguard:tst:1" comment="usbguard is running"/>
                    <criteria operator="OR" comment="service usbguard is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_usbguard:tst:1" comment="multi-user.target wants usbguard"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_usbguard_socket:tst:1" comment="multi-user.target wants usbguard socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_systemd-coredump_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable acquiring, saving, and processing core dumps</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_systemd-coredump_disabled"/>
                  <description>The systemd-coredump service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package systemd removed or service systemd-coredump is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_systemd-coredump_package_systemd_removed:tst:1" comment="systemd removed"/>
                  <criteria comment="service systemd-coredump is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_systemd-coredump:tst:1" comment="systemd-coredump is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_systemd-coredump:tst:1" comment="Property LoadState of service systemd-coredump is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_syslogng_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable syslog-ng Service</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_syslogng_enabled"/>
                  <description>The syslog-ng service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package syslog-ng installed and service syslog-ng is configured to start">
                  <criterion test_ref="oval:ssg-test_service_syslog-ng_package_syslog-ng_installed:tst:1" comment="syslog-ng installed"/>
                  <criteria comment="service syslog-ng is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_syslog-ng:tst:1" comment="syslog-ng is running"/>
                    <criteria operator="OR" comment="service syslog-ng is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_syslog-ng:tst:1" comment="multi-user.target wants syslog-ng"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_syslog-ng_socket:tst:1" comment="multi-user.target wants syslog-ng socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_syslog_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>service_syslog_disabled</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_syslog_disabled"/>
                  <description>The syslog service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package rsyslog removed or service syslog is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_syslog_package_rsyslog_removed:tst:1" comment="rsyslog removed"/>
                  <criteria comment="service syslog is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_syslog:tst:1" comment="syslog is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_syslog:tst:1" comment="Property LoadState of service syslog is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_sssd_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>service_sssd_disabled</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_sssd_disabled"/>
                  <description>The sssd service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package sssd-common removed or service sssd is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_sssd_package_sssd-common_removed:tst:1" comment="sssd-common removed"/>
                  <criteria comment="service sssd is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_sssd:tst:1" comment="sssd is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_sssd:tst:1" comment="Property LoadState of service sssd is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_sshd_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable SSH Server If Possible (Unusual)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_sshd_disabled"/>
                  <description>The sshd service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package openssh-server removed or service sshd is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_sshd_package_openssh-server_removed:tst:1" comment="openssh-server removed"/>
                  <criteria comment="service sshd is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_sshd:tst:1" comment="sshd is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_sshd:tst:1" comment="Property LoadState of service sshd is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_rsyslog_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable rsyslog Service</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_rsyslog_enabled"/>
                  <description>The rsyslog service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package rsyslog installed and service rsyslog is configured to start">
                  <criterion test_ref="oval:ssg-test_service_rsyslog_package_rsyslog_installed:tst:1" comment="rsyslog installed"/>
                  <criteria comment="service rsyslog is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_rsyslog:tst:1" comment="rsyslog is running"/>
                    <criteria operator="OR" comment="service rsyslog is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_rsyslog:tst:1" comment="multi-user.target wants rsyslog"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_rsyslog_socket:tst:1" comment="multi-user.target wants rsyslog socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_rsyncd_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure rsyncd service is diabled</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_rsyncd_disabled"/>
                  <description>The rsyncd service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package rsync-daemon removed or service rsyncd is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_rsyncd_package_rsync-daemon_removed:tst:1" comment="rsync-daemon removed"/>
                  <criteria comment="service rsyncd is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_rsyncd:tst:1" comment="rsyncd is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_rsyncd:tst:1" comment="Property LoadState of service rsyncd is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_rpcsvcgssd_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Secure RPC Server Service (rpcsvcgssd)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_rpcsvcgssd_disabled"/>
                  <description>The rpcsvcgssd service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package nfs-utils removed or service rpcsvcgssd is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_rpcsvcgssd_package_nfs-utils_removed:tst:1" comment="nfs-utils removed"/>
                  <criteria comment="service rpcsvcgssd is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_rpcsvcgssd:tst:1" comment="rpcsvcgssd is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_rpcsvcgssd:tst:1" comment="Property LoadState of service rpcsvcgssd is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_rpcidmapd_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable RPC ID Mapping Service (rpcidmapd)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_rpcidmapd_disabled"/>
                  <description>The rpcidmapd service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package nfs-utils removed or service rpcidmapd is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_rpcidmapd_package_nfs-utils_removed:tst:1" comment="nfs-utils removed"/>
                  <criteria comment="service rpcidmapd is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_rpcidmapd:tst:1" comment="rpcidmapd is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_rpcidmapd:tst:1" comment="Property LoadState of service rpcidmapd is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_rpcgssd_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Secure RPC Client Service (rpcgssd)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_rpcgssd_disabled"/>
                  <description>The rpcgssd service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package nfs-utils removed or service rpcgssd is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_rpcgssd_package_nfs-utils_removed:tst:1" comment="nfs-utils removed"/>
                  <criteria comment="service rpcgssd is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_rpcgssd:tst:1" comment="rpcgssd is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_rpcgssd:tst:1" comment="Property LoadState of service rpcgssd is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_rngd_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable the Hardware RNG Entropy Gatherer Service</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_rngd_enabled"/>
                  <description>The rngd service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package rng-tools installed and service rngd is configured to start">
                  <criterion test_ref="oval:ssg-test_service_rngd_package_rng-tools_installed:tst:1" comment="rng-tools installed"/>
                  <criteria comment="service rngd is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_rngd:tst:1" comment="rngd is running"/>
                    <criteria operator="OR" comment="service rngd is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_rngd:tst:1" comment="multi-user.target wants rngd"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_rngd_socket:tst:1" comment="multi-user.target wants rngd socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_pcscd_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable the pcscd Service</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_pcscd_enabled"/>
                  <description>The pcscd service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package pcsc-lite installed and service pcscd is configured to start">
                  <criterion test_ref="oval:ssg-test_service_pcscd_package_pcsc-lite_installed:tst:1" comment="pcsc-lite installed"/>
                  <criteria comment="service pcscd is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_pcscd:tst:1" comment="pcscd is running"/>
                    <criteria operator="OR" comment="service pcscd is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_pcscd:tst:1" comment="multi-user.target wants pcscd"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_pcscd_socket:tst:1" comment="multi-user.target wants pcscd socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_ntpd_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable the NTP Daemon</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_ntpd_enabled"/>
                  <description>The ntpd service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package ntp installed and service ntpd is configured to start">
                  <criterion test_ref="oval:ssg-test_service_ntpd_package_ntp_installed:tst:1" comment="ntp installed"/>
                  <criteria comment="service ntpd is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_ntpd:tst:1" comment="ntpd is running"/>
                    <criteria operator="OR" comment="service ntpd is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_ntpd:tst:1" comment="multi-user.target wants ntpd"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_ntpd_socket:tst:1" comment="multi-user.target wants ntpd socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_ntp_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable the NTP Daemon</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_ntp_enabled"/>
                  <description>The ntp service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package ntp installed and service ntp is configured to start">
                  <criterion test_ref="oval:ssg-test_service_ntp_package_ntp_installed:tst:1" comment="ntp installed"/>
                  <criteria comment="service ntp is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_ntp:tst:1" comment="ntp is running"/>
                    <criteria operator="OR" comment="service ntp is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_ntp:tst:1" comment="multi-user.target wants ntp"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_ntp_socket:tst:1" comment="multi-user.target wants ntp socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_nfslock_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Network File System Lock Service (nfslock)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_nfslock_disabled"/>
                  <description>The nfslock service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package nfs-utils removed or service nfslock is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_nfslock_package_nfs-utils_removed:tst:1" comment="nfs-utils removed"/>
                  <criteria comment="service nfslock is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_nfslock:tst:1" comment="nfslock is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_nfslock:tst:1" comment="Property LoadState of service nfslock is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_nfs_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Network File System (nfs)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_nfs_disabled"/>
                  <description>The nfs-server service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package nfs-utils removed or service nfs-server is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_nfs-server_package_nfs-utils_removed:tst:1" comment="nfs-utils removed"/>
                  <criteria comment="service nfs-server is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_nfs-server:tst:1" comment="nfs-server is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_nfs-server:tst:1" comment="Property LoadState of service nfs-server is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_netfs_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Network File Systems (netfs)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_netfs_disabled"/>
                  <description>The netfs service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package netfs removed or service netfs is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_netfs_package_netfs_removed:tst:1" comment="netfs removed"/>
                  <criteria comment="service netfs is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_netfs:tst:1" comment="netfs is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_netfs:tst:1" comment="Property LoadState of service netfs is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_iptables_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify iptables Enabled</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_iptables_enabled"/>
                  <description>The iptables service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package iptables installed and service iptables is configured to start">
                  <criterion test_ref="oval:ssg-test_service_iptables_package_iptables_installed:tst:1" comment="iptables installed"/>
                  <criteria comment="service iptables is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_iptables:tst:1" comment="iptables is running"/>
                    <criteria operator="OR" comment="service iptables is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_iptables:tst:1" comment="multi-user.target wants iptables"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_iptables_socket:tst:1" comment="multi-user.target wants iptables socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_ip6tables_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify ip6tables Enabled if Using IPv6</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_ip6tables_enabled"/>
                  <description>The ip6tables service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package iptables-ipv6 installed and service ip6tables is configured to start">
                  <criterion test_ref="oval:ssg-test_service_ip6tables_package_iptables-ipv6_installed:tst:1" comment="iptables-ipv6 installed"/>
                  <criteria comment="service ip6tables is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_ip6tables:tst:1" comment="ip6tables is running"/>
                    <criteria operator="OR" comment="service ip6tables is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_ip6tables:tst:1" comment="multi-user.target wants ip6tables"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_ip6tables_socket:tst:1" comment="multi-user.target wants ip6tables socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_firewalld_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify firewalld Enabled</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_firewalld_enabled"/>
                  <description>The firewalld service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package firewalld installed and service firewalld is configured to start">
                  <criterion test_ref="oval:ssg-test_service_firewalld_package_firewalld_installed:tst:1" comment="firewalld installed"/>
                  <criteria comment="service firewalld is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_firewalld:tst:1" comment="firewalld is running"/>
                    <criteria operator="OR" comment="service firewalld is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_firewalld:tst:1" comment="multi-user.target wants firewalld"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_firewalld_socket:tst:1" comment="multi-user.target wants firewalld socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_debug-shell_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable debug-shell SystemD Service</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_debug-shell_disabled"/>
                  <description>The debug-shell service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package systemd removed or service debug-shell is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_debug-shell_package_systemd_removed:tst:1" comment="systemd removed"/>
                  <criteria comment="service debug-shell is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_debug-shell:tst:1" comment="debug-shell is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_debug-shell:tst:1" comment="Property LoadState of service debug-shell is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_crond_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable cron Service</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_crond_enabled"/>
                  <description>The crond service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package cronie installed and service crond is configured to start">
                  <criterion test_ref="oval:ssg-test_service_crond_package_cronie_installed:tst:1" comment="cronie installed"/>
                  <criteria comment="service crond is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_crond:tst:1" comment="crond is running"/>
                    <criteria operator="OR" comment="service crond is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_crond:tst:1" comment="multi-user.target wants crond"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_crond_socket:tst:1" comment="multi-user.target wants crond socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_cron_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable cron Service</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_cron_enabled"/>
                  <description>The cron service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package cron installed and service cron is configured to start">
                  <criterion test_ref="oval:ssg-test_service_cron_package_cron_installed:tst:1" comment="cron installed"/>
                  <criteria comment="service cron is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_cron:tst:1" comment="cron is running"/>
                    <criteria operator="OR" comment="service cron is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_cron:tst:1" comment="multi-user.target wants cron"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_cron_socket:tst:1" comment="multi-user.target wants cron socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_chronyd_or_ntpd_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable the NTP Daemon</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_chronyd_or_ntpd_enabled"/>
                  <description>At least one of the chronyd or ntpd services should be enabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="chronyd or ntpd service enabled">
                  <extend_definition definition_ref="oval:ssg-service_chronyd_enabled:def:1" comment="service chronyd enabled"/>
                  <extend_definition definition_ref="oval:ssg-service_ntpd_enabled:def:1" comment="service ntpd enabled"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_chronyd_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>The Chronyd service is enabled</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_chronyd_enabled"/>
                  <description>The chronyd service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package chrony installed and service chronyd is configured to start">
                  <criterion test_ref="oval:ssg-test_service_chronyd_package_chrony_installed:tst:1" comment="chrony installed"/>
                  <criteria comment="service chronyd is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_chronyd:tst:1" comment="chronyd is running"/>
                    <criteria operator="OR" comment="service chronyd is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_chronyd:tst:1" comment="multi-user.target wants chronyd"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_chronyd_socket:tst:1" comment="multi-user.target wants chronyd socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_bluetooth_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Bluetooth Service</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_bluetooth_disabled"/>
                  <description>The bluetooth service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package bluez removed or service bluetooth is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_bluetooth_package_bluez_removed:tst:1" comment="bluez removed"/>
                  <criteria comment="service bluetooth is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_bluetooth:tst:1" comment="bluetooth is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_bluetooth:tst:1" comment="Property LoadState of service bluetooth is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_autofs_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable the Automounter</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_autofs_disabled"/>
                  <description>The autofs service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package autofs removed or service autofs is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_autofs_package_autofs_removed:tst:1" comment="autofs removed"/>
                  <criteria comment="service autofs is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_autofs:tst:1" comment="autofs is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_autofs:tst:1" comment="Property LoadState of service autofs is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_auditd_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable auditd Service</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_auditd_enabled"/>
                  <description>The auditd service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package audit installed and service auditd is configured to start">
                  <criterion test_ref="oval:ssg-test_service_auditd_package_audit_installed:tst:1" comment="audit installed"/>
                  <criteria comment="service auditd is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_auditd:tst:1" comment="auditd is running"/>
                    <criteria operator="OR" comment="service auditd is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_auditd:tst:1" comment="multi-user.target wants auditd"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_auditd_socket:tst:1" comment="multi-user.target wants auditd socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_atd_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable At Service (atd)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_atd_disabled"/>
                  <description>The atd service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package at removed or service atd is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_atd_package_at_removed:tst:1" comment="at removed"/>
                  <criteria comment="service atd is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_atd:tst:1" comment="atd is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_atd:tst:1" comment="Property LoadState of service atd is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-selinux_state:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure SELinux State is Enforcing</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="selinux_state"/>
                  <description>The SELinux state should be enforcing the local policy.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_etc_selinux_config:tst:1" comment="enforce is disabled"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-selinux_policytype:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure SELinux Policy</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="selinux_policytype"/>
                  <description>The SELinux policy should be set appropriately.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_selinux_policy:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-selinux_confinement_of_daemons:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure No Daemons are Unconfined by SELinux</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="selinux_confinement_of_daemons"/>
                  <description>All pids in /proc should be assigned an SELinux security context other than 'unconfined_service_t'.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_selinux_confinement_of_daemons:tst:1" comment="no unconfined_service_t in /proc"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-selinux_all_devicefiles_labeled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure No Device Files are Unlabeled by SELinux</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="selinux_all_devicefiles_labeled"/>
                  <description>All device files in /dev should be assigned an SELinux security context other than 'device_t' and 'unlabeled_t'.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_selinux_dev_device_t:tst:1" comment="device_t in /dev"/>
                  <criterion test_ref="oval:ssg-test_selinux_dev_unlabeled_t:tst:1" comment="unlabeled_t in /dev"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-securetty_root_login_console_only:def:1" version="1" class="compliance">
                <metadata>
                  <title>Restrict Virtual Console Root Logins</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="securetty_root_login_console_only"/>
                  <description>Preventing direct root login to virtual console devices
      helps ensure accountability for actions taken on the system using the
      root account.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_virtual_consoles_etc_securetty:tst:1" comment="virtual consoles /etc/securetty"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-rsyslog_remote_tls_cacert:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure CA certificate for rsyslog remote logging</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rsyslog_remote_tls_cacert"/>
                  <description>Check that the CA certificate path is set</description>
                </metadata>
                <criteria comment="Check that CA certificate is configured for rsyslog remote logging">
                  <criterion test_ref="oval:ssg-test_rsyslog_remote_tls_cacert:tst:1" comment="Check that the CA certificate path is set"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-rsyslog_remote_tls:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure TLS for rsyslog remote logging</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rsyslog_remote_tls"/>
                  <description>Check that all needed TLS-related options are present</description>
                </metadata>
                <criteria comment="Check that rsyslog is configured to use TLS for remote logging">
                  <criterion test_ref="oval:ssg-test_rsyslog_remote_tls:tst:1" comment="Check that all needed TLS-related options are present"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-rsyslog_remote_loghost:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Logs Sent To Remote Host</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rsyslog_remote_loghost"/>
                  <description>Syslog logs should be sent to a remote loghost</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_remote_rsyslog_conf:tst:1" comment="Remote logging set within /etc/rsyslog.conf"/>
                  <criterion test_ref="oval:ssg-test_remote_rsyslog_d:tst:1" comment="Remote logging set within /etc/rsyslog.d"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-rsyslog_remote_access_monitoring:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure remote access methods are monitored in Rsyslog</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rsyslog_remote_access_monitoring"/>
                  <description>Rsyslog should be configured to monitor remote access methods.</description>
                </metadata>
                <criteria comment="remote access methods are configured in rsyslog">
                  <criterion test_ref="oval:ssg-test_remote_method_monitoring_auth:tst:1" comment="ensure 'auth.*' remote method is configured in rsyslog"/>
                  <criterion test_ref="oval:ssg-test_remote_method_monitoring_authpriv:tst:1" comment="ensure 'authpriv.*' remote method is configured in rsyslog"/>
                  <criterion test_ref="oval:ssg-test_remote_method_monitoring_daemon:tst:1" comment="ensure 'daemon.*' remote method is configured in rsyslog"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-rsyslog_nolisten:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rsyslog_nolisten"/>
                  <description>rsyslogd should reject remote messages</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rsyslog_nolisten:tst:1" comment="Conditions are satisfied"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-rsyslog_files_permissions:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure System Log Files Have Correct Permissions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rsyslog_files_permissions"/>
                  <description>File permissions for all syslog log files should be set correctly.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rsyslog_files_permissions:tst:1" comment="Check permissions of all system log files"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-rsyslog_files_ownership:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Log Files Are Owned By Appropriate User</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rsyslog_files_ownership"/>
                  <description>All syslog log files should be owned by the appropriate user.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rsyslog_files_ownership:tst:1" comment="Check if all system log files are owned by appropriate user"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-rsyslog_files_groupownership:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Log Files Are Owned By Appropriate Group</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rsyslog_files_groupownership"/>
                  <description>All syslog log files should be owned by the appropriate group.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rsyslog_files_groupownership:tst:1" comment="Check if all system log files are owned by the appropriate group"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Rsyslog Encrypts Off-Loaded Audit Records</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rsyslog_encrypt_offload_defaultnetstreamdriver"/>
                  <description>Rsyslogd must encrypt the off-loading of logs off of the system.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:tst:1" comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf"/>
                    <criterion test_ref="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:tst:1" comment="Check if $DefaultNetstreamDriver gtls is set in files in /etc/rsyslog.d"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Rsyslog Encrypts Off-Loaded Audit Records</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rsyslog_encrypt_offload_actionsendstreamdrivermode"/>
                  <description>Rsyslogd must encrypt the off-loading of logs off of the system.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:tst:1" comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf"/>
                    <criterion test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:tst:1" comment="Check if $ActionSendStreamDriverMode 1 is set in files in /etc/rsyslog.d"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Rsyslog Authenticates Off-Loaded Audit Records</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rsyslog_encrypt_offload_actionsendstreamdriverauthmode"/>
                  <description>Rsyslogd must authenticate remote system its sending logs to.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:tst:1" comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"/>
                    <criterion test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:tst:1" comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in files in /etc/rsyslog.d"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-rsyslog_cron_logging:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure cron Is Logging To Rsyslog</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rsyslog_cron_logging"/>
                  <description>Rsyslog should be configured to capture cron messages.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_cron_logging_rsyslog:tst:1" comment="cron is configured in /etc/rsyslog.conf"/>
                  <criterion test_ref="oval:ssg-test_cron_logging_rsyslog_dir:tst:1" comment="cron is configured in /etc/rsyslog.d"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-rpm_verify_permissions:def:1" version="3" class="compliance">
                <metadata>
                  <title>Verify and Correct File Permissions with RPM</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rpm_verify_permissions"/>
                  <description>Verify the permissions of installed packages
      by comparing the installed files with information about the
      files taken from the package metadata stored in the RPM
      database.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_verify_all_rpms_mode:tst:1" comment="mode of all files matches local rpm database"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-rpm_verify_hashes:def:1" version="3" class="compliance">
                <metadata>
                  <title>Verify File Hashes with RPM</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rpm_verify_hashes"/>
                  <description>Verify the RPM digests of system binaries using the RPM database.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_files_fail_md5_hash:tst:1" comment="verify file md5 hashes"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-root_permissions_syslibrary_files:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify the system-wide library files in directories
"/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are group-owned by root.</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="root_permissions_syslibrary_files"/>
                  <description>This test makes sure that FILEPATH is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_0:tst:1" comment="Check file group ownership of /lib/"/>
                  <criterion test_ref="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_1:tst:1" comment="Check file group ownership of /lib64/"/>
                  <criterion test_ref="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_2:tst:1" comment="Check file group ownership of /usr/lib/"/>
                  <criterion test_ref="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_3:tst:1" comment="Check file group ownership of /usr/lib64/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-root_path_no_dot:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure that Root's Path Does Not Include Relative Paths or Null Directories</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="root_path_no_dot"/>
                  <description>The environment variable PATH should be set correctly for
      the root user.</description>
                </metadata>
                <criteria comment="environment variable PATH contains dangerous path">
                  <criterion test_ref="oval:ssg-test_env_var_begins:tst:1" comment="environment variable PATH starts with : or ."/>
                  <criterion test_ref="oval:ssg-test_env_var_contains_doublecolon:tst:1" comment="environment variable PATH contains : twice in a row"/>
                  <criterion test_ref="oval:ssg-test_env_var_contains_doubleperiod:tst:1" comment="environment variable PATH contains . twice in a row"/>
                  <criterion test_ref="oval:ssg-test_env_var_ends:tst:1" comment="environment variable PATH ends with : or ."/>
                  <criterion test_ref="oval:ssg-test_env_var_begins_slash:tst:1" comment="environment variable PATH doesn't begin with a /"/>
                  <criterion test_ref="oval:ssg-test_env_var_contains_relative_path:tst:1" comment="environment variable PATH doesn't contain relative paths"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-restrict_serial_port_logins:def:1" version="1" class="compliance">
                <metadata>
                  <title>Restrict Serial Port Root Logins</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="restrict_serial_port_logins"/>
                  <description>Preventing direct root login to serial port interfaces helps
      ensure accountability for actions taken on the system using the root
      account.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_serial_ports_etc_securetty:tst:1" negate="true" comment="serial ports /etc/securetty"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-require_singleuser_auth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Require Authentication for Single User Mode</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="require_singleuser_auth"/>
                  <description>The requirement for a password to boot into single-user mode
      should be configured correctly.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_require_rescue_service:tst:1" comment="Conditions are satisfied"/>
                  <criterion test_ref="oval:ssg-test_require_rescue_service_runlevel1:tst:1"/>
                  <criterion test_ref="oval:ssg-test_no_custom_runlevel1_target:tst:1" negate="true"/>
                  <criterion test_ref="oval:ssg-test_no_custom_rescue_service:tst:1" negate="true"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-require_emergency_target_auth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Require Authentication for Emergency Systemd Target</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="require_emergency_target_auth"/>
                  <description>The requirement for a password to boot into emergency mode
      should be configured correctly.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_require_emergency_service:tst:1" comment="Conditions are satisfied"/>
                  <criterion test_ref="oval:ssg-test_require_emergency_service_emergency_target:tst:1"/>
                  <criterion test_ref="oval:ssg-test_no_custom_emergency_target:tst:1" negate="true"/>
                  <criterion test_ref="oval:ssg-test_no_custom_emergency_service:tst:1" negate="true"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-removable_partition_doesnt_exist:def:1" version="1" class="compliance">
                <metadata>
                  <title>Device Files for Removable Media Partitions Does Not Exist on the System</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="removable_partition_doesnt_exist"/>
                  <description>Verify if device file representing removable partitions
      exist on the system</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_removable_partition_doesnt_exist:tst:1" comment="Check if removable partition really exists on the system"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" version="1" class="inventory">
                <metadata>
                  <title>Test that the architecture is s390x</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="proc_sys_kernel_osrelease_arch_s390x"/>
                  <description>Check that architecture of kernel in /proc/sys/kernel/osrelease is s390x</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1" comment="Architecture is s390x"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-proc_sys_kernel_osrelease_arch_not_s390x:def:1" version="1" class="inventory">
                <metadata>
                  <title>Test for different architecture than s390x</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="proc_sys_kernel_osrelease_arch_not_s390x"/>
                  <description>Check that architecture of kernel in /proc/sys/kernel/osrelease is not s390x</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" negate="true" comment="Architecture is not s390x"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-proc_sys_kernel_osrelease_arch_not_aarch64:def:1" version="1" class="inventory">
                <metadata>
                  <title>Test for different architecture than aarch64</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="proc_sys_kernel_osrelease_arch_not_aarch64"/>
                  <description>Check that architecture of kernel in /proc/sys/kernel/osrelease is not aarch64</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-proc_sys_kernel_osrelease_arch_aarch64:def:1" negate="true" comment="Architecture is not aarch64"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-proc_sys_kernel_osrelease_arch_aarch64:def:1" version="1" class="inventory">
                <metadata>
                  <title>Test that the architecture is aarch64</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="proc_sys_kernel_osrelease_arch_aarch64"/>
                  <description>Check that architecture of kernel in /proc/sys/kernel/osrelease is aarch64</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_proc_sys_kernel_osrelease_arch_aarch64:tst:1" comment="Architecture is aarch64"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-prefer_64bit_os:def:1" version="1" class="compliance">
                <metadata>
                  <title>Prefer to use a 64-bit Operating System when supported</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="prefer_64bit_os"/>
                  <description>Check if the system supports a 64-bit Operating System</description>
                </metadata>
                <criteria operator="OR" comment="Either the OS is 64-bit, or the CPU doesn't support 64-bit (it is 32 or 16 bit)">
                  <criterion test_ref="oval:ssg-test_proc_sys_kernel_osrelease_64_bit:tst:1" comment="Check if OS is 64-bit"/>
                  <criterion test_ref="oval:ssg-test_proc_cpuinfo_64_bit:tst:1" negate="true" comment="Check if CPU is not 64-bit"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-postfix_client_configure_mail_alias:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure System to Forward All Mail For The Root Account</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="postfix_client_configure_mail_alias"/>
                  <description>Check if root has the correct mail alias.</description>
                </metadata>
                <criteria comment="Check if root has the correct mail alias.">
                  <criterion test_ref="oval:ssg-test_postfix_client_configure_mail_alias:tst:1" comment="Check if root has the correct mail alias."/>
                </criteria>
              </definition>
              <definition id="oval:ssg-partition_for_var_log_audit:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure /var/log/audit Located On Separate Partition</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="partition_for_var_log_audit"/>
                  <description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-testvar_log_audit_partition:tst:1" comment="/var/log/audit on own partition"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-partition_for_var_log:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure /var/log Located On Separate Partition</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="partition_for_var_log"/>
                  <description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-testvar_log_partition:tst:1" comment="/var/log on own partition"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-partition_for_var:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure /var Located On Separate Partition</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="partition_for_var"/>
                  <description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-testvar_partition:tst:1" comment="/var on own partition"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-partition_for_usr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure /usr Located On Separate Partition</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="partition_for_usr"/>
                  <description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-testusr_partition:tst:1" comment="/usr on own partition"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-partition_for_tmp:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure /tmp Located On Separate Partition</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="partition_for_tmp"/>
                  <description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-testtmp_partition:tst:1" comment="/tmp on own partition"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-partition_for_srv:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure /srv Located On Separate Partition</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="partition_for_srv"/>
                  <description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-testsrv_partition:tst:1" comment="/srv on own partition"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-partition_for_opt:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure /opt Located On Separate Partition</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="partition_for_opt"/>
                  <description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-testopt_partition:tst:1" comment="/opt on own partition"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-partition_for_home:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure /home Located On Separate Partition</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="partition_for_home"/>
                  <description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-testhome_partition:tst:1" comment="/home on own partition"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-partition_for_boot:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure /boot Located On Separate Partition</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="partition_for_boot"/>
                  <description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-testboot_partition:tst:1" comment="/boot on own partition"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_xorg-x11-server-common_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Remove the X Windows Package Group</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_xorg-x11-server-common_removed"/>
                  <description>The RPM package xorg-x11-server-common should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_xorg-x11-server-common_removed:tst:1" comment="package xorg-x11-server-common is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_vsftpd_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall vsftpd Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_vsftpd_removed"/>
                  <description>The RPM package vsftpd should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_vsftpd_removed:tst:1" comment="package vsftpd is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_vsftpd_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install vsftpd Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_vsftpd_installed"/>
                  <description>The RPM package vsftpd should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_vsftpd_installed:tst:1" comment="package vsftpd is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_vim_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install vim Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_vim_installed"/>
                  <description>The RPM package vim-enhanced should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_vim-enhanced_installed:tst:1" comment="package vim-enhanced is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_usbguard_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install usbguard Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_usbguard_installed"/>
                  <description>The RPM package usbguard should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_usbguard_installed:tst:1" comment="package usbguard is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_tuned_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall tuned Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_tuned_removed"/>
                  <description>The RPM package tuned should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_tuned_removed:tst:1" comment="package tuned is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_tmux_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install the tmux Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_tmux_installed"/>
                  <description>The RPM package tmux should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_tmux_installed:tst:1" comment="package tmux is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_telnetd_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall the telnet server</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_telnetd_removed"/>
                  <description>The RPM package telnetd should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_telnetd_removed:tst:1" comment="package telnetd is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_telnetd-ssl_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall the ssl compliant telnet server</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_telnetd-ssl_removed"/>
                  <description>The RPM package telnetd-ssl should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_telnetd-ssl_removed:tst:1" comment="package telnetd-ssl is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_tar_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install tar Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_tar_installed"/>
                  <description>The RPM package tar should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_tar_installed:tst:1" comment="package tar is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_syslogng_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure syslog-ng is Installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_syslogng_installed"/>
                  <description>The RPM package syslog-ng should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_syslog-ng_installed:tst:1" comment="package syslog-ng is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_sudo_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install sudo Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_sudo_installed"/>
                  <description>The RPM package sudo should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_sudo_installed:tst:1" comment="package sudo is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_sssd-ipa_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install sssd-ipa Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_sssd-ipa_installed"/>
                  <description>The RPM package sssd-ipa should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_sssd-ipa_installed:tst:1" comment="package sssd-ipa is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_setroubleshoot_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall setroubleshoot Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_setroubleshoot_removed"/>
                  <description>The RPM package setroubleshoot should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_setroubleshoot_removed:tst:1" comment="package setroubleshoot is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_setroubleshoot-server_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall setroubleshoot-server Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_setroubleshoot-server_removed"/>
                  <description>The RPM package setroubleshoot-server should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_setroubleshoot-server_removed:tst:1" comment="package setroubleshoot-server is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_setroubleshoot-plugins_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall setroubleshoot-plugins Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_setroubleshoot-plugins_removed"/>
                  <description>The RPM package setroubleshoot-plugins should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_setroubleshoot-plugins_removed:tst:1" comment="package setroubleshoot-plugins is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_sendmail_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall Sendmail Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_sendmail_removed"/>
                  <description>The RPM package sendmail should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_sendmail_removed:tst:1" comment="package sendmail is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_screen_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install the screen Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_screen_installed"/>
                  <description>The RPM package screen should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_screen_installed:tst:1" comment="package screen is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_scap-security-guide_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install scap-security-guide Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_scap-security-guide_installed"/>
                  <description>The RPM package scap-security-guide should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_scap-security-guide_installed:tst:1" comment="package scap-security-guide is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_samba-common_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>package_samba-common_removed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_samba-common_removed"/>
                  <description>The RPM package samba-common should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_samba-common_removed:tst:1" comment="package samba-common is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_rsyslog_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure rsyslog is Installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_rsyslog_installed"/>
                  <description>The RPM package rsyslog should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_rsyslog_installed:tst:1" comment="package rsyslog is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_rsyslog-gnutls_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure rsyslog-gnutls is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_rsyslog-gnutls_installed"/>
                  <description>The RPM package rsyslog-gnutls should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_rsyslog-gnutls_installed:tst:1" comment="package rsyslog-gnutls is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_rng-tools_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install rng-tools Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_rng-tools_installed"/>
                  <description>The RPM package rng-tools should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_rng-tools_installed:tst:1" comment="package rng-tools is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_rear_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install rear Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_rear_installed"/>
                  <description>The RPM package rear should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_rear_installed:tst:1" comment="package rear is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_python3-abrt-addon_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall python3-abrt-addon Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_python3-abrt-addon_removed"/>
                  <description>The RPM package python3-abrt-addon should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_python3-abrt-addon_removed:tst:1" comment="package python3-abrt-addon is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_prelink_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>package_prelink_removed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_prelink_removed"/>
                  <description>The RPM package prelink should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_prelink_removed:tst:1" comment="package prelink is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_policycoreutils_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install policycoreutils Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_policycoreutils_installed"/>
                  <description>The RPM package policycoreutils should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_policycoreutils_installed:tst:1" comment="package policycoreutils is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_pcsc-lite_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install the pcsc-lite package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_pcsc-lite_installed"/>
                  <description>The RPM package pcsc-lite should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_pcsc-lite_installed:tst:1" comment="package pcsc-lite is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_pam_ldap_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>package_pam_ldap_removed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_pam_ldap_removed"/>
                  <description>The RPM package pam_ldap should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_pam_ldap_removed:tst:1" comment="package pam_ldap is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_openssh-server_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Remove the OpenSSH Server Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_openssh-server_removed"/>
                  <description>The RPM package openssh-server should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_openssh-server_removed:tst:1" comment="package openssh-server is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_openssh-server_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install the OpenSSH Server Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_openssh-server_installed"/>
                  <description>The RPM package openssh-server should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_openssh-server_installed:tst:1" comment="package openssh-server is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_openscap-scanner_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install openscap-scanner Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_openscap-scanner_installed"/>
                  <description>The RPM package openscap-scanner should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_openscap-scanner_installed:tst:1" comment="package openscap-scanner is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_opensc_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install the opensc Package For Multifactor Authentication</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_opensc_installed"/>
                  <description>The RPM package opensc should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_opensc_installed:tst:1" comment="package opensc is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_openldap-clients_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure LDAP client is not installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_openldap-clients_removed"/>
                  <description>The RPM package openldap-clients should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_openldap-clients_removed:tst:1" comment="package openldap-clients is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_ntpdate_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall the ntpdate package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_ntpdate_removed"/>
                  <description>The RPM package ntpdate should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_ntpdate_removed:tst:1" comment="package ntpdate is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_ntp_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install the ntp service</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_ntp_installed"/>
                  <description>The RPM package ntp should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_ntp_installed:tst:1" comment="package ntp is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_nss-tools_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure nss-tools is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_nss-tools_installed"/>
                  <description>The RPM package nss-tools should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_nss-tools_installed:tst:1" comment="package nss-tools is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_nis_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall the nis package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_nis_removed"/>
                  <description>The RPM package nis should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_nis_removed:tst:1" comment="package nis is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_nfs-utils_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall nfs-utils Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_nfs-utils_removed"/>
                  <description>The RPM package nfs-utils should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_nfs-utils_removed:tst:1" comment="package nfs-utils is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_net-snmp_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall net-snmp Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_net-snmp_removed"/>
                  <description>The RPM package net-snmp should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_net-snmp_removed:tst:1" comment="package net-snmp is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_mcstrans_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall mcstrans Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_mcstrans_removed"/>
                  <description>The RPM package mcstrans should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_mcstrans_removed:tst:1" comment="package mcstrans is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_libselinux_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install libselinux Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_libselinux_installed"/>
                  <description>The RPM package libselinux should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_libselinux_installed:tst:1" comment="package libselinux is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_libreswan_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install libreswan Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_libreswan_installed"/>
                  <description>The RPM package libreswan should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_libreswan_installed:tst:1" comment="package libreswan is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_libreport-plugin-rhtsupport_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall libreport-plugin-rhtsupport Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_libreport-plugin-rhtsupport_removed"/>
                  <description>The RPM package libreport-plugin-rhtsupport should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_libreport-plugin-rhtsupport_removed:tst:1" comment="package libreport-plugin-rhtsupport is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_libreport-plugin-logger_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall libreport-plugin-logger Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_libreport-plugin-logger_removed"/>
                  <description>The RPM package libreport-plugin-logger should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_libreport-plugin-logger_removed:tst:1" comment="package libreport-plugin-logger is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_libcap-ng-utils_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install libcap-ng-utils Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_libcap-ng-utils_installed"/>
                  <description>The RPM package libcap-ng-utils should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_libcap-ng-utils_installed:tst:1" comment="package libcap-ng-utils is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_krb5-workstation_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall krb5-workstation Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_krb5-workstation_removed"/>
                  <description>The RPM package krb5-workstation should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_krb5-workstation_removed:tst:1" comment="package krb5-workstation is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_iptables_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install iptables Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_iptables_installed"/>
                  <description>The RPM package iptables should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_iptables_installed:tst:1" comment="package iptables is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_iprutils_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall iprutils Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_iprutils_removed"/>
                  <description>The RPM package iprutils should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_iprutils_removed:tst:1" comment="package iprutils is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_inetutils-telnetd_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall the inet-based telnet server</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_inetutils-telnetd_removed"/>
                  <description>The RPM package inetutils-telnetd should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_inetutils-telnetd_removed:tst:1" comment="package inetutils-telnetd is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_gssproxy_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall gssproxy Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_gssproxy_removed"/>
                  <description>The RPM package gssproxy should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_gssproxy_removed:tst:1" comment="package gssproxy is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_gnutls-utils_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure gnutls-utils is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_gnutls-utils_installed"/>
                  <description>The RPM package gnutls-utils should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_gnutls-utils_installed:tst:1" comment="package gnutls-utils is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_geolite2-country_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall geolite2-country Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_geolite2-country_removed"/>
                  <description>The RPM package geolite2-country should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_geolite2-country_removed:tst:1" comment="package geolite2-country is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_geolite2-city_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall geolite2-city Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_geolite2-city_removed"/>
                  <description>The RPM package geolite2-city should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_geolite2-city_removed:tst:1" comment="package geolite2-city is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_gdm_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Remove the GDM Package Group</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_gdm_removed"/>
                  <description>The RPM package gdm should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_gdm_removed:tst:1" comment="package gdm is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_gdm_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>package_gdm_installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_gdm_installed"/>
                  <description>The RPM package gdm should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_gdm_installed:tst:1" comment="package gdm is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_fapolicyd_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install fapolicyd Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_fapolicyd_installed"/>
                  <description>The RPM package fapolicyd should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_fapolicyd_installed:tst:1" comment="package fapolicyd is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_esc_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>package_esc_installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_esc_installed"/>
                  <description>The RPM package esc should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_esc_installed:tst:1" comment="package esc is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_dnf-automatic_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install dnf-automatic Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_dnf-automatic_installed"/>
                  <description>The RPM package dnf-automatic should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_dnf-automatic_installed:tst:1" comment="package dnf-automatic is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_dconf_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>package_dconf_installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_dconf_installed"/>
                  <description>The RPM package dconf should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_dconf_installed:tst:1" comment="package dconf is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_cryptsetup-luks_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install cryptsetup-luks Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_cryptsetup-luks_installed"/>
                  <description>The RPM package cryptsetup-luks should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_cryptsetup-luks_installed:tst:1" comment="package cryptsetup-luks is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_cron_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install the cron service</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_cron_installed"/>
                  <description>The RPM package cron should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_cron_installed:tst:1" comment="package cron is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_chrony_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>The Chrony package is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_chrony_installed"/>
                  <description>The RPM package chrony should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_chrony_installed:tst:1" comment="package chrony is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_binutils_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install binutils Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_binutils_installed"/>
                  <description>The RPM package binutils should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_binutils_installed:tst:1" comment="package binutils is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_bind_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall bind Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_bind_removed"/>
                  <description>The RPM package bind should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_bind_removed:tst:1" comment="package bind is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_avahi_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>package_avahi_installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_avahi_installed"/>
                  <description>The RPM package avahi should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_avahi_installed:tst:1" comment="package avahi is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_audit_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure the audit Subsystem is Installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_audit_installed"/>
                  <description>The RPM package audit should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_audit_installed:tst:1" comment="package audit is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_audit-audispd-plugins_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure the default plugins for the audit dispatcher are Installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_audit-audispd-plugins_installed"/>
                  <description>The RPM package audit-audispd-plugins should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_audit-audispd-plugins_installed:tst:1" comment="package audit-audispd-plugins is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_audispd-plugins_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install audispd-plugins Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_audispd-plugins_installed"/>
                  <description>The RPM package audispd-plugins should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_audispd-plugins_installed:tst:1" comment="package audispd-plugins is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_aide_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install AIDE</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_aide_installed"/>
                  <description>The RPM package aide should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_aide_installed:tst:1" comment="package aide is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_abrt_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall Automatic Bug Reporting Tool (abrt)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_abrt_removed"/>
                  <description>The RPM package abrt should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_abrt_removed:tst:1" comment="package abrt is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_abrt-plugin-sosreport_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall abrt-plugin-sosreport Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_abrt-plugin-sosreport_removed"/>
                  <description>The RPM package abrt-plugin-sosreport should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_abrt-plugin-sosreport_removed:tst:1" comment="package abrt-plugin-sosreport is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_abrt-plugin-rhtsupport_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall abrt-plugin-rhtsupport Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_abrt-plugin-rhtsupport_removed"/>
                  <description>The RPM package abrt-plugin-rhtsupport should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_abrt-plugin-rhtsupport_removed:tst:1" comment="package abrt-plugin-rhtsupport is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_abrt-plugin-logger_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall abrt-plugin-logger Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_abrt-plugin-logger_removed"/>
                  <description>The RPM package abrt-plugin-logger should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_abrt-plugin-logger_removed:tst:1" comment="package abrt-plugin-logger is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_abrt-cli_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall abrt-cli Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_abrt-cli_removed"/>
                  <description>The RPM package abrt-cli should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_abrt-cli_removed:tst:1" comment="package abrt-cli is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_abrt-addon-kerneloops_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall abrt-addon-kerneloops Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_abrt-addon-kerneloops_removed"/>
                  <description>The RPM package abrt-addon-kerneloops should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_abrt-addon-kerneloops_removed:tst:1" comment="package abrt-addon-kerneloops is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_abrt-addon-ccpp_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall abrt-addon-ccpp Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_abrt-addon-ccpp_removed"/>
                  <description>The RPM package abrt-addon-ccpp should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_abrt-addon-ccpp_removed:tst:1" comment="package abrt-addon-ccpp is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_MFEhiplsm_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install the Host Intrusion Prevention System (HIPS) Module</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_MFEhiplsm_installed"/>
                  <description>The RPM package MFEhiplsm should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_MFEhiplsm_installed:tst:1" comment="package MFEhiplsm is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_GConf2_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>package_GConf2_installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_GConf2_installed"/>
                  <description>The RPM package GConf2 should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_GConf2_installed:tst:1" comment="package GConf2 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-ntpd_specify_remote_server:def:1" version="2" class="compliance">
                <metadata>
                  <title>Specify a Remote NTP Server</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="ntpd_specify_remote_server"/>
                  <description>A remote ntpd NTP Server for time synchronization should be
      specified (and dependencies are met)</description>
                </metadata>
                <criteria comment="ntp.conf conditions are met">
                  <criterion test_ref="oval:ssg-test_ntp_remote_server:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-ntpd_specify_multiple_servers:def:1" version="2" class="compliance">
                <metadata>
                  <title>Specify Additional Remote NTP Servers</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="ntpd_specify_multiple_servers"/>
                  <description>Multiple ntpd NTP Servers for time synchronization should be specified.</description>
                </metadata>
                <criteria comment="ntp.conf conditions are met">
                  <criterion test_ref="oval:ssg-test_ntpd_multiple_servers:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-ntpd_run_as_ntp_user:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure ntpd To Run As ntp User</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="ntpd_run_as_ntp_user"/>
                  <description>Ensure ntpd is configured to run correctly under the ntp user.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_ntpd_run_as_ntp_user_etc_sysconfig_ntpd:tst:1" comment="check /etc/sysconfig/ntpd is configured correctly"/>
                  <criterion test_ref="oval:ssg-test_ntpd_run_as_ntp_user_systemd:tst:1" comment="check /usr/lib/systemd/system/ntpd.service is configured correctly"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-ntpd_configure_restrictions:def:1" version="2" class="compliance">
                <metadata>
                  <title>Configure server restrictions for ntpd</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="ntpd_configure_restrictions"/>
                  <description>Certain restrictions are imposed on ntp servers configured to be used by ntpd</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_ntpd_configure_restrictions_ipv6:tst:1" comment="test ipv6 configuration"/>
                  <criterion test_ref="oval:ssg-test_ntpd_configure_restrictions_ipv4:tst:1" comment="test ipv4 configuration"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_tmux_in_shells:def:1" version="1" class="compliance">
                <metadata>
                  <title>Prevent user from disabling the screen lock</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_tmux_in_shells"/>
                  <description>Check that tmux is not listed in /etc/shells</description>
                </metadata>
                <criteria comment="Check that tmux is not listed in /etc/shells">
                  <criterion test_ref="oval:ssg-test_no_tmux_in_shells:tst:1" comment="check that tmux is not listed in /etc/shells"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_shelllogin_for_systemaccounts:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure that System Accounts Do Not Run a Shell Upon Login</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_shelllogin_for_systemaccounts"/>
                  <description>The root account is the only system account that should have
      a login shell.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_sys_uid_min_not_defined:tst:1" comment="Test SYS_UID_MIN not defined in /etc/login.defs"/>
                    <criterion test_ref="oval:ssg-test_sys_uid_max_not_defined:tst:1" comment="Test SYS_UID_MAX not defined in /etc/login.defs"/>
                    <criterion test_ref="oval:ssg-test_shell_defined_default_uid_range:tst:1" comment="Test shell defined for UID from &lt;0, UID_MIN -1&gt;"/>
                  </criteria>
                  <criteria>
                    <criterion test_ref="oval:ssg-test_sys_uid_min_not_defined:tst:1" negate="true" comment="Test SYS_UID_MIN defined in /etc/login.defs"/>
                    <criterion test_ref="oval:ssg-test_sys_uid_max_not_defined:tst:1" negate="true" comment="Test SYS_UID_MAX defined in /etc/login.defs"/>
                    <criterion test_ref="oval:ssg-test_shell_defined_reserved_uid_range:tst:1" comment="Test shell defined for reserved system UIDs"/>
                    <criterion test_ref="oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1" comment="Test shell defined for dynamically allocated system UIDs"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_rsh_trust_files:def:1" version="1" class="compliance">
                <metadata>
                  <title>Remove Rsh Trust Files</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_rsh_trust_files"/>
                  <description>There should not be any .rhosts or hosts.equiv files on the system.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_no_rsh_trust_files_root:tst:1" negate="true"/>
                  <criterion test_ref="oval:ssg-test_no_rsh_trust_files_home:tst:1" negate="true"/>
                  <criterion test_ref="oval:ssg-test_no_rsh_trust_files_etc:tst:1" negate="true"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_netrc_files:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify No netrc Files Exist</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_netrc_files"/>
                  <description>The .netrc files contain login information used to auto-login into FTP servers and reside in the user's home directory. Any .netrc files should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_no_netrc_files_home:tst:1" negate="true"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_legacy_plus_entries_etc_shadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure there are no legacy + NIS entries in /etc/shadow</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_legacy_plus_entries_etc_shadow"/>
                  <description>No lines starting with + are in /etc/shadow</description>
                </metadata>
                <criteria comment="no lines starting with + are in /etc/shadow">
                  <criterion test_ref="oval:ssg-test_no_legacy_plus_entries_etc_shadow:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_legacy_plus_entries_etc_passwd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure there are no legacy + NIS entries in /etc/passwd</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_legacy_plus_entries_etc_passwd"/>
                  <description>No lines starting with + are in /etc/passwd</description>
                </metadata>
                <criteria comment="no lines starting with + are in /etc/passwd">
                  <criterion test_ref="oval:ssg-test_no_legacy_plus_entries_etc_passwd:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_legacy_plus_entries_etc_group:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure there are no legacy + NIS entries in /etc/group</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_legacy_plus_entries_etc_group"/>
                  <description>No lines starting with + are in /etc/group</description>
                </metadata>
                <criteria comment="no lines starting with + are in /etc/group">
                  <criterion test_ref="oval:ssg-test_no_legacy_plus_entries_etc_group:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_insecure_locks_exports:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Insecure File Locking is Not Allowed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_insecure_locks_exports"/>
                  <description>Allowing insecure file locking could allow for sensitive 
      data to be viewed or edited by an unauthorized user.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_no_insecure_locks_exports:tst:1" comment="Check for insecure NFS locks in /etc/exports"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_files_unowned_by_user:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure All Files Are Owned by a User</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_files_unowned_by_user"/>
                  <description>All files should be owned by a user</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-no_files_unowned_by_user_test:tst:1" comment="Check all files and make sure they are owned by a user"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_empty_passwords_etc_shadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure There Are No Accounts With Blank or Null Passwords</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_empty_passwords_etc_shadow"/>
                  <description>The file /etc/shadow shows that there aren't empty passwords</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_no_empty_passwords_etc_shadow:tst:1" comment="make sure there aren't blank or null passwords in /etc/shadow"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_empty_passwords:def:1" version="1" class="compliance">
                <metadata>
                  <title>Prevent Login to Accounts With Empty Password</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_empty_passwords"/>
                  <description>The file /etc/pam.d/system-auth should not contain the nullok option</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_no_empty_passwords:tst:1" comment="make sure the nullok option is not used in /etc/pam.d/system-auth"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_direct_root_logins:def:1" version="1" class="compliance">
                <metadata>
                  <title>Direct root Logins Not Allowed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_direct_root_logins"/>
                  <description>Preventing direct root logins help ensure accountability for actions
      taken on the system using the root account.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_no_direct_root_logins:tst:1" comment="serial ports /etc/securetty"/>
                  <criterion test_ref="oval:ssg-test_etc_securetty_exists:tst:1" comment="serial ports /etc/securetty"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" version="1" class="compliance">
                <metadata>
                  <title>No CD/DVD drive is configured to automount in /etc/fstab</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_cd_dvd_drive_in_etc_fstab"/>
                  <description>Check the /etc/fstab and check if a CD/DVD drive
      is not configured for automount.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_no_cd_dvd_drive_in_etc_fstab:tst:1" comment="Check if CD/DVD drive is not configured to automout in /etc/fstab"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-network_sniffer_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure System is Not Acting as a Network Sniffer</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="network_sniffer_disabled"/>
                  <description>Disable the network sniffer</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_promisc_interfaces:tst:1" negate="true" comment="promisc interfaces"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-network_nmcli_permissions:def:1" version="1" class="compliance">
                <metadata>
                  <title>Prevent non-Privileged Users from Modifying Network Interfaces using nmcli</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="network_nmcli_permissions"/>
                  <description>polkit is properly configured to prevent non-privileged users from changing networking settings</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_network_nmcli_permissions:tst:1" comment="check for properly configured .pkla file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-network_ipv6_static_address:def:1" version="1" class="compliance">
                <metadata>
                  <title>Manually Assign Global IPv6 Address</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="network_ipv6_static_address"/>
                  <description>Manually configure addresses for IPv6</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="IPv6 disabled or..."/>
                  <criterion test_ref="oval:ssg-test_network_ipv6_static_address:tst:1" comment="Set static IPv6 address on each interface"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-network_ipv6_privacy_extensions:def:1" version="1" class="compliance">
                <metadata>
                  <title>Use Privacy Extensions for Address</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="network_ipv6_privacy_extensions"/>
                  <description>Enable privacy extensions for IPv6</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="IPv6 disabled or..."/>
                  <criterion test_ref="oval:ssg-test_network_ipv6_privacy_extensions:tst:1" comment="Enable privacy extensions per interface"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-network_ipv6_disable_rpc:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Support for RPC IPv6</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="network_ipv6_disable_rpc"/>
                  <description>Disable ipv6 based rpc services</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_network_ipv6_disable_rpc_udp6:tst:1" comment="Disable udp6"/>
                  <criterion test_ref="oval:ssg-test_network_ipv6_disable_rpc_tcp6:tst:1" comment="Disable tcp6"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-network_ipv6_default_gateway:def:1" version="1" class="compliance">
                <metadata>
                  <title>Manually Assign IPv6 Router Address</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="network_ipv6_default_gateway"/>
                  <description>Define default gateways for IPv6 traffic</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="IPv6 disabled or..."/>
                  <criterion test_ref="oval:ssg-test_network_ipv6_default_gateway:tst:1" comment="Define default gateways"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-network_disable_zeroconf:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Zeroconf Networking</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="network_disable_zeroconf"/>
                  <description>Disable Zeroconf automatic route assignment in the
      169.254.0.0 subnet.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysconfig_nozeroconf_yes:tst:1" comment="Look for NOZEROCONF=yes in /etc/sysconfig/network"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_var_tmp_bind:def:1" version="1" class="compliance">
                <metadata>
                  <title>Bind Mount /var/tmp To /tmp</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_var_tmp_bind"/>
                  <description>The /var/tmp directory should be bind mounted to /tmp in
      order to consolidate temporary storage into one location protected by the
      same techniques as /tmp.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_configure_mount_option_var_tmp_bind_tmp:tst:1" comment="Ensure /var/tmp is configured to bind mount to /tmp"/>
                  <criterion test_ref="oval:ssg-test_mount_option_var_tmp:tst:1" comment="Ensure /var/tmp is mounted"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_mount_option_var_tmp_bind:tst:1" comment="Ensure /var/tmp is mounted and binded"/>
                    <criterion test_ref="oval:ssg-test_mount_option_var_tmp_bind_compare_source:tst:1" comment="Ensure /var/tmp and /tmp have the same source device"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_var_nosuid:def:1" version="2" class="compliance">
                <metadata>
                  <title>Add nosuid Option to /var</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_var_nosuid"/>
                  <description>/var should be mounted with mount option nosuid.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_var_partition_nosuid_optional_yes:tst:1" comment="nosuid on /var"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_var_noexec:def:1" version="2" class="compliance">
                <metadata>
                  <title>Add noexec Option to /var</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_var_noexec"/>
                  <description>/var should be mounted with mount option noexec.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_var_partition_noexec_optional_yes:tst:1" comment="noexec on /var"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_var_nodev:def:1" version="2" class="compliance">
                <metadata>
                  <title>Add nodev Option to /var</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_var_nodev"/>
                  <description>/var should be mounted with mount option nodev.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_var_partition_nodev_optional_yes:tst:1" comment="nodev on /var"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_var_log_nosuid:def:1" version="2" class="compliance">
                <metadata>
                  <title>Add nosuid Option to /var/log</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_var_log_nosuid"/>
                  <description>/var/log should be mounted with mount option nosuid.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_var_log_partition_nosuid_optional_yes:tst:1" comment="nosuid on /var/log"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_var_log_noexec:def:1" version="2" class="compliance">
                <metadata>
                  <title>Add noexec Option to /var/log</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_var_log_noexec"/>
                  <description>/var/log should be mounted with mount option noexec.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_var_log_partition_noexec_optional_yes:tst:1" comment="noexec on /var/log"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_var_log_nodev:def:1" version="2" class="compliance">
                <metadata>
                  <title>Add nodev Option to /var/log</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_var_log_nodev"/>
                  <description>/var/log should be mounted with mount option nodev.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_var_log_partition_nodev_optional_yes:tst:1" comment="nodev on /var/log"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_var_log_audit_nosuid:def:1" version="2" class="compliance">
                <metadata>
                  <title>Add nosuid Option to /var/log/audit</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_var_log_audit_nosuid"/>
                  <description>/var/log/audit should be mounted with mount option nosuid.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_var_log_audit_partition_nosuid_optional_yes:tst:1" comment="nosuid on /var/log/audit"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_var_log_audit_noexec:def:1" version="2" class="compliance">
                <metadata>
                  <title>Add noexec Option to /var/log/audit</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_var_log_audit_noexec"/>
                  <description>/var/log/audit should be mounted with mount option noexec.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_var_log_audit_partition_noexec_optional_yes:tst:1" comment="noexec on /var/log/audit"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_var_log_audit_nodev:def:1" version="2" class="compliance">
                <metadata>
                  <title>Add nodev Option to /var/log/audit</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_var_log_audit_nodev"/>
                  <description>/var/log/audit should be mounted with mount option nodev.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_var_log_audit_partition_nodev_optional_yes:tst:1" comment="nodev on /var/log/audit"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_tmp_nosuid:def:1" version="2" class="compliance">
                <metadata>
                  <title>Add nosuid Option to /tmp</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_tmp_nosuid"/>
                  <description>/tmp should be mounted with mount option nosuid.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_tmp_partition_nosuid_optional_yes:tst:1" comment="nosuid on /tmp"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_tmp_noexec:def:1" version="2" class="compliance">
                <metadata>
                  <title>Add noexec Option to /tmp</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_tmp_noexec"/>
                  <description>/tmp should be mounted with mount option noexec.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_tmp_partition_noexec_optional_yes:tst:1" comment="noexec on /tmp"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_tmp_nodev:def:1" version="2" class="compliance">
                <metadata>
                  <title>Add nodev Option to /tmp</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_tmp_nodev"/>
                  <description>/tmp should be mounted with mount option nodev.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_tmp_partition_nodev_optional_yes:tst:1" comment="nodev on /tmp"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_srv_nosuid:def:1" version="2" class="compliance">
                <metadata>
                  <title>Add nosuid Option to /srv</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_srv_nosuid"/>
                  <description>/srv should be mounted with mount option nosuid.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_srv_partition_nosuid_optional_yes:tst:1" comment="nosuid on /srv"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_proc_hidepid:def:1" version="2" class="compliance">
                <metadata>
                  <title>Add hidepid Option to /proc</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_proc_hidepid"/>
                  <description>/proc should be mounted with mount option hidepid.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_proc_partition_hidepid_optional_no:tst:1" comment="hidepid on /proc"/>
                  <criterion test_ref="oval:ssg-test_proc_no_partition_hidepid_optional_no:tst:1" negate="true" comment="/proc does not exist"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_opt_nosuid:def:1" version="2" class="compliance">
                <metadata>
                  <title>Add nosuid Option to /opt</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_opt_nosuid"/>
                  <description>/opt should be mounted with mount option nosuid.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_opt_partition_nosuid_optional_yes:tst:1" comment="nosuid on /opt"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_nosuid_removable_partitions:def:1" version="5" class="compliance">
                <metadata>
                  <title>Add nosuid Option to Removable Media Partitions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_nosuid_removable_partitions"/>
                  <description>The nosuid option should be enabled for all removable devices mounts in /etc/fstab.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1" comment="Check if removable partition really exists on the system"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1" comment="Check if removable partition value represents CD/DVD drive"/>
                    <criteria operator="OR">
                      <criterion test_ref="oval:ssg-test_nosuid_etc_fstab_cd_dvd_drive:tst:1" comment="Check if at least one from CD/DVD drive alternative names is using 'nosuid' mount option in /etc/fstab"/>
                      <extend_definition definition_ref="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" comment="Check if CD/DVD drive is not configured to automount in /etc/fstab"/>
                    </criteria>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_nosuid_etc_fstab_not_cd_dvd_drive:tst:1" comment="Check if removable partition is using 'nosuid' mount option in /etc/fstab"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_noexec_removable_partitions:def:1" version="5" class="compliance">
                <metadata>
                  <title>Add noexec Option to Removable Media Partitions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_noexec_removable_partitions"/>
                  <description>The noexec option should be enabled for all removable devices mounts in /etc/fstab.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1" comment="Check if removable partition really exists on the system"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1" comment="Check if removable partition value represents CD/DVD drive"/>
                    <criteria operator="OR">
                      <criterion test_ref="oval:ssg-test_noexec_etc_fstab_cd_dvd_drive:tst:1" comment="Check if at least one from CD/DVD drive alternative names is using 'noexec' mount option in /etc/fstab"/>
                      <extend_definition definition_ref="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" comment="Check if CD/DVD drive is not configured to automount in /etc/fstab"/>
                    </criteria>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_noexec_etc_fstab_not_cd_dvd_drive:tst:1" comment="Check if removable partition is using 'noexec' mount option in /etc/fstab"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_nodev_removable_partitions:def:1" version="5" class="compliance">
                <metadata>
                  <title>Add nodev Option to Removable Media Partitions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_nodev_removable_partitions"/>
                  <description>The nodev option should be enabled for all removable devices mounts in /etc/fstab.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1" comment="Check if removable partition really exists on the system"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1" comment="Check if removable partition value represents CD/DVD drive"/>
                    <criteria operator="OR">
                      <criterion test_ref="oval:ssg-test_nodev_etc_fstab_cd_dvd_drive:tst:1" comment="Check if at least one from CD/DVD drive alternative names is using 'nodev' mount option in /etc/fstab"/>
                      <extend_definition definition_ref="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" comment="Check if CD/DVD drive is not configured to automount in /etc/fstab"/>
                    </criteria>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_nodev_etc_fstab_not_cd_dvd_drive:tst:1" comment="Check if removable partition is using 'nodev' mount option in /etc/fstab"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_nodev_nonroot_local_partitions:def:1" version="1" class="compliance">
                <metadata>
                  <title>Add nodev Option to Non-Root Local Partitions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_nodev_nonroot_local_partitions"/>
                  <description>The nodev mount option prevents files from being interpreted
      as character or block devices. Legitimate character and block devices
      should exist in the /dev directory on the root partition or within chroot
      jails built for system services. All other locations should not allow
      character and block devices.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_nodev_nonroot_local_partitions:tst:1" negate="true" comment="nodev on local filesystems"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_home_noexec:def:1" version="2" class="compliance">
                <metadata>
                  <title>Add noexec Option to /home</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_home_noexec"/>
                  <description>/home should be mounted with mount option noexec.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_home_partition_noexec_optional_yes:tst:1" comment="noexec on /home"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_dev_shm_nosuid:def:1" version="2" class="compliance">
                <metadata>
                  <title>Add nosuid Option to /dev/shm</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_dev_shm_nosuid"/>
                  <description>/dev/shm should be mounted with mount option nosuid.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_dev_shm_partition_nosuid_optional_no:tst:1" comment="nosuid on /dev/shm"/>
                  <criterion test_ref="oval:ssg-test_dev_shm_no_partition_nosuid_optional_no:tst:1" negate="true" comment="/dev/shm does not exist"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_dev_shm_noexec:def:1" version="2" class="compliance">
                <metadata>
                  <title>Add noexec Option to /dev/shm</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_dev_shm_noexec"/>
                  <description>/dev/shm should be mounted with mount option noexec.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_dev_shm_partition_noexec_optional_no:tst:1" comment="noexec on /dev/shm"/>
                  <criterion test_ref="oval:ssg-test_dev_shm_no_partition_noexec_optional_no:tst:1" negate="true" comment="/dev/shm does not exist"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_dev_shm_nodev:def:1" version="2" class="compliance">
                <metadata>
                  <title>Add nodev Option to /dev/shm</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_dev_shm_nodev"/>
                  <description>/dev/shm should be mounted with mount option nodev.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_dev_shm_partition_nodev_optional_no:tst:1" comment="nodev on /dev/shm"/>
                  <criterion test_ref="oval:ssg-test_dev_shm_no_partition_nodev_optional_no:tst:1" negate="true" comment="/dev/shm does not exist"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_boot_nosuid:def:1" version="2" class="compliance">
                <metadata>
                  <title>Add nosuid Option to /boot</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_boot_nosuid"/>
                  <description>/boot should be mounted with mount option nosuid.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_boot_partition_nosuid_optional_yes:tst:1" comment="nosuid on /boot"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_boot_noexec:def:1" version="2" class="compliance">
                <metadata>
                  <title>Add noexec Option to /boot</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_boot_noexec"/>
                  <description>/boot should be mounted with mount option noexec.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_boot_partition_noexec_optional_yes:tst:1" comment="noexec on /boot"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_boot_nodev:def:1" version="2" class="compliance">
                <metadata>
                  <title>Add nodev Option to /boot</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_boot_nodev"/>
                  <description>/boot should be mounted with mount option nodev.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_boot_partition_nodev_optional_yes:tst:1" comment="nodev on /boot"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_boot_noauto:def:1" version="2" class="compliance">
                <metadata>
                  <title>Add noauto Option to /boot</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_boot_noauto"/>
                  <description>/boot should be mounted with mount option noauto.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_boot_partition_noauto_optional_yes:tst:1" comment="noauto on /boot"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-logwatch_configured_splithosts:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure Logwatch SplitHosts Line</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="logwatch_configured_splithosts"/>
                  <description>Check if SplitHosts line in logwatch.conf is set appropriately.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_logwatch_configured_splithosts:tst:1" comment="Test value of SplitHosts"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-logwatch_configured_hostlimit:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure Logwatch HostLimit Line</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="logwatch_configured_hostlimit"/>
                  <description>Test if HostLimit line in logwatch.conf is set appropriately.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_logwatch_configured_hostlimit:tst:1" comment="Test value of HostLimit"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_vfat_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Mounting of vFAT filesystems</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_vfat_disabled"/>
                  <description>The kernel module vfat should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_vfat_disabled:tst:1" comment="kernel module vfat disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_vfat_etcmodules-load:tst:1" comment="kernel module vfat disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_vfat_runmodules-load:tst:1" comment="kernel module vfat disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_vfat_libmodules-load:tst:1" comment="kernel module vfat disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_vfat_runmodprobed:tst:1" comment="kernel module vfat disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_vfat_libmodprobed:tst:1" comment="kernel module vfat disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_vfat_modprobeconf:tst:1" comment="kernel module vfat disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_usb-storage_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Modprobe Loading of USB Storage Driver</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_usb-storage_disabled"/>
                  <description>The kernel module usb-storage should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_usb-storage_disabled:tst:1" comment="kernel module usb-storage disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_usb-storage_etcmodules-load:tst:1" comment="kernel module usb-storage disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_usb-storage_runmodules-load:tst:1" comment="kernel module usb-storage disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_usb-storage_libmodules-load:tst:1" comment="kernel module usb-storage disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_usb-storage_runmodprobed:tst:1" comment="kernel module usb-storage disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_usb-storage_libmodprobed:tst:1" comment="kernel module usb-storage disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_usb-storage_modprobeconf:tst:1" comment="kernel module usb-storage disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_udf_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Mounting of udf</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_udf_disabled"/>
                  <description>The kernel module udf should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_udf_disabled:tst:1" comment="kernel module udf disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_udf_etcmodules-load:tst:1" comment="kernel module udf disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_udf_runmodules-load:tst:1" comment="kernel module udf disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_udf_libmodules-load:tst:1" comment="kernel module udf disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_udf_runmodprobed:tst:1" comment="kernel module udf disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_udf_libmodprobed:tst:1" comment="kernel module udf disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_udf_modprobeconf:tst:1" comment="kernel module udf disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_tipc_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable TIPC Support</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_tipc_disabled"/>
                  <description>The kernel module tipc should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_tipc_disabled:tst:1" comment="kernel module tipc disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_tipc_etcmodules-load:tst:1" comment="kernel module tipc disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_tipc_runmodules-load:tst:1" comment="kernel module tipc disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_tipc_libmodules-load:tst:1" comment="kernel module tipc disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_tipc_runmodprobed:tst:1" comment="kernel module tipc disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_tipc_libmodprobed:tst:1" comment="kernel module tipc disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_tipc_modprobeconf:tst:1" comment="kernel module tipc disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_squashfs_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Mounting of squashfs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_squashfs_disabled"/>
                  <description>The kernel module squashfs should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_squashfs_disabled:tst:1" comment="kernel module squashfs disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_squashfs_etcmodules-load:tst:1" comment="kernel module squashfs disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_squashfs_runmodules-load:tst:1" comment="kernel module squashfs disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_squashfs_libmodules-load:tst:1" comment="kernel module squashfs disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_squashfs_runmodprobed:tst:1" comment="kernel module squashfs disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_squashfs_libmodprobed:tst:1" comment="kernel module squashfs disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_squashfs_modprobeconf:tst:1" comment="kernel module squashfs disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_rds_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable RDS Support</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_rds_disabled"/>
                  <description>The kernel module rds should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_rds_disabled:tst:1" comment="kernel module rds disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_rds_etcmodules-load:tst:1" comment="kernel module rds disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_rds_runmodules-load:tst:1" comment="kernel module rds disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_rds_libmodules-load:tst:1" comment="kernel module rds disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_rds_runmodprobed:tst:1" comment="kernel module rds disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_rds_libmodprobed:tst:1" comment="kernel module rds disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_rds_modprobeconf:tst:1" comment="kernel module rds disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_mac80211_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Kernel mac80211 Module</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_mac80211_disabled"/>
                  <description>The kernel module mac80211 should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_mac80211_disabled:tst:1" comment="kernel module mac80211 disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_mac80211_etcmodules-load:tst:1" comment="kernel module mac80211 disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_mac80211_runmodules-load:tst:1" comment="kernel module mac80211 disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_mac80211_libmodules-load:tst:1" comment="kernel module mac80211 disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_mac80211_runmodprobed:tst:1" comment="kernel module mac80211 disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_mac80211_libmodprobed:tst:1" comment="kernel module mac80211 disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_mac80211_modprobeconf:tst:1" comment="kernel module mac80211 disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_jffs2_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Mounting of jffs2</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_jffs2_disabled"/>
                  <description>The kernel module jffs2 should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_jffs2_disabled:tst:1" comment="kernel module jffs2 disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_jffs2_etcmodules-load:tst:1" comment="kernel module jffs2 disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_jffs2_runmodules-load:tst:1" comment="kernel module jffs2 disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_jffs2_libmodules-load:tst:1" comment="kernel module jffs2 disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_jffs2_runmodprobed:tst:1" comment="kernel module jffs2 disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_jffs2_libmodprobed:tst:1" comment="kernel module jffs2 disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_jffs2_modprobeconf:tst:1" comment="kernel module jffs2 disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_iwlwifi_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Kernel iwlwifi Module</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_iwlwifi_disabled"/>
                  <description>The kernel module iwlwifi should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_iwlwifi_disabled:tst:1" comment="kernel module iwlwifi disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_iwlwifi_etcmodules-load:tst:1" comment="kernel module iwlwifi disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_iwlwifi_runmodules-load:tst:1" comment="kernel module iwlwifi disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_iwlwifi_libmodules-load:tst:1" comment="kernel module iwlwifi disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_iwlwifi_runmodprobed:tst:1" comment="kernel module iwlwifi disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_iwlwifi_libmodprobed:tst:1" comment="kernel module iwlwifi disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_iwlwifi_modprobeconf:tst:1" comment="kernel module iwlwifi disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_iwlmvm_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Kernel iwlmvm Module</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_iwlmvm_disabled"/>
                  <description>The kernel module iwlmvm should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_iwlmvm_disabled:tst:1" comment="kernel module iwlmvm disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_iwlmvm_etcmodules-load:tst:1" comment="kernel module iwlmvm disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_iwlmvm_runmodules-load:tst:1" comment="kernel module iwlmvm disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_iwlmvm_libmodules-load:tst:1" comment="kernel module iwlmvm disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_iwlmvm_runmodprobed:tst:1" comment="kernel module iwlmvm disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_iwlmvm_libmodprobed:tst:1" comment="kernel module iwlmvm disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_iwlmvm_modprobeconf:tst:1" comment="kernel module iwlmvm disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_ipv6_option_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable IPv6 Networking Support Automatic Loading</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_ipv6_option_disabled"/>
                  <description>The disable option will allow the IPv6 module to be inserted, but prevent address assignment and activation of the network stack.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_kernel_module_ipv6_option_disabled:tst:1" comment="ipv6 disabled any modprobe conf file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_hfsplus_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Mounting of hfsplus</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_hfsplus_disabled"/>
                  <description>The kernel module hfsplus should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_hfsplus_disabled:tst:1" comment="kernel module hfsplus disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_hfsplus_etcmodules-load:tst:1" comment="kernel module hfsplus disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_hfsplus_runmodules-load:tst:1" comment="kernel module hfsplus disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_hfsplus_libmodules-load:tst:1" comment="kernel module hfsplus disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_hfsplus_runmodprobed:tst:1" comment="kernel module hfsplus disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_hfsplus_libmodprobed:tst:1" comment="kernel module hfsplus disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_hfsplus_modprobeconf:tst:1" comment="kernel module hfsplus disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_hfs_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Mounting of hfs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_hfs_disabled"/>
                  <description>The kernel module hfs should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_hfs_disabled:tst:1" comment="kernel module hfs disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_hfs_etcmodules-load:tst:1" comment="kernel module hfs disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_hfs_runmodules-load:tst:1" comment="kernel module hfs disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_hfs_libmodules-load:tst:1" comment="kernel module hfs disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_hfs_runmodprobed:tst:1" comment="kernel module hfs disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_hfs_libmodprobed:tst:1" comment="kernel module hfs disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_hfs_modprobeconf:tst:1" comment="kernel module hfs disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_freevxfs_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Mounting of freevxfs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_freevxfs_disabled"/>
                  <description>The kernel module freevxfs should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_freevxfs_disabled:tst:1" comment="kernel module freevxfs disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_freevxfs_etcmodules-load:tst:1" comment="kernel module freevxfs disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_freevxfs_runmodules-load:tst:1" comment="kernel module freevxfs disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_freevxfs_libmodules-load:tst:1" comment="kernel module freevxfs disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_freevxfs_runmodprobed:tst:1" comment="kernel module freevxfs disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_freevxfs_libmodprobed:tst:1" comment="kernel module freevxfs disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_freevxfs_modprobeconf:tst:1" comment="kernel module freevxfs disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_firewire-core_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable IEEE 1394 (FireWire) Support</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_firewire-core_disabled"/>
                  <description>The kernel module firewire-core should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_firewire-core_disabled:tst:1" comment="kernel module firewire-core disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_firewire-core_etcmodules-load:tst:1" comment="kernel module firewire-core disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_firewire-core_runmodules-load:tst:1" comment="kernel module firewire-core disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_firewire-core_libmodules-load:tst:1" comment="kernel module firewire-core disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_firewire-core_runmodprobed:tst:1" comment="kernel module firewire-core disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_firewire-core_libmodprobed:tst:1" comment="kernel module firewire-core disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_firewire-core_modprobeconf:tst:1" comment="kernel module firewire-core disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_dccp_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable DCCP Support</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_dccp_disabled"/>
                  <description>The kernel module dccp should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_dccp_disabled:tst:1" comment="kernel module dccp disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_dccp_etcmodules-load:tst:1" comment="kernel module dccp disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_dccp_runmodules-load:tst:1" comment="kernel module dccp disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_dccp_libmodules-load:tst:1" comment="kernel module dccp disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_dccp_runmodprobed:tst:1" comment="kernel module dccp disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_dccp_libmodprobed:tst:1" comment="kernel module dccp disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_dccp_modprobeconf:tst:1" comment="kernel module dccp disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_cramfs_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Mounting of cramfs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_cramfs_disabled"/>
                  <description>The kernel module cramfs should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_cramfs_disabled:tst:1" comment="kernel module cramfs disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_cramfs_etcmodules-load:tst:1" comment="kernel module cramfs disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_cramfs_runmodules-load:tst:1" comment="kernel module cramfs disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_cramfs_libmodules-load:tst:1" comment="kernel module cramfs disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_cramfs_runmodprobed:tst:1" comment="kernel module cramfs disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_cramfs_libmodprobed:tst:1" comment="kernel module cramfs disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_cramfs_modprobeconf:tst:1" comment="kernel module cramfs disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_cfg80211_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Kernel cfg80211 Module</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_cfg80211_disabled"/>
                  <description>The kernel module cfg80211 should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_cfg80211_disabled:tst:1" comment="kernel module cfg80211 disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_cfg80211_etcmodules-load:tst:1" comment="kernel module cfg80211 disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_cfg80211_runmodules-load:tst:1" comment="kernel module cfg80211 disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_cfg80211_libmodules-load:tst:1" comment="kernel module cfg80211 disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_cfg80211_runmodprobed:tst:1" comment="kernel module cfg80211 disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_cfg80211_libmodprobed:tst:1" comment="kernel module cfg80211 disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_cfg80211_modprobeconf:tst:1" comment="kernel module cfg80211 disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_can_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable CAN Support</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_can_disabled"/>
                  <description>The kernel module can should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_can_disabled:tst:1" comment="kernel module can disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_can_etcmodules-load:tst:1" comment="kernel module can disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_can_runmodules-load:tst:1" comment="kernel module can disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_can_libmodules-load:tst:1" comment="kernel module can disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_can_runmodprobed:tst:1" comment="kernel module can disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_can_libmodprobed:tst:1" comment="kernel module can disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_can_modprobeconf:tst:1" comment="kernel module can disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_bluetooth_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Bluetooth Kernel Module</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_bluetooth_disabled"/>
                  <description>The kernel module bluetooth should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_bluetooth_disabled:tst:1" comment="kernel module bluetooth disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_bluetooth_etcmodules-load:tst:1" comment="kernel module bluetooth disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_bluetooth_runmodules-load:tst:1" comment="kernel module bluetooth disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_bluetooth_libmodules-load:tst:1" comment="kernel module bluetooth disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_bluetooth_runmodprobed:tst:1" comment="kernel module bluetooth disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_bluetooth_libmodprobed:tst:1" comment="kernel module bluetooth disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_bluetooth_modprobeconf:tst:1" comment="kernel module bluetooth disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_atm_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable ATM Support</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_atm_disabled"/>
                  <description>The kernel module atm should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_atm_disabled:tst:1" comment="kernel module atm disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_atm_etcmodules-load:tst:1" comment="kernel module atm disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_atm_runmodules-load:tst:1" comment="kernel module atm disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_atm_libmodules-load:tst:1" comment="kernel module atm disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_atm_runmodprobed:tst:1" comment="kernel module atm disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_atm_libmodprobed:tst:1" comment="kernel module atm disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_atm_modprobeconf:tst:1" comment="kernel module atm disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_x86_vsyscall_emulation:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable x86 vsyscall emulation</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_x86_vsyscall_emulation"/>
                  <description>The kernel CONFIG_X86_VSYSCALL_EMULATION should have value n</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_x86_vsyscall_emulation:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_x86_vsyscall_emulation_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_kernel_config_x86_vsyscall_emulation_absence:tst:1" comment="Check absense of build configuration of installed kernels"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_vmap_stack:def:1" version="1" class="compliance">
                <metadata>
                  <title>User a virtually-mapped stack</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_vmap_stack"/>
                  <description>The kernel CONFIG_VMAP_STACK should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_vmap_stack:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_vmap_stack_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_unmap_kernel_at_el0:def:1" version="1" class="compliance">
                <metadata>
                  <title>Unmap kernel when running in userspace (aka KAISER)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_unmap_kernel_at_el0"/>
                  <description>The kernel CONFIG_UNMAP_KERNEL_AT_EL0 should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_unmap_kernel_at_el0:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_unmap_kernel_at_el0_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_syn_cookies:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable TCP/IP syncookie support</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_syn_cookies"/>
                  <description>The kernel CONFIG_SYN_COOKIES should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_syn_cookies:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_syn_cookies_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_strict_module_rwx:def:1" version="1" class="compliance">
                <metadata>
                  <title>Make the module text and rodata read-only</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_strict_module_rwx"/>
                  <description>The kernel CONFIG_STRICT_MODULE_RWX should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_strict_module_rwx:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_strict_module_rwx_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_strict_kernel_rwx:def:1" version="1" class="compliance">
                <metadata>
                  <title>Make the kernel text and rodata read-only</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_strict_kernel_rwx"/>
                  <description>The kernel CONFIG_STRICT_KERNEL_RWX should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_strict_kernel_rwx:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_strict_kernel_rwx_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_stackprotector_strong:def:1" version="1" class="compliance">
                <metadata>
                  <title>Strong Stack Protector</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_stackprotector_strong"/>
                  <description>The kernel CONFIG_STACKPROTECTOR_STRONG should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_stackprotector_strong:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_stackprotector_strong_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_stackprotector:def:1" version="1" class="compliance">
                <metadata>
                  <title>Stack Protector buffer overlow detection</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_stackprotector"/>
                  <description>The kernel CONFIG_STACKPROTECTOR should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_stackprotector:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_stackprotector_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_slub_debug:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable SLUB debugging support</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_slub_debug"/>
                  <description>The kernel CONFIG_SLUB_DEBUG should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_slub_debug:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_slub_debug_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_slab_merge_default:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disallow merge of slab caches</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_slab_merge_default"/>
                  <description>The kernel CONFIG_SLAB_MERGE_DEFAULT should have value n</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_slab_merge_default:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_slab_merge_default_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_kernel_config_slab_merge_default_absence:tst:1" comment="Check absense of build configuration of installed kernels"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_slab_freelist_random:def:1" version="1" class="compliance">
                <metadata>
                  <title>Randomize slab freelist</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_slab_freelist_random"/>
                  <description>The kernel CONFIG_SLAB_FRELIST_RANDOM should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_slab_frelist_random:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_slab_frelist_random_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_slab_freelist_hardened:def:1" version="1" class="compliance">
                <metadata>
                  <title>Harden slab freelist metadata</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_slab_freelist_hardened"/>
                  <description>The kernel CONFIG_SLAB_FREELIST_HARDENED should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_slab_freelist_hardened:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_slab_freelist_hardened_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_security_yama:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable Yama support</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_security_yama"/>
                  <description>The kernel CONFIG_SECURITY_YAMA should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_security_yama:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_security_yama_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_security_writable_hooks:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable mutable hooks</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_security_writable_hooks"/>
                  <description>The kernel CONFIG_SECURITY_WRITABLE_HOOKS should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_security_writable_hooks:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_security_writable_hooks_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_security_dmesg_restrict:def:1" version="1" class="compliance">
                <metadata>
                  <title>Restrict unprivileged access to the kernel syslog</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_security_dmesg_restrict"/>
                  <description>The kernel CONFIG_SECURITY_DMESG_RESTRICT should have value n</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_security_dmesg_restrict:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_security_dmesg_restrict_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_kernel_config_security_dmesg_restrict_absence:tst:1" comment="Check absense of build configuration of installed kernels"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_security:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable different security models</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_security"/>
                  <description>The kernel CONFIG_SECURITY should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_security:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_security_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_seccomp_filter:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable use of Berkeley Packet Filter with seccomp</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_seccomp_filter"/>
                  <description>The kernel CONFIG_SECCOMP_FILTER should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_seccomp_filter:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_seccomp_filter_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_seccomp:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable seccomp to safely compute untrusted bytecode</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_seccomp"/>
                  <description>The kernel CONFIG_SECCOMP should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_seccomp:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_seccomp_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_sched_stack_end_check:def:1" version="1" class="compliance">
                <metadata>
                  <title>Detect stack corruption on calls to schedule()</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_sched_stack_end_check"/>
                  <description>The kernel CONFIG_SCHED_STACK_END_CHECK should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_sched_stack_end_check:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_sched_stack_end_check_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_retpoline:def:1" version="1" class="compliance">
                <metadata>
                  <title>Avoid speculative indirect branches in kernel</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_retpoline"/>
                  <description>The kernel CONFIG_RETPOLINE should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_retpoline:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_retpoline_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_refcount_full:def:1" version="1" class="compliance">
                <metadata>
                  <title>Perform full reference count validation</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_refcount_full"/>
                  <description>The kernel CONFIG_REFCOUNT_FULL should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_refcount_full:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_refcount_full_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_randomize_memory:def:1" version="1" class="compliance">
                <metadata>
                  <title>Randomize the kernel memory sections</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_randomize_memory"/>
                  <description>The kernel CONFIG_RANDOMIZE_MEMORY should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_randomize_memory:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_randomize_memory_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_randomize_base:def:1" version="1" class="compliance">
                <metadata>
                  <title>Randomize the address of the kernel image (KASLR)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_randomize_base"/>
                  <description>The kernel CONFIG_RANDOMIZE_BASE should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_randomize_base:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_randomize_base_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_proc_kcore:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable support for /proc/kkcore</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_proc_kcore"/>
                  <description>The kernel CONFIG_PROC_KCORE should have value n</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_proc_kcore:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_proc_kcore_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_kernel_config_proc_kcore_absence:tst:1" comment="Check absense of build configuration of installed kernels"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_panic_timeout:def:1" version="1" class="compliance">
                <metadata>
                  <title>Kernel panic timeout</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_panic_timeout"/>
                  <description>The kernel CONFIG_PANIC_TIMEOUT should have value according to var_kernel_config_panic_timeout</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_panic_timeout:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_panic_timeout_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_panic_on_oops:def:1" version="1" class="compliance">
                <metadata>
                  <title>Kernel panic oops</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_panic_on_oops"/>
                  <description>The kernel CONFIG_PANIC_ON_OOPS should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_panic_on_oops:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_panic_on_oops_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_page_table_isolation:def:1" version="1" class="compliance">
                <metadata>
                  <title>Remove the kernel mapping in user mode</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_page_table_isolation"/>
                  <description>The kernel CONFIG_PAGE_TABLE_ISOLATION should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_page_table_isolation:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_page_table_isolation_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_page_poisoning_zero:def:1" version="1" class="compliance">
                <metadata>
                  <title>Use zero for poisoning instead of debugging value</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_page_poisoning_zero"/>
                  <description>The kernel CONFIG_PAGE_POISONING_ZERO should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_page_poisoning_zero:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_page_poisoning_zero_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_page_poisoning_no_sanity:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable poison without sanity check</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_page_poisoning_no_sanity"/>
                  <description>The kernel CONFIG_PAGE_POISONING_NO_SANITY should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_page_poisoning_no_sanity:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_page_poisoning_no_sanity_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_page_poisoning:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable poison of pages after freeing</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_page_poisoning"/>
                  <description>The kernel CONFIG_PAGE_POISONING should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_page_poisoning:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_page_poisoning_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_module_sig_sha512:def:1" version="1" class="compliance">
                <metadata>
                  <title>Sign kernel modules with SHA-512</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_module_sig_sha512"/>
                  <description>The kernel CONFIG_MODULE_SIG_SHA512 should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_module_sig_sha512:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_module_sig_sha512_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_module_sig_key:def:1" version="1" class="compliance">
                <metadata>
                  <title>Specify module signing key to use</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_module_sig_key"/>
                  <description>The kernel CONFIG_MODULE_SIG_KEY should have value according to var_kernel_config_module_sig_key</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_module_sig_key:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_module_sig_key_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_module_sig_hash:def:1" version="1" class="compliance">
                <metadata>
                  <title>Specify the hash to use when signing modules</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_module_sig_hash"/>
                  <description>The kernel CONFIG_MODULE_SIG_HASH should have value according to var_kernel_config_module_sig_hash</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_module_sig_hash:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_module_sig_hash_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_module_sig_force:def:1" version="1" class="compliance">
                <metadata>
                  <title>Require modules to be validly signed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_module_sig_force"/>
                  <description>The kernel CONFIG_MODULE_SIG_FORCE should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_module_sig_force:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_module_sig_force_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_module_sig_all:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable automatic signing of all modules</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_module_sig_all"/>
                  <description>The kernel CONFIG_MODULE_SIG_ALL should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_module_sig_all:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_module_sig_all_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_module_sig:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable module signature verification</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_module_sig"/>
                  <description>The kernel CONFIG_MODULE_SIG should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_module_sig:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_module_sig_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_modify_ldt_syscall:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable the LDT (local descriptor table)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_modify_ldt_syscall"/>
                  <description>The kernel CONFIG_MODIFY_LDT_SYSCALL should have value n</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_modify_ldt_syscall:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_modify_ldt_syscall_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_kernel_config_modify_ldt_syscall_absence:tst:1" comment="Check absense of build configuration of installed kernels"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_legacy_vsyscall_xonly:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable vsyscall emulate execution only</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_legacy_vsyscall_xonly"/>
                  <description>The kernel CONFIG_LEGACY_VSYSCALL_XONLY should have value n</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_legacy_vsyscall_xonly:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_legacy_vsyscall_xonly_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_kernel_config_legacy_vsyscall_xonly_absence:tst:1" comment="Check absense of build configuration of installed kernels"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_legacy_vsyscall_none:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable vsyscall mapping</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_legacy_vsyscall_none"/>
                  <description>The kernel CONFIG_LEGACY_VSYSCALL_NONE should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_legacy_vsyscall_none:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_legacy_vsyscall_none_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_legacy_vsyscall_emulate:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable vsyscall emulation</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_legacy_vsyscall_emulate"/>
                  <description>The kernel CONFIG_LEGACY_VSYSCALL_EMULATE should have value n</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_legacy_vsyscall_emulate:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_legacy_vsyscall_emulate_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_kernel_config_legacy_vsyscall_emulate_absence:tst:1" comment="Check absense of build configuration of installed kernels"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_legacy_ptys:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable legacy (BSD) PTY support</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_legacy_ptys"/>
                  <description>The kernel CONFIG_LEGACY_PTYS should have value n</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_legacy_ptys:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_legacy_ptys_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_kernel_config_legacy_ptys_absence:tst:1" comment="Check absense of build configuration of installed kernels"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_kexec:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable kexec system call</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_kexec"/>
                  <description>The kernel CONFIG_KEXEC should have value n</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_kexec:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_kexec_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_kernel_config_kexec_absence:tst:1" comment="Check absense of build configuration of installed kernels"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_ipv6:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable the IPv6 protocol</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_ipv6"/>
                  <description>The kernel CONFIG_IPV6 should have value n</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_ipv6:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_ipv6_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_kernel_config_ipv6_absence:tst:1" comment="Check absense of build configuration of installed kernels"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_ia32_emulation:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable IA32 emulation</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_ia32_emulation"/>
                  <description>The kernel CONFIG_IA32_EMULATION should have value n</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_ia32_emulation:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_ia32_emulation_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_kernel_config_ia32_emulation_absence:tst:1" comment="Check absense of build configuration of installed kernels"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_hibernation:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable hibernation</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_hibernation"/>
                  <description>The kernel CONFIG_HIBERNATION should have value n</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_hibernation:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_hibernation_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_kernel_config_hibernation_absence:tst:1" comment="Check absense of build configuration of installed kernels"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_hardened_usercopy_fallback:def:1" version="1" class="compliance">
                <metadata>
                  <title>Do not allow usercopy whitelist violations to fallback to object size</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_hardened_usercopy_fallback"/>
                  <description>The kernel CONFIG_HARDENED_USERCOPY_FALLBACK should have value n</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_hardened_usercopy_fallback:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_hardened_usercopy_fallback_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_kernel_config_hardened_usercopy_fallback_absence:tst:1" comment="Check absense of build configuration of installed kernels"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_hardened_usercopy:def:1" version="1" class="compliance">
                <metadata>
                  <title>Harden memory copies between kernel and userspace</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_hardened_usercopy"/>
                  <description>The kernel CONFIG_HARDENED_USERCOPY should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_hardened_usercopy:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_hardened_usercopy_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_gcc_plugin_structleak_byref_all:def:1" version="1" class="compliance">
                <metadata>
                  <title>zero-init everything passed by reference</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_gcc_plugin_structleak_byref_all"/>
                  <description>The kernel CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_gcc_plugin_structleak_byref_all:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_gcc_plugin_structleak_byref_all_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_gcc_plugin_structleak:def:1" version="1" class="compliance">
                <metadata>
                  <title>Force initialization of variables containing userspace addresses</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_gcc_plugin_structleak"/>
                  <description>The kernel CONFIG_GCC_PLUGIN_STRUCTLEAK should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_gcc_plugin_structleak:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_gcc_plugin_structleak_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_gcc_plugin_stackleak:def:1" version="1" class="compliance">
                <metadata>
                  <title>Poison kernel stack before returning from syscalls</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_gcc_plugin_stackleak"/>
                  <description>The kernel CONFIG_GCC_PLUGIN_STACKLEAK should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_gcc_plugin_stackleak:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_gcc_plugin_stackleak_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_gcc_plugin_randstruct:def:1" version="1" class="compliance">
                <metadata>
                  <title>Randomize layout of sensitive kernel structures</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_gcc_plugin_randstruct"/>
                  <description>The kernel CONFIG_GCC_PLUGIN_RANDSTRUCT should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_gcc_plugin_randstruct:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_gcc_plugin_randstruct_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_gcc_plugin_latent_entropy:def:1" version="1" class="compliance">
                <metadata>
                  <title>Generate some entropy during boot and runtime</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_gcc_plugin_latent_entropy"/>
                  <description>The kernel CONFIG_GCC_PLUGIN_LATENT_ENTROPY should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_gcc_plugin_latent_entropy:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_gcc_plugin_latent_entropy_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_fortify_source:def:1" version="1" class="compliance">
                <metadata>
                  <title>Harden common str/mem functions against buffer overflows</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_fortify_source"/>
                  <description>The kernel CONFIG_FORTIFY_SOURCE should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_fortify_source:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_fortify_source_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_devkmem:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable /dev/kmem virtual device support</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_devkmem"/>
                  <description>The kernel CONFIG_DEVKMEM should have value n</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_devkmem:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_devkmem_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_kernel_config_devkmem_absence:tst:1" comment="Check absense of build configuration of installed kernels"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_default_mmap_min_addr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure low address space to protect from user allocation</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_default_mmap_min_addr"/>
                  <description>The kernel CONFIG_DEFAULT_MMAP_MIN_ADDR should have value 65536</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_default_mmap_min_addr:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_default_mmap_min_addr_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_debug_wx:def:1" version="1" class="compliance">
                <metadata>
                  <title>Warn on W+X mappings found at boot</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_debug_wx"/>
                  <description>The kernel CONFIG_DEBUG_WX should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_debug_wx:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_debug_wx_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_debug_sg:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable checks on scatter-gather (SG) table operations</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_debug_sg"/>
                  <description>The kernel CONFIG_DEBUG_SG should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_debug_sg:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_debug_sg_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_debug_notifiers:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable checks on notifier call chains</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_debug_notifiers"/>
                  <description>The kernel CONFIG_DEBUG_NOTIFIERS should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_debug_notifiers:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_debug_notifiers_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_debug_list:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable checks on linked list manipulation</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_debug_list"/>
                  <description>The kernel CONFIG_DEBUG_LIST should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_debug_list:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_debug_list_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_debug_fs:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable kernel debugfs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_debug_fs"/>
                  <description>The kernel CONFIG_DEBUG_FS should have value n</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_debug_fs:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_debug_fs_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_kernel_config_debug_fs_absence:tst:1" comment="Check absense of build configuration of installed kernels"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_debug_credentials:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable checks on credential management</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_debug_credentials"/>
                  <description>The kernel CONFIG_DEBUG_CREDENTIALS should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_debug_credentials:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_debug_credentials_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_compat_vdso:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable the 32-bit vDSO</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_compat_vdso"/>
                  <description>The kernel CONFIG_COMPAT_VDSO should have value n</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_compat_vdso:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_compat_vdso_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_kernel_config_compat_vdso_absence:tst:1" comment="Check absense of build configuration of installed kernels"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_compat_brk:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable compatibility with brk()</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_compat_brk"/>
                  <description>The kernel CONFIG_COMPAT_BRK should have value n</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_compat_brk:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_compat_brk_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_kernel_config_compat_brk_absence:tst:1" comment="Check absense of build configuration of installed kernels"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_bug_on_data_corruption:def:1" version="1" class="compliance">
                <metadata>
                  <title>Trigger a kernel BUG when data corruption is detected</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_bug_on_data_corruption"/>
                  <description>The kernel CONFIG_BUG_ON_DATA_CORRUPTION should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_bug_on_data_corruption:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_bug_on_data_corruption_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_bug:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable support for BUG()</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_bug"/>
                  <description>The kernel CONFIG_BUG should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_bug:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_bug_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_binfmt_misc:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable kernel support for MISC binaries</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_binfmt_misc"/>
                  <description>The kernel CONFIG_BINFMT_MISC should have value n</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_binfmt_misc:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_binfmt_misc_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_kernel_config_binfmt_misc_absence:tst:1" comment="Check absense of build configuration of installed kernels"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_arm64_sw_ttbr0_pan:def:1" version="1" class="compliance">
                <metadata>
                  <title>Emulate Privileged Access Never (PAN)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_arm64_sw_ttbr0_pan"/>
                  <description>The kernel CONFIG_ARM64_SW_TTBR0_PAN should have value y</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_arm64_sw_ttbr0_pan:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_arm64_sw_ttbr0_pan_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_config_acpi_custom_method:def:1" version="1" class="compliance">
                <metadata>
                  <title>Do not allow ACPI methods to be inserted/replaced at run time</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_config_acpi_custom_method"/>
                  <description>The kernel CONFIG_ACPI_CUSTOM_METHOD should have value n</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_acpi_custom_method:tst:1" comment="Check presence of build configuration of installed kernels"/>
                    <criterion test_ref="oval:ssg-test_all_kernels_config_acpi_custom_method_compliant:tst:1" comment="Ensure all kernels have the config"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_kernel_config_acpi_custom_method_absence:tst:1" comment="Check absense of build configuration of installed kernels"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kerberos_disable_no_keytab:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Kerberos by removing host keytab</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kerberos_disable_no_keytab"/>
                  <description>Check that there is no Kerberos keytab file present in /etc</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_kerberos_disable_no_keytab:tst:1" comment="Restrict Kerberos operation by removing keytab files"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_is_a_machine:def:1" version="2" class="inventory">
                <metadata>
                  <title>Check if the scan target is a machine</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:machine"/>
                  <reference source="ssg" ref_id="installed_env_is_a_machine"/>
                  <description>Check for absence of files characterizing container filesystems.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_env_is_a_container:def:1" negate="true" comment="If environment is not a container, it is machine"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_is_a_container:def:1" version="2" class="inventory">
                <metadata>
                  <title>Check if the scan target is a container</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:container"/>
                  <reference source="ssg" ref_id="installed_env_is_a_container"/>
                  <description>Check for presence of files characterizing container filesystems.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_installed_env_is_a_docker_container:tst:1" comment="Check if /.dockerenv exists"/>
                  <criterion test_ref="oval:ssg-test_installed_env_is_a_podman_container:tst:1" comment="Check if /run/.containerenv exists"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_zipl_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>System uses zIPL</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:zipl"/>
                  <reference source="ssg" ref_id="installed_env_has_zipl_package"/>
                  <description>Checks if system uses zIPL bootloader.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_zipl_installed:tst:1" comment="Package s390utils-base is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_yum_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package yum is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:yum"/>
                  <reference source="ssg" ref_id="installed_env_has_yum_package"/>
                  <description>Checks if package yum is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_yum_installed:tst:1" comment="Package yum is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_wifi_interface:def:1" version="1" class="inventory">
                <metadata>
                  <title>WiFi interface is present</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:wifi-iface"/>
                  <reference source="ssg" ref_id="installed_env_has_wifi_interface"/>
                  <description>Checks if any wifi interface is present.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_proc_net_wireless_exists:tst:1" comment="WiFi interface is present"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_usbguard_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package usbguard is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:usbguard"/>
                  <reference source="ssg" ref_id="installed_env_has_usbguard_package"/>
                  <description>Checks if package usbguard is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_usbguard_installed:tst:1" comment="Package usbguard is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_tftp_server_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package tftp-server is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:tftp-server"/>
                  <reference source="ssg" ref_id="installed_env_has_tftp_server_package"/>
                  <description>Checks if package tftp-server is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_tftp_server_installed:tst:1" comment="Package tftp-server is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_systemd_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package systemd is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:systemd"/>
                  <reference source="ssg" ref_id="installed_env_has_systemd_package"/>
                  <description>Checks if package systemd is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_systemd_installed:tst:1" comment="Package systemd is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_sudo_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package sudo is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:sudo"/>
                  <reference source="ssg" ref_id="installed_env_has_sudo_package"/>
                  <description>Checks if package sudo is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_sudo_installed:tst:1" comment="Package sudo is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_sssd-common_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package sssd-common is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:sssd"/>
                  <reference source="ssg" ref_id="installed_env_has_sssd-common_package"/>
                  <description>Checks if package sssd-common is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_sssd-common_installed:tst:1" comment="Package sssd-common is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_postfix_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package postfix is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:postfix"/>
                  <reference source="ssg" ref_id="installed_env_has_postfix_package"/>
                  <description>Checks if package postfix is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_postfix_installed:tst:1" comment="Package postfix is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_polkit_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package polkit is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:polkit"/>
                  <reference source="ssg" ref_id="installed_env_has_polkit_package"/>
                  <description>Checks if package polkit is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_polkit_installed:tst:1" comment="Package polkit is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_pam_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package pam is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:pam"/>
                  <reference source="ssg" ref_id="installed_env_has_pam_package"/>
                  <description>Checks if package pam is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_pam_installed:tst:1" comment="Package pam is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_ovirt:def:1" version="1" class="inventory">
                <metadata>
                  <title>Check if the system acts as an oVirt host or manager</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:ovirt-host"/>
                  <reference source="ssg" ref_id="installed_env_has_ovirt"/>
                  <description>Check if the system has ovirt-host or ovirt-engine installed</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_env_has_ovirt-host_installed:tst:1" comment="Package ovirt-host is installed"/>
                  <criterion test_ref="oval:ssg-test_env_has_ovirt-engine_installed:tst:1" comment="Package ovirt-engine is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_ntp_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package ntp is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:ntp"/>
                  <reference source="ssg" ref_id="installed_env_has_ntp_package"/>
                  <description>Checks if package ntp is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_ntp_installed:tst:1" comment="Package ntp is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_nss-pam-ldapd_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package nss-pam-ldapd is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:nss-pam-ldapd"/>
                  <reference source="ssg" ref_id="installed_env_has_nss-pam-ldapd_package"/>
                  <description>Checks if package nss-pam-ldapd is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_nss-pam-ldapd_installed:tst:1" comment="Package nss-pam-ldapd is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_no_ovirt:def:1" version="1" class="inventory">
                <metadata>
                  <title>Check if the system doesn't act as an oVirt host or manager</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="installed_env_has_no_ovirt"/>
                  <description>Check if the system has neither ovirt-host nor ovirt-engine installed.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_env_has_ovirt:def:1" negate="true" comment="Package ovirt-host is not installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_net-snmp_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package net-snmp is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:net-snmp"/>
                  <reference source="ssg" ref_id="installed_env_has_net-snmp_package"/>
                  <description>Checks if package net-snmp is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_net-snmp_installed:tst:1" comment="Package net-snmp is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_login_defs:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package providing /etc/login.defs is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:login_defs"/>
                  <reference source="ssg" ref_id="installed_env_has_login_defs"/>
                  <description>Checks if package providing /etc/login.defs and is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_login_defs_installed:tst:1" comment="Package providing /etc/login.defs is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_libuser_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package libuser is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:libuser"/>
                  <reference source="ssg" ref_id="installed_env_has_libuser_package"/>
                  <description>Checks if package libuser is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_libuser_installed:tst:1" comment="Package libuser is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_grub2_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package grub2 is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:grub2"/>
                  <reference source="ssg" ref_id="installed_env_has_grub2_package"/>
                  <description>Checks if package grub2-common is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_grub2_installed:tst:1" comment="Package grub2-common is installed"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" negate="true" comment="Test for ppcle64 architecture"/>
                    <criterion test_ref="oval:ssg-test_system_using_opal:tst:1" negate="true" comment="Test if OPAL is not used"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_gdm_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package gdm is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:gdm"/>
                  <reference source="ssg" ref_id="installed_env_has_gdm_package"/>
                  <description>Checks if package gdm is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_gdm_installed:tst:1" comment="Package gdm is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_chrony_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package chrony is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:chrony"/>
                  <reference source="ssg" ref_id="installed_env_has_chrony_package"/>
                  <description>Checks if package chrony is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_chrony_installed:tst:1" comment="Package chrony is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_audit_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package audit is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:audit"/>
                  <reference source="ssg" ref_id="installed_env_has_audit_package"/>
                  <description>Checks if package audit is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_audit_installed:tst:1" comment="Package audit is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_app_is_rhv4:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Virtualization 4</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:redhat:virtualization:4"/>
                  <reference source="ssg" ref_id="installed_app_is_rhv4"/>
                  <description>The application installed installed on the system is
      Red Hat Virtualization 4.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel7:def:1" comment="RHEL7 OS installed"/>
                  <criterion test_ref="oval:ssg-test_rhevm4_version:tst:1" comment="Red Hat Virtualization Manager (RHVM)"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_wrlinux8:def:1" version="1" class="inventory">
                <metadata>
                  <title>WRLinux 8</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:windriver:wrlinux"/>
                  <reference source="ssg" ref_id="installed_OS_is_wrlinux8"/>
                  <description>The operating system installed on the system is
      Wind River Linux 8</description>
                </metadata>
                <criteria comment="current WRLinux version is WRLinux8">
                  <criterion test_ref="oval:ssg-test_unix_wrlinux8:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criterion test_ref="oval:ssg-test_wrlinux8_version:tst:1" comment="WRLinux 8 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_wrlinux1019:def:1" version="1" class="inventory">
                <metadata>
                  <title>WRLinux 1019</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:windriver:wrlinux"/>
                  <reference source="ssg" ref_id="installed_OS_is_wrlinux1019"/>
                  <description>The operating system installed on the system is
      Wind River Linux 1019</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_unix_wrlinux1019:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criterion test_ref="oval:ssg-test_wrlinux1019_name:tst:1" comment="Produce name is WRLinux"/>
                  <criterion test_ref="oval:ssg-test_wrlinux1019_version:tst:1" comment="WRLinux version is 1019"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_vendor_supported:def:1" version="1" class="compliance">
                <metadata>
                  <title>The Installed Operating System Is Vendor Supported</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="installed_OS_is_vendor_supported"/>
                  <description>
        The operating system installed on the system is supported by a vendor that provides security patches.
      </description>
                </metadata>
                <criteria operator="OR" comment="Installed operating system is supported by a vendor">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel7:def:1" comment="Installed OS is RHEL7"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel8:def:1" comment="Installed OS is RHEL8"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel9:def:1" comment="Installed OS is RHEL9"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_ol7_family:def:1" comment="Installed OS is OL7"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_ol8_family:def:1" comment="Installed OS is OL8"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_sle12:def:1" comment="Installed OS is SLE12"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_sle15:def:1" comment="Installed OS is SLE15"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ubuntu:def:1" version="1" class="inventory">
                <metadata>
                  <title>Ubuntu</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="installed_OS_is_ubuntu"/>
                  <description>The operating system installed is an Ubuntu System</description>
                </metadata>
                <criteria comment="System is Ubuntu">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_lsb:tst:1" comment="lsb-based distrib"/>
                  <criterion test_ref="oval:ssg-test_ubuntu:tst:1" comment="Ubuntu is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ubuntu2004:def:1" version="1" class="inventory">
                <metadata>
                  <title>Ubuntu 2004</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:canonical:ubuntu_linux:20.04"/>
                  <reference source="ssg" ref_id="installed_OS_is_ubuntu2004"/>
                  <description>The operating system installed on the system is Ubuntu 2004</description>
                </metadata>
                <criteria comment="current Ubuntu version is Focal">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1" comment="Ubuntu is installed"/>
                  <criterion test_ref="oval:ssg-test_ubuntu_focal:tst:1" comment="Focal is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ubuntu1804:def:1" version="1" class="inventory">
                <metadata>
                  <title>Ubuntu 1804</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:canonical:ubuntu_linux:18.04"/>
                  <reference source="ssg" ref_id="installed_OS_is_ubuntu1804"/>
                  <description>The operating system installed on the system is Ubuntu 1804</description>
                </metadata>
                <criteria comment="current Ubuntu version is Bionic">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1" comment="Ubuntu is installed"/>
                  <criterion test_ref="oval:ssg-test_ubuntu_bionic:tst:1" comment="Bionic is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ubuntu1604:def:1" version="1" class="inventory">
                <metadata>
                  <title>Ubuntu 1604</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:canonical:ubuntu_linux:16.04"/>
                  <reference source="ssg" ref_id="installed_OS_is_ubuntu1604"/>
                  <description>The operating system installed on the system is Ubuntu 1604</description>
                </metadata>
                <criteria comment="current Ubuntu version is Xenial">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1" comment="Ubuntu is installed"/>
                  <criterion test_ref="oval:ssg-test_ubuntu_xenial:tst:1" comment="Xenial is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_sle15:def:1" version="1" class="inventory">
                <metadata>
                  <title>SUSE Linux Enterprise 15</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:suse:linux_enterprise_server:15"/>
                  <reference source="CPE" ref_id="cpe:/o:suse:linux_enterprise_desktop:15"/>
                  <reference source="ssg" ref_id="installed_OS_is_sle15"/>
                  <description>The operating system installed on the system is
      SUSE Linux Enterprise 15.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sle15_unix_family:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_sle15_desktop:tst:1" comment="SLE 15 Desktop is installed"/>
                    <criterion test_ref="oval:ssg-test_sle15_server:tst:1" comment="SLE 15 Server is installed"/>
                    <criterion test_ref="oval:ssg-test_sles_15_for_sap:tst:1" comment="SLES 15 for SAP Applications is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_sle12:def:1" version="1" class="inventory">
                <metadata>
                  <title>SUSE Linux Enterprise 12</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:suse:linux_enterprise_server:12"/>
                  <reference source="CPE" ref_id="cpe:/o:suse:linux_enterprise_desktop:12"/>
                  <reference source="ssg" ref_id="installed_OS_is_sle12"/>
                  <description>The operating system installed on the system is
      SUSE Linux Enterprise 12.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sle12_unix_family:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_sle12_desktop:tst:1" comment="SLE 12 Desktop is installed"/>
                    <criterion test_ref="oval:ssg-test_sle12_server:tst:1" comment="SLE 12 Server is installed"/>
                    <criterion test_ref="oval:ssg-test_sles_12_for_sap:tst:1" comment="SLES 12 for SAP Applications is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_sl7:def:1" version="2" class="inventory">
                <metadata>
                  <title>Scientific Linux 7</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:scientificlinux:scientificlinux:7"/>
                  <reference source="ssg" ref_id="installed_OS_is_sl7"/>
                  <description>The operating system installed on the system is
      Scientific Linux 7</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_sl7:tst:1" comment="Scientific Linux 7 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_sl6:def:1" version="2" class="inventory">
                <metadata>
                  <title>Scientific Linux 6</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:scientificlinux:scientificlinux:6"/>
                  <reference source="ssg" ref_id="installed_OS_is_sl6"/>
                  <description>The operating system installed on the system is
      Scientific Linux 6</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_sl6:tst:1" comment="Scientific Linux 6 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhv4:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Virtualization 4</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:virtualization:4"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhv4"/>
                  <description>The operating system installed on the system is
      Red Hat Virtualization Host 4.4+ or Red Hat Enterprise Host.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel8:def:1" comment="RHEL8 OS installed"/>
                  <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" comment="Red Hat Virtualization Host (RHVH)"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel9:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 9</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:9"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel9"/>
                  <description>The operating system installed on the system is
      Red Hat Enterprise Linux 9</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel9_unix_family:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_rhel9:tst:1" comment="RHEL 9 is installed"/>
                    <criteria comment="Red Hat Enterprise Virtualization Host is installed">
                      <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" comment="Red Hat Virtualization Host (RHVH)"/>
                      <criterion test_ref="oval:ssg-test_rhevh_rhel9_version:tst:1" comment="Red Hat Enterprise Virtualization Host is based on RHEL 9"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_9:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.9</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.9"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel8_9"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.9</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_9:tst:1" comment="RHEL 8.9 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_8:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.8</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.8"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel8_8"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.8</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_8:tst:1" comment="RHEL 8.8 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_7:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.7</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.7"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel8_7"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.7</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_7:tst:1" comment="RHEL 8.7 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_6:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.6</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.6"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel8_6"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.6</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_6:tst:1" comment="RHEL 8.6 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_5:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.5</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.5"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel8_5"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.5</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_5:tst:1" comment="RHEL 8.5 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_4:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.4</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.4"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel8_4"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.4</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_4:tst:1" comment="RHEL 8.4 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_3:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.3</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.3"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel8_3"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.3</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_3:tst:1" comment="RHEL 8.3 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_2:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.2</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.2"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel8_2"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.2</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_2:tst:1" comment="RHEL 8.2 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_1:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.1</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.1"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel8_1"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.1</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_1:tst:1" comment="RHEL 8.1 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_10:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.10</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.10"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel8_10"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.10</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_10:tst:1" comment="RHEL 8.10 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_0:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.0</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.0"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel8_0"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.0</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_0:tst:1" comment="RHEL 8.0 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel8"/>
                  <description>The operating system installed on the system is
      Red Hat Enterprise Linux 8</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_unix_family:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_rhel8:tst:1" comment="RHEL 8 is installed"/>
                    <criteria comment="Red Hat Enterprise Virtualization Host is installed">
                      <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" comment="Red Hat Virtualization Host (RHVH)"/>
                      <criterion test_ref="oval:ssg-test_rhevh_rhel8_version:tst:1" comment="Red Hat Enterprise Virtualization Host is based on RHEL 8"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel7:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 7</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:7"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel7"/>
                  <description>The operating system installed on the system is
      Red Hat Enterprise Linux 7</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel7_unix_family:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_rhel7_client:tst:1" comment="RHEL 7 Client is installed"/>
                    <criterion test_ref="oval:ssg-test_rhel7_workstation:tst:1" comment="RHEL 7 Workstation is installed"/>
                    <criterion test_ref="oval:ssg-test_rhel7_server:tst:1" comment="RHEL 7 Server is installed"/>
                    <criterion test_ref="oval:ssg-test_rhel7_computenode:tst:1" comment="RHEL 7 Compute Node is installed"/>
                    <criteria comment="Red Hat Enterprise Virtualization Host is installed">
                      <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" comment="Red Hat Virtualization Host (RHVH)"/>
                      <criterion test_ref="oval:ssg-test_rhevh_rhel7_version:tst:1" comment="Red Hat Enterprise Virtualization Host is based on RHEL 7"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhcos4:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux CoreOS</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux_coreos:4"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhcos4"/>
                  <description>The operating system installed on the system is
      Red Hat Enterprise Linux CoreOS release 4</description>
                </metadata>
                <criteria>
                  <criteria>
                    <criterion test_ref="oval:ssg-test_rhcos:tst:1" comment="RHCOS is installed"/>
                    <criterion test_ref="oval:ssg-test_rhcos4:tst:1" comment="RHCOS version 4 is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" class="inventory">
                <metadata>
                  <title>Installed operating system is part of the Unix family</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="installed_OS_is_part_of_Unix_family"/>
                  <description>The operating system installed on the system is part of the Unix OS family</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_unix_family:tst:1" comment="Installed operating system is part of the unix family"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_opensuse_leap42:def:1" version="1" class="inventory">
                <metadata>
                  <title>openSUSE Leap 42</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:leap:42.1"/>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:leap:42.2"/>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:leap:42.3"/>
                  <reference source="ssg" ref_id="installed_OS_is_opensuse_leap42"/>
                  <description>The operating system installed on the system is openSUSE Leap 42.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_opensuse:def:1" comment="openSUSE is installed"/>
                  <criterion test_ref="oval:ssg-test_opensuse_leap42_installed:tst:1" comment="openSUSE Leap 42 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_opensuse_leap15:def:1" version="1" class="inventory">
                <metadata>
                  <title>openSUSE Leap 15</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:leap:15.0"/>
                  <reference source="ssg" ref_id="installed_OS_is_opensuse_leap15"/>
                  <description>The operating system installed on the system is openSUSE Leap 15.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_opensuse:def:1" comment="openSUSE is installed"/>
                  <criterion test_ref="oval:ssg-test_opensuse_leap15_installed:tst:1" comment="openSUSE Leap 15 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_opensuse:def:1" version="1" class="inventory">
                <metadata>
                  <title>openSUSE</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="installed_OS_is_opensuse"/>
                  <description>The operating system installed on the system is openSUSE.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_opensuse_installed:tst:1" comment="openSUSE is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ol9_family:def:1" version="1" class="inventory">
                <metadata>
                  <title>Oracle Linux 9</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:oracle:linux:9"/>
                  <reference source="ssg" ref_id="installed_OS_is_ol9_family"/>
                  <description>The operating system installed on the system is
      Oracle Linux 9</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_ol9_system:tst:1" comment="Oracle Linux 9 System is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ol8_family:def:1" version="1" class="inventory">
                <metadata>
                  <title>Oracle Linux 8</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:oracle:linux:8"/>
                  <reference source="ssg" ref_id="installed_OS_is_ol8_family"/>
                  <description>The operating system installed on the system is
      Oracle Linux 8</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_ol8_system:tst:1" comment="Oracle Linux 8 System is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ol7_family:def:1" version="1" class="inventory">
                <metadata>
                  <title>Oracle Linux 7</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:oracle:linux:7"/>
                  <reference source="ssg" ref_id="installed_OS_is_ol7_family"/>
                  <description>The operating system installed on the system is
      Oracle Linux 7</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_ol7_system:tst:1" comment="Oracle Linux 7 System is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_fedora:def:1" version="3" class="inventory">
                <metadata>
                  <title>Installed operating system is Fedora</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:33"/>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:34"/>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:35"/>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:36"/>
                  <reference source="ssg" ref_id="installed_OS_is_fedora"/>
                  <description>The operating system installed on the system is Fedora</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_fedora_release_rpm:tst:1" comment="fedora-release RPM packages are installed"/>
                  <criterion test_ref="oval:ssg-test_fedora_vendor_product:tst:1" comment="CPE vendor is 'fedoraproject' and product is 'fedora'"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_debian:def:1" version="1" class="inventory">
                <metadata>
                  <title>Debian</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="installed_OS_is_debian"/>
                  <description>The operating system installed is a Debian System</description>
                </metadata>
                <criteria comment="System is Debian">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_debian:tst:1" comment="Debian is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_debian9:def:1" version="3" class="inventory">
                <metadata>
                  <title>Debian 9</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:debian:debian_linux:9"/>
                  <reference source="ssg" ref_id="installed_OS_is_debian9"/>
                  <description>The operating system installed on the system is Debian 9</description>
                </metadata>
                <criteria comment="current Debian version is Debian Stretch">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_debian:def:1" comment="Debian is installed"/>
                  <criterion test_ref="oval:ssg-test_debian_9:tst:1" comment="Debian9 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_debian11:def:1" version="3" class="inventory">
                <metadata>
                  <title>Debian Linux 11</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:debian:debian_linux:11"/>
                  <reference source="ssg" ref_id="installed_OS_is_debian11"/>
                  <description>The operating system installed on the system is Debian 11</description>
                </metadata>
                <criteria comment="Debian Linux is version 11">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_debian:def:1" comment="Debian is installed"/>
                  <criterion test_ref="oval:ssg-test_debian_11:tst:1" comment="Debian11 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_debian10:def:1" version="3" class="inventory">
                <metadata>
                  <title>Debian Linux 10</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:debian:debian_linux:10"/>
                  <reference source="ssg" ref_id="installed_OS_is_debian10"/>
                  <description>The operating system installed on the system is Debian 10</description>
                </metadata>
                <criteria comment="Debian Linux is version 10">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_debian:def:1" comment="Debian is installed"/>
                  <criterion test_ref="oval:ssg-test_debian_10:tst:1" comment="Debian10 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_centos9:def:1" version="2" class="inventory">
                <metadata>
                  <title>CentOS Stream 9</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:centos:centos:9"/>
                  <reference source="ssg" ref_id="installed_OS_is_centos9"/>
                  <description>The operating system installed on the system is
      CentOS Stream 9</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_centos9_name:tst:1" comment="OS is CentOS Stream"/>
                  <criterion test_ref="oval:ssg-test_centos9_version:tst:1" comment="OS version is 9"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_centos8:def:1" version="2" class="inventory">
                <metadata>
                  <title>CentOS 8</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:centos:centos:8"/>
                  <reference source="ssg" ref_id="installed_OS_is_centos8"/>
                  <description>The operating system installed on the system is
      CentOS 8</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_centos8_name:tst:1" comment="OS is CentOS"/>
                  <criterion test_ref="oval:ssg-test_centos8_version:tst:1" comment="OS version is 8"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_centos7:def:1" version="2" class="inventory">
                <metadata>
                  <title>CentOS 7</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:centos:centos:7"/>
                  <reference source="ssg" ref_id="installed_OS_is_centos7"/>
                  <description>The operating system installed on the system is
      CentOS 7</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_centos7:tst:1" comment="CentOS7 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_centos6:def:1" version="2" class="inventory">
                <metadata>
                  <title>CentOS 6</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:centos:centos:6"/>
                  <reference source="ssg" ref_id="installed_OS_is_centos6"/>
                  <description>The operating system installed on the system is
      CentOS 6</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_centos6:tst:1" comment="CentOS6 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_FIPS_certified:def:1" version="1" class="compliance">
                <metadata>
                  <title>The Installed Operating System Is FIPS 140-2 Certified</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="installed_OS_is_FIPS_certified"/>
                  <description>
          The operating system installed on the system is a certified operating system that meets FIPS 140-2 requirements.
      </description>
                </metadata>
                <criteria operator="OR" comment="Installed operating system is a certified operating system">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel7:def:1" comment="Installed OS is RHEL7"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel8:def:1" comment="Installed OS is RHEL8"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_rhcos4:def:1" comment="Installed OS is RHCOS4"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_ol7_family:def:1" comment="Installed OS is OL7"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_sle12:def:1" comment="Installed OS is SLE12"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_sle15:def:1" comment="Installed OS is SLE15"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu1604:def:1" comment="Installed OS is Ubuntu 16.04"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu1804:def:1" comment="Installed OS is Ubuntu 18.04"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu2004:def:1" comment="Installed OS is Ubuntu 20.04"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-install_smartcard_packages:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install Smart Card Packages For Multifactor Authentication</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="install_smartcard_packages"/>
                  <description>The RPM package openssl-pkcs11 should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_openssl-pkcs11_installed:tst:1" comment="package openssl-pkcs11 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-install_mcafee_hbss_pa:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install the Policy Auditor (PA) Module</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="install_mcafee_hbss_pa"/>
                  <description>Install the Policy Auditor (PA) Module.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_mcafee_auditengine_exists:tst:1" comment="McAfee Policy Auditor is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-install_mcafee_hbss_accm:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install the Asset Configuration Compliance Module (ACCM)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="install_mcafee_hbss_accm"/>
                  <description>Install the Asset Configuration Compliance Module (ACCM).</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_mcafee_accm_exists:tst:1" comment="McAfee ACCM is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-install_mcafee_hbss:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install McAfee Host-Based Intrusion Detection Software (HBSS)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="install_mcafee_hbss"/>
                  <description>McAfee Host-Based Intrusion Detection Software (HBSS) software
      should be installed.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-install_mcafee_cma_rt:def:1" comment="McAfee HBSS"/>
                  <extend_definition definition_ref="oval:ssg-install_mcafee_hbss_accm:def:1" comment="McAfee HBSS"/>
                  <extend_definition definition_ref="oval:ssg-package_MFEhiplsm_installed:def:1" comment="McAfee HBSS"/>
                  <extend_definition definition_ref="oval:ssg-install_mcafee_hbss_pa:def:1" comment="McAfee HBSS"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-install_mcafee_cma_rt:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install the McAfee Runtime Libraries and Linux Agent</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="install_mcafee_cma_rt"/>
                  <description>Install the McAfee Runtime Libraries (MFErt) and Linux Agent (MFEcma).</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_mcafee_runtime_installed:tst:1" comment="McAfee runtime library package installed"/>
                  <criterion test_ref="oval:ssg-test_mcafee_management_agent:tst:1" comment="McAfee management agent package installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-install_mcafee_antivirus:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install McAfee Virus Scanning Software</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="install_mcafee_antivirus"/>
                  <description>McAfee Antivirus software should be installed.</description>
                </metadata>
                <criteria comment="Antivirus is not being used or conditions are met">
                  <extend_definition definition_ref="oval:ssg-install_mcafee_cma_rt:def:1" comment="McAfee Runtime Libraries and Agent"/>
                  <criterion test_ref="oval:ssg-test_linuxshield_install_antivirus:tst:1" comment="Linuxshield AntiVirus package is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-install_hids:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install Intrusion Detection Software</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="install_hids"/>
                  <description>Intrusion detection software or SELinux should be installed and enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-install_mcafee_hbss:def:1" comment="McAfee HBSS"/>
                  <criterion test_ref="oval:ssg-test_selinux_enforcing:tst:1" comment="SELinux enabled"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-install_antivirus:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install Virus Scanning Software</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="install_antivirus"/>
                  <description>Antivirus software should be installed.</description>
                </metadata>
                <criteria comment="Antivirus is not being used or conditions are met">
                  <extend_definition definition_ref="oval:ssg-install_mcafee_antivirus:def:1" comment="McAfee A/V Installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-install_PAE_kernel_on_x86-32:def:1" version="2" class="compliance">
                <metadata>
                  <title>Install PAE Kernel on Supported 32-bit x86 Systems</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="install_PAE_kernel_on_x86-32"/>
                  <description>The RPM package kernel-PAE should be installed on 32-bit
      systems.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-system_info_architecture_x86:def:1" negate="true" comment="Not a 32-bit system"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_PAE_NX_cpu_support:tst:1" negate="true" comment="Check if PAE or NX is supported by the CPUs"/>
                    <criteria>
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_x86:def:1" comment="A 32-bit system"/>
                      <criterion test_ref="oval:ssg-test_package_kernel-PAE_installed:tst:1" comment="Package kernel-PAE is installed"/>
                      <criterion test_ref="oval:ssg-test_defaultkernel_sysconfig_kernel:tst:1" comment="check for DEFAULTKERNEL set to kernel-PAE in /etc/sysconfig/kernel"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-harden_sshd_macs_openssh_conf_crypto_policy:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure SSH Client to Use FIPS 140-2 Validated MACs: openssh.config</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="harden_sshd_macs_openssh_conf_crypto_policy"/>
                  <description>Limit the Message Authentication Codes (MACs) to those which are FIPS-approved.</description>
                </metadata>
                <criteria comment="Test conditions - presence of the file plus.">
                  <criterion test_ref="oval:ssg-test_harden_sshd_macs_openssh_conf_crypto_policy:tst:1" comment="Check that /etc/crypto-policies/back-ends/openssh.config contains FIPS-approved SSHD MACs"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-harden_sshd_crypto_policy:def:1" version="1" class="compliance">
                <metadata>
                  <title>Harden SSHD Crypto Policy</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="harden_sshd_crypto_policy"/>
                  <description>Ensure 'CRYPTO_POLICY' is configured with value ''-oCiphers=aes256-ctr,aes128-ctr,aes256-cbc,aes128-cbc -oMACs=hmac-sha2-512,hmac-sha2-256 -oGSSAPIKeyExchange=no -oKexAlgorithms=ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256 -oPubkeyAcceptedKeyTypes=rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256'' in /etc/crypto-policies/back-ends/opensshserver.config</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_harden_sshd_crypto_policy:tst:1" comment="Check the CRYPTO_POLICY in /etc/crypto-policies/back-ends/opensshserver.config"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure SSH Client to Use FIPS 140-2 Validated Ciphers: openssh.config</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="harden_sshd_ciphers_openssh_conf_crypto_policy"/>
                  <description>Limit the Ciphers to those which are FIPS-approved.</description>
                </metadata>
                <criteria comment="Test conditions - presence of the file plus.">
                  <criterion test_ref="oval:ssg-test_harden_sshd_ciphers_openssh_conf_crypto_policy:tst:1" comment="Check that /etc/crypto-policies/back-ends/openssh.config contains FIPS-approved SSHD Ciphers"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-harden_ssh_client_crypto_policy:def:1" version="3" class="compliance">
                <metadata>
                  <title>Harden SSH client Crypto Policy</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="harden_ssh_client_crypto_policy"/>
                  <description>Ensure the ssh client ciphers are configured correctly in /etc/ssh/ssh_config.d/02-ospp.conf</description>
                </metadata>
                <criteria comment="SSH client is configured correctly">
                  <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_Match:tst:1" comment="Check the Match in /etc/ssh/ssh_config.d/02-ospp.conf"/>
                  <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_RekeyLimit:tst:1" comment="Check the RekeyLimit in /etc/ssh/ssh_config.d/02-ospp.conf"/>
                  <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_GSSAPIAuthentication:tst:1" comment="Check the GSSAPIAuthentication in /etc/ssh/ssh_config.d/02-ospp.conf"/>
                  <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_Ciphers:tst:1" comment="Check the Ciphers in /etc/ssh/ssh_config.d/02-ospp.conf"/>
                  <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:tst:1" comment="Check the PubkeyAcceptedKeyTypes in /etc/ssh/ssh_config.d/02-ospp.conf"/>
                  <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_MACs:tst:1" comment="Check the MACs in /etc/ssh/ssh_config.d/02-ospp.conf"/>
                  <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_KexAlgorithms:tst:1" comment="Check the KexAlgorithms in /etc/ssh/ssh_config.d/02-ospp.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_vsyscall_argument:def:1" version="2" class="compliance">
                <metadata>
                  <title>Disable vsyscalls</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_vsyscall_argument"/>
                  <description>Ensure vsyscall=none is configured in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_grub2_vsyscall_argument:tst:1" comment="check for vsyscall=none in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
                    <criteria>
                      <criterion test_ref="oval:ssg-test_grub2_vsyscall_argument_default:tst:1" comment="check for vsyscall=none in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                      <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_uefi_password:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set the UEFI Boot Loader Password</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_uefi_password"/>
                  <description>The UEFI grub2 boot loader should have password protection enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_grub2_uefi_password_usercfg:tst:1" comment="make sure a password is defined in /boot/grub2/user.cfg"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_uefi_admin_username:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set the UEFI Boot Loader Admin Username to a Non-Default Value</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_uefi_admin_username"/>
                  <description>The grub2 boot loader superuser should have a username that is hard to guess.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_bootloader_uefi_superuser_differ_from_other_users:tst:1" comment="Superuser is defined in /boot/grub2/grub.cfg and it             isn't root, admin, administrator nor equal to any system username"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_spectre_v2_argument:def:1" version="2" class="compliance">
                <metadata>
                  <title>Enforce Spectre v2 mitigation</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_spectre_v2_argument"/>
                  <description>Ensure spectre_v2=on is configured in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_grub2_spectre_v2_argument:tst:1" comment="check for spectre_v2=on in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
                    <criteria>
                      <criterion test_ref="oval:ssg-test_grub2_spectre_v2_argument_default:tst:1" comment="check for spectre_v2=on in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                      <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_spec_store_bypass_disable_argument:def:1" version="2" class="compliance">
                <metadata>
                  <title>Configure Speculative Store Bypass Mitigation</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_spec_store_bypass_disable_argument"/>
                  <description>Ensure spec_store_bypass_disable is configured in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_grub2_spec_store_bypass_disable_argument:tst:1" comment="check for spec_store_bypass_disable in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
                    <criteria>
                      <criterion test_ref="oval:ssg-test_grub2_spec_store_bypass_disable_argument_default:tst:1" comment="check for spec_store_bypass_disable in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                      <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_slub_debug_argument:def:1" version="2" class="compliance">
                <metadata>
                  <title>Enable SLUB/SLAB allocator poisoning</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_slub_debug_argument"/>
                  <description>Ensure slub_debug is configured in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_grub2_slub_debug_argument:tst:1" comment="check for slub_debug in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
                    <criteria>
                      <criterion test_ref="oval:ssg-test_grub2_slub_debug_argument_default:tst:1" comment="check for slub_debug in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                      <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_slab_nomerge_argument:def:1" version="2" class="compliance">
                <metadata>
                  <title>Disable merging of slabs with similar size</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_slab_nomerge_argument"/>
                  <description>Ensure slab_nomerge=yes is configured in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_grub2_slab_nomerge_argument:tst:1" comment="check for slab_nomerge=yes in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
                    <criteria>
                      <criterion test_ref="oval:ssg-test_grub2_slab_nomerge_argument_default:tst:1" comment="check for slab_nomerge=yes in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                      <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_rng_core_default_quality_argument:def:1" version="2" class="compliance">
                <metadata>
                  <title>Configure the confidence in TPM for entropy</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_rng_core_default_quality_argument"/>
                  <description>Ensure rng_core.default_quality is configured in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_grub2_rng_core_default_quality_argument:tst:1" comment="check for rng_core.default_quality in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
                    <criteria>
                      <criterion test_ref="oval:ssg-test_grub2_rng_core_default_quality_argument_default:tst:1" comment="check for rng_core.default_quality in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                      <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_pti_argument:def:1" version="2" class="compliance">
                <metadata>
                  <title>Enable Kernel Page-Table Isolation (KPTI)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_pti_argument"/>
                  <description>Ensure pti=on is configured in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_grub2_pti_argument:tst:1" comment="check for pti=on in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
                    <criteria>
                      <criterion test_ref="oval:ssg-test_grub2_pti_argument_default:tst:1" comment="check for pti=on in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                      <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_password:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set Boot Loader Password in grub2</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_password"/>
                  <description>The grub2 boot loader should have password protection enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criteria operator="OR" comment="check both files to account for procedure change in documenation">
                      <criterion test_ref="oval:ssg-test_grub2_password_usercfg:tst:1" comment="make sure a password is defined in /boot/grub2/user.cfg"/>
                      <criterion test_ref="oval:ssg-test_grub2_password_grubcfg:tst:1" comment="make sure a password is defined in /boot/grub2/grub.cfg"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_bootloader_superuser:tst:1" comment="make sure a superuser is defined in /boot/grub2/grub.cfg"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_page_poison_argument:def:1" version="2" class="compliance">
                <metadata>
                  <title>Enable page allocator poisoning</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_page_poison_argument"/>
                  <description>Ensure page_poison=1 is configured in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_grub2_page_poison_argument:tst:1" comment="check for page_poison=1 in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
                    <criteria>
                      <criterion test_ref="oval:ssg-test_grub2_page_poison_argument_default:tst:1" comment="check for page_poison=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                      <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_nousb_argument:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Kernel Support for USB via Bootloader Configuration</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_nousb_argument"/>
                  <description>Ensure 'GRUB_CMDLINE_LINUX' is configured with value 'nousb' in /etc/default/grub</description>
                </metadata>
                <criteria operator="OR" comment="grub is configured correctly">
                  <criterion test_ref="oval:ssg-test_grub2_nousb_argument:tst:1" comment="Check the GRUB_CMDLINE_LINUX in /etc/default/grub"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_nosmep_argument_absent:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure SMEP is not disabled during boot</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_nosmep_argument_absent"/>
                  <description>Ensure nosmep is not set in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_grub2_nosmep_argument_absent:tst:1" comment="check for absence of nosmep in /etc/default/grub on GRUB_CMDLINE_LINUX"/>
                    <criteria>
                      <criterion test_ref="oval:ssg-test_grub2_nosmep_argument_absent_default:tst:1" comment="check for absence ofnosmep in /etc/default/grub on GRUB_CMDLINE_LINUX_DEFAULT"/>
                      <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_nosmap_argument_absent:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure SMAP is not disabled during boot</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_nosmap_argument_absent"/>
                  <description>Ensure nosmap is not set in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_grub2_nosmap_argument_absent:tst:1" comment="check for absence of nosmap in /etc/default/grub on GRUB_CMDLINE_LINUX"/>
                    <criteria>
                      <criterion test_ref="oval:ssg-test_grub2_nosmap_argument_absent_default:tst:1" comment="check for absence ofnosmap in /etc/default/grub on GRUB_CMDLINE_LINUX_DEFAULT"/>
                      <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_mds_argument:def:1" version="2" class="compliance">
                <metadata>
                  <title>Configure Microarchitectural Data Sampling mitigation</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_mds_argument"/>
                  <description>Ensure mds is configured in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_grub2_mds_argument:tst:1" comment="check for mds in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
                    <criteria>
                      <criterion test_ref="oval:ssg-test_grub2_mds_argument_default:tst:1" comment="check for mds in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                      <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_mce_argument:def:1" version="2" class="compliance">
                <metadata>
                  <title>Force kernel panic on uncorrected MCEs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_mce_argument"/>
                  <description>Ensure mce=0 is configured in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_grub2_mce_argument:tst:1" comment="check for mce=0 in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
                    <criteria>
                      <criterion test_ref="oval:ssg-test_grub2_mce_argument_default:tst:1" comment="check for mce=0 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                      <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_l1tf_argument:def:1" version="2" class="compliance">
                <metadata>
                  <title>Configure L1 Terminal Fault mitigations</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_l1tf_argument"/>
                  <description>Ensure l1tf is configured in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_grub2_l1tf_argument:tst:1" comment="check for l1tf in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
                    <criteria>
                      <criterion test_ref="oval:ssg-test_grub2_l1tf_argument_default:tst:1" comment="check for l1tf in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                      <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_ipv6_disable_argument:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure IPv6 is disabled through kernel boot parameter</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_ipv6_disable_argument"/>
                  <description>Ensure ipv6.disable=1 is configured in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_grub2_ipv6_disable_argument:tst:1" comment="check for ipv6.disable=1 in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
                    <criteria>
                      <criterion test_ref="oval:ssg-test_grub2_ipv6_disable_argument_default:tst:1" comment="check for ipv6.disable=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                      <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_entries_reference_kernelopts:def:1" version="2" class="compliance">
                <metadata>
                  <title>Use $kernelopts in /boot/loader/entries/*.conf</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_entries_reference_kernelopts"/>
                  <description>Ensure that grubenv-defined kernel options are referenced in individual boot loader entries</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_grub2_entries_reference_kernelopts:tst:1" comment="check kernel command line parameters for referenced boot entries reference the $kernelopts variable."/>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_enable_selinux:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure SELinux Not Disabled in /etc/default/grub</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_enable_selinux"/>
                  <description>
        Check if selinux=0 OR enforcing=0 within the GRUB2 configuration files, fail if found.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_selinux_default_grub:tst:1" comment="check value selinux|enforcing=0 in /etc/default/grub, fail if found"/>
                  <criterion test_ref="oval:ssg-test_selinux_grub2_cfg:tst:1" comment="check value selinux|enforcing=0 in /etc/grub2.cfg, fail if found"/>
                  <criterion test_ref="oval:ssg-test_selinux_grub_dir:tst:1" comment="check value selinux|enforcing=0 in /etc/grub.d, fail if found"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_enable_iommu_force:def:1" version="2" class="compliance">
                <metadata>
                  <title>IOMMU configuration directive</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_enable_iommu_force"/>
                  <description>Ensure iommu=force is configured in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_grub2_iommu_argument:tst:1" comment="check for iommu=force in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
                    <criteria>
                      <criterion test_ref="oval:ssg-test_grub2_iommu_argument_default:tst:1" comment="check for iommu=force in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                      <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_disable_interactive_boot:def:1" version="4" class="compliance">
                <metadata>
                  <title>Verify that Interactive Boot is Disabled</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_disable_interactive_boot"/>
                  <description>The ability for users to perform interactive startups should
      be disabled.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux:tst:1" comment="Check systemd.confirm_spawn=(1|yes|true|on) not in GRUB_CMDLINE_LINUX"/>
                  <criteria>
                    <criterion test_ref="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux_default:tst:1" comment="Check systemd.confirm_spawn=(1|yes|true|on) not in GRUB_CMDLINE_LINUX_DEFAULT"/>
                    <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_default_exists:def:1" version="1" class="compliance">
                <metadata>
                  <title>GRUB_CMDLINE_LINUX_DEFAULT existance check</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_default_exists"/>
                  <description>Check if GRUB_CMDLINE_LINUX_DEFAULT exists in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_grub2_default_exists:tst:1" comment="check for GRUB_CMDLINE_LINUX_DEFAULT exists in /etc/default/grub"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_audit_backlog_limit_argument:def:1" version="2" class="compliance">
                <metadata>
                  <title>Extend Audit Backlog Limit for the Audit Daemon</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_audit_backlog_limit_argument"/>
                  <description>Ensure audit_backlog_limit=8192 is configured in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_grub2_audit_backlog_limit_argument:tst:1" comment="check for audit_backlog_limit=8192 in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
                    <criteria>
                      <criterion test_ref="oval:ssg-test_grub2_audit_backlog_limit_argument_default:tst:1" comment="check for audit_backlog_limit=8192 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                      <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_audit_argument:def:1" version="2" class="compliance">
                <metadata>
                  <title>Enable Auditing for Processes Which Start Prior to the Audit Daemon</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_audit_argument"/>
                  <description>Ensure audit=1 is configured in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_grub2_audit_argument:tst:1" comment="check for audit=1 in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
                    <criteria>
                      <criterion test_ref="oval:ssg-test_grub2_audit_argument_default:tst:1" comment="check for audit=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
                      <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_admin_username:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set the Boot Loader Admin Username to a Non-Default Value</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_admin_username"/>
                  <description>The grub2 boot loader superuser should have a username that is hard to guess.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_bootloader_superuser_differ_from_other_users:tst:1" comment="Superuser is defined in /boot/grub2/grub.cfg and it isn't             root, admin, administrator nor equal to any system username"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-group_unique_name:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure All Groups on the System Have Unique Group Names</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="group_unique_name"/>
                  <description>All groups on the system should have unique names for proper accountability.</description>
                </metadata>
                <criteria comment="There should not exist duplicate group names entries in /etc/passwd">
                  <criterion test_ref="oval:ssg-test_etc_group_no_duplicate_group_names:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-group_unique_id:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure All Groups on the System Have Unique Group ID</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="group_unique_id"/>
                  <description>All groups on the system should have unique names for proper accountability.</description>
                </metadata>
                <criteria comment="There should not exist duplicate group ids entries in /etc/passwd">
                  <criterion test_ref="oval:ssg-test_etc_group_no_duplicate_group_ids:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-gnome_gdm_disable_xdmcp:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable XDMCP in GDM</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="gnome_gdm_disable_xdmcp"/>
                  <description>Ensure 'Enable' is configured with value 'false in section 'xdmcp' in /etc/gdm/custom.conf</description>
                </metadata>
                <criteria comment="gdm is configured correctly and configuration file exists">
                  <criteria operator="OR" comment="gdm is configured correctly">
                    <criterion test_ref="oval:ssg-test_gnome_gdm_disable_xdmcp:tst:1" comment="Check the Enable in /etc/gdm/custom.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_gnome_gdm_disable_xdmcp_config_file_exists:tst:1" comment="test if configuration file /etc/gdm/custom.conf exists for gnome_gdm_disable_xdmcp"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-gnome_gdm_disable_guest_login:def:1" version="2" class="compliance">
                <metadata>
                  <title>Disable GDM Guest Login</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="gnome_gdm_disable_guest_login"/>
                  <description>Disable the GNOME Display Manager (GDM) ability to allow guest users
      to login.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_gdm_installed:def:1" negate="true" comment="gdm installed"/>
                  <criterion test_ref="oval:ssg-test_disable_guest_login:tst:1" comment="Disable GDM Guest Login"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-gnome_gdm_disable_automatic_login:def:1" version="2" class="compliance">
                <metadata>
                  <title>Disable GDM Automatic Login</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="gnome_gdm_disable_automatic_login"/>
                  <description>Disable the GNOME Display Manager (GDM) ability to allow users to
      automatically login.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_gdm_installed:def:1" negate="true" comment="gdm installed"/>
                  <criterion test_ref="oval:ssg-test_disable_automatic_login:tst:1" comment="Disable GDM Automatic Login"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-gid_passwd_group_same:def:1" version="2" class="compliance">
                <metadata>
                  <title>All GIDs referenced in /etc/passwd must be defined in /etc/group</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="gid_passwd_group_same"/>
                  <description>All GIDs referenced in /etc/passwd must be defined in /etc/group.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_gid_passwd_group_same:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-ftp_present_banner:def:1" version="1" class="compliance">
                <metadata>
                  <title>Create Warning Banners for All FTP Users</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="ftp_present_banner"/>
                  <description>This setting will cause the system greeting banner to be 
      used for FTP connections as well.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_vsftpd_removed:def:1" comment="vsftpd package is not installed"/>
                  <criterion test_ref="oval:ssg-test_ftp_present_banner:tst:1" comment="Banner for FTP Users"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-ftp_log_transactions:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable Logging of All FTP Transactions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="ftp_log_transactions"/>
                  <description>To trace malicious activity facilitated by the FTP 
      service, it must be configured to ensure that all commands sent to 
      the FTP server are logged using the verbose vsftpd log format.
      </description>
                </metadata>
                <criteria operator="OR" comment="FTP is not being used or the conditions are met">
                  <extend_definition definition_ref="oval:ssg-package_vsftpd_installed:def:1" negate="true" comment="vsftp package is not installed"/>
                  <criteria comment="FTP configuration conditions are not set or are met">
                    <criterion test_ref="oval:ssg-test_ftp_log_transactions_enable:tst:1" comment="log ftp transactions enable"/>
                    <criterion test_ref="oval:ssg-test_ftp_log_transactions_format:tst:1" comment="log ftp transactions format"/>
                    <criterion test_ref="oval:ssg-test_ftp_log_transactions_protocol:tst:1" comment="log ftp transactions protocol"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-force_opensc_card_drivers:def:1" version="1" class="compliance">
                <metadata>
                  <title>Force opensc To Use Defined Smart Card Driver</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="force_opensc_card_drivers"/>
                  <description>Force opensc to use the organization's smart card driver so that only
      the smart card in use by the organization will be recognized by the system.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_force_opensc_card_drivers:tst:1" comment="Check that force_card_driver is configured for opensc"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_var_log_syslog:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on /var/log/syslog File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_var_log_syslog"/>
                  <description>This test makes sure that FILEPATH has mode 0640.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_var_log_syslog_0:tst:1" comment="Check file mode of /var/log/syslog"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_var_log_messages:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on /var/log/messages File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_var_log_messages"/>
                  <description>This test makes sure that FILEPATH has mode 0640.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_var_log_messages_0:tst:1" comment="Check file mode of /var/log/messages"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_var_log_audit:def:1" version="2" class="compliance">
                <metadata>
                  <title>System Audit Logs Must Have Mode 0640 or Less Permissive</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_var_log_audit"/>
                  <description>Checks for correct permissions for all audit log files.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria comment="log_file set">
                    <extend_definition definition_ref="oval:ssg-auditd_conf_log_file_not_set:def:1" negate="true" comment="log_file set in auditd.conf"/>
                    <criteria comment="log_group in auditd.conf is not root">
                      <extend_definition definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1" comment="log_group in auditd.conf is not root"/>
                      <criterion test_ref="oval:ssg-test_file_permissions_audit_log-non_root:tst:1" negate="true"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_file_permissions_audit_log:tst:1" negate="true"/>
                  </criteria>
                  <criteria comment="log_group in auditd.conf is not root">
                    <extend_definition definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1" comment="log_group in auditd.conf is not root"/>
                    <criterion test_ref="oval:ssg-test_file_permissions_var_log_audit-non_root:tst:1" negate="true"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_var_log_audit:tst:1" negate="true"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_var_log:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on /var/log Directory</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_var_log"/>
                  <description>This test makes sure that FILEPATH has mode 0755.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_var_log_0:tst:1" comment="Check file mode of /var/log/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_ungroupowned:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure All Files Are Owned by a Group</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_ungroupowned"/>
                  <description>All files should be owned by a group</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_ungroupowned:tst:1" comment="Check all files and make sure they are owned by a group"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_unauthorized_world_writable:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure No World-Writable Files Exist</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_unauthorized_world_writable"/>
                  <description>The world-write permission should be disabled for all files.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_unauthorized_world_write:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_unauthorized_suid:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure All SUID Executables Are Authorized</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_unauthorized_suid"/>
                  <description>Evaluates to true if all files with SUID set are owned by RPM packages.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_unauthorized_suid:tst:1" comment="Check all suid files"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_unauthorized_sgid:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure All SGID Executables Are Authorized</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_unauthorized_sgid"/>
                  <description>Evaluates to true if all files with SGID set are owned by RPM packages.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_unauthorized_sgid:tst:1" comment="Check all sgid files"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_systemmap:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify that local System.map file (if exists) is readable only by root</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_systemmap"/>
                  <description>
        Checks that /boot/System.map-* are only readable by root.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_permissions_systemmap_files:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_sshd_pub_key:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on SSH Server Public *.pub Key Files</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_sshd_pub_key"/>
                  <description>This test makes sure that FILEPATH has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_sshd_pub_key_0:tst:1" comment="Check file mode of /etc/ssh/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_sshd_private_key:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on SSH Server Private *_key Key Files</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_sshd_private_key"/>
                  <description>This test makes sure that FILEPATH has mode 0600.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_sshd_private_key_0:tst:1" comment="Check file mode of /etc/ssh/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_library_dirs:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify that Shared Library Files Have Restrictive Permissions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_library_dirs"/>
                  <description>This test makes sure that FILEPATH has mode 7755.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_library_dirs_0:tst:1" comment="Check file mode of /lib/"/>
                  <criterion test_ref="oval:ssg-test_file_permissions_library_dirs_1:tst:1" comment="Check file mode of /lib64/"/>
                  <criterion test_ref="oval:ssg-test_file_permissions_library_dirs_2:tst:1" comment="Check file mode of /usr/lib/"/>
                  <criterion test_ref="oval:ssg-test_file_permissions_library_dirs_3:tst:1" comment="Check file mode of /usr/lib64/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_home_dirs:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure that User Home Directories are not Group-Writable or World-Readable</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_home_dirs"/>
                  <description>Ensure that User Home Directories are not Group-Writable or World-Readable</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_home_dirs:tst:1" comment="home directories"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_grub2_cfg:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify /boot/grub2/grub.cfg Permissions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_grub2_cfg"/>
                  <description>This test makes sure that FILEPATH has mode 0600.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_grub2_cfg_0:tst:1" comment="Check file mode of /boot/grub2/grub.cfg"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_etc_shadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on shadow File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_etc_shadow"/>
                  <description>This test makes sure that FILEPATH has mode 0000.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_etc_shadow_0:tst:1" comment="Check file mode of /etc/shadow"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_etc_passwd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on passwd File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_etc_passwd"/>
                  <description>This test makes sure that FILEPATH has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_etc_passwd_0:tst:1" comment="Check file mode of /etc/passwd"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_etc_motd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify permissions on Message of the Day Banner</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_etc_motd"/>
                  <description>This test makes sure that FILEPATH has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_etc_motd_0:tst:1" comment="Check file mode of /etc/motd"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_etc_issue:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify permissions on System Login Banner</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_etc_issue"/>
                  <description>This test makes sure that FILEPATH has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_etc_issue_0:tst:1" comment="Check file mode of /etc/issue"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_etc_gshadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on gshadow File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_etc_gshadow"/>
                  <description>This test makes sure that FILEPATH has mode 0000.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_etc_gshadow_0:tst:1" comment="Check file mode of /etc/gshadow"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_etc_group:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on group File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_etc_group"/>
                  <description>This test makes sure that FILEPATH has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_etc_group_0:tst:1" comment="Check file mode of /etc/group"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_etc_audit_rulesd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on /etc/audit/rules.d/*.rules</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_etc_audit_rulesd"/>
                  <description>This test makes sure that FILEPATH has mode 0640.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_etc_audit_rulesd_0:tst:1" comment="Check file mode of /etc/audit/rules.d/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_etc_audit_auditd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on /etc/audit/auditd.conf</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_etc_audit_auditd"/>
                  <description>This test makes sure that FILEPATH has mode 0640.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_etc_audit_auditd_0:tst:1" comment="Check file mode of /etc/audit/auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_efi_grub2_cfg:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify the UEFI Boot Loader grub.cfg Permissions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_efi_grub2_cfg"/>
                  <description>This test makes sure that FILEPATH has mode 0700.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_efi_grub2_cfg_0:tst:1" comment="Check file mode of /boot/grub2/grub.cfg"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_binary_dirs:def:1" version="2" class="compliance">
                <metadata>
                  <title>Verify that System Executables Have Restrictive Permissions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_binary_dirs"/>
                  <description>
        Checks that binary files under /bin, /sbin, /usr/bin, /usr/sbin,
        /usr/local/bin, /usr/local/sbin, and /usr/libexec are not group-writable or world-writable.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_perms_binary_files:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_backup_etc_shadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on Backup shadow File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_backup_etc_shadow"/>
                  <description>This test makes sure that FILEPATH has mode 0000.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_backup_etc_shadow_0:tst:1" comment="Check file mode of /etc/shadow-"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_backup_etc_passwd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on Backup passwd File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_backup_etc_passwd"/>
                  <description>This test makes sure that FILEPATH has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_backup_etc_passwd_0:tst:1" comment="Check file mode of /etc/passwd-"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_backup_etc_gshadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on Backup gshadow File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_backup_etc_gshadow"/>
                  <description>This test makes sure that FILEPATH has mode 0000.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_backup_etc_gshadow_0:tst:1" comment="Check file mode of /etc/gshadow-"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_backup_etc_group:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on Backup group File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_backup_etc_group"/>
                  <description>This test makes sure that FILEPATH has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_backup_etc_group_0:tst:1" comment="Check file mode of /etc/group-"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_ownership_var_log_audit:def:1" version="3" class="compliance">
                <metadata>
                  <title>System Audit Logs Must Be Owned By Root</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_ownership_var_log_audit"/>
                  <description>Checks that all /var/log/audit files and directories are owned by the root user and group.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria comment="directories are root owned">
                    <criterion test_ref="oval:ssg-test_ownership_var_log_audit_files:tst:1"/>
                    <criterion test_ref="oval:ssg-test_ownership_var_log_audit_directories:tst:1"/>
                  </criteria>
                  <criteria comment="log_group in auditd.conf is not root">
                    <extend_definition definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1" comment="log_group in auditd.conf is not root"/>
                    <criterion test_ref="oval:ssg-test_ownership_var_log_audit_files-non_root:tst:1"/>
                    <criterion test_ref="oval:ssg-test_ownership_var_log_audit_directories-non_root:tst:1"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_ownership_library_dirs:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify that Shared Library Files Have Root Ownership</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_ownership_library_dirs"/>
                  <description>This test makes sure that FILEPATH is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_ownership_library_dirs_0:tst:1" comment="Check file ownership of /lib/"/>
                  <criterion test_ref="oval:ssg-test_file_ownership_library_dirs_1:tst:1" comment="Check file ownership of /lib64/"/>
                  <criterion test_ref="oval:ssg-test_file_ownership_library_dirs_2:tst:1" comment="Check file ownership of /usr/lib/"/>
                  <criterion test_ref="oval:ssg-test_file_ownership_library_dirs_3:tst:1" comment="Check file ownership of /usr/lib64/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_ownership_binary_dirs:def:1" version="2" class="compliance">
                <metadata>
                  <title>Verify that System Executables Have Root Ownership</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_ownership_binary_dirs"/>
                  <description>
        Checks that /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin,
        /usr/local/sbin, /usr/libexec, and objects therein, are owned by root.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_ownership_binary_directories:tst:1"/>
                  <criterion test_ref="oval:ssg-test_ownership_binary_files:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_ownership_audit_configuration:def:1" version="1" class="compliance">
                <metadata>
                  <title>Audit Configuration Files Must Be Owned By Root</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_ownership_audit_configuration"/>
                  <description>This test makes sure that FILEPATH is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_ownership_audit_configuration_0:tst:1" comment="Check file ownership of /etc/audit/"/>
                  <criterion test_ref="oval:ssg-test_file_ownership_audit_configuration_1:tst:1" comment="Check file ownership of /etc/audit/rules.d/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_var_log_syslog:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify User Who Owns /var/log/syslog File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_var_log_syslog"/>
                  <description>This test makes sure that FILEPATH is owned by 104.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_var_log_syslog_0:tst:1" comment="Check file ownership of /var/log/syslog"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_var_log_messages:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify User Who Owns /var/log/messages File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_var_log_messages"/>
                  <description>This test makes sure that FILEPATH is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_var_log_messages_0:tst:1" comment="Check file ownership of /var/log/messages"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_var_log:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify User Who Owns /var/log Directory</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_var_log"/>
                  <description>This test makes sure that FILEPATH is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_var_log_0:tst:1" comment="Check file ownership of /var/log/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_grub2_cfg:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify /boot/grub2/grub.cfg User Ownership</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_grub2_cfg"/>
                  <description>This test makes sure that FILEPATH is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_grub2_cfg_0:tst:1" comment="Check file ownership of /boot/grub2/grub.cfg"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_etc_shadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify User Who Owns shadow File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_etc_shadow"/>
                  <description>This test makes sure that FILEPATH is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_etc_shadow_0:tst:1" comment="Check file ownership of /etc/shadow"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_etc_passwd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify User Who Owns passwd File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_etc_passwd"/>
                  <description>This test makes sure that FILEPATH is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_etc_passwd_0:tst:1" comment="Check file ownership of /etc/passwd"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_etc_motd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify ownership of Message of the Day Banner</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_etc_motd"/>
                  <description>This test makes sure that FILEPATH is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_etc_motd_0:tst:1" comment="Check file ownership of /etc/motd"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_etc_issue:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify ownership of System Login Banner</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_etc_issue"/>
                  <description>This test makes sure that FILEPATH is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_etc_issue_0:tst:1" comment="Check file ownership of /etc/issue"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_etc_gshadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify User Who Owns gshadow File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_etc_gshadow"/>
                  <description>This test makes sure that FILEPATH is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_etc_gshadow_0:tst:1" comment="Check file ownership of /etc/gshadow"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_etc_group:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify User Who Owns group File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_etc_group"/>
                  <description>This test makes sure that FILEPATH is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_etc_group_0:tst:1" comment="Check file ownership of /etc/group"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_efi_grub2_cfg:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify the UEFI Boot Loader grub.cfg User Ownership</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_efi_grub2_cfg"/>
                  <description>This test makes sure that FILEPATH is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_efi_grub2_cfg_0:tst:1" comment="Check file ownership of /boot/grub2/grub.cfg"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_backup_etc_shadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Who Owns Backup shadow File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_backup_etc_shadow"/>
                  <description>This test makes sure that FILEPATH is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_backup_etc_shadow_0:tst:1" comment="Check file ownership of /etc/shadow-"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_backup_etc_passwd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify User Who Owns Backup passwd File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_backup_etc_passwd"/>
                  <description>This test makes sure that FILEPATH is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_backup_etc_passwd_0:tst:1" comment="Check file ownership of /etc/passwd-"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_backup_etc_gshadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify User Who Owns Backup gshadow File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_backup_etc_gshadow"/>
                  <description>This test makes sure that FILEPATH is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_backup_etc_gshadow_0:tst:1" comment="Check file ownership of /etc/gshadow-"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_backup_etc_group:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify User Who Owns Backup group File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_backup_etc_group"/>
                  <description>This test makes sure that FILEPATH is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_backup_etc_group_0:tst:1" comment="Check file ownership of /etc/group-"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupownership_system_commands_dirs:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify that system commands files are group owned by root</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupownership_system_commands_dirs"/>
                  <description>
        Checks that system commands in /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin 
        are owned by root group.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_groupownership_system_commands_dirs:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupownership_audit_configuration:def:1" version="1" class="compliance">
                <metadata>
                  <title>Audit Configuration Files Must Be Owned By Group root</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupownership_audit_configuration"/>
                  <description>This test makes sure that FILEPATH is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupownership_audit_configuration_0:tst:1" comment="Check file group ownership of /etc/audit/"/>
                  <criterion test_ref="oval:ssg-test_file_groupownership_audit_configuration_1:tst:1" comment="Check file group ownership of /etc/audit/rules.d/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_var_log_syslog:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Who Owns /var/log/syslog File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_var_log_syslog"/>
                  <description>This test makes sure that FILEPATH is group owned by 4.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_var_log_syslog_0:tst:1" comment="Check file group ownership of /var/log/syslog"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_var_log_messages:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Who Owns /var/log/messages File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_var_log_messages"/>
                  <description>This test makes sure that FILEPATH is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_var_log_messages_0:tst:1" comment="Check file group ownership of /var/log/messages"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_var_log:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Who Owns /var/log Directory</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_var_log"/>
                  <description>This test makes sure that FILEPATH is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_var_log_0:tst:1" comment="Check file group ownership of /var/log/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_grub2_cfg:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify /boot/grub2/grub.cfg Group Ownership</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_grub2_cfg"/>
                  <description>This test makes sure that FILEPATH is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_grub2_cfg_0:tst:1" comment="Check file group ownership of /boot/grub2/grub.cfg"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_etc_shadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Who Owns shadow File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_etc_shadow"/>
                  <description>This test makes sure that FILEPATH is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_etc_shadow_0:tst:1" comment="Check file group ownership of /etc/shadow"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_etc_passwd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Who Owns passwd File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_etc_passwd"/>
                  <description>This test makes sure that FILEPATH is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_etc_passwd_0:tst:1" comment="Check file group ownership of /etc/passwd"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_etc_motd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Ownership of Message of the Day Banner</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_etc_motd"/>
                  <description>This test makes sure that FILEPATH is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_etc_motd_0:tst:1" comment="Check file group ownership of /etc/motd"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_etc_issue:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Ownership of System Login Banner</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_etc_issue"/>
                  <description>This test makes sure that FILEPATH is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_etc_issue_0:tst:1" comment="Check file group ownership of /etc/issue"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_etc_gshadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Who Owns gshadow File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_etc_gshadow"/>
                  <description>This test makes sure that FILEPATH is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_etc_gshadow_0:tst:1" comment="Check file group ownership of /etc/gshadow"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_etc_group:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Who Owns group File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_etc_group"/>
                  <description>This test makes sure that FILEPATH is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_etc_group_0:tst:1" comment="Check file group ownership of /etc/group"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_efi_grub2_cfg:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify the UEFI Boot Loader grub.cfg Group Ownership</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_efi_grub2_cfg"/>
                  <description>This test makes sure that FILEPATH is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_efi_grub2_cfg_0:tst:1" comment="Check file group ownership of /boot/grub2/grub.cfg"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_backup_etc_shadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify User Who Owns Backup shadow File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_backup_etc_shadow"/>
                  <description>This test makes sure that FILEPATH is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_backup_etc_shadow_0:tst:1" comment="Check file group ownership of /etc/shadow-"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_backup_etc_passwd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Who Owns Backup passwd File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_backup_etc_passwd"/>
                  <description>This test makes sure that FILEPATH is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_backup_etc_passwd_0:tst:1" comment="Check file group ownership of /etc/passwd-"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_backup_etc_gshadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Who Owns Backup gshadow File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_backup_etc_gshadow"/>
                  <description>This test makes sure that FILEPATH is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_backup_etc_gshadow_0:tst:1" comment="Check file group ownership of /etc/gshadow-"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_backup_etc_group:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Who Owns Backup group File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_backup_etc_group"/>
                  <description>This test makes sure that FILEPATH is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_backup_etc_group_0:tst:1" comment="Check file group ownership of /etc/group-"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_cron_deny_not_exist:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure that /etc/cron.deny does not exist</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_cron_deny_not_exist"/>
                  <description>This test makes sure that/etc/cron.deny does not exist.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_cron_deny_not_exist:tst:1" comment="Ensure that /etc/cron.deny does not exist."/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_at_deny_not_exist:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure that /etc/at.deny does not exist</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_at_deny_not_exist"/>
                  <description>This test makes sure that/etc/at.deny does not exist.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_at_deny_not_exist:tst:1" comment="Ensure that /etc/at.deny does not exist."/>
                </criteria>
              </definition>
              <definition id="oval:ssg-etc_system_fips_exists:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure '/etc/system-fips' exists</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="etc_system_fips_exists"/>
                  <description>Check /etc/system-fips exists</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_etc_system_fips:tst:1" comment="/etc/system-fips exists"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-ensure_logrotate_activated:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Logrotate Runs Periodically</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="ensure_logrotate_activated"/>
                  <description>
      The frequency of automatic log files rotation performed by the logrotate utility should be configured to run daily
      </description>
                </metadata>
                <criteria comment="/etc/logrotate.conf contains daily setting and /etc/cron.daily/logrotate file exists">
                  <criterion test_ref="oval:ssg-test_logrotate_conf_daily_setting:tst:1" comment="Check if daily is set in /etc/logrotate.conf"/>
                  <criterion test_ref="oval:ssg-test_logrotate_conf_no_other_keyword:tst:1" comment="check that there is no weekly/monthly/yearly keyword in logrotate.conf"/>
                  <criterion test_ref="oval:ssg-test_cron_daily_logrotate_existence:tst:1" comment="Check if /etc/cron.daily/logrotate file exists (and calls logrotate)"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-ensure_gpgcheck_repo_metadata:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure gpgcheck Enabled for Repository Metadata</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="ensure_gpgcheck_repo_metadata"/>
                  <description>The repo_gpgcheck option should be used to ensure that checking
      of repository metadata always occurs.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_yum_ensure_gpgcheck_repo_metadata:tst:1" comment="check value of repo_gpgcheck in /etc/dnf/dnf.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-ensure_gpgcheck_never_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure gpgcheck Enabled for All dnf Package Repositories</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="ensure_gpgcheck_never_disabled"/>
                  <description>Ensure all yum or dnf repositories utilize signature checking.</description>
                </metadata>
                <criteria comment="ensure all yum or dnf repositories utilize signiature checking">
                  <criterion test_ref="oval:ssg-test_ensure_gpgcheck_never_disabled:tst:1" comment="verify no gpgpcheck=0 present in /etc/yum.repos.d files"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-ensure_gpgcheck_local_packages:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure gpgcheck Enabled for Local Packages</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="ensure_gpgcheck_local_packages"/>
                  <description>The localpkg_gpgcheck option should be used to ensure that checking 
      of an RPM package's signature always occurs prior to its
      installation.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_yum_ensure_gpgcheck_local_packages:tst:1" comment="check value of localpkg_gpgcheck in /etc/dnf/dnf.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-ensure_gpgcheck_globally_activated:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure gpgcheck Enabled In Main dnf Configuration</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="ensure_gpgcheck_globally_activated"/>
                  <description>The gpgcheck option should be used to ensure that checking
      of an RPM package's signature always occurs prior to its
      installation.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_ensure_gpgcheck_globally_activated:tst:1" comment="check value of gpgcheck in /etc/dnf/dnf.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-ensure_fedora_gpgkey_installed:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure Fedora GPG Key Installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="ensure_fedora_gpgkey_installed"/>
                  <description>The Fedora release key package is required to be installed.</description>
                </metadata>
                <criteria comment="Fedora Vendor keys">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_fedora:def:1" comment="Fedora installed"/>
                  <criteria operator="OR" comment="Supported Fedora key is installed">
                    <criterion test_ref="oval:ssg-test_package_gpgkey-5323552a-6112bcdc_installed:tst:1" comment="Fedora 37 package gpg-pubkey-5323552a-6112bcdc is installed"/>
                    <criterion test_ref="oval:ssg-test_package_gpgkey-38ab71f4-60242b08_installed:tst:1" comment="Fedora 36 package gpg-pubkey-38ab71f4-60242b08 is installed"/>
                    <criterion test_ref="oval:ssg-test_package_gpgkey-9867c58f-601c49ca_installed:tst:1" comment="Fedora 35 package gpg-pubkey-9867c58f-601c49ca is installed"/>
                    <criterion test_ref="oval:ssg-test_package_gpgkey-45719a39-5f2c0192_installed:tst:1" comment="Fedora 34 package gpg-pubkey-45719a39-5f2c0192 is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-enable_pam_namespace:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set Up a Private Namespace in PAM Configuration</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="enable_pam_namespace"/>
                  <description>Check presence of pam_namespace.so module in the /etc/pam.d/login file</description>
                </metadata>
                <criteria comment="Check that /etc/pam.d/login contains a line with certain text">
                  <criterion test_ref="oval:ssg-test_enable_pam_namespace:tst:1" comment="Check that /etc/pam.d/login contains a line with certain text"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-enable_fips_mode:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable FIPS Mode</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="enable_fips_mode"/>
                  <description>Check if FIPS mode is enabled on the system</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-etc_system_fips_exists:def:1" comment="check /etc/system-fips exists"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_crypto_fips_enabled:def:1" comment="check sysctl crypto.fips_enabled = 1"/>
                  <extend_definition definition_ref="oval:ssg-enable_dracut_fips_module:def:1" comment="Dracut FIPS module is enabled"/>
                  <extend_definition definition_ref="oval:ssg-configure_crypto_policy:def:1" comment="system cryptography policy is configured"/>
                  <criterion test_ref="oval:ssg-test_system_crypto_policy_value:tst:1" comment="check if system crypto policy selection in var_system_crypto_policy in the profile is set to FIPS"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-enable_dracut_fips_module:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable Dracut FIPS Module</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="enable_dracut_fips_module"/>
                  <description>fips module should be enabled in Dracut configuration</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_enable_dracut_fips_module:tst:1" comment="dracut fips module is enabled"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-enable_dconf_user_profile:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure GNOME3 DConf User Profile</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="enable_dconf_user_profile"/>
                  <description>The DConf User profile should have the local DB configured.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criterion test_ref="oval:ssg-test_dconf_user_profile:tst:1" comment="dconf user profile exists"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-dnf-automatic_security_updates_only:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure dnf-automatic to Install Only Security Updates</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dnf-automatic_security_updates_only"/>
                  <description>Ensure 'upgrade_type' is configured with value 'security in section 'commands' in /etc/dnf/automatic.conf</description>
                </metadata>
                <criteria comment="dnf-automatic is configured correctly and configuration file exists">
                  <criteria operator="OR" comment="dnf-automatic is configured correctly">
                    <criterion test_ref="oval:ssg-test_dnf-automatic_security_updates_only:tst:1" comment="Check the upgrade_type in /etc/dnf/automatic.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_dnf-automatic_security_updates_only_config_file_exists:tst:1" comment="test if configuration file /etc/dnf/automatic.conf exists for dnf-automatic_security_updates_only"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-dnf-automatic_apply_updates:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure dnf-automatic to Install Available Updates Automatically</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dnf-automatic_apply_updates"/>
                  <description>Ensure 'apply_updates' is configured with value 'yes in section 'commands' in /etc/dnf/automatic.conf</description>
                </metadata>
                <criteria comment="dnf-automatic is configured correctly and configuration file exists">
                  <criteria operator="OR" comment="dnf-automatic is configured correctly">
                    <criterion test_ref="oval:ssg-test_dnf-automatic_apply_updates:tst:1" comment="Check the apply_updates in /etc/dnf/automatic.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_dnf-automatic_apply_updates_config_file_exists:tst:1" comment="test if configuration file /etc/dnf/automatic.conf exists for dnf-automatic_apply_updates"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-display_login_attempts:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure PAM Displays Last Logon/Access Notification</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="display_login_attempts"/>
                  <description>Configure the system to notify users of last login/access using pam_lastlog.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_display_login_attempts:tst:1" comment="Conditions for pam_lastlog are satisfied"/>
                  <criterion test_ref="oval:ssg-test_display_login_attempts_silent:tst:1" comment="silent option for pam_lastlog is not set"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-disallow_bypass_password_sudo:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disallow Configuration to Bypass Password Requirements for Privilege Escalation</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="disallow_bypass_password_sudo"/>
                  <description>Disallow Configuration to Bypass Password Requirements for Privilege Escalation.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_disallow_bypass_password_sudo:tst:1" comment="Check absence of conf pam_succeed_if in /etc/pam.d/sudo"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-disable_users_coredumps:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Core Dumps for All Users</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="disable_users_coredumps"/>
                  <description>Core dumps for all users should be disabled</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_core_dumps_limits_d:tst:1" comment="Are core dumps disabled in /etc/security/limits.d/*"/>
                  <criteria>
                    <criterion test_ref="oval:ssg-test_core_dumps_limits_d_exists:tst:1" negate="true" comment="Are core dumps configured in /etc/security/limits.d/*"/>
                    <criterion test_ref="oval:ssg-test_core_dumps_limitsconf:tst:1" comment="Are core dumps disabled in /etc/security/limits.conf"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-disable_host_auth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Host-Based Authentication</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="disable_host_auth"/>
                  <description>Ensure 'HostbasedAuthentication' is configured with value 'no' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_disable_host_auth:tst:1" comment="Check the HostbasedAuthentication in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_disable_host_auth_config_dir:tst:1" comment="Check the HostbasedAuthentication in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-disable_ctrlaltdel_reboot:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Ctrl-Alt-Del Reboot Activation</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="disable_ctrlaltdel_reboot"/>
                  <description>By default, the system will reboot when the
      Ctrl-Alt-Del key sequence is pressed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_disable_ctrlaltdel_exists:tst:1" comment="Disable Ctrl-Alt-Del systemd softlink exists"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-directory_permissions_var_log_audit:def:1" version="1" class="compliance">
                <metadata>
                  <title>System Audit Logs Must Have Mode 0750 or Less Permissive</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="directory_permissions_var_log_audit"/>
                  <description>Checks for correct permissions for audit logs.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria comment="log_file set">
                    <extend_definition definition_ref="oval:ssg-auditd_conf_log_file_not_set:def:1" negate="true" comment="log_file set in auditd.conf"/>
                    <criteria comment="log_group in auditd.conf is not root">
                      <extend_definition definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1" comment="log_group in auditd.conf is not root"/>
                      <criterion test_ref="oval:ssg-test_dir_permissions_audit_log-non_root:tst:1" negate="true"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_dir_permissions_audit_log:tst:1" negate="true"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_dir_permissions_var_log_audit:tst:1" negate="true"/>
                  <criteria comment="log_group in auditd.conf is not root">
                    <extend_definition definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1" comment="log_group in auditd.conf is not root"/>
                    <criterion test_ref="oval:ssg-test_dir_permissions_var_log_audit-non_root:tst:1" negate="true"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-directory_access_var_log_audit:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Access Events to Audit Log Directory</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="directory_access_var_log_audit"/>
                  <description>Audit rules about the read events to /var/log/audit</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_directory_acccess_var_log_audit_augenrules:tst:1" comment="audit rule to record read access events to /var/log/audit"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_directory_acccess_var_log_audit_auditctl:tst:1" comment="audit rule to record read access events to /var/log/audit"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dir_perms_world_writable_system_owned_group:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure All World-Writable Directories Are Group Owned by a System Account</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dir_perms_world_writable_system_owned_group"/>
                  <description>All world writable directories should be group owned by a system user.</description>
                </metadata>
                <criteria negate="true" comment="check for local directories that are world writable and have gid greater than or equal to 1000">
                  <criterion test_ref="oval:ssg-test_dir_world_writable_gid_gt_value:tst:1" comment="check for local directories that are world writable and have gid greater than or equal to 1000"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-dir_perms_world_writable_system_owned:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure All World-Writable Directories Are Owned by a System Account</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dir_perms_world_writable_system_owned"/>
                  <description>All world writable directories should be owned by a system user.</description>
                </metadata>
                <criteria negate="true" comment="check for local directories that are world writable and have uid greater than or equal to 1000">
                  <criterion test_ref="oval:ssg-test_dir_world_writable_uid_gt_value:tst:1" comment="check for local directories that are world writable and have uid greater than or equal to 1000"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-dir_perms_world_writable_sticky_bits:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify that All World-Writable Directories Have Sticky Bits Set</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dir_perms_world_writable_sticky_bits"/>
                  <description>The sticky bit should be set for all world-writable directories.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_dir_perms_world_writable_sticky_bits:tst:1" negate="true" comment="all local world writable directories have sticky bit set"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-dir_perms_world_writable_root_owned:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure All World-Writable Directories Are Owned by root user</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dir_perms_world_writable_root_owned"/>
                  <description>All world writable directories should be owned by root.</description>
                </metadata>
                <criteria negate="true" comment="check for local directories that are world writable and have uid greater than 0">
                  <criterion test_ref="oval:ssg-test_dir_world_writable_uid_gt_zero:tst:1" comment="check for local directories that are world writable and have uid greater than 0"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-dir_permissions_library_dirs:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify that Shared Library Directories Have Restrictive Permissions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dir_permissions_library_dirs"/>
                  <description>This test makes sure that FILEPATH has mode 0755.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissionsdir_permissions_library_dirs_0:tst:1" comment="Check file mode of /lib/"/>
                  <criterion test_ref="oval:ssg-test_file_permissionsdir_permissions_library_dirs_1:tst:1" comment="Check file mode of /lib64/"/>
                  <criterion test_ref="oval:ssg-test_file_permissionsdir_permissions_library_dirs_2:tst:1" comment="Check file mode of /usr/lib/"/>
                  <criterion test_ref="oval:ssg-test_file_permissionsdir_permissions_library_dirs_3:tst:1" comment="Check file mode of /usr/lib64/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-dir_permissions_binary_dirs:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify that System Executable Directories Have Restrictive Permissions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dir_permissions_binary_dirs"/>
                  <description>This test makes sure that FILEPATH has mode 0755.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_0:tst:1" comment="Check file mode of /bin/"/>
                  <criterion test_ref="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_1:tst:1" comment="Check file mode of /sbin/"/>
                  <criterion test_ref="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_2:tst:1" comment="Check file mode of /usr/bin/"/>
                  <criterion test_ref="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_3:tst:1" comment="Check file mode of /usr/sbin/"/>
                  <criterion test_ref="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_4:tst:1" comment="Check file mode of /usr/local/bin/"/>
                  <criterion test_ref="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_5:tst:1" comment="Check file mode of /usr/local/sbin/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-dir_ownership_library_dirs:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify that Shared Library Directories Have Root Ownership</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dir_ownership_library_dirs"/>
                  <description>This test makes sure that FILEPATH is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_ownerdir_ownership_library_dirs_0:tst:1" comment="Check file ownership of /lib/"/>
                  <criterion test_ref="oval:ssg-test_file_ownerdir_ownership_library_dirs_1:tst:1" comment="Check file ownership of /lib64/"/>
                  <criterion test_ref="oval:ssg-test_file_ownerdir_ownership_library_dirs_2:tst:1" comment="Check file ownership of /usr/lib/"/>
                  <criterion test_ref="oval:ssg-test_file_ownerdir_ownership_library_dirs_3:tst:1" comment="Check file ownership of /usr/lib64/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-dir_ownership_binary_dirs:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify that System Executable Have Root Ownership</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dir_ownership_binary_dirs"/>
                  <description>This test makes sure that FILEPATH is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_ownerdir_ownership_binary_dirs_0:tst:1" comment="Check file ownership of /bin/"/>
                  <criterion test_ref="oval:ssg-test_file_ownerdir_ownership_binary_dirs_1:tst:1" comment="Check file ownership of /sbin/"/>
                  <criterion test_ref="oval:ssg-test_file_ownerdir_ownership_binary_dirs_2:tst:1" comment="Check file ownership of /usr/bin/"/>
                  <criterion test_ref="oval:ssg-test_file_ownerdir_ownership_binary_dirs_3:tst:1" comment="Check file ownership of /usr/sbin/"/>
                  <criterion test_ref="oval:ssg-test_file_ownerdir_ownership_binary_dirs_4:tst:1" comment="Check file ownership of /usr/local/bin/"/>
                  <criterion test_ref="oval:ssg-test_file_ownerdir_ownership_binary_dirs_5:tst:1" comment="Check file ownership of /usr/local/sbin/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-dir_group_ownership_library_dirs:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify that Shared Library Directories Have Root Group Ownership</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dir_group_ownership_library_dirs"/>
                  <description>This test makes sure that FILEPATH is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_0:tst:1" comment="Check file group ownership of /lib/"/>
                  <criterion test_ref="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_1:tst:1" comment="Check file group ownership of /lib64/"/>
                  <criterion test_ref="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_2:tst:1" comment="Check file group ownership of /usr/lib/"/>
                  <criterion test_ref="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_3:tst:1" comment="Check file group ownership of /usr/lib64/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_session_idle_user_locks:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Users Cannot Change GNOME3 Session Idle Settings</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_session_idle_user_locks"/>
                  <description>Ensure that users cannot change GNOME3 session idle settings.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="check screensaver idle delay and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_user_change_idle_delay_lock:tst:1" comment="prevent user from changing idle delay"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_screensaver_user_locks:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Users Cannot Change GNOME3 Screensaver Settings</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_screensaver_user_locks"/>
                  <description>Ensure that users cannot change GNOME3 screensaver idle and lock settings.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="check screensaver idle delay and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_user_change_lock_delay_lock:tst:1" comment="prevent user from changing screensaver lock delay"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_screensaver_user_info:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Full User Name on Splash Shield</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_screensaver_user_info"/>
                  <description>GNOME3 screen splash shield should not display full name of logged in user.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Disable screensaver user info and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_screensaver_disable_user_info:tst:1" comment="screensaver user info is disabled"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_info_change:tst:1" comment="screensaver prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_screensaver_mode_blank:def:1" version="2" class="compliance">
                <metadata>
                  <title>Implement Blank Screensaver</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_screensaver_mode_blank"/>
                  <description>The GNOME3 screensaver should be blank.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Enable blank screensaver and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_screensaver_mode_blank:tst:1" comment="screensaver is blank"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_screensaver_mode_change:tst:1" comment="screensaver prevent user from changing mode"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_screensaver_lock_locked:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Users Cannot Change GNOME3 Screensaver Lock After Idle Period</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_screensaver_lock_locked"/>
                  <description>Idle activation of the screen lock should not be changed by users.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Enable screensaver lock and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_screensaver_lock_locked:tst:1" comment="screensaver lock prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_screensaver_lock_enabled:def:1" version="2" class="compliance">
                <metadata>
                  <title>Enable GNOME3 Screensaver Lock After Idle Period</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_screensaver_lock_enabled"/>
                  <description>Idle activation of the screen lock should be enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Enable screensaver lock and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_screensaver_lock_enabled:tst:1" comment="screensaver lock is enabled"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_screensaver_lock:tst:1" comment="screensaver lock prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_screensaver_lock_delay:def:1" version="2" class="compliance">
                <metadata>
                  <title>Set GNOME3 Screensaver Lock Delay After Activation Period</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_screensaver_lock_delay"/>
                  <description>Idle activation of the screen lock should be enabled immediately or
      after a delay.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Enable screensaver lock and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_screensaver_lock_delay:tst:1" comment="screensaver lock delay is configured"/>
                    <criterion test_ref="oval:ssg-test_screensaver_lock_delay_setting:tst:1" comment="lock delay is set correctly"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_screensaver_idle_delay:def:1" version="2" class="compliance">
                <metadata>
                  <title>Set GNOME3 Screensaver Inactivity Timeout</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_screensaver_idle_delay"/>
                  <description>The allowed period of inactivity before the screensaver is activated.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="check screensaver idle delay and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_screensaver_idle_delay:tst:1" comment="idle delay has been configured"/>
                    <criterion test_ref="oval:ssg-test_screensaver_idle_delay_setting:tst:1" comment="idle delay is set correctly"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_screensaver_idle_activation_locked:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Users Cannot Change GNOME3 Screensaver Idle Activation</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_screensaver_idle_activation_locked"/>
                  <description>Idle activation of the screen saver should not be changed by users.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="check screensaver idle activation and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_change_idle_activation_locked:tst:1" comment="prevent user from changing idle delay"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_screensaver_idle_activation_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable GNOME3 Screensaver Idle Activation</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_screensaver_idle_activation_enabled"/>
                  <description>Idle activation of the screen saver should be enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="check screensaver idle activation and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_screensaver_idle_activation_enabled:tst:1" comment="idle activation has been configured"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_change_idle_activation_enabled:tst:1" comment="prevent user from changing idle delay"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_remote_access_encryption:def:1" version="1" class="compliance">
                <metadata>
                  <title>Require Encryption for Remote Access in GNOME3</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_remote_access_encryption"/>
                  <description>Configure GNOME3 to require encryption for remote access connections.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_configure_remote_access_encryption:tst:1" comment="configure remote access encryption"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_remote_access_encryption:tst:1" comment="Prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_remote_access_credential_prompt:def:1" version="1" class="compliance">
                <metadata>
                  <title>Require Credential Prompting for Remote Access in GNOME3</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_remote_access_credential_prompt"/>
                  <description>Configure GNOME3 to require credential prompting for remote access.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_configure_remote_access_creds:tst:1" comment="configure remote access credentials"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_remote_access_creds:tst:1" comment="Prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_login_retries:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set the GNOME3 Login Number of Failures</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_login_retries"/>
                  <description>Set the GNOME3 number of login failure attempts.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Set number of login attempts and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_configure_allowed_failures:tst:1" comment="Set number of login tries"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_allowed-failures_change:tst:1" comment="Prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_login_banner_text:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set the GNOME3 Login Warning Banner Text</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_login_banner_text"/>
                  <description>Enable the GUI warning banner.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Enable GUI banner and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_banner_change:tst:1" comment="Prevent user from changing banner"/>
                    <criterion test_ref="oval:ssg-test_gdm_login_banner_text_setting:tst:1" comment="Login banner is correctly set"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_lock_screen_on_smartcard_removal:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable the GNOME3 Screen Locking On Smartcard Removal</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_lock_screen_on_smartcard_removal"/>
                  <description>Ensure 'removal-action' is configured with value ''lock-screen' in section 'org/gnome/settings-daemon/peripherals/smartcard' in /etc/dconf/db/local.d/</description>
                </metadata>
                <criteria comment="dconf is configured correctly">
                  <criterion test_ref="oval:ssg-test_dconf_gnome_lock_screen_on_smartcard_removal:tst:1" comment="Check the removal-action in /etc/dconf/db/local.d/"/>
                  <criterion test_ref="oval:ssg-test_prevent_user_removal-action:tst:1" comment="Prevent user from modifying removal-action"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_enable_smartcard_auth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable the GNOME3 Login Smartcard Authentication</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_enable_smartcard_auth"/>
                  <description>Enable smartcard authentication in the GNOME3 Login GUI.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Enable smartcard authentication and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_enable_gnome_smartcard:tst:1" comment="Enable smartcard authentication"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_disable_smartcard:tst:1" comment="Prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_disable_wifi_notification:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable WIFI Network Notification in GNOME3</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_disable_wifi_notification"/>
                  <description>Disable the GNOME3 wireless network notification.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_disable_wifi_notification:tst:1" comment="Disable wifi notification"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_enable_wifi_notification:tst:1" comment="Prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_disable_wifi_create:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable WIFI Network Connection Creation in GNOME3</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_disable_wifi_create"/>
                  <description>Disable the GNOME3 wireless network creation settings.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_disable_wifi_creation:tst:1" comment="Disable wifi creation"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_enable_wifi_creation:tst:1" comment="Prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_disable_user_list:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable the GNOME3 Login User List</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_disable_user_list"/>
                  <description>Disable the GNOME3 GUI listing of all known users on the login screen.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Disable GUI listing of known users and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_disable_user_list:tst:1" comment="Disable user list"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_disable_user_list:tst:1" comment="Prevent user from disabling banner"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_disable_user_admin:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable User Administration in GNOME3</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_disable_user_admin"/>
                  <description>Ensure 'user-administration-disabled' is configured with value 'true in section 'org/gnome/desktop/lockdown' in /etc/dconf/db/local.d/</description>
                </metadata>
                <criteria comment="dconf is configured correctly">
                  <criterion test_ref="oval:ssg-test_dconf_gnome_disable_user_admin:tst:1" comment="Check the user-administration-disabled in /etc/dconf/db/local.d/"/>
                  <criterion test_ref="oval:ssg-test_prevent_user_user-administration-disabled:tst:1" comment="Prevent user from modifying user-administration-disabled"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_disable_thumbnailers:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable All GNOME3 Thumbnailers</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_disable_thumbnailers"/>
                  <description>The system's default desktop environment, GNOME3, uses a
      number of different thumbnailer programs to generate thumbnails for any
      new or modified content in an opened folder. Disable the execution of
      these thumbnail applications within GNOME3.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Disable Gnome3 Thumbnailers and prevent user from enabling">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_gnome_disable_thumbnailers:tst:1" comment="Disable thumbnailers in GNOME3"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_change_gnome_thumbnailers:tst:1" comment="prevent user from changing idle delay"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_disable_restart_shutdown:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable the GNOME3 Login Restart and Shutdown Buttons</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_disable_restart_shutdown"/>
                  <description>Disable the GNOME3 Login GUI Restart and Shutdown buttons to all users on the login screen.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Disable GUI shutdown and restart buttons and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_disable_restart_buttons:tst:1" comment="Disable restart and shutdown buttons"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_enable_restart_buttons:tst:1" comment="Prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_disable_power_settings:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Power Settings in GNOME3</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_disable_power_settings"/>
                  <description>Disable GNOME3 power settings.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_disable_gnome_power_setting:tst:1" comment="Disable power settings"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_power_setting_change:tst:1" comment="Prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_disable_geolocation:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Geolocation in GNOME3</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_disable_geolocation"/>
                  <description>Disable GNOME3 Geolocation for the clock and system.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_disable_sys_geolocation:tst:1" comment="Disable system geolocation"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_sys_geolocation:tst:1" comment="Prevent user from changing"/>
                    <criterion test_ref="oval:ssg-test_disable_clock_geolocation:tst:1" comment="Disable clock geolocation"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_clock_geolocation:tst:1" comment="Prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_disable_ctrlaltdel_reboot:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_disable_ctrlaltdel_reboot"/>
                  <description>Disable the GNOME3 ctrl-alt-del reboot key sequence in GNOME3.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_disable_gnome_ctrlaltdel:tst:1" comment="Disable Ctrl-Alt-Del"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_enable_ctrlaltdel:tst:1" comment="Prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_disable_autorun:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable GNOME3 autorun</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_disable_autorun"/>
                  <description>The system's default desktop environment, GNOME3, will mount
    devices and removable media (such as DVDs, CDs and USB flash drives)
    whenever they are inserted into the system. Disable autorun within GNOME3.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Disable GNOME3 autorun and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_dconf_gnome_disable_autorun:tst:1" comment="Disable autorun in GNOME3"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_gnome_autorun:tst:1" comment="Prevent user from changing autorun setting"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_disable_automount_open:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable GNOME3 automount-open</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_disable_automount_open"/>
                  <description>The system's default desktop environment, GNOME3, will mount
    devices and removable media (such as DVDs, CDs and USB flash drives)
    whenever they are inserted into the system. Disable automount-open within GNOME3.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Disable GNOME3 automount/autorun and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_dconf_gnome_disable_automount_open:tst:1" comment="Disable automount-open in GNOME3"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_gnome_automount_open:tst:1" comment="Prevent user from changing automount-open setting"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_disable_automount:def:1" version="2" class="compliance">
                <metadata>
                  <title>Disable GNOME3 automount</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_disable_automount"/>
                  <description>The system's default desktop environment, GNOME3, will mount
      devices and removable media (such as DVDs, CDs and USB flash drives)
      whenever they are inserted into the system. Disable automount within GNOME3.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Disable GNOME3 automount and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_dconf_gnome_disable_automount:tst:1" comment="Disable automount in GNOME3"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_gnome_automount:tst:1" comment="Prevent user from changing automount setting"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_banner_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable GNOME3 Login Warning Banner</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_banner_enabled"/>
                  <description>Enable the GNOME3 Login warning banner.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Enable GUI banner and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_banner_gui_enabled:tst:1" comment="Enable GUI banner"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_banner_gui_enabled_change:tst:1" comment="Prevent user from disabling banner"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_db_up_to_date:def:1" version="2" class="compliance">
                <metadata>
                  <title>Make sure that the dconf databases are up-to-date with regards to respective keyfiles</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_db_up_to_date"/>
                  <description>Make sure that the dconf databases are up-to-date with regards to respective keyfiles.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="check that all DBs in question are up-to-date">
                    <criteria operator="OR" comment="check that all DBs in question are up-to-date">
                      <criterion test_ref="oval:ssg-test_dconf_distro_up_to_date:tst:1" comment="distro database is up-to-date wrt keyfiles"/>
                      <criterion test_ref="oval:ssg-test_dconf_distro_no_keyfiles:tst:1" comment="no keyfiles applicable to the distro database"/>
                    </criteria>
                    <criteria operator="OR" comment="check that all DBs in question are up-to-date">
                      <criterion test_ref="oval:ssg-test_dconf_local_up_to_date:tst:1" comment="local database is up-to-date wrt keyfiles"/>
                      <criterion test_ref="oval:ssg-test_dconf_local_no_keyfiles:tst:1" comment="no keyfiles applicable to the local database"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-coreos_enable_selinux_kernel_argument:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure SELinux Not Disabled in the kernel arguments</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="coreos_enable_selinux_kernel_argument"/>
                  <description>Ensure selinux=0 argument is not present in the 'options' line of /boot/loader/entries/ostree-2-*.conf (or ostree-1-*.conf if there is no ostree-2-*.conf as ostree has only two enries at the most, with *-2-*.conf entry always being the most recent). Also, ensure that kernel is currently running with this argument by checking /proc/cmdline.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criteria>
                      <criterion test_ref="oval:ssg-test_coreos_enable_selinux_kernel_argument_file_boot_loader_entries_ostree_2_conf_absent:tst:1" comment="Pass if there are no files matching pattern '/boot/loader/entries/ostree-2-.*.conf' exist in the system"/>
                      <criterion test_ref="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:tst:1" negate="true" comment="Check if argument selinux=0 for Linux kernel is not present in /boot/loader/entries/ostree-1-.*.conf"/>
                    </criteria>
                    <criteria>
                      <criterion test_ref="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:tst:1" negate="true" comment="Check if argument selinux=0 for Linux kernel is not present in /boot/loader/entries/ostree-2-.*.conf"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <criterion test_ref="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:tst:1" negate="true" comment="Check if argument selinux=0 for Linux kernel is not present in /proc/cmdline"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-coredump_disable_storage:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable storing core dump</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="coredump_disable_storage"/>
                  <description>Ensure 'Storage' is configured with value 'none in section 'Coredump' in /etc/systemd/coredump.conf</description>
                </metadata>
                <criteria operator="OR" comment="systemd-coredump is configured correctly">
                  <criterion test_ref="oval:ssg-test_coredump_disable_storage:tst:1" comment="Check the Storage in /etc/systemd/coredump.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-coredump_disable_backtraces:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable core dump backtraces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="coredump_disable_backtraces"/>
                  <description>Ensure 'ProcessSizeMax' is configured with value '0 in section 'Coredump' in /etc/systemd/coredump.conf</description>
                </metadata>
                <criteria operator="OR" comment="systemd-coredump is configured correctly">
                  <criterion test_ref="oval:ssg-test_coredump_disable_backtraces:tst:1" comment="Check the ProcessSizeMax in /etc/systemd/coredump.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_usbguard_auditbackend:def:1" version="1" class="compliance">
                <metadata>
                  <title>Log USBGuard daemon audit events using Linux Audit</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_usbguard_auditbackend"/>
                  <description>Ensure 'AuditBackend' is configured with value 'LinuxAudit' in /etc/usbguard/usbguard-daemon.conf</description>
                </metadata>
                <criteria comment="usbguard is configured correctly and configuration file exists">
                  <criteria operator="OR" comment="usbguard is configured correctly">
                    <criterion test_ref="oval:ssg-test_configure_usbguard_auditbackend:tst:1" comment="Check the AuditBackend in /etc/usbguard/usbguard-daemon.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_configure_usbguard_auditbackend_config_file_exists:tst:1" comment="test if configuration file /etc/usbguard/usbguard-daemon.conf exists for configure_usbguard_auditbackend"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_tmux_lock_command:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure the tmux Lock Command</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_tmux_lock_command"/>
                  <description>Check if the vlock command is configured to be used as a locking mechanism in tmux.</description>
                </metadata>
                <criteria comment="Configure the tmux Lock Command">
                  <criterion test_ref="oval:ssg-test_configure_tmux_lock_command:tst:1" comment="check lock-command is set to vlock in /etc/tmux.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_tmux_lock_after_time:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure tmux to lock session after inactivity</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_tmux_lock_after_time"/>
                  <description>Check if tmux is configured to lock sessions after period of inactivity.</description>
                </metadata>
                <criteria comment="Configure tmux to lock session after inactivity">
                  <criterion test_ref="oval:ssg-test_configure_tmux_lock_after_time:tst:1" comment="check lock-after-time is set to 900 in /etc/tmux.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_ssh_crypto_policy:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure SSH to use System Crypto Policy</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_ssh_crypto_policy"/>
                  <description>SSH should be configured to use the system-wide crypto policy setting.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_configure_ssh_crypto_policy:tst:1" comment="Check that the SSH configuration mandates usage of system-wide crypto policies."/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_openssl_crypto_policy:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure OpenSSL library to use System Crypto Policy</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_openssl_crypto_policy"/>
                  <description>OpenSSL should be configured to use the system-wide crypto policy setting.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_configure_openssl_crypto_policy:tst:1" comment="Check that the configuration mandates usage of system-wide crypto policies."/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_opensc_nss_db:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure NSS DB To Use opensc</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_opensc_nss_db"/>
                  <description>The NSS DB should be set to use opensc library.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_configure_opensc_nss_db:tst:1" comment="Check opensc library is configured in /etc/pki/nssdb/pkcs11.txt"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_opensc_card_drivers:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure opensc Smart Card Drivers</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_opensc_card_drivers"/>
                  <description>Configure the organization's smart card driver so that only
      the smart card in use by the organization will be recognized by the system.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_configure_opensc_card_drivers:tst:1" comment="Check that card_drivers is configured for opensc"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_libreswan_crypto_policy:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure Libreswan to use System Crypto Policy</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_libreswan_crypto_policy"/>
                  <description>Libreswan should be configured to use the system-wide crypto policy setting.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_libreswan_installed:def:1" negate="true" comment="Check if package libreswan is not installed"/>
                  <criterion test_ref="oval:ssg-test_configure_libreswan_crypto_policy:tst:1" comment="Check that the libreswan configuration includes the crypto policy config file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_kerberos_crypto_policy:def:1" version="2" class="compliance">
                <metadata>
                  <title>Configure Kerberos to use System Crypto Policy</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_kerberos_crypto_policy"/>
                  <description>Kerberos should be configured to use the system-wide crypto policy setting.</description>
                </metadata>
                <criteria operator="OR" comment="The config file is always a symlink to the backend, but the backend itself may be either a file, or a symlink. For this reason, we need two tests, if one passes, the other one is expected to either fail, or error.">
                  <criterion test_ref="oval:ssg-test_configure_kerberos_crypto_policy_symlink:tst:1" comment="kerberos crypto-policy configuration links to same file as kerberos crypto-policy backend"/>
                  <criterion test_ref="oval:ssg-test_configure_kerberos_crypto_policy_nosymlink:tst:1" comment="kerberos crypto-policy configuration links to the crypto-policy backend file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_gnutls_tls_crypto_policy:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure GnuTLS library to use DoD-approved TLS Encryption</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_gnutls_tls_crypto_policy"/>
                  <description>Check presence of +VERS-ALL:-VERS-DTLS0.9:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS1.0 in /etc/crypto-policies/back-ends/gnutls.config</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_configure_gnutls_tls_crypto_policy:tst:1" comment="Check that /etc/crypto-policies/back-ends/gnutls.config contains a line with certain text"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_crypto_policy:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure System Cryptography Policy</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_crypto_policy"/>
                  <description>Ensure crypto policy is correctly configured in /etc/crypto-policies/config, and the policy is current.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_configure_crypto_policy:tst:1" comment="check for crypto policy correctly configured in /etc/crypto-policy/config"/>
                  <criterion test_ref="oval:ssg-test_configure_crypto_policy_current:tst:1" comment="check for crypto policy correctly configured in /etc/crypto-policy/state/current"/>
                  <criterion test_ref="oval:ssg-test_crypto_policies_updated:tst:1" comment="Check if update-crypto-policies has been run after config update"/>
                  <criterion test_ref="oval:ssg-test_crypto_policy_nss_config:tst:1" comment="Check if /etc/crypto-policies/back-ends/nss.config exists"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_bind_crypto_policy:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure BIND to use System Crypto Policy</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_bind_crypto_policy"/>
                  <description>BIND should be configured to use the system-wide crypto policy setting.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_bind_removed:def:1" comment="Check if package bind is not installed"/>
                  <criterion test_ref="oval:ssg-test_configure_bind_crypto_policy:tst:1" comment="Check that the configuration includes the policy config file."/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_bashrc_exec_tmux:def:1" version="1" class="compliance">
                <metadata>
                  <title>Support session locking with tmux</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_bashrc_exec_tmux"/>
                  <description>Check if tmux is configured to exec at the end of bashrc.</description>
                </metadata>
                <criteria comment="Check exec tmux configured at the end of bashrc">
                  <criterion test_ref="oval:ssg-test_configure_bashrc_exec_tmux:tst:1" comment="check tmux is configured to exec on the last line of /etc/bashrc"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-clean_components_post_updating:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure dnf Removes Previous Package Versions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="clean_components_post_updating"/>
                  <description>The clean_requirements_on_remove option should be used to ensure that old 
      versions of software components are removed after updating.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_yum_clean_components_post_updating:tst:1" comment="check value of clean_requirements_on_remove in /etc/dnf/dnf.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-chronyd_specify_remote_server:def:1" version="1" class="compliance">
                <metadata>
                  <title>A remote time server for Chrony is configured</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="chronyd_specify_remote_server"/>
                  <description>A remote NTP Server for time synchronization should be
      specified (and dependencies are met)</description>
                </metadata>
                <criteria comment="chrony.conf conditions are met">
                  <criterion test_ref="oval:ssg-test_chronyd_remote_server:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-chronyd_specify_multiple_servers:def:1" version="1" class="compliance">
                <metadata>
                  <title>Specify Multiple Remote chronyd NTP Servers for Time Data</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="chronyd_specify_multiple_servers"/>
                  <description>Multiple chronyd NTP Servers for time synchronization should be specified.</description>
                </metadata>
                <criteria comment="chrony.conf conditions are met">
                  <criterion test_ref="oval:ssg-test_chronyd_multiple_servers:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-chronyd_server_directive:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Chrony is only configured with the server directive</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="chronyd_server_directive"/>
                  <description>Ensure Chrony has time sources configured with server directive</description>
                </metadata>
                <criteria comment="chrony.conf only has server directive">
                  <criterion test_ref="oval:ssg-test_chronyd_server_directive_with_server:tst:1"/>
                  <criterion test_ref="oval:ssg-test_chronyd_server_directive_no_pool:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-chronyd_run_as_chrony_user:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure that chronyd is running under chrony user account</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="chronyd_run_as_chrony_user"/>
                  <description>Ensure 'OPTIONS' is configured with value '["]?.*-u chrony.*["]?' in /etc/sysconfig/chronyd</description>
                </metadata>
                <criteria comment="The respective application or service is configured correctly and configuration file exists">
                  <criteria operator="OR" comment="The respective application or service is configured correctly">
                    <criterion test_ref="oval:ssg-test_chronyd_run_as_chrony_user:tst:1" comment="Check the OPTIONS in /etc/sysconfig/chronyd"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_chronyd_run_as_chrony_user_config_file_exists:tst:1" comment="test if configuration file /etc/sysconfig/chronyd exists for chronyd_run_as_chrony_user"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-chronyd_or_ntpd_specify_remote_server:def:1" version="1" class="compliance">
                <metadata>
                  <title>Specify a Remote NTP Server</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="chronyd_or_ntpd_specify_remote_server"/>
                  <description>A remote chronyd or ntpd NTP Server for time synchronization should be specified (and dependencies are met)</description>
                </metadata>
                <criteria operator="OR">
                  <criteria comment="chronyd enabled and remote server specified">
                    <extend_definition definition_ref="oval:ssg-service_chronyd_enabled:def:1" comment="service chronyd enabled"/>
                    <extend_definition definition_ref="oval:ssg-chronyd_specify_remote_server:def:1" comment="chronyd remote server specified"/>
                  </criteria>
                  <criteria comment="ntpd enabled and remote server specified">
                    <extend_definition definition_ref="oval:ssg-service_ntpd_enabled:def:1" comment="service ntpd enabled"/>
                    <extend_definition definition_ref="oval:ssg-ntpd_specify_remote_server:def:1" comment="ntpd remote server specified"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-chronyd_or_ntpd_specify_multiple_servers:def:1" version="1" class="compliance">
                <metadata>
                  <title>Specify Additional Remote NTP Servers</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="chronyd_or_ntpd_specify_multiple_servers"/>
                  <description>Multiple remote chronyd or ntpd NTP Servers for time synchronization should be specified (and dependencies are met)</description>
                </metadata>
                <criteria operator="OR">
                  <criteria comment="chronyd enabled and multiple remote servers specified">
                    <extend_definition definition_ref="oval:ssg-service_chronyd_enabled:def:1" comment="service chronyd enabled"/>
                    <extend_definition definition_ref="oval:ssg-chronyd_specify_multiple_servers:def:1" comment="multiple chronyd remote servers specified"/>
                  </criteria>
                  <criteria comment="ntpd enabled and multile remote servers specified">
                    <extend_definition definition_ref="oval:ssg-service_ntpd_enabled:def:1" comment="service ntpd enabled"/>
                    <extend_definition definition_ref="oval:ssg-ntpd_specify_multiple_servers:def:1" comment="multiple ntpd remote servers specified"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-chronyd_or_ntpd_set_maxpoll:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure Time Service Maxpoll Interval</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="chronyd_or_ntpd_set_maxpoll"/>
                  <description>Configure the maxpoll setting in /etc/ntp.conf or chrony.conf
      to continuously poll the time source servers.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_ntp_no_server:tst:1" comment="check if no server entry is set in /etc/ntp.conf"/>
                    <criteria>
                      <criterion test_ref="oval:ssg-test_ntp_set_maxpoll:tst:1" comment="check if maxpoll is set in /etc/ntp.conf"/>
                      <criterion test_ref="oval:ssg-test_ntp_all_server_has_maxpoll:tst:1" comment="check if all server entries have maxpoll set in /etc/ntp.conf"/>
                    </criteria>
                  </criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_chrony_no_server_nor_pool:tst:1" comment="check if no server or pool entry is set in /etc/chrony.conf"/>
                    <criteria>
                      <criterion test_ref="oval:ssg-test_chrony_set_maxpoll:tst:1" comment="check if maxpoll is set in /etc/chrony.conf"/>
                      <criterion test_ref="oval:ssg-test_chrony_all_server_has_maxpoll:tst:1" comment="check if all server entries have maxpoll set in /etc/chrony.conf"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-chronyd_no_chronyc_network:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable network management of chrony daemon</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="chronyd_no_chronyc_network"/>
                  <description>Configure the cmdport setting in {{{ chrony_conf_path }}} to disable
      chronyc management connections over network.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-service_chronyd_enabled:def:1" comment="service chronyd enabled"/>
                  <criterion test_ref="oval:ssg-test_chronyd_no_chronyc_network:tst:1" comment="check if cmdport is 0 in /etc/chrony.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-chronyd_client_only:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable chrony daemon from acting as server</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="chronyd_client_only"/>
                  <description>Configure the port setting in {{{ chrony_conf_path }}} to disable
      server operation.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-service_chronyd_enabled:def:1" comment="service chronyd enabled"/>
                  <criterion test_ref="oval:ssg-test_chronyd_client_only:tst:1" comment="check if port is 0 in /etc/chrony.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify GRUB_DISABLE_RECOVERY Set to true</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="bootloader_disable_recovery_set_to_true"/>
                  <description>GRUB_DISABLE_RECOVERY set to 'true' in
      /etc/default/grub</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_bootloader_disable_recovery_set_to_true:tst:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-bios_enable_execution_restrictions:def:1" version="2" class="compliance">
                <metadata>
                  <title>Enable NX or XD Support in the BIOS</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="bios_enable_execution_restrictions"/>
                  <description>The NX (no-execution) bit flag should be set on the system.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_NX_cpu_support:tst:1" comment="NX bit is set"/>
                  <criterion test_ref="oval:ssg-test_messages_nx_active:tst:1" comment="No log messages about NX being disabled"/>
                  <criterion test_ref="oval:ssg-test_noexec_cmd_line:tst:1" comment="NX is not disabled in the kernel command line"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-banner_etc_motd:def:1" version="2" class="compliance">
                <metadata>
                  <title>Modify the System Message of the Day Banner</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="banner_etc_motd"/>
                  <description>The system login banner text should be set correctly.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_banner_etc_motd:tst:1" comment="/etc/motd is set appropriately"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-banner_etc_issue:def:1" version="2" class="compliance">
                <metadata>
                  <title>Modify the System Login Banner</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="banner_etc_issue"/>
                  <description>The system login banner text should be set correctly.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_banner_etc_issue:tst:1" comment="/etc/issue is set appropriately"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_write_logs:def:1" version="1" class="compliance">
                <metadata>
                  <title>Write Audit Logs to the Disk</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_write_logs"/>
                  <description>Ensure 'write_logs' is configured with value 'yes' in /etc/audit/auditd.conf</description>
                </metadata>
                <criteria operator="OR" comment="auditd is configured correctly">
                  <criterion test_ref="oval:ssg-test_auditd_write_logs:tst:1" comment="Check the write_logs in /etc/audit/auditd.conf"/>
                  <criterion test_ref="oval:ssg-test_auditd_write_logs_default_not_overriden:tst:1" comment="Check the absence of write_logs in /etc/audit/auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_overflow_action:def:1" version="1" class="compliance">
                <metadata>
                  <title>Appropriate Action Must be Setup When the Internal Audit Event Queue is Full</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_overflow_action"/>
                  <description>Ensure 'overflow_action' is configured with value '(syslog|single|halt)' in /etc/audit/auditd.conf</description>
                </metadata>
                <criteria operator="OR" comment="The respective application or service is configured correctly">
                  <criterion test_ref="oval:ssg-test_auditd_overflow_action:tst:1" comment="Check the overflow_action in /etc/audit/auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_name_format:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set hostname as computer node name in audit logs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_name_format"/>
                  <description>Ensure 'name_format' is configured with value 'hostname' in /etc/audit/auditd.conf</description>
                </metadata>
                <criteria operator="OR" comment="auditd is configured correctly">
                  <criterion test_ref="oval:ssg-test_auditd_name_format:tst:1" comment="Check the name_format in /etc/audit/auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_log_format:def:1" version="1" class="compliance">
                <metadata>
                  <title>Resolve information before writing to audit logs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_log_format"/>
                  <description>Ensure 'log_format' is configured with value 'ENRICHED' in /etc/audit/auditd.conf</description>
                </metadata>
                <criteria operator="OR" comment="auditd is configured correctly">
                  <criterion test_ref="oval:ssg-test_auditd_log_format:tst:1" comment="Check the log_format in /etc/audit/auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_local_events:def:1" version="1" class="compliance">
                <metadata>
                  <title>Include Local Events in Audit Logs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_local_events"/>
                  <description>Ensure 'local_events' is configured with value 'yes' in /etc/audit/auditd.conf</description>
                </metadata>
                <criteria operator="OR" comment="auditd is configured correctly">
                  <criterion test_ref="oval:ssg-test_auditd_local_events:tst:1" comment="Check the local_events in /etc/audit/auditd.conf"/>
                  <criterion test_ref="oval:ssg-test_auditd_local_events_default_not_overriden:tst:1" comment="Check the absence of local_events in /etc/audit/auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_freq:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set number of records to cause an explicit flush to audit logs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_freq"/>
                  <description>Ensure 'freq' is configured with value '50' in /etc/audit/auditd.conf</description>
                </metadata>
                <criteria operator="OR" comment="auditd is configured correctly">
                  <criterion test_ref="oval:ssg-test_auditd_freq:tst:1" comment="Check the freq in /etc/audit/auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_data_retention_space_left_percentage:def:1" version="2" class="compliance">
                <metadata>
                  <title>Configure auditd space_left on Low Disk Space</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_data_retention_space_left_percentage"/>
                  <description>space_left setting in /etc/audit/auditd.conf is set to at least a certain value</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_data_retention_space_left_percentage:tst:1" comment="space_left setting in auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_data_retention_space_left_action:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure auditd space_left Action on Low Disk Space</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_data_retention_space_left_action"/>
                  <description>space_left_action setting in /etc/audit/auditd.conf is set to a certain action</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_data_retention_space_left_action:tst:1" comment="space_left_action setting in auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_data_retention_num_logs:def:1" version="2" class="compliance">
                <metadata>
                  <title>Configure auditd Number of Logs Retained</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_data_retention_num_logs"/>
                  <description>num_logs setting in /etc/audit/auditd.conf is set to at least a certain value</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_data_retention_num_logs:tst:1" comment="num_logs setting in auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_data_retention_max_log_file_action:def:1" version="2" class="compliance">
                <metadata>
                  <title>Configure auditd max_log_file_action Upon Reaching Maximum Log Size</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_data_retention_max_log_file_action"/>
                  <description>max_log_file_action setting in /etc/audit/auditd.conf is set to a certain action</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_data_retention_max_log_file_action:tst:1" comment="max_log_file_action setting in auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_data_retention_max_log_file:def:1" version="2" class="compliance">
                <metadata>
                  <title>Configure auditd Max Log File Size</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_data_retention_max_log_file"/>
                  <description>max_log_file setting in /etc/audit/auditd.conf is set to at least a certain value</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_data_retention_max_log_file:tst:1" comment="max_log_file setting in auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_data_retention_flush:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure auditd flush priority</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_data_retention_flush"/>
                  <description>The setting for flush in /etc/audit/auditd.conf</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_data_retention_flush:tst:1" comment="flush setting in auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_data_retention_admin_space_left_action:def:1" version="2" class="compliance">
                <metadata>
                  <title>Configure auditd admin_space_left Action on Low Disk Space</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_data_retention_admin_space_left_action"/>
                  <description>admin_space_left_action setting in /etc/audit/auditd.conf is set to a certain action</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_data_retention_admin_space_left_action:tst:1" comment="admin_space_left_action setting in auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_data_retention_action_mail_acct:def:1" version="2" class="compliance">
                <metadata>
                  <title>Configure auditd mail_acct Action on Low Disk Space</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_data_retention_action_mail_acct"/>
                  <description>action_mail_acct setting in /etc/audit/auditd.conf is set to a certain account</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_data_retention_action_mail_acct:tst:1" comment="action_mail_acct setting in auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_data_disk_full_action:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure auditd Disk Full Action when Disk Space Is Full</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_data_disk_full_action"/>
                  <description>disk_full_action setting in /etc/audit/auditd.conf is set to a certain action</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_data_disk_full_action:tst:1" comment="disk_full_action setting in auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_data_disk_error_action:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure auditd Disk Error Action on Disk Error</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_data_disk_error_action"/>
                  <description>disk_error_action setting in /etc/audit/auditd.conf is set to a certain action</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_data_disk_error_action:tst:1" comment="disk_error_action setting in auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_conf_log_group_not_root:def:1" version="1" class="compliance">
                <metadata>
                  <title>'log_group' Not Set To 'root' In /etc/audit/auditd.conf</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_conf_log_group_not_root"/>
                  <description>Verify 'log_group' is not set to 'root' in
      /etc/audit/auditd.conf.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_conf_log_group_not_root:tst:1" comment="Verify 'log_group' not set to 'root' in /etc/audit/auditd.conf"/>
                  <criterion test_ref="oval:ssg-test_auditd_conf_log_group_is_set:tst:1" comment="Verify 'log_group' is set in /etc/audit/auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_conf_log_file_not_set:def:1" version="1" class="compliance">
                <metadata>
                  <title>'log_file' Not Set In /etc/audit/auditd.conf</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_conf_log_file_not_set"/>
                  <description>Verify 'log_file' is not set in /etc/audit/auditd.conf.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_conf_log_file_not_set:tst:1" comment="Verify 'log_file' not set in /etc/audit/auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_audispd_syslog_plugin_activated:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure auditd to use audispd's syslog plugin</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_audispd_syslog_plugin_activated"/>
                  <description>active setting in /etc/audit/plugins.d/syslog.conf is set to 'yes'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_audispd_syslog_plugin_activated:tst:1" comment="active setting in syslog.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_audispd_encrypt_sent_records:def:1" version="1" class="compliance">
                <metadata>
                  <title>Encrypt Audit Records Sent With audispd Plugin</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_audispd_encrypt_sent_records"/>
                  <description>transport setting in /etc/audit/audisp-remote.conf is set to 'KRB5'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_audispd_encrypt_sent_records:tst:1" comment="setting in audisp-remote.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_audispd_configure_remote_server:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure audispd Plugin To Send Logs To Remote Server</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_audispd_configure_remote_server"/>
                  <description>remote_server setting in /etc/audit/audisp-remote.conf is set to a certain IP address or hostname</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_audispd_configure_remote_server:tst:1" comment="remote_server setting in audisp-remote.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_usergroup_modification_shadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information - /etc/shadow</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_usergroup_modification_shadow"/>
                  <description>Audit user/group modification.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_shadow_augen:tst:1" comment="audit shadow"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_shadow_auditctl:tst:1" comment="audit shadow"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_usergroup_modification_passwd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information - /etc/passwd</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_usergroup_modification_passwd"/>
                  <description>Audit user/group modification.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_passwd_augen:tst:1" comment="audit passwd"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_passwd_auditctl:tst:1" comment="audit passwd"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_usergroup_modification_opasswd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information - /etc/security/opasswd</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_usergroup_modification_opasswd"/>
                  <description>Audit user/group modification.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_opasswd_augen:tst:1" comment="audit opasswd"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_opasswd_auditctl:tst:1" comment="audit opasswd"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_usergroup_modification_gshadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information - /etc/gshadow</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_usergroup_modification_gshadow"/>
                  <description>Audit user/group modification.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_gshadow_augen:tst:1" comment="audit gshadow"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_gshadow_auditctl:tst:1" comment="audit gshadow"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_usergroup_modification_group:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information - /etc/group</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_usergroup_modification_group"/>
                  <description>Audit user/group modification.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_group_augen:tst:1" comment="audit group"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_group_auditctl:tst:1" comment="audit group"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_usergroup_modification:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_usergroup_modification"/>
                  <description>Audit rules should detect modification to system files that hold information about users and groups.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_group_augen:tst:1" comment="audit /etc/group"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_augen:tst:1" comment="audit /etc/passwd"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_augen:tst:1" comment="audit /etc/gshadow"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_augen:tst:1" comment="audit /etc/shadow"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_augen:tst:1" comment="audit /etc/security/opasswd"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_group_auditctl:tst:1" comment="audit /etc/group"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_auditctl:tst:1" comment="audit /etc/passwd"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_auditctl:tst:1" comment="audit /etc/gshadow"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_auditctl:tst:1" comment="audit /etc/shadow"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:tst:1" comment="audit /etc/security/opasswd"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_unlinkat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Delete Attempts to Files - unlinkat</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_unlinkat"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_unlinkat_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_unlinkat_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_unlinkat_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_unlinkat_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_unlinkat_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_unlinkat_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_unlinkat_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_unlinkat_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_unlink:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Delete Attempts to Files - unlink</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_unlink"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_unlink_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_unlink_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_unlink_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_unlink_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_unlink_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_unlink_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_unlink_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_unlink_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_truncate:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessful Access Attempts to Files - truncate</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_truncate"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_truncate_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_truncate_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_truncate_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_truncate_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_truncate_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_truncate_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_truncate_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_truncate_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_setxattr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Permission Changes to Files - setxattr</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_setxattr"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_setxattr_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_setxattr_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_setxattr_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_setxattr_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_setxattr_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_setxattr_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_setxattr_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_setxattr_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_renameat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Delete Attempts to Files - renameat</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_renameat"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_renameat_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_renameat_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_renameat_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_renameat_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_renameat_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_renameat_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_renameat_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_renameat_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_rename:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Delete Attempts to Files - rename</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_rename"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_rename_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_rename_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_rename_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_rename_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_rename_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_rename_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_rename_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_rename_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_removexattr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Permission Changes to Files - removexattr</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_removexattr"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_removexattr_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_removexattr_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_removexattr_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_removexattr_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_removexattr_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_removexattr_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_removexattr_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_removexattr_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_openat_rule_order:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_openat_rule_order"/>
                  <description>Audit rules about the information on the unsuccessful use of openat is configured in the proper rule order.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arufm_openat_order_32bit_eacces_augenrules:tst:1" comment="audit augenrules 32-bit"/>
                    <criterion test_ref="oval:ssg-test_arufm_openat_order_32bit_eperm_augenrules:tst:1" comment="audit augenrules 32-bit"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_openat_order_64bit_eacces_augenrules:tst:1" comment="audit augenrules 64-bit"/>
                        <criterion test_ref="oval:ssg-test_arufm_openat_order_64bit_eperm_augenrules:tst:1" comment="audit augenrules 64-bit"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arufm_openat_order_32bit_eacces_auditctl:tst:1" comment="audit augenrules 32-bit"/>
                    <criterion test_ref="oval:ssg-test_arufm_openat_order_32bit_eperm_auditctl:tst:1" comment="audit augenrules 32-bit"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_openat_order_64bit_eacces_auditctl:tst:1" comment="audit augenrules 32-bit"/>
                        <criterion test_ref="oval:ssg-test_arufm_openat_order_64bit_eperm_auditctl:tst:1" comment="audit augenrules 32-bit"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_openat_o_trunc_write"/>
                  <description>Audit rules about the information on the unsuccessful use of openat O_TRUNC is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eacces_augenrules:tst:1" comment="Verify audit rule openat 32bit a2&amp;01003 eacces augenrules exists"/>
                    <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eperm_augenrules:tst:1" comment="Verify audit rule openat 32bit a2&amp;01003 eperm augenrules exists"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eacces_augenrules:tst:1" comment="Verify audit rule openat 64bit a2&amp;01003 eacces augenrules exists"/>
                        <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eperm_augenrules:tst:1" comment="Verify audit rule openat 64bit a2&amp;01003 eperm augenrules exists"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eacces_auditctl:tst:1" comment="Verify audit rule openat 32bit a2&amp;01003 eacces auditctl exists"/>
                    <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eperm_auditctl:tst:1" comment="Verify audit rule openat 32bit a2&amp;01003 eperm auditctl exists"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eacces_auditctl:tst:1" comment="Verify audit rule openat 64bit a2&amp;01003 eacces auditctl exists"/>
                        <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eperm_auditctl:tst:1" comment="Verify audit rule openat 64bit a2&amp;01003 eperm auditctl exists"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessful Creation Attempts to Files - openat O_CREAT</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_openat_o_creat"/>
                  <description>Audit rules about the information on the unsuccessful use of openat O_CREAT is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eacces_augenrules:tst:1" comment="Verify audit rule openat 32bit a2&amp;0100 eacces augenrules exists"/>
                    <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eperm_augenrules:tst:1" comment="Verify audit rule openat 32bit a2&amp;0100 eperm augenrules exists"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eacces_augenrules:tst:1" comment="Verify audit rule openat 64bit a2&amp;0100 eacces augenrules exists"/>
                        <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eperm_augenrules:tst:1" comment="Verify audit rule openat 64bit a2&amp;0100 eperm augenrules exists"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eacces_auditctl:tst:1" comment="Verify audit rule openat 32bit a2&amp;0100 eacces auditctl exists"/>
                    <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eperm_auditctl:tst:1" comment="Verify audit rule openat 32bit a2&amp;0100 eperm auditctl exists"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eacces_auditctl:tst:1" comment="Verify audit rule openat 64bit a2&amp;0100 eacces auditctl exists"/>
                        <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eperm_auditctl:tst:1" comment="Verify audit rule openat 64bit a2&amp;0100 eperm auditctl exists"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_openat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessful Access Attempts to Files - openat</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_openat"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_openat_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_openat_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_openat_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_openat_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_openat_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_openat_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_openat_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_openat_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_open_rule_order:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_open_rule_order"/>
                  <description>Audit rules about the information on the unsuccessful use of open is configured in the proper rule order.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_order_32bit_eacces_augenrules:tst:1" comment="audit augenrules 32-bit"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_order_32bit_eperm_augenrules:tst:1" comment="audit augenrules 32-bit"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_open_order_64bit_eacces_augenrules:tst:1" comment="audit augenrules 64-bit"/>
                        <criterion test_ref="oval:ssg-test_arufm_open_order_64bit_eperm_augenrules:tst:1" comment="audit augenrules 64-bit"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_order_32bit_eacces_auditctl:tst:1" comment="audit augenrules 32-bit"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_order_32bit_eperm_auditctl:tst:1" comment="audit augenrules 32-bit"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_open_order_64bit_eacces_auditctl:tst:1" comment="audit augenrules 32-bit"/>
                        <criterion test_ref="oval:ssg-test_arufm_open_order_64bit_eperm_auditctl:tst:1" comment="audit augenrules 32-bit"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_open_o_trunc_write"/>
                  <description>Audit rules about the information on the unsuccessful use of open O_TRUNC is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eacces_augenrules:tst:1" comment="Verify audit rule open 32bit a1&amp;01003 eacces augenrules exists"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eperm_augenrules:tst:1" comment="Verify audit rule open 32bit a1&amp;01003 eperm augenrules exists"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eacces_augenrules:tst:1" comment="Verify audit rule open 64bit a1&amp;01003 eacces augenrules exists"/>
                        <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eperm_augenrules:tst:1" comment="Verify audit rule open 64bit a1&amp;01003 eperm augenrules exists"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eacces_auditctl:tst:1" comment="Verify audit rule open 32bit a1&amp;01003 eacces auditctl exists"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eperm_auditctl:tst:1" comment="Verify audit rule open 32bit a1&amp;01003 eperm auditctl exists"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eacces_auditctl:tst:1" comment="Verify audit rule open 64bit a1&amp;01003 eacces auditctl exists"/>
                        <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eperm_auditctl:tst:1" comment="Verify audit rule open 64bit a1&amp;01003 eperm auditctl exists"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_open_o_creat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessful Creation Attempts to Files - open O_CREAT</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_open_o_creat"/>
                  <description>Audit rules about the information on the unsuccessful use of open O_CREAT is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eacces_augenrules:tst:1" comment="Verify audit rule open 32bit a1&amp;0100 eacces augenrules exists"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eperm_augenrules:tst:1" comment="Verify audit rule open 32bit a1&amp;0100 eperm augenrules exists"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eacces_augenrules:tst:1" comment="Verify audit rule open 64bit a1&amp;0100 eacces augenrules exists"/>
                        <criterion test_ref="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eperm_augenrules:tst:1" comment="Verify audit rule open 64bit a1&amp;0100 eperm augenrules exists"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eacces_auditctl:tst:1" comment="Verify audit rule open 32bit a1&amp;0100 eacces auditctl exists"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eperm_auditctl:tst:1" comment="Verify audit rule open 32bit a1&amp;0100 eperm auditctl exists"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eacces_auditctl:tst:1" comment="Verify audit rule open 64bit a1&amp;0100 eacces auditctl exists"/>
                        <criterion test_ref="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eperm_auditctl:tst:1" comment="Verify audit rule open 64bit a1&amp;0100 eperm auditctl exists"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order"/>
                  <description>Audit rules about the information on the unsuccessful use of open_by_handle_at is configured in the proper rule order.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eacces_augenrules:tst:1" comment="audit augenrules 32-bit"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eperm_augenrules:tst:1" comment="audit augenrules 32-bit"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eacces_augenrules:tst:1" comment="audit augenrules 64-bit"/>
                        <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eperm_augenrules:tst:1" comment="audit augenrules 64-bit"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eacces_auditctl:tst:1" comment="audit augenrules 32-bit"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eperm_auditctl:tst:1" comment="audit augenrules 32-bit"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eacces_auditctl:tst:1" comment="audit augenrules 32-bit"/>
                        <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eperm_auditctl:tst:1" comment="audit augenrules 32-bit"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write"/>
                  <description>Audit rules about the information on the unsuccessful use of open_by_handle_at O_TRUNC is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_augenrules:tst:1" comment="Verify audit rule open_by_handle_at 32bit a2&amp;01003 eacces augenrules exists"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_augenrules:tst:1" comment="Verify audit rule open_by_handle_at 32bit a2&amp;01003 eperm augenrules exists"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_augenrules:tst:1" comment="Verify audit rule open_by_handle_at 64bit a2&amp;01003 eacces augenrules exists"/>
                        <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_augenrules:tst:1" comment="Verify audit rule open_by_handle_at 64bit a2&amp;01003 eperm augenrules exists"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_auditctl:tst:1" comment="Verify audit rule open_by_handle_at 32bit a2&amp;01003 eacces auditctl exists"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_auditctl:tst:1" comment="Verify audit rule open_by_handle_at 32bit a2&amp;01003 eperm auditctl exists"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_auditctl:tst:1" comment="Verify audit rule open_by_handle_at 64bit a2&amp;01003 eacces auditctl exists"/>
                        <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_auditctl:tst:1" comment="Verify audit rule open_by_handle_at 64bit a2&amp;01003 eperm auditctl exists"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat"/>
                  <description>Audit rules about the information on the unsuccessful use of open_by_handle_at O_CREAT is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_augenrules:tst:1" comment="Verify audit rule open_by_handle_at 32bit a2&amp;0100 eacces augenrules exists"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_augenrules:tst:1" comment="Verify audit rule open_by_handle_at 32bit a2&amp;0100 eperm augenrules exists"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_augenrules:tst:1" comment="Verify audit rule open_by_handle_at 64bit a2&amp;0100 eacces augenrules exists"/>
                        <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_augenrules:tst:1" comment="Verify audit rule open_by_handle_at 64bit a2&amp;0100 eperm augenrules exists"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_auditctl:tst:1" comment="Verify audit rule open_by_handle_at 32bit a2&amp;0100 eacces auditctl exists"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_auditctl:tst:1" comment="Verify audit rule open_by_handle_at 32bit a2&amp;0100 eperm auditctl exists"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_auditctl:tst:1" comment="Verify audit rule open_by_handle_at 64bit a2&amp;0100 eacces auditctl exists"/>
                        <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_auditctl:tst:1" comment="Verify audit rule open_by_handle_at 64bit a2&amp;0100 eperm auditctl exists"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessful Access Attempts to Files - open_by_handle_at</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_open_by_handle_at"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_open:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessful Access Attempts to Files - open</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_open"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_open_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_open_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_open_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_open_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_open_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_open_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_open_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_open_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_lsetxattr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Permission Changes to Files - lsetxattr</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_lsetxattr"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_lsetxattr_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_lsetxattr_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_lsetxattr_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_lsetxattr_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_lsetxattr_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_lsetxattr_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_lsetxattr_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_lsetxattr_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_lremovexattr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Permission Changes to Files - lremovexattr</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_lremovexattr"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_lremovexattr_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_lremovexattr_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_lremovexattr_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_lremovexattr_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_lremovexattr_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_lremovexattr_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_lremovexattr_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_lremovexattr_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_lchown:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Ownership Changes to Files - lchown</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_lchown"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_lchown_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_lchown_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_lchown_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_lchown_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_lchown_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_lchown_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_lchown_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_lchown_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_ftruncate:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessful Access Attempts to Files - ftruncate</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_ftruncate"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_ftruncate_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_ftruncate_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_ftruncate_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_ftruncate_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_ftruncate_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_ftruncate_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_ftruncate_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_ftruncate_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_fsetxattr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Permission Changes to Files - fsetxattr</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_fsetxattr"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fsetxattr_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fsetxattr_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fsetxattr_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fsetxattr_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fsetxattr_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fsetxattr_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fsetxattr_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fsetxattr_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_fremovexattr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Permission Changes to Files - fremovexattr</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_fremovexattr"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fremovexattr_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fremovexattr_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fremovexattr_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fremovexattr_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fremovexattr_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fremovexattr_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fremovexattr_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fremovexattr_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_fchownat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Ownership Changes to Files - fchownat</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_fchownat"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchownat_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchownat_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchownat_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchownat_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchownat_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchownat_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchownat_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchownat_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_fchown:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Ownership Changes to Files - fchown</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_fchown"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchown_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchown_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchown_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchown_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchown_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchown_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchown_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchown_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_fchmodat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Permission Changes to Files - fchmodat</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_fchmodat"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchmodat_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchmodat_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchmodat_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchmodat_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchmodat_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchmodat_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchmodat_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchmodat_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_fchmod:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Permission Changes to Files - fchmod</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_fchmod"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchmod_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchmod_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchmod_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchmod_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchmod_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchmod_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchmod_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchmod_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_creat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessful Access Attempts to Files - creat</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_creat"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_creat_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_creat_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_creat_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_creat_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_creat_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_creat_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_creat_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_creat_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_chown:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Ownership Changes to Files - chown</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_chown"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_chown_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_chown_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_chown_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_chown_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_chown_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_chown_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_chown_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_chown_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_chmod:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Permission Changes to Files - chmod</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_chmod"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_chmod_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_chmod_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_chmod_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_chmod_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_chmod_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_chmod_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_chmod_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_chmod_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_creat:def:1" comment="audit creat"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_ftruncate:def:1" comment="audit ftruncate"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_openat:def:1" comment="audit openat"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at:def:1" comment="audit open_by_handle_at"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_open:def:1" comment="audit open"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_truncate:def:1" comment="audit truncate"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_time_watch_localtime:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Attempts to Alter the localtime File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_time_watch_localtime"/>
                  <description>Record attempts to alter time through /etc/localtime.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_artw_etc_localtime_augenrules:tst:1" comment="audit /etc/localtime watch augenrules"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_artw_etc_localtime_auditctl:tst:1" comment="audit /etc/localtime watch auditctl"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_time_stime:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Attempts to Alter Time Through stime</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_time_stime"/>
                  <description>Record attempts to alter time through stime. Note that on
      64-bit architectures the stime system call is not defined in the audit
      system calls lookup table.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR" comment="32-bit or 64-bit system">
                    <extend_definition definition_ref="oval:ssg-system_info_architecture_x86:def:1" comment="32-bit system"/>
                    <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" comment="64-bit system"/>
                  </criteria>
                  <criteria operator="OR" comment="audit augenrules or audit auditctl">
                    <criteria comment="audit augenrules stime">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                      <criterion test_ref="oval:ssg-test_32bit_art_stime_augenrules:tst:1" comment="audit augenrules 32-bit stime"/>
                    </criteria>
                    <criteria comment="audit auditctl stime">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                      <criterion test_ref="oval:ssg-test_32bit_art_stime_auditctl:tst:1" comment="audit auditctl 32-bit stime"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_time_settimeofday:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record attempts to alter time through settimeofday</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_time_settimeofday"/>
                  <description>Record attempts to alter time through settimeofday.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_art_settimeofday_augenrules:tst:1" comment="audit augenrules 32-bit settimeofday"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_art_settimeofday_augenrules:tst:1" comment="audit augenrules 64-bit settimeofday"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_art_settimeofday_auditctl:tst:1" comment="audit auditctl 32-bit settimeofday"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_art_settimeofday_auditctl:tst:1" comment="audit auditctl 64-bit settimeofday"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_time_clock_settime:def:1" version="2" class="compliance">
                <metadata>
                  <title>Record Attempts to Alter Time Through clock_settime</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_time_clock_settime"/>
                  <description>Record attempts to alter time through clock_settime.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_art_clock_settime_augenrules:tst:1" comment="audit augenrules 32-bit clock_settime"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_art_clock_settime_augenrules:tst:1" comment="audit augenrules 64-bit clock_settime"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_art_clock_settime_auditctl:tst:1" comment="audit auditctl 32-bit clock_settime"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_art_clock_settime_auditctl:tst:1" comment="audit auditctl 64-bit clock_settime"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_time_adjtimex:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record attempts to alter time through adjtimex</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_time_adjtimex"/>
                  <description>Record attempts to alter time through adjtimex.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_art_adjtimex_augenrules:tst:1" comment="audit augenrules 32-bit adjtimex"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_art_adjtimex_augenrules:tst:1" comment="audit augenrules 64-bit adjtimex"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_art_adjtimex_auditctl:tst:1" comment="audit auditctl 32-bit adjtimex"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_art_adjtimex_auditctl:tst:1" comment="audit auditctl 64-bit adjtimex"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_sysadmin_actions:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects System Administrator Actions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_sysadmin_actions"/>
                  <description>Audit actions taken by system administrators on the system.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_augenrules:tst:1" comment="audit augenrules sudoers"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_augenrules:tst:1" comment="audit augenrules sudoers_d"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_auditctl:tst:1" comment="audit auditctl sudoers"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_auditctl:tst:1" comment="audit auditctl sudoers_d"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_session_events:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Attempts to Alter Process and Session Initiation Information</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_session_events"/>
                  <description>Audit rules should capture information about session initiation.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arse_utmp_augenrules:tst:1" comment="audit augenrules utmp"/>
                    <criterion test_ref="oval:ssg-test_arse_btmp_augenrules:tst:1" comment="audit augenrules btmp"/>
                    <criterion test_ref="oval:ssg-test_arse_wtmp_augenrules:tst:1" comment="audit augenrules wtmp"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arse_utmp_auditctl:tst:1" comment="audit auditctl utmp"/>
                    <criterion test_ref="oval:ssg-test_arse_btmp_auditctl:tst:1" comment="audit auditctl btmp"/>
                    <criterion test_ref="oval:ssg-test_arse_wtmp_auditctl:tst:1" comment="audit auditctl wtmp"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_usernetctl:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - usernetctl</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_usernetctl"/>
                  <description>Audit rules about the information on the use of usernetctl is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_usernetctl_augenrules:tst:1" comment="audit augenrules usernetctl"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_usernetctl_auditctl:tst:1" comment="audit auditctl usernetctl"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_userhelper:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - userhelper</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_userhelper"/>
                  <description>Audit rules about the information on the use of userhelper is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_userhelper_augenrules:tst:1" comment="audit augenrules userhelper"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_userhelper_auditctl:tst:1" comment="audit auditctl userhelper"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_unix_chkpwd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_unix_chkpwd"/>
                  <description>Audit rules about the information on the use of unix_chkpwd is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_augenrules:tst:1" comment="audit augenrules unix_chkpwd"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_auditctl:tst:1" comment="audit auditctl unix_chkpwd"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_umount:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - umount</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_umount"/>
                  <description>Audit rules about the information on the use of umount is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_umount_augenrules:tst:1" comment="audit augenrules umount"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_umount_auditctl:tst:1" comment="audit auditctl umount"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_sudoedit:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_sudoedit"/>
                  <description>Audit rules about the information on the use of sudoedit is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_sudoedit_augenrules:tst:1" comment="audit augenrules sudoedit"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_sudoedit_auditctl:tst:1" comment="audit auditctl sudoedit"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_sudo:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - sudo</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_sudo"/>
                  <description>Audit rules about the information on the use of sudo is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_sudo_augenrules:tst:1" comment="audit augenrules sudo"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_sudo_auditctl:tst:1" comment="audit auditctl sudo"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_su:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - su</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_su"/>
                  <description>Audit rules about the information on the use of su is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_su_augenrules:tst:1" comment="audit augenrules su"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_su_auditctl:tst:1" comment="audit auditctl su"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_ssh_keysign:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_ssh_keysign"/>
                  <description>Audit rules about the information on the use of ssh_keysign is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_augenrules:tst:1" comment="audit augenrules ssh_keysign"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_auditctl:tst:1" comment="audit auditctl ssh_keysign"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_pt_chown:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - pt_chown</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_pt_chown"/>
                  <description>Audit rules about the information on the use of pt_chown is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_pt_chown_augenrules:tst:1" comment="audit augenrules pt_chown"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_pt_chown_auditctl:tst:1" comment="audit auditctl pt_chown"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_passwd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - passwd</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_passwd"/>
                  <description>Audit rules about the information on the use of passwd is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_passwd_augenrules:tst:1" comment="audit augenrules passwd"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_passwd_auditctl:tst:1" comment="audit auditctl passwd"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_newuidmap:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - newuidmap</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_newuidmap"/>
                  <description>Audit rules about the information on the use of newuidmap is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_newuidmap_augenrules:tst:1" comment="audit augenrules newuidmap"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_newuidmap_auditctl:tst:1" comment="audit auditctl newuidmap"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_newgrp:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_newgrp"/>
                  <description>Audit rules about the information on the use of newgrp is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_newgrp_augenrules:tst:1" comment="audit augenrules newgrp"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_newgrp_auditctl:tst:1" comment="audit auditctl newgrp"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_newgidmap:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - newgidmap</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_newgidmap"/>
                  <description>Audit rules about the information on the use of newgidmap is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_newgidmap_augenrules:tst:1" comment="audit augenrules newgidmap"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_newgidmap_auditctl:tst:1" comment="audit auditctl newgidmap"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_mount:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - mount</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_mount"/>
                  <description>Audit rules about the information on the use of mount is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_mount_augenrules:tst:1" comment="audit augenrules mount"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_mount_auditctl:tst:1" comment="audit auditctl mount"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_gpasswd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_gpasswd"/>
                  <description>Audit rules about the information on the use of gpasswd is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_gpasswd_augenrules:tst:1" comment="audit augenrules gpasswd"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_gpasswd_auditctl:tst:1" comment="audit auditctl gpasswd"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_crontab:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - crontab</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_crontab"/>
                  <description>Audit rules about the information on the use of crontab is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_crontab_augenrules:tst:1" comment="audit augenrules crontab"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_crontab_auditctl:tst:1" comment="audit auditctl crontab"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_chsh:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - chsh</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_chsh"/>
                  <description>Audit rules about the information on the use of chsh is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_chsh_augenrules:tst:1" comment="audit augenrules chsh"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_chsh_auditctl:tst:1" comment="audit auditctl chsh"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_chage:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - chage</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_chage"/>
                  <description>Audit rules about the information on the use of chage is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_chage_augenrules:tst:1" comment="audit augenrules chage"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_chage_auditctl:tst:1" comment="audit auditctl chage"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_at:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - at</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_at"/>
                  <description>Audit rules about the information on the use of at is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_at_augenrules:tst:1" comment="audit augenrules at"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_at_auditctl:tst:1" comment="audit auditctl at"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands"/>
                  <description>Audit rules about the information on the use of privileged commands are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arpc_suid_sgid_augenrules:tst:1" comment="audit augenrules suid sgid"/>
                    <criterion test_ref="oval:ssg-test_arpc_bin_count_equals_rules_count_augenrules:tst:1" comment="audit augenrules binaries count matches rules count"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arpc_suid_sgid_auditctl:tst:1" comment="audit auditctl suid sgid"/>
                    <criterion test_ref="oval:ssg-test_arpc_bin_count_equals_rules_count_auditctl:tst:1" comment="audit auditctl binaries count matches rules count"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_networkconfig_modification_hostname:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Network Environment</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_networkconfig_modification_hostname"/>
                  <description>The network environment should not be modified by anything other than
      administrator action. Any change to network parameters should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_sethostname_augenrules:tst:1" comment="audit augenrules 32-bit sethostname"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_sethostname_augenrules:tst:1" comment="audit augenrules 64-bit sethostname"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_sethostname_auditctl:tst:1" comment="audit auditctl 32-bit sethostname"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_sethostname_auditctl:tst:1" comment="audit auditctl 64-bit sethostname"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_networkconfig_modification_domainname:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Network Environment</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_networkconfig_modification_domainname"/>
                  <description>The network environment should not be modified by anything other than
      administrator action. Any change to network parameters should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_setdomainname_augenrules:tst:1" comment="audit augenrules 32-bit setdomainname"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_setdomainname_augenrules:tst:1" comment="audit augenrules 64-bit setdomainname"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_setdomainname_auditctl:tst:1" comment="audit auditctl 32-bit setdomainname"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_setdomainname_auditctl:tst:1" comment="audit auditctl 64-bit setdomainname"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_networkconfig_modification:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Network Environment</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_networkconfig_modification"/>
                  <description>The network environment should not be modified by anything other than
      administrator action. Any change to network parameters should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arnm_etc_issue_augenrules:tst:1" comment="audit /etc/issue augenrules"/>
                    <criterion test_ref="oval:ssg-test_arnm_etc_issue_net_augenrules:tst:1" comment="audit /etc/issue.net augenrules"/>
                    <criterion test_ref="oval:ssg-test_arnm_etc_hosts_augenrules:tst:1" comment="audit /etc/hosts augenrules"/>
                    <criterion test_ref="oval:ssg-test_arnm_etc_sysconfig_network_augenrules:tst:1" comment="audit /etc/sysconfig/network augenrules"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_networkconfig_modification_hostname:def:1" comment="audit augenrules sethostname"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_networkconfig_modification_domainname:def:1" comment="audit augenrules setdomainname"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arnm_etc_issue_auditctl:tst:1" comment="audit /etc/issue auditctl"/>
                    <criterion test_ref="oval:ssg-test_arnm_etc_issue_net_auditctl:tst:1" comment="audit /etc/issue.net auditctl"/>
                    <criterion test_ref="oval:ssg-test_arnm_etc_hosts_auditctl:tst:1" comment="audit /etc/hosts auditctl"/>
                    <criterion test_ref="oval:ssg-test_arnm_etc_sysconfig_network_auditctl:tst:1" comment="audit /etc/sysconfig/network auditctl"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_networkconfig_modification_hostname:def:1" comment="audit augenrules sethostname"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_networkconfig_modification_domainname:def:1" comment="audit augenrules setdomainname"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_media_export:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on Exporting to Media (successful)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_media_export"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_mount_augenrules:tst:1" comment="audit augenrules 32-bit mount"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_mount_augenrules:tst:1" comment="audit augenrules 64-bit mount"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_mount_auditctl:tst:1" comment="audit auditctl 32-bit mount"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_mount_auditctl:tst:1" comment="audit auditctl 64-bit mount"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_mac_modification:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Mandatory Access Controls</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_mac_modification"/>
                  <description>Audit rules that detect changes to the system's mandatory access controls (SELinux) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_armm_selinux_watch_augenrules:tst:1" comment="audit selinux changes augenrules"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_armm_selinux_watch_auditctl:tst:1" comment="audit selinux changes auditctl"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_login_events_tallylog:def:1" version="2" class="compliance">
                <metadata>
                  <title>Record Attempts to Alter Logon and Logout Events - tallylog</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_login_events_tallylog"/>
                  <description>Audit rules should be configured to log successful and unsuccessful login and logout events.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arle_tallylog_augenrules:tst:1" comment="audit augenrules tallylog"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arle_tallylog_auditctl:tst:1" comment="audit auditctl tallylog"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_login_events_lastlog:def:1" version="2" class="compliance">
                <metadata>
                  <title>Record Attempts to Alter Logon and Logout Events - lastlog</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_login_events_lastlog"/>
                  <description>Audit rules should be configured to log successful and unsuccessful login and logout events.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arle_lastlog_augenrules:tst:1" comment="audit augenrules lastlog"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arle_lastlog_auditctl:tst:1" comment="audit auditctl lastlog"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_login_events_faillock:def:1" version="2" class="compliance">
                <metadata>
                  <title>Record Attempts to Alter Logon and Logout Events - faillock</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_login_events_faillock"/>
                  <description>Audit rules should be configured to log successful and unsuccessful login and logout events.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arle_faillock_augenrules:tst:1" comment="audit augenrules faillock"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arle_faillock_auditctl:tst:1" comment="audit auditctl faillock"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_login_events:def:1" version="2" class="compliance">
                <metadata>
                  <title>Record Attempts to Alter Logon and Logout Events</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_login_events"/>
                  <description>Audit rules should be configured to log successful and unsuccessful login and logout events.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-audit_rules_login_events_tallylog:def:1" comment="audit tallylog"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_login_events_faillock:def:1" comment="audit faillock"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_login_events_lastlog:def:1" comment="audit lastlog"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_kernel_module_loading_init:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on Kernel Module Loading - init_module</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_kernel_module_loading_init"/>
                  <description>The audit rules should be configured to log information about kernel module loading and unloading.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_init_module_augenrules:tst:1" comment="audit augenrules 32-bit init_module"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_init_module_augenrules:tst:1" comment="audit augenrules 64-bit init_module"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_init_module_auditctl:tst:1" comment="audit auditctl 32-bit init_module"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_init_module_auditctl:tst:1" comment="audit auditctl 64-bit init_module"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_kernel_module_loading_finit:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_kernel_module_loading_finit"/>
                  <description>The audit rules should be configured to log information about kernel module loading and unloading.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_finit_module_augenrules:tst:1" comment="audit augenrules 32-bit finit_module"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_finit_module_augenrules:tst:1" comment="audit augenrules 64-bit finit_module"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_finit_module_auditctl:tst:1" comment="audit auditctl 32-bit finit_module"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_finit_module_auditctl:tst:1" comment="audit auditctl 64-bit finit_module"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_kernel_module_loading_delete:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on Kernel Module Unloading - delete_module</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_kernel_module_loading_delete"/>
                  <description>The audit rules should be configured to log information about kernel module loading and unloading.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_delete_module_augenrules:tst:1" comment="audit augenrules 32-bit delete_module"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_delete_module_augenrules:tst:1" comment="audit augenrules 64-bit delete_module"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_delete_module_auditctl:tst:1" comment="audit auditctl 32-bit delete_module"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_delete_module_auditctl:tst:1" comment="audit auditctl 64-bit delete_module"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_kernel_module_loading:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on Kernel Module Loading and Unloading</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_kernel_module_loading"/>
                  <description>The audit rules should be configured to log information about kernel module loading and unloading.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-audit_rules_kernel_module_loading_init:def:1" comment="audit init_module"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_kernel_module_loading_delete:def:1" comment="audit delete_module"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_kernel_module_loading_finit:def:1" comment="audit finit_module"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_immutable:def:1" version="1" class="compliance">
                <metadata>
                  <title>Make the auditd Configuration Immutable</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_immutable"/>
                  <description>Force a reboot to change audit rules is enabled</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_ari_locked_augenrules:tst:1" comment="audit augenrules configuration locked"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_ari_locked_auditctl:tst:1" comment="audit auditctl configuration locked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_file_deletion_events_unlinkat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects File Deletion Events by User - unlinkat</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_file_deletion_events_unlinkat"/>
                  <description>The deletion of files should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_unlinkat_augenrules:tst:1" comment="audit augenrules 32-bit unlinkat"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_unlinkat_augenrules:tst:1" comment="audit augenrules 64-bit unlinkat"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_unlinkat_auditctl:tst:1" comment="audit auditctl 32-bit unlinkat"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_unlinkat_auditctl:tst:1" comment="audit auditctl 64-bit unlinkat"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_file_deletion_events_unlink:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects File Deletion Events by User - unlink</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_file_deletion_events_unlink"/>
                  <description>The deletion of files should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_unlink_augenrules:tst:1" comment="audit augenrules 32-bit unlink"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_unlink_augenrules:tst:1" comment="audit augenrules 64-bit unlink"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_unlink_auditctl:tst:1" comment="audit auditctl 32-bit unlink"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_unlink_auditctl:tst:1" comment="audit auditctl 64-bit unlink"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_file_deletion_events_rmdir:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects File Deletion Events by User - rmdir</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_file_deletion_events_rmdir"/>
                  <description>The deletion of files should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_rmdir_augenrules:tst:1" comment="audit augenrules 32-bit rmdir"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_rmdir_augenrules:tst:1" comment="audit augenrules 64-bit rmdir"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_rmdir_auditctl:tst:1" comment="audit auditctl 32-bit rmdir"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_rmdir_auditctl:tst:1" comment="audit auditctl 64-bit rmdir"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_file_deletion_events_renameat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects File Deletion Events by User - renameat</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_file_deletion_events_renameat"/>
                  <description>The deletion of files should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_renameat_augenrules:tst:1" comment="audit augenrules 32-bit renameat"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_renameat_augenrules:tst:1" comment="audit augenrules 64-bit renameat"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_renameat_auditctl:tst:1" comment="audit auditctl 32-bit renameat"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_renameat_auditctl:tst:1" comment="audit auditctl 64-bit renameat"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_file_deletion_events_rename:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects File Deletion Events by User - rename</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_file_deletion_events_rename"/>
                  <description>The deletion of files should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_rename_augenrules:tst:1" comment="audit augenrules 32-bit rename"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_rename_augenrules:tst:1" comment="audit augenrules 64-bit rename"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_rename_auditctl:tst:1" comment="audit auditctl 32-bit rename"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_rename_auditctl:tst:1" comment="audit auditctl 64-bit rename"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_file_deletion_events:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects File Deletion Events by User</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_file_deletion_events"/>
                  <description>Audit files deletion events.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-audit_rules_file_deletion_events_rmdir:def:1" comment="audit rmdir"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_file_deletion_events_unlink:def:1" comment="audit unlink"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_file_deletion_events_unlinkat:def:1" comment="audit unlinkat"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_file_deletion_events_rename:def:1" comment="audit rename"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_file_deletion_events_renameat:def:1" comment="audit renameat"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_execution_seunshare:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Any Attempts to Run seunshare</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_execution_seunshare"/>
                  <description>Audit rules about the information on the use of seunshare is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_execution_seunshare_augenrules:tst:1" comment="audit augenrules seunshare"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_execution_seunshare_auditctl:tst:1" comment="audit auditctl seunshare"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_execution_setsebool:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Any Attempts to Run setsebool</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_execution_setsebool"/>
                  <description>Audit rules about the information on the use of setsebool is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_execution_setsebool_augenrules:tst:1" comment="audit augenrules setsebool"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_execution_setsebool_auditctl:tst:1" comment="audit auditctl setsebool"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_execution_semanage:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Any Attempts to Run semanage</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_execution_semanage"/>
                  <description>Audit rules about the information on the use of semanage is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_execution_semanage_augenrules:tst:1" comment="audit augenrules semanage"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_execution_semanage_auditctl:tst:1" comment="audit auditctl semanage"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_execution_restorecon:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Any Attempts to Run restorecon</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_execution_restorecon"/>
                  <description>Audit rules about the information on the use of restorecon is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_execution_restorecon_augenrules:tst:1" comment="audit augenrules restorecon"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_execution_restorecon_auditctl:tst:1" comment="audit auditctl restorecon"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_execution_chcon:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Any Attempts to Run chcon</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_execution_chcon"/>
                  <description>Audit rules about the information on the use of chcon is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_execution_chcon_augenrules:tst:1" comment="audit augenrules chcon"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_execution_chcon_auditctl:tst:1" comment="audit auditctl chcon"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_etc_shadow_openat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information via openat syscall - /etc/shadow</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_etc_shadow_openat"/>
                  <description>Audit rules about the write events to /etc/shadow</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_openat_32bit_augenrules:tst:1" comment="audit rule to record write events to /etc/shadow"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_openat_64bit_augenrules:tst:1" comment="audit rule to record write events to /etc/shadow"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_openat_32bit_auditctl:tst:1" comment="audit rule to record write events to /etc/shadow"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_openat_64bit_auditctl:tst:1" comment="audit rule to record write events to /etc/shadow"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_etc_shadow_open_by_handle_at:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_etc_shadow_open_by_handle_at"/>
                  <description>Audit rules about the write events to /etc/shadow</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_32bit_augenrules:tst:1" comment="audit rule to record write events to /etc/shadow"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_64bit_augenrules:tst:1" comment="audit rule to record write events to /etc/shadow"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_32bit_auditctl:tst:1" comment="audit rule to record write events to /etc/shadow"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_64bit_auditctl:tst:1" comment="audit rule to record write events to /etc/shadow"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_etc_shadow_open:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information via open syscall - /etc/shadow</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_etc_shadow_open"/>
                  <description>Audit rules about the write events to /etc/shadow</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_32bit_augenrules:tst:1" comment="audit rule to record write events to /etc/shadow"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_64bit_augenrules:tst:1" comment="audit rule to record write events to /etc/shadow"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_32bit_auditctl:tst:1" comment="audit rule to record write events to /etc/shadow"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_64bit_auditctl:tst:1" comment="audit rule to record write events to /etc/shadow"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_etc_passwd_openat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information via openat syscall - /etc/passwd</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_etc_passwd_openat"/>
                  <description>Audit rules about the write events to /etc/passwd</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_openat_32bit_augenrules:tst:1" comment="audit rule to record write events to /etc/passwd"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_openat_64bit_augenrules:tst:1" comment="audit rule to record write events to /etc/passwd"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_openat_32bit_auditctl:tst:1" comment="audit rule to record write events to /etc/passwd"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_openat_64bit_auditctl:tst:1" comment="audit rule to record write events to /etc/passwd"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_etc_passwd_open_by_handle_at:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_etc_passwd_open_by_handle_at"/>
                  <description>Audit rules about the write events to /etc/passwd</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_32bit_augenrules:tst:1" comment="audit rule to record write events to /etc/passwd"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_64bit_augenrules:tst:1" comment="audit rule to record write events to /etc/passwd"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_32bit_auditctl:tst:1" comment="audit rule to record write events to /etc/passwd"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_64bit_auditctl:tst:1" comment="audit rule to record write events to /etc/passwd"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_etc_passwd_open:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information via open syscall - /etc/passwd</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_etc_passwd_open"/>
                  <description>Audit rules about the write events to /etc/passwd</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_32bit_augenrules:tst:1" comment="audit rule to record write events to /etc/passwd"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_64bit_augenrules:tst:1" comment="audit rule to record write events to /etc/passwd"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_32bit_auditctl:tst:1" comment="audit rule to record write events to /etc/passwd"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_64bit_auditctl:tst:1" comment="audit rule to record write events to /etc/passwd"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_etc_gshadow_openat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information via openat syscall - /etc/gshadow</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_etc_gshadow_openat"/>
                  <description>Audit rules about the write events to /etc/gshadow</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_openat_32bit_augenrules:tst:1" comment="audit rule to record write events to /etc/gshadow"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_openat_64bit_augenrules:tst:1" comment="audit rule to record write events to /etc/gshadow"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_openat_32bit_auditctl:tst:1" comment="audit rule to record write events to /etc/gshadow"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_openat_64bit_auditctl:tst:1" comment="audit rule to record write events to /etc/gshadow"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_etc_gshadow_open_by_handle_at:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_etc_gshadow_open_by_handle_at"/>
                  <description>Audit rules about the write events to /etc/gshadow</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_32bit_augenrules:tst:1" comment="audit rule to record write events to /etc/gshadow"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_64bit_augenrules:tst:1" comment="audit rule to record write events to /etc/gshadow"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_32bit_auditctl:tst:1" comment="audit rule to record write events to /etc/gshadow"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_64bit_auditctl:tst:1" comment="audit rule to record write events to /etc/gshadow"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_etc_gshadow_open:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information via open syscall - /etc/gshadow</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_etc_gshadow_open"/>
                  <description>Audit rules about the write events to /etc/gshadow</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_32bit_augenrules:tst:1" comment="audit rule to record write events to /etc/gshadow"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_64bit_augenrules:tst:1" comment="audit rule to record write events to /etc/gshadow"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_32bit_auditctl:tst:1" comment="audit rule to record write events to /etc/gshadow"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_64bit_auditctl:tst:1" comment="audit rule to record write events to /etc/gshadow"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_etc_group_openat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information via openat syscall - /etc/group</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_etc_group_openat"/>
                  <description>Audit rules about the write events to /etc/group</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_group_openat_32bit_augenrules:tst:1" comment="audit rule to record write events to /etc/group"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_group_openat_64bit_augenrules:tst:1" comment="audit rule to record write events to /etc/group"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_group_openat_32bit_auditctl:tst:1" comment="audit rule to record write events to /etc/group"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_group_openat_64bit_auditctl:tst:1" comment="audit rule to record write events to /etc/group"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_etc_group_open_by_handle_at:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_etc_group_open_by_handle_at"/>
                  <description>Audit rules about the write events to /etc/group</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_32bit_augenrules:tst:1" comment="audit rule to record write events to /etc/group"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_64bit_augenrules:tst:1" comment="audit rule to record write events to /etc/group"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_32bit_auditctl:tst:1" comment="audit rule to record write events to /etc/group"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_64bit_auditctl:tst:1" comment="audit rule to record write events to /etc/group"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_etc_group_open:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information via open syscall - /etc/group</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_etc_group_open"/>
                  <description>Audit rules about the write events to /etc/group</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_32bit_augenrules:tst:1" comment="audit rule to record write events to /etc/group"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_64bit_augenrules:tst:1" comment="audit rule to record write events to /etc/group"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_32bit_auditctl:tst:1" comment="audit rule to record write events to /etc/group"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_64bit_auditctl:tst:1" comment="audit rule to record write events to /etc/group"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_enable_syscall_auditing:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable Syscall Auditing</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_enable_syscall_auditing"/>
                  <description>Syscall auditing should not be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_enable_syscall_audit_augenrules:tst:1" comment="check that no audit rule exists in /etc/audit/rules.d/*.rules that disables all syscall auditing"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_enable_syscall_audit_auditctl:tst:1" comment="check that no audit rule exists in /etc/audit/audit.rules that disables all syscall auditing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_umount:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - umount</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_umount"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_umount_augenrules:tst:1" comment="audit augenrules 32-bit umount"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_umount_auditctl:tst:1" comment="audit auditctl 32-bit umount"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_umount2:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - umount2</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_umount2"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_umount2_augenrules:tst:1" comment="audit augenrules 32-bit umount2"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_umount2_augenrules:tst:1" comment="audit augenrules 64-bit umount2"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_umount2_auditctl:tst:1" comment="audit auditctl 32-bit umount2"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_umount2_auditctl:tst:1" comment="audit auditctl 64-bit umount2"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_setxattr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - setxattr</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_setxattr"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_setxattr_augenrules:tst:1" comment="audit augenrules 32-bit setxattr"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_setxattr_augenrules:tst:1" comment="audit augenrules 64-bit setxattr"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_setxattr_auditctl:tst:1" comment="audit auditctl 32-bit setxattr"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_setxattr_auditctl:tst:1" comment="audit auditctl 64-bit setxattr"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_removexattr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - removexattr</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_removexattr"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_removexattr_augenrules:tst:1" comment="audit augenrules 32-bit removexattr"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_removexattr_augenrules:tst:1" comment="audit augenrules 64-bit removexattr"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_removexattr_auditctl:tst:1" comment="audit auditctl 32-bit removexattr"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_removexattr_auditctl:tst:1" comment="audit auditctl 64-bit removexattr"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_lsetxattr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - lsetxattr</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_lsetxattr"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_lsetxattr_augenrules:tst:1" comment="audit augenrules 32-bit lsetxattr"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_lsetxattr_augenrules:tst:1" comment="audit augenrules 64-bit lsetxattr"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_lsetxattr_auditctl:tst:1" comment="audit auditctl 32-bit lsetxattr"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_lsetxattr_auditctl:tst:1" comment="audit auditctl 64-bit lsetxattr"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_lremovexattr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - lremovexattr</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_lremovexattr"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_lremovexattr_augenrules:tst:1" comment="audit augenrules 32-bit lremovexattr"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_lremovexattr_augenrules:tst:1" comment="audit augenrules 64-bit lremovexattr"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_lremovexattr_auditctl:tst:1" comment="audit auditctl 32-bit lremovexattr"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_lremovexattr_auditctl:tst:1" comment="audit auditctl 64-bit lremovexattr"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_lchown:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - lchown</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_lchown"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_lchown_augenrules:tst:1" comment="audit augenrules 32-bit lchown"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_lchown_augenrules:tst:1" comment="audit augenrules 64-bit lchown"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_lchown_auditctl:tst:1" comment="audit auditctl 32-bit lchown"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_lchown_auditctl:tst:1" comment="audit auditctl 64-bit lchown"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_fsetxattr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - fsetxattr</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_fsetxattr"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_fsetxattr_augenrules:tst:1" comment="audit augenrules 32-bit fsetxattr"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_fsetxattr_augenrules:tst:1" comment="audit augenrules 64-bit fsetxattr"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_fsetxattr_auditctl:tst:1" comment="audit auditctl 32-bit fsetxattr"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_fsetxattr_auditctl:tst:1" comment="audit auditctl 64-bit fsetxattr"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_fremovexattr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - fremovexattr</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_fremovexattr"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_fremovexattr_augenrules:tst:1" comment="audit augenrules 32-bit fremovexattr"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_fremovexattr_augenrules:tst:1" comment="audit augenrules 64-bit fremovexattr"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_fremovexattr_auditctl:tst:1" comment="audit auditctl 32-bit fremovexattr"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_fremovexattr_auditctl:tst:1" comment="audit auditctl 64-bit fremovexattr"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_fchownat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - fchownat</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_fchownat"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_fchownat_augenrules:tst:1" comment="audit augenrules 32-bit fchownat"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_fchownat_augenrules:tst:1" comment="audit augenrules 64-bit fchownat"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_fchownat_auditctl:tst:1" comment="audit auditctl 32-bit fchownat"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_fchownat_auditctl:tst:1" comment="audit auditctl 64-bit fchownat"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_fchown:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - fchown</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_fchown"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_fchown_augenrules:tst:1" comment="audit augenrules 32-bit fchown"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_fchown_augenrules:tst:1" comment="audit augenrules 64-bit fchown"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_fchown_auditctl:tst:1" comment="audit auditctl 32-bit fchown"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_fchown_auditctl:tst:1" comment="audit auditctl 64-bit fchown"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_fchmodat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - fchmodat</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_fchmodat"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_fchmodat_augenrules:tst:1" comment="audit augenrules 32-bit fchmodat"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_fchmodat_augenrules:tst:1" comment="audit augenrules 64-bit fchmodat"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_fchmodat_auditctl:tst:1" comment="audit auditctl 32-bit fchmodat"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_fchmodat_auditctl:tst:1" comment="audit auditctl 64-bit fchmodat"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_fchmod:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - fchmod</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_fchmod"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_fchmod_augenrules:tst:1" comment="audit augenrules 32-bit fchmod"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_fchmod_augenrules:tst:1" comment="audit augenrules 64-bit fchmod"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_fchmod_auditctl:tst:1" comment="audit auditctl 32-bit fchmod"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_fchmod_auditctl:tst:1" comment="audit auditctl 64-bit fchmod"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_chown:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - chown</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_chown"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_chown_augenrules:tst:1" comment="audit augenrules 32-bit chown"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_chown_augenrules:tst:1" comment="audit augenrules 64-bit chown"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_chown_auditctl:tst:1" comment="audit auditctl 32-bit chown"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_chown_auditctl:tst:1" comment="audit auditctl 64-bit chown"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_chmod:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - chmod</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_chmod"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_chmod_augenrules:tst:1" comment="audit augenrules 32-bit chmod"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_chmod_augenrules:tst:1" comment="audit augenrules 64-bit chmod"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_chmod_auditctl:tst:1" comment="audit auditctl 32-bit chmod"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_chmod_auditctl:tst:1" comment="audit auditctl 64-bit chmod"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_augenrules:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Any Attempts to Run semanage</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_augenrules"/>
                  <description>Test if augenrules is enabled for audit rules.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_audit_rules_augenrules:tst:1" comment="audit augenrules"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_auditctl:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Any Attempts to Run semanage</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_auditctl"/>
                  <description>Test if auditctl is in use for audit rules.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_audit_rules_auditctl:tst:1" comment="audit auditctl"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-aide_periodic_cron_checking:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Periodic Execution of AIDE</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="aide_periodic_cron_checking"/>
                  <description>By default, AIDE does not install itself for periodic
      execution. Periodically running AIDE is necessary to reveal
      unexpected changes in installed files.
      </description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-package_aide_installed:def:1" comment="Aide is installed"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_aide_periodic_cron_checking:tst:1" comment="run aide with cron"/>
                    <criterion test_ref="oval:ssg-test_aide_crond_checking:tst:1" comment="run aide with cron"/>
                    <criterion test_ref="oval:ssg-test_aide_var_cron_checking:tst:1" comment="run aide with cron"/>
                    <criterion test_ref="oval:ssg-test_aide_crontabs_checking:tst:1" comment="run aide with cron.(daily|weekly)"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-aide_check_audit_tools:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure AIDE to Verify the Audit Tools</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="aide_check_audit_tools"/>
                  <description>The {{{ full_name }}} operating system file integrity tool must be configured to protect the integrity of the audit tools.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-package_aide_installed:def:1" comment="Aide is installed"/>
                  <criterion test_ref="oval:ssg-test_aide_verify_auditctl:tst:1" comment="auditctl is checked in /etc/aide.conf"/>
                  <criterion test_ref="oval:ssg-test_aide_verify_auditd:tst:1" comment="auditd is checked in /etc/aide.conf"/>
                  <criterion test_ref="oval:ssg-test_aide_verify_ausearch:tst:1" comment="ausearch is checked in /etc/aide.conf"/>
                  <criterion test_ref="oval:ssg-test_aide_verify_aureport:tst:1" comment="aureport is checked in /etc/aide.conf"/>
                  <criterion test_ref="oval:ssg-test_aide_verify_autrace:tst:1" comment="autrace is checked in /etc/aide.conf"/>
                  <criterion test_ref="oval:ssg-test_aide_verify_audispd:tst:1" comment="audispd is checked in /etc/aide.conf"/>
                  <criterion test_ref="oval:ssg-test_aide_verify_augenrules:tst:1" comment="augenrules is checked in /etc/aide.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-aide_build_database:def:1" version="2" class="compliance">
                <metadata>
                  <title>Build and Test AIDE Database</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="aide_build_database"/>
                  <description>The aide database must be initialized.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-package_aide_installed:def:1" comment="Aide is installed"/>
                  <criterion test_ref="oval:ssg-test_aide_build_new_database_absolute_path:tst:1"/>
                  <criterion test_ref="oval:ssg-test_aide_operational_database_absolute_path:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_umask_etc_profile:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure the Default Umask is Set Correctly in /etc/profile</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_umask_etc_profile"/>
                  <description>The default umask for all users should be set correctly</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-var_accounts_user_umask_as_number:def:1" comment="Get value of var_accounts_user_umask variable as octal number"/>
                  <criterion test_ref="oval:ssg-tst_accounts_umask_etc_profile:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_umask_etc_login_defs:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure the Default Umask is Set Correctly in login.defs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_umask_etc_login_defs"/>
                  <description>The default umask for all users specified in /etc/login.defs</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-var_accounts_user_umask_as_number:def:1" comment="Get value of var_accounts_user_umask variable as octal number"/>
                  <criterion test_ref="oval:ssg-tst_accounts_umask_etc_login_defs:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_tmout:def:1" version="3" class="compliance">
                <metadata>
                  <title>Set Interactive Session Timeout</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_tmout"/>
                  <description>Checks interactive shell timeout</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_etc_profile_tmout:tst:1" comment="TMOUT value in /etc/profile &lt;= var_accounts_tmout"/>
                  <criterion test_ref="oval:ssg-test_etc_profiled_tmout:tst:1" comment="TMOUT value in /etc/profile.d/*.sh &lt;= var_accounts_tmout"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_root_path_dirs_no_write:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure that Root's Path Does Not Include World or Group-Writable Directories</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_root_path_dirs_no_write"/>
                  <description>Check each directory in root's path and make use it does
      not grant write permission to group and other</description>
                </metadata>
                <criteria comment="Check that write permission to group and other in root's path is denied">
                  <criterion test_ref="oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1" comment="Check for write permission to group and other in root's path"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_root_gid_zero:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Root Has A Primary GID 0</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_root_gid_zero"/>
                  <description>The root account should have primary group of 0</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_accounts_root_gid_zero:tst:1" comment="tests that the root account's gid is equal to 0"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_polyinstantiated_var_tmp:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure Polyinstantiation of /var/tmp Directories</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_polyinstantiated_var_tmp"/>
                  <description/>
                </metadata>
                <criteria comment="Check Polyinstantiation of /tmp Directories">
                  <criterion test_ref="oval:ssg-test_var_tmp_tmp_inst:tst:1" comment="Check that /var/tmp/tmp-inst exists and has mode 000"/>
                  <criterion test_ref="oval:ssg-test_var_tmp_in_namespace_conf:tst:1" comment="Check configuration of /var/tmp in /etc/security/namespace.conf file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_polyinstantiated_tmp:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure Polyinstantiation of /tmp Directories</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_polyinstantiated_tmp"/>
                  <description/>
                </metadata>
                <criteria comment="Check Polyinstantiation of /tmp Directories">
                  <criterion test_ref="oval:ssg-test_tmp_inst:tst:1" comment="Check that /tmp/tmp-inst exists and has mode 000"/>
                  <criterion test_ref="oval:ssg-test_tmp_in_namespace_conf:tst:1" comment="Check configuration of /tmp in /etc/security/namespace.conf file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_passwords_pam_faillock_unlock_time:def:1" version="3" class="compliance">
                <metadata>
                  <title>Set Lockout Time for Failed Password Attempts</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_passwords_pam_faillock_unlock_time"/>
                  <description>The unlock time after number of failed logins should be set correctly.</description>
                </metadata>
                <criteria comment="Check the proper configuration of pam_faillock.so">
                  <criteria comment="Check if pam_faillock.so is properly enabled">
                    <criteria comment="Count occurrences of pam_unix.so in system-auth and password-auth">
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_unix_auth:tst:1" comment="pam_unix.so appears only once in auth section of system-auth"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_unix_auth:tst:1" comment="pam_unix.so appears only once in auth section of password-auth"/>
                    </criteria>
                    <criteria comment="Check common definition of pam_faillock.so">
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_auth:tst:1" comment="pam_faillock.so is properly defined in auth section of system-auth"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_account:tst:1" comment="pam_faillock.so is properly defined in account section of system-auth"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_auth:tst:1" comment="pam_faillock.so is properly defined in auth section of password-auth"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_account:tst:1" comment="pam_faillock.so is properly defined in account section of password-auth"/>
                    </criteria>
                  </criteria>
                  <criteria operator="OR" comment="Check expected value for pam_faillock.so unlock_time parameter">
                    <criteria comment="Check expected pam_faillock.so unlock_time parameter in pam files">
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_system:tst:1" comment="Check the unlock_time parameter in auth section of system-auth file"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_password:tst:1" comment="Check the unlock_time parameter in auth section of password-auth file"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_faillock_conf:tst:1" comment="Ensure /etc/security/faillock.conf is not used together with pam files"/>
                    </criteria>
                    <criteria comment="Check expected pam_faillock.so unlock_time parameter in faillock.conf">
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_pamd_system:tst:1" comment="Check the unlock_time parameter is not present system-auth file"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_pamd_password:tst:1" comment="Check the unlock_time parameter is not present password-auth file"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_faillock_conf:tst:1" comment="Ensure the unlock_time parameter is present in /etc/security/faillock.conf"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_passwords_pam_faillock_interval:def:1" version="3" class="compliance">
                <metadata>
                  <title>Set Interval For Counting Failed Password Attempts</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_passwords_pam_faillock_interval"/>
                  <description>The number of allowed failed logins should be set correctly.</description>
                </metadata>
                <criteria comment="Check the proper configuration of pam_faillock.so">
                  <criteria comment="Check if pam_faillock.so is properly enabled">
                    <criteria comment="Count occurrences of pam_unix.so in system-auth and password-auth">
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_unix_auth:tst:1" comment="pam_unix.so appears only once in auth section of system-auth"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_unix_auth:tst:1" comment="pam_unix.so appears only once in auth section of password-auth"/>
                    </criteria>
                    <criteria comment="Check common definition of pam_faillock.so">
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_faillock_auth:tst:1" comment="pam_faillock.so is properly defined in auth section of system-auth"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_faillock_account:tst:1" comment="pam_faillock.so is properly defined in account section of system-auth"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_faillock_auth:tst:1" comment="pam_faillock.so is properly defined in auth section of password-auth"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_faillock_account:tst:1" comment="pam_faillock.so is properly defined in account section of password-auth"/>
                    </criteria>
                  </criteria>
                  <criteria operator="OR" comment="Check expected value for pam_faillock.so fail_interval parameter">
                    <criteria comment="Check expected pam_faillock.so fail_interval parameter in pam files">
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_pamd_system:tst:1" comment="Check the fail_interval parameter in auth section of system-auth file"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_pamd_password:tst:1" comment="Check the fail_interval parameter in auth section of password-auth file"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_faillock_conf:tst:1" comment="Ensure /etc/security/faillock.conf is not used together with pam files"/>
                    </criteria>
                    <criteria comment="Check expected pam_faillock.so fail_interval parameter in faillock.conf">
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_pamd_system:tst:1" comment="Check the fail_interval parameter is not present system-auth file"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_pamd_password:tst:1" comment="Check the fail_interval parameter is not present password-auth file"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_faillock_conf:tst:1" comment="Ensure the fail_interval parameter is present in /etc/security/faillock.conf"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_passwords_pam_faillock_enforce_local:def:1" version="5" class="compliance">
                <metadata>
                  <title>Enforce pam_faillock for Local Accounts Only</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_passwords_pam_faillock_enforce_local"/>
                  <description>Enforce pam_faillock for Local Accounts Only</description>
                </metadata>
                <criteria comment="Check the proper configuration of pam_faillock.so">
                  <criteria comment="Check if pam_faillock.so is properly enabled">
                    <criteria comment="Count occurrences of pam_unix.so in system-auth and password-auth">
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_system_pam_unix_auth:tst:1" comment="pam_unix.so appears only once in auth section of system-auth"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_password_pam_unix_auth:tst:1" comment="pam_unix.so appears only once in auth section of password-auth"/>
                    </criteria>
                    <criteria comment="Check common definition of pam_faillock.so">
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_system_pam_faillock_auth:tst:1" comment="pam_faillock.so is properly defined in auth section of system-auth"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_system_pam_faillock_account:tst:1" comment="pam_faillock.so is properly defined in account section of system-auth"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_password_pam_faillock_auth:tst:1" comment="pam_faillock.so is properly defined in auth section of password-auth"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_password_pam_faillock_account:tst:1" comment="pam_faillock.so is properly defined in account section of password-auth"/>
                    </criteria>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_parameter_faillock_conf:tst:1" comment="Ensure the local_users_only parameter is present in /etc/security/faillock.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_passwords_pam_faillock_deny_root:def:1" version="5" class="compliance">
                <metadata>
                  <title>Configure the root Account for Failed Password Attempts</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_passwords_pam_faillock_deny_root"/>
                  <description>The root account should be configured to deny access after the number of
      defined failed attempts has been reached.</description>
                </metadata>
                <criteria comment="Check the proper configuration of pam_faillock.so">
                  <criteria comment="Check if pam_faillock.so is properly enabled">
                    <criteria comment="Count occurrences of pam_unix.so in system-auth and password-auth">
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_system_pam_unix_auth:tst:1" comment="pam_unix.so appears only once in auth section of system-auth"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_password_pam_unix_auth:tst:1" comment="pam_unix.so appears only once in auth section of password-auth"/>
                    </criteria>
                    <criteria comment="Check common definition of pam_faillock.so">
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_auth:tst:1" comment="pam_faillock.so is properly defined in auth section of system-auth"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_account:tst:1" comment="pam_faillock.so is properly defined in account section of system-auth"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_auth:tst:1" comment="pam_faillock.so is properly defined in auth section of password-auth"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_account:tst:1" comment="pam_faillock.so is properly defined in account section of password-auth"/>
                    </criteria>
                  </criteria>
                  <criteria operator="OR" comment="Check expected value for pam_faillock.so even_deny_root parameter">
                    <criteria comment="Check expected pam_faillock.so even_deny_root parameter in pam files">
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_pamd_system:tst:1" comment="Check the even_deny_root parameter in auth section of system-auth file"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_pamd_password:tst:1" comment="Check the even_deny_root parameter in auth section of password-auth file"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_no_faillock_conf:tst:1" comment="Ensure /etc/security/faillock.conf is not used together with pam files"/>
                    </criteria>
                    <criteria comment="Check expected pam_faillock.so even_deny_root parameter in faillock.conf">
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_no_pamd_system:tst:1" comment="Check the even_deny_root parameter is not present system-auth file"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_no_pamd_password:tst:1" comment="Check the even_deny_root parameter is not present password-auth file"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_faillock_conf:tst:1" comment="Ensure the even_deny_root parameter is present in /etc/security/faillock.conf"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_passwords_pam_faillock_deny:def:1" version="5" class="compliance">
                <metadata>
                  <title>Lock Accounts After Failed Password Attempts</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_passwords_pam_faillock_deny"/>
                  <description>Lockout account after failed login attempts</description>
                </metadata>
                <criteria comment="Check the proper configuration of pam_faillock.so">
                  <criteria comment="Check if pam_faillock.so is properly enabled">
                    <criteria comment="Count occurrences of pam_unix.so in system-auth and password-auth">
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_unix_auth:tst:1" comment="pam_unix.so appears only once in auth section of system-auth"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_unix_auth:tst:1" comment="pam_unix.so appears only once in auth section of password-auth"/>
                    </criteria>
                    <criteria comment="Check common definition of pam_faillock.so">
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_faillock_auth:tst:1" comment="pam_faillock.so is properly defined in auth section of system-auth"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_faillock_account:tst:1" comment="pam_faillock.so is properly defined in account section of system-auth"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_faillock_auth:tst:1" comment="pam_faillock.so is properly defined in auth section of password-auth"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_faillock_account:tst:1" comment="pam_faillock.so is properly defined in account section of password-auth"/>
                    </criteria>
                  </criteria>
                  <criteria operator="OR" comment="Check expected value for pam_faillock.so deny parameter">
                    <criteria comment="Check expected pam_faillock.so deny parameter in pam files">
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_pamd_system:tst:1" comment="Check the deny parameter in auth section of system-auth file"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_pamd_password:tst:1" comment="Check the deny parameter in auth section of password-auth file"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_faillock_conf:tst:1" comment="Ensure /etc/security/faillock.conf is not used together with pam files"/>
                    </criteria>
                    <criteria comment="Check expected pam_faillock.so deny parameter in faillock.conf">
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_pamd_system:tst:1" comment="Check the deny parameter is not present system-auth file"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_pamd_password:tst:1" comment="Check the deny parameter is not present password-auth file"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_faillock_conf:tst:1" comment="Ensure the deny parameter is present in /etc/security/faillock.conf"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_warn_age_login_defs:def:1" version="3" class="compliance">
                <metadata>
                  <title>Set Password Warning Age</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_warn_age_login_defs"/>
                  <description>The password expiration warning age should be set appropriately.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_pass_warn_age:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_unix_rounds_system_auth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set number of Password Hashing Rounds - system-auth</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_unix_rounds_system_auth"/>
                  <description>The number of rounds for password hashing should be set correctly.</description>
                </metadata>
                <criteria operator="OR" comment="Check if rounds option of pam_unix is as expected">
                  <criterion test_ref="oval:ssg-test_system_auth_pam_unix_rounds_is_set:tst:1" comment="The value of rounds is set correctly in pam_unix.so"/>
                  <criteria comment="The value of rounds is no set, in this case the system default is used">
                    <criterion test_ref="oval:ssg-test_system_auth_pam_unix_rounds_is_default:tst:1" comment="The default value of rounds is used in pam_unix.so"/>
                    <criterion test_ref="oval:ssg-test_system_auth_default_pam_unix_rounds_var:tst:1" comment="The target value of rounds is the default"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_unix_rounds_password_auth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set number of Password Hashing Rounds - password-auth</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_unix_rounds_password_auth"/>
                  <description>The number of rounds for password hashing should be set correctly.</description>
                </metadata>
                <criteria operator="OR" comment="Check if rounds option of pam_unix is as expected">
                  <criterion test_ref="oval:ssg-test_password_auth_pam_unix_rounds_is_set:tst:1" comment="The value of rounds is set correctly in pam_unix.so"/>
                  <criteria comment="The value of rounds is no set, in this case the system default is used">
                    <criterion test_ref="oval:ssg-test_password_auth_pam_unix_rounds_is_default:tst:1" comment="The default value of rounds is used in pam_unix.so"/>
                    <criterion test_ref="oval:ssg-test_password_auth_default_pam_unix_rounds_var:tst:1" comment="The target value of rounds is the default"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_unix_remember:def:1" version="2" class="compliance">
                <metadata>
                  <title>Limit Password Reuse</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_unix_remember"/>
                  <description>The passwords to remember should be set correctly.</description>
                </metadata>
                <criteria operator="OR" comment="remember parameter of pam_unix.so or pam_pwhistory.so is set correctly">
                  <criterion test_ref="oval:ssg-test_accounts_password_pam_unix_remember:tst:1" comment="remember parameter of pam_unix.so is set correctly"/>
                  <criterion test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember:tst:1" comment="remember parameter of pam_pwhistory.so is set correctly"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_ucredit:def:1" version="3" class="compliance">
                <metadata>
                  <title>Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_ucredit"/>
                  <description>The password ucredit should meet minimum requirements</description>
                </metadata>
                <criteria comment="conditions for ucredit are satisfied">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="pwquality.so exists in system-auth"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality_ucredit:tst:1" comment="pwquality.conf"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_retry:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_retry"/>
                  <description>The password retry should meet minimum requirements</description>
                </metadata>
                <criteria operator="OR" comment="Conditions for retry are satisfied">
                  <criteria comment="Conditions for retry in PAM files are satisfied">
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality_retry_system_auth:tst:1" comment="pam_pwquality system-auth"/>
                  </criteria>
                  <criteria comment="Conditions for retry in pwquality.conf file are satisfied">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="pwquality.so exists in system-auth"/>
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality_retry_pwquality_conf:tst:1" comment="check retry parameter in pwquality.conf"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_pwquality_system_auth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure PAM password complexity module is enabled in system-auth</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_pwquality_system_auth"/>
                  <description>The PAM module pam_pwquality is used in system-auth</description>
                </metadata>
                <criteria comment="Condition for pam_pwquality in system-auth is satisfied">
                  <criterion test_ref="oval:ssg-test_accounts_password_pam_pwquality_system_auth:tst:1" comment="pam_pwquality system-auth"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_pwquality_password_auth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure PAM password complexity module is enabled in password-auth</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_pwquality_password_auth"/>
                  <description>The PAM module pam_pwquality is used in password-auth</description>
                </metadata>
                <criteria comment="Condition for pam_pwquality in password-auth is satisfied">
                  <criterion test_ref="oval:ssg-test_accounts_password_pam_pwquality_password_auth:tst:1" comment="pam_pwquality password-auth"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" class="compliance">
                <metadata>
                  <title>Check pam_pwquality Existence in system-auth</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_pwquality"/>
                  <description>Check that pam_pwquality.so exists in system-auth</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_password_pam_pwquality:tst:1" comment="Conditions for pam_pwquality are satisfied"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_pwhistory_remember_system_auth:def:1" version="2" class="compliance">
                <metadata>
                  <title>Limit Password Reuse: system-auth</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_pwhistory_remember_system_auth"/>
                  <description>The passwords to remember should be set correctly.</description>
                </metadata>
                <criteria comment="remember parameter of pam_pwhistory.so is set correctly">
                  <criterion test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth:tst:1" comment="remember parameter of pam_pwhistory.so is set correctly"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_pwhistory_remember_password_auth:def:1" version="2" class="compliance">
                <metadata>
                  <title>Limit Password Reuse: password-auth</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_pwhistory_remember_password_auth"/>
                  <description>The passwords to remember should be set correctly.</description>
                </metadata>
                <criteria comment="remember parameter of pam_pwhistory.so is set correctly in password-auth">
                  <criterion test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth:tst:1" comment="remember parameter of pam_pwhistory.so is set correctly in password-auth"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_ocredit:def:1" version="3" class="compliance">
                <metadata>
                  <title>Ensure PAM Enforces Password Requirements - Minimum Special Characters</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_ocredit"/>
                  <description>The password ocredit should meet minimum requirements</description>
                </metadata>
                <criteria comment="conditions for ocredit are satisfied">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="pwquality.so exists in system-auth"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality_ocredit:tst:1" comment="pwquality.conf"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_minlen:def:1" version="3" class="compliance">
                <metadata>
                  <title>Ensure PAM Enforces Password Requirements - Minimum Length</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_minlen"/>
                  <description>The password minlen should meet minimum requirements</description>
                </metadata>
                <criteria comment="conditions for minlen are satisfied">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="pwquality.so exists in system-auth"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality_minlen:tst:1" comment="pwquality.conf"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_minclass:def:1" version="3" class="compliance">
                <metadata>
                  <title>Ensure PAM Enforces Password Requirements - Minimum Different Categories</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_minclass"/>
                  <description>The password minclass should meet minimum requirements</description>
                </metadata>
                <criteria comment="conditions for minclass are satisfied">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="pwquality.so exists in system-auth"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality_minclass:tst:1" comment="pwquality.conf"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_maxrepeat:def:1" version="3" class="compliance">
                <metadata>
                  <title>Set Password Maximum Consecutive Repeating Characters</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_maxrepeat"/>
                  <description>The password maxrepeat should meet minimum requirements</description>
                </metadata>
                <criteria comment="conditions for maxrepeat are satisfied">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="pwquality.so exists in system-auth"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality_maxrepeat:tst:1" comment="pwquality.conf"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_maxclassrepeat:def:1" version="3" class="compliance">
                <metadata>
                  <title>Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_maxclassrepeat"/>
                  <description>The password maxclassrepeat should meet minimum requirements</description>
                </metadata>
                <criteria comment="conditions for maxclassrepeat are satisfied">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="pwquality.so exists in system-auth"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality_maxclassrepeat:tst:1" comment="pwquality.conf"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_lcredit:def:1" version="3" class="compliance">
                <metadata>
                  <title>Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_lcredit"/>
                  <description>The password lcredit should meet minimum requirements</description>
                </metadata>
                <criteria comment="conditions for lcredit are satisfied">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="pwquality.so exists in system-auth"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality_lcredit:tst:1" comment="pwquality.conf"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_faillock:def:1" version="1" class="compliance">
                <metadata>
                  <title>Check pam_faillock Existence in system-auth</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_faillock"/>
                  <description>Check that pam_faillock.so exists in system-auth</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_accounts_password_pam_faillock:tst:1" comment="Conditions for pam_faillock are satisfied"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_enforce_root:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure PAM Enforces Password Requirements - Enforce for root User</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_enforce_root"/>
                  <description>Check presence of enforce_for_root in /etc/security/pwquality.conf</description>
                </metadata>
                <criteria comment="Test conditions - presence of the file plus 1 extra definitions.">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="extend_definition added explicitly"/>
                  <criterion test_ref="oval:ssg-test_accounts_password_pam_enforce_root:tst:1" comment="Check that /etc/security/pwquality.conf contains a line with certain text"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_enforce_local:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure PAM Enforces Password Requirements - Enforce for Local Accounts Only</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_enforce_local"/>
                  <description>Check presence of local_users_only in /etc/security/pwquality.conf</description>
                </metadata>
                <criteria comment="Test conditions - presence of the file plus 1 extra definitions.">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="extend_definition added explicitly"/>
                  <criterion test_ref="oval:ssg-test_accounts_password_pam_enforce_local:tst:1" comment="Check that /etc/security/pwquality.conf contains a line with certain text"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_difok:def:1" version="3" class="compliance">
                <metadata>
                  <title>Ensure PAM Enforces Password Requirements - Minimum Different Characters</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_difok"/>
                  <description>The password difok should meet minimum requirements</description>
                </metadata>
                <criteria comment="conditions for difok are satisfied">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="pwquality.so exists in system-auth"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality_difok:tst:1" comment="pwquality.conf"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_dictcheck:def:1" version="3" class="compliance">
                <metadata>
                  <title>Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_dictcheck"/>
                  <description>The password dictcheck should meet minimum requirements</description>
                </metadata>
                <criteria comment="conditions for dictcheck are satisfied">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="pwquality.so exists in system-auth"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality_dictcheck:tst:1" comment="pwquality.conf"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_dcredit:def:1" version="3" class="compliance">
                <metadata>
                  <title>Ensure PAM Enforces Password Requirements - Minimum Digit Characters</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_dcredit"/>
                  <description>The password dcredit should meet minimum requirements</description>
                </metadata>
                <criteria comment="conditions for dcredit are satisfied">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="pwquality.so exists in system-auth"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality_dcredit:tst:1" comment="pwquality.conf"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_minlen_login_defs:def:1" version="3" class="compliance">
                <metadata>
                  <title>Set Password Minimum Length in login.defs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_minlen_login_defs"/>
                  <description>The password minimum length should be set appropriately.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_pass_min_len:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_all_shadowed_sha512:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify All Account Password Hashes are Shadowed with SHA512</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_all_shadowed_sha512"/>
                  <description>All password hashes should be shadowed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_accounts_password_all_shadowed_sha512:tst:1" comment="password hashes are shadowed using sha512"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_all_shadowed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify All Account Password Hashes are Shadowed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_all_shadowed"/>
                  <description>All password hashes should be shadowed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_accounts_password_all_shadowed:tst:1" comment="password hashes are shadowed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_no_uid_except_zero:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Only Root Has UID 0</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_no_uid_except_zero"/>
                  <description>Only the root account should be assigned a user id of 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_accounts_no_uid_except_root:tst:1" comment="tests that there are no accounts with UID 0 except root in the /etc/passwd file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_minimum_age_login_defs:def:1" version="3" class="compliance">
                <metadata>
                  <title>Set Password Minimum Age</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_minimum_age_login_defs"/>
                  <description>The minimum password age policy should be set appropriately.</description>
                </metadata>
                <criteria comment="The value of PASS_MIN_DAYS should be set appropriately in /etc/login.defs">
                  <criterion test_ref="oval:ssg-test_pass_min_days:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_maximum_age_login_defs:def:1" version="3" class="compliance">
                <metadata>
                  <title>Set Password Maximum Age</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_maximum_age_login_defs"/>
                  <description>The maximum password age policy should meet minimum requirements.</description>
                </metadata>
                <criteria comment="The value PASS_MAX_DAYS should be set appropriately in /etc/login.defs">
                  <criterion test_ref="oval:ssg-test_pass_max_days:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_max_concurrent_login_sessions:def:1" version="1" class="compliance">
                <metadata>
                  <title>Limit the Number of Concurrent Login Sessions Allowed Per User</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_max_concurrent_login_sessions"/>
                  <description>The maximum number of concurrent login sessions per user should meet
      minimum requirements.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_limitsd_maxlogins:tst:1" comment="the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf"/>
                  <criteria>
                    <criterion test_ref="oval:ssg-test_limitsd_maxlogins_exists:tst:1" negate="true" comment="the value maxlogins should not be set at all in /etc/security/limits.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_maxlogins:tst:1" comment="the value maxlogins should be set appropriately in /etc/security/limits.conf"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_logon_fail_delay:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure the Logon Failure Delay is Set Correctly in login.defs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_logon_fail_delay"/>
                  <description>The delay between failed authentication attempts should be
      set for all users specified in /etc/login.defs</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_accounts_logon_fail_delay:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_have_homedir_login_defs:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Home Directories are Created for New Users</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_have_homedir_login_defs"/>
                  <description>CREATE_HOME should be enabled</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_accounts_have_homedir_login_defs:tst:1" comment="Check CREATE_HOME in /etc/login.defs"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_authorized_local_users:def:1" version="1" class="compliance">
                <metadata>
                  <title>Only Authorized Local User Accounts Exist on Operating System</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_authorized_local_users"/>
                  <description>Besides the default operating system user, there should be no other users
      except the users that are authorized to exist locally on the operating system.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_accounts_authorized_local_users:tst:1" comment="only root user and explicitly authorized users are allowed in /etc/passwd"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-account_unique_name:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure All Accounts on the System Have Unique Names</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="account_unique_name"/>
                  <description>All accounts on the system should have unique names for proper accountability.</description>
                </metadata>
                <criteria comment="There should not exist duplicate user name entries in /etc/passwd">
                  <criterion test_ref="oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-account_unique_id:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure All Accounts on the System Have Unique User IDs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="account_unique_id"/>
                  <description>All accounts on the system should have unique IDs for proper accountability.</description>
                </metadata>
                <criteria comment="There should not exist duplicate user IDs entries in /etc/passwd">
                  <criterion test_ref="oval:ssg-test_etc_passwd_no_duplicate_user_ids:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-account_disable_post_pw_expiration:def:1" version="2" class="compliance">
                <metadata>
                  <title>Set Account Expiration Following Inactivity</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="account_disable_post_pw_expiration"/>
                  <description>The accounts should be configured to expire automatically following password expiration.</description>
                </metadata>
                <criteria comment="the value INACTIVE parameter should be set appropriately in /etc/default/useradd">
                  <criterion test_ref="oval:ssg-test_etc_default_useradd_inactive:tst:1"/>
                </criteria>
              </definition>
            </definitions>
            <tests>
              <ind-def:variable_test id="oval:ssg-tst_umask_for_daemons:tst:1" version="1" check="all" comment="Test the retrieved /etc/init.d/functions umask value(s) match the var_umask_for_daemons requirement">
                <ind-def:object object_ref="oval:ssg-obj_umask_for_daemons:obj:1"/>
                <ind-def:state state_ref="oval:ssg-ste_umask_for_daemons:ste:1"/>
              </ind-def:variable_test>
              <ind-def:textfilecontent54_test id="oval:ssg-tst_maxstartups_start_parameter:tst:1" version="1" check_existence="only_one_exists" check="all" comment="SSH MaxStartups start parameter is less than or equal to 10">
                <ind-def:object object_ref="oval:ssg-obj_sshd_config_maxstartups_first_parameter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-ste_sshd_config_start_parameter_valid:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-tst_maxstartups_rate_parameter:tst:1" version="1" check_existence="only_one_exists" check="all" comment="SSH MaxStartups rate parameter is greater than or equal to 30">
                <ind-def:object object_ref="oval:ssg-obj_sshd_config_maxstartups_second_parameter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-ste_sshd_config_rate_parameter_valid:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-tst_maxstartups_full_parameter:tst:1" version="1" check_existence="only_one_exists" check="all" comment="SSH MaxStartups full parameter is less than or equal to 100">
                <ind-def:object object_ref="oval:ssg-obj_sshd_config_maxstartups_third_parameter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-ste_sshd_config_full_parameter_valid:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:variable_test id="oval:ssg-tst_accounts_umask_etc_profile:tst:1" version="1" check="all" comment="Test the retrieved /etc/profile umask value(s) match the var_accounts_user_umask requirement">
                <ind-def:object object_ref="oval:ssg-obj_accounts_umask_etc_profile:obj:1"/>
                <ind-def:state state_ref="oval:ssg-ste_accounts_umask_etc_profile:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-tst_accounts_umask_etc_login_defs:tst:1" version="1" check="all" comment="Test the retrieved /etc/login.defs umask value(s) match the var_accounts_user_umask requirement">
                <ind-def:object object_ref="oval:ssg-obj_accounts_umask_etc_login_defs:obj:1"/>
                <ind-def:state state_ref="oval:ssg-ste_accounts_umask_etc_login_defs:ste:1"/>
              </ind-def:variable_test>
              <lin-def:partition_test id="oval:ssg-testvar_partition:tst:1" version="1" check_existence="all_exist" check="all" comment="/var on own partition">
                <lin-def:object object_ref="oval:ssg-object_mountvar_own_partition:obj:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-testvar_log_partition:tst:1" version="1" check_existence="all_exist" check="all" comment="/var/log on own partition">
                <lin-def:object object_ref="oval:ssg-object_mountvar_log_own_partition:obj:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-testvar_log_audit_partition:tst:1" version="1" check_existence="all_exist" check="all" comment="/var/log/audit on own partition">
                <lin-def:object object_ref="oval:ssg-object_mountvar_log_audit_own_partition:obj:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-testusr_partition:tst:1" version="1" check_existence="all_exist" check="all" comment="/usr on own partition">
                <lin-def:object object_ref="oval:ssg-object_mountusr_own_partition:obj:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-testtmp_partition:tst:1" version="1" check_existence="all_exist" check="all" comment="/tmp on own partition">
                <lin-def:object object_ref="oval:ssg-object_mounttmp_own_partition:obj:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-testsrv_partition:tst:1" version="1" check_existence="all_exist" check="all" comment="/srv on own partition">
                <lin-def:object object_ref="oval:ssg-object_mountsrv_own_partition:obj:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-testopt_partition:tst:1" version="1" check_existence="all_exist" check="all" comment="/opt on own partition">
                <lin-def:object object_ref="oval:ssg-object_mountopt_own_partition:obj:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-testhome_partition:tst:1" version="1" check_existence="all_exist" check="all" comment="/home on own partition">
                <lin-def:object object_ref="oval:ssg-object_mounthome_own_partition:obj:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-testboot_partition:tst:1" version="1" check_existence="all_exist" check="all" comment="/boot on own partition">
                <lin-def:object object_ref="oval:ssg-object_mountboot_own_partition:obj:1"/>
              </lin-def:partition_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_yum_ensure_gpgcheck_repo_metadata:tst:1" version="1" check_existence="all_exist" check="all" comment="check value of repo_gpgcheck in /etc/dnf/dnf.conf">
                <ind-def:object object_ref="oval:ssg-object_yum_ensure_gpgcheck_repo_metadata:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_yum_ensure_gpgcheck_local_packages:tst:1" version="1" check_existence="all_exist" check="all" comment="check value of localpkg_gpgcheck in /etc/dnf/dnf.conf">
                <ind-def:object object_ref="oval:ssg-object_yum_ensure_gpgcheck_local_packages:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_yum_clean_components_post_updating:tst:1" version="1" check_existence="all_exist" check="all" comment="check value of clean_requirements_on_remove in /etc/dnf/dnf.conf">
                <ind-def:object object_ref="oval:ssg-object_yum_clean_components_post_updating:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_wrlinux8_version:tst:1" version="1" check="all" comment="Check WRLinux8 version">
                <ind-def:object object_ref="oval:ssg-obj_version_wrlinux8:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_wrlinux1019_version:tst:1" version="1" check="all" comment="Check WRLinux10.19 version">
                <ind-def:object object_ref="oval:ssg-obj_version_wrlinux1019:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_wrlinux1019_name:tst:1" version="1" check="all" comment="Check WRLinux10.19 version">
                <ind-def:object object_ref="oval:ssg-obj_name_wrlinux1019:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:interface_test id="oval:ssg-test_wireless_disable_interfaces:tst:1" version="1" check="all" comment="check if UP flag is present on wifi interfaces">
                <unix-def:object object_ref="oval:ssg-object_active_wifi_interfaces:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_wifi_up:ste:1"/>
              </unix-def:interface_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_virtual_consoles_etc_securetty:tst:1" version="1" check_existence="none_exist" check="all" comment="virtual consoles /etc/securetty">
                <ind-def:object object_ref="oval:ssg-object_virtual_consoles_etc_securetty:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpmverifyfile_test id="oval:ssg-test_verify_all_rpms_mode:tst:1" version="1" check_existence="none_exist" check="all" comment="mode of all files matches local rpm database">
                <lin-def:object object_ref="oval:ssg-object_files_fail_mode:obj:1"/>
              </lin-def:rpmverifyfile_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_vdsm_nopasswd_etc_sudoers_d:tst:1" version="1" check_existence="none_exist" check="all" comment="NOPASSWD only exists for vdsm user in /etc/sudoers.d">
                <ind-def:object object_ref="oval:ssg-object_vdsm_nopasswd_etc_sudoers_d:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_vdsm_nopasswd_etc_sudoers:tst:1" version="1" check_existence="none_exist" check="all" comment="NOPASSWD only exists for vdsm user in /etc/sudoers">
                <ind-def:object object_ref="oval:ssg-object_vdsm_nopasswd_etc_sudoers:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_var_tmp_tmp_inst:tst:1" version="1" check_existence="only_one_exists" check="all" comment="Check that /tmp-inst exists and has mode 000">
                <unix-def:object object_ref="oval:ssg-obj_var_tmp_tmp_inst:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_var_tmp_tmp_inst:ste:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_var_tmp_in_namespace_conf:tst:1" version="1" check="all" comment="Check configuration of /tmp in /etc/security/namespace.conf file">
                <ind-def:object object_ref="oval:ssg-obj_var_tmp_in_namespace_conf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:variable_test id="oval:ssg-test_var_removable_partition_is_cd_dvd_drive:tst:1" version="1" check="all" comment="Check if removable partition variable value represents CD/DVD drive">
                <ind-def:object object_ref="oval:ssg-object_var_removable_partition_is_cd_dvd_drive:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_removable_partition_is_cd_dvd_drive:ste:1"/>
              </ind-def:variable_test>
              <lin-def:partition_test id="oval:ssg-test_var_partition_nosuid_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" comment="nosuid on /var optional yes">
                <lin-def:object object_ref="oval:ssg-object_var_partition_nosuid_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_var_partition_nosuid_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_var_partition_noexec_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" comment="noexec on /var optional yes">
                <lin-def:object object_ref="oval:ssg-object_var_partition_noexec_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_var_partition_noexec_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_var_partition_nodev_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" comment="nodev on /var optional yes">
                <lin-def:object object_ref="oval:ssg-object_var_partition_nodev_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_var_partition_nodev_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_var_log_partition_nosuid_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" comment="nosuid on /var/log optional yes">
                <lin-def:object object_ref="oval:ssg-object_var_log_partition_nosuid_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_var_log_partition_nosuid_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_var_log_partition_noexec_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" comment="noexec on /var/log optional yes">
                <lin-def:object object_ref="oval:ssg-object_var_log_partition_noexec_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_var_log_partition_noexec_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_var_log_partition_nodev_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" comment="nodev on /var/log optional yes">
                <lin-def:object object_ref="oval:ssg-object_var_log_partition_nodev_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_var_log_partition_nodev_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_var_log_audit_partition_nosuid_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" comment="nosuid on /var/log/audit optional yes">
                <lin-def:object object_ref="oval:ssg-object_var_log_audit_partition_nosuid_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_var_log_audit_partition_nosuid_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_var_log_audit_partition_noexec_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" comment="noexec on /var/log/audit optional yes">
                <lin-def:object object_ref="oval:ssg-object_var_log_audit_partition_noexec_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_var_log_audit_partition_noexec_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_var_log_audit_partition_nodev_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" comment="nodev on /var/log/audit optional yes">
                <lin-def:object object_ref="oval:ssg-object_var_log_audit_partition_nodev_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_var_log_audit_partition_nodev_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_user_change_lock_delay_lock:tst:1" version="1" check_existence="all_exist" check="all" comment="screensaver lock delay cannot be changed by user">
                <ind-def:object object_ref="oval:ssg-obj_user_change_lock_delay_lock:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_user_change_idle_delay_lock:tst:1" version="1" check_existence="all_exist" check="all" comment="user cannot change screensaver idle delay">
                <ind-def:object object_ref="oval:ssg-obj_user_change_idle_delay_lock:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_use_pty_sudoers:tst:1" version="1" check="all" comment="use_pty exists in /etc/sudoers or /etc/sudoers.d/">
                <ind-def:object object_ref="oval:ssg-object_use_pty_sudoers:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_use_pam_wheel_for_su:tst:1" version="1" check="all" comment="check /etc/pam.d/su for correct setting">
                <ind-def:object object_ref="oval:ssg-object_use_pam_wheel_for_su:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_usbguard_rules_nonempty:tst:1" version="1" check="all" comment="Check the usbguard rules in either /etc/usbguard/rules.conf or /etc/usbguard/rules.d/ contain at least one non whitespace character and exists">
                <ind-def:object object_ref="oval:ssg-obj_usbguard_rules_nonempty:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:family_test id="oval:ssg-test_unix_wrlinux8:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_unix_wrlinux8:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_unix_wrlinux8:ste:1"/>
              </ind-def:family_test>
              <ind-def:family_test id="oval:ssg-test_unix_wrlinux1019:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_unix_wrlinux1019:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_unix_wrlinux1019:ste:1"/>
              </ind-def:family_test>
              <ind-def:family_test id="oval:ssg-test_unix_family:tst:1" version="1" check="all" comment="Test installed OS is part of the unix family">
                <ind-def:object object_ref="oval:ssg-object_unix_family:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_unix_family:ste:1"/>
              </ind-def:family_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ubuntu_xenial:tst:1" version="1" check="all" comment="Check Ubuntu version">
                <ind-def:object object_ref="oval:ssg-obj_ubuntu_xenial:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ubuntu_focal:tst:1" version="1" check="all" comment="Check Ubuntu version">
                <ind-def:object object_ref="oval:ssg-obj_ubuntu_focal:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ubuntu_bionic:tst:1" version="1" check="all" comment="Check Ubuntu version">
                <ind-def:object object_ref="oval:ssg-obj_ubuntu_bionic:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ubuntu:tst:1" version="1" check="all" comment="Check Ubuntu">
                <ind-def:object object_ref="oval:ssg-obj_ubuntu:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:partition_test id="oval:ssg-test_tmp_partition_nosuid_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" comment="nosuid on /tmp optional yes">
                <lin-def:object object_ref="oval:ssg-object_tmp_partition_nosuid_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_tmp_partition_nosuid_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_tmp_partition_noexec_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" comment="noexec on /tmp optional yes">
                <lin-def:object object_ref="oval:ssg-object_tmp_partition_noexec_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_tmp_partition_noexec_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_tmp_partition_nodev_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" comment="nodev on /tmp optional yes">
                <lin-def:object object_ref="oval:ssg-object_tmp_partition_nodev_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_tmp_partition_nodev_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <unix-def:file_test id="oval:ssg-test_tmp_inst:tst:1" version="1" check_existence="only_one_exists" check="all" comment="Check that /tmp/tmp-inst exists and has mode 000">
                <unix-def:object object_ref="oval:ssg-obj_tmp_inst:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_tmp_inst:ste:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_tmp_in_namespace_conf:tst:1" version="1" check="all" comment="Check configuration of /tmp in /etc/security/namespace.conf file">
                <ind-def:object object_ref="oval:ssg-obj_tmp_in_namespace_conf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_timer_running_dnf-automatic:tst:1" version="1" check="at least one" comment="Test that the dnf-automatic timer is running">
                <lin-def:object object_ref="oval:ssg-obj_timer_running_dnf-automatic:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_timer_running_dnf-automatic:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <unix-def:file_test id="oval:ssg-test_system_using_opal:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if /sys/firmware/opal exists">
                <unix-def:object object_ref="oval:ssg-object_system_using_opal:obj:1"/>
              </unix-def:file_test>
              <unix-def:uname_test id="oval:ssg-test_system_info_architecture_x86_64:tst:1" version="1" check="all" comment="64 bit architecture">
                <unix-def:object object_ref="oval:ssg-object_system_info_architecture_x86_64:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_system_info_architecture_x86_64:ste:1"/>
              </unix-def:uname_test>
              <unix-def:uname_test id="oval:ssg-test_system_info_architecture_x86:tst:1" version="1" check="all" comment="32 bit architecture">
                <unix-def:object object_ref="oval:ssg-object_system_info_architecture_x86:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_system_info_architecture_x86:ste:1"/>
              </unix-def:uname_test>
              <unix-def:uname_test id="oval:ssg-test_system_info_architecture_s390_64:tst:1" version="1" check="all" comment="64 bit architecture">
                <unix-def:object object_ref="oval:ssg-object_system_info_architecture_s390_64:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_system_info_architecture_s390_64:ste:1"/>
              </unix-def:uname_test>
              <unix-def:uname_test id="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" version="1" check="all" comment="64 bit architecture">
                <unix-def:object object_ref="oval:ssg-object_system_info_architecture_ppcle_64:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_system_info_architecture_ppcle_64:ste:1"/>
              </unix-def:uname_test>
              <unix-def:uname_test id="oval:ssg-test_system_info_architecture_ppc_64:tst:1" version="1" check="all" comment="64 bit architecture">
                <unix-def:object object_ref="oval:ssg-object_system_info_architecture_ppc_64:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_system_info_architecture_ppc_64:ste:1"/>
              </unix-def:uname_test>
              <unix-def:uname_test id="oval:ssg-test_system_info_architecture_aarch_64:tst:1" version="1" check="all" comment="64 bit architecture">
                <unix-def:object object_ref="oval:ssg-object_system_info_architecture_aarch_64:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_system_info_architecture_aarch_64:ste:1"/>
              </unix-def:uname_test>
              <ind-def:variable_test id="oval:ssg-test_system_crypto_policy_value:tst:1" version="1" check="at least one" comment="tests if var_system_crypto_policy is set to FIPS">
                <ind-def:object object_ref="oval:ssg-obj_system_crypto_policy_value:obj:1"/>
                <ind-def:state state_ref="oval:ssg-ste_system_crypto_policy_value:ste:1"/>
              </ind-def:variable_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_system_auth_pam_unix_rounds_is_set:tst:1" version="1" check_existence="all_exist" check="all" comment="Test if rounds attribute of pam_unix.so is set correctly in /etc/pam.d/system-auth">
                <ind-def:object object_ref="oval:ssg-object_system_auth_pam_unix_rounds:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_system_auth_pam_unix_rounds:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_system_auth_pam_unix_rounds_is_default:tst:1" version="1" check_existence="none_exist" check="all" comment="Test if rounds attribute of pam_unix.so is not set in /etc/pam.d/system-auth">
                <ind-def:object object_ref="oval:ssg-object_system_auth_pam_unix_rounds:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:variable_test id="oval:ssg-test_system_auth_default_pam_unix_rounds_var:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if value of var_password_pam_unix_rounds is the system's default">
                <ind-def:object object_ref="oval:ssg-object_system_auth_default_pam_unix_rounds_var:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_system_auth_default_pam_unix_rounds_var:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_vm_mmap_min_addr_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains vm_mmap_min_addr">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_vm_mmap_min_addr_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_vm_mmap_min_addr_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_user_max_user_namespaces_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains user_max_user_namespaces">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_user_max_user_namespaces_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_user_max_user_namespaces_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_vm_mmap_min_addr:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter vm.mmap_min_addr set to 65536">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_vm_mmap_min_addr:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_vm_mmap_min_addr:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_user_max_user_namespaces:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter user.max_user_namespaces set to 0">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_user_max_user_namespaces:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_user_max_user_namespaces:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_router_solicitations:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.default.router_solicitations set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_router_solicitations:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_router_solicitations:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_max_addresses:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.default.max_addresses set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_max_addresses:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_max_addresses:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.default.disable_ipv6 set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_autoconf:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.default.autoconf set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_autoconf:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_autoconf:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_redirects:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_redirects:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_router_solicitations:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.all.router_solicitations set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_router_solicitations:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_router_solicitations:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_max_addresses:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.all.max_addresses set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_max_addresses:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_max_addresses:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_autoconf:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.all.autoconf set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_autoconf:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_autoconf:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_tcp_syncookies:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.tcp_syncookies set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_tcp_syncookies:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_tcp_syncookies:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_ip_local_port_range:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.ip_local_port_range set to 32768 65535">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_ip_local_port_range:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_ip_local_port_range:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_ip_forward:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.ip_forward set to 0">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_ip_forward:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_ip_forward:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_shared_media:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.default.shared_media set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_shared_media:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_shared_media:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_send_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_send_redirects:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_send_redirects:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_secure_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_secure_redirects:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_secure_redirects:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_rp_filter:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.default.rp_filter set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_rp_filter:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_rp_filter:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_log_martians:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.default.log_martians set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_log_martians:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_log_martians:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_source_route:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_accept_source_route:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_accept_source_route:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_accept_redirects:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_accept_redirects:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_shared_media:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.all.shared_media set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_shared_media:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_shared_media:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_send_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_send_redirects:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_send_redirects:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_secure_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_secure_redirects:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_secure_redirects:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_rp_filter:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.all.rp_filter set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_rp_filter:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_rp_filter:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_route_localnet:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.all.route_localnet set to 0">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_route_localnet:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_route_localnet:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_log_martians:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.all.log_martians set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_log_martians:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_log_martians:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.all.drop_gratuitous_arp set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_drop_gratuitous_arp:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_drop_gratuitous_arp:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_arp_ignore:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.all.arp_ignore set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_arp_ignore:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_arp_ignore:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_arp_filter:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.all.arp_filter set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_arp_filter:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_arp_filter:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_source_route:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_accept_source_route:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_accept_source_route:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_accept_redirects:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_accept_redirects:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_local:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.all.accept_local set to 0">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_accept_local:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_accept_local:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_core_bpf_jit_harden:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.core.bpf_jit_harden set to 2">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_core_bpf_jit_harden:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_core_bpf_jit_harden:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_yama_ptrace_scope:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.yama.ptrace_scope set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_yama_ptrace_scope:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_yama_ptrace_scope:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_unprivileged_bpf_disabled:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.unprivileged_bpf_disabled set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_unprivileged_bpf_disabled:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_unprivileged_bpf_disabled:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_sysrq:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.sysrq set to 0">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_sysrq:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_sysrq:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_randomize_va_space:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.randomize_va_space set to 2">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_randomize_va_space:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_randomize_va_space:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_pid_max:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.pid_max set to 65536">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_pid_max:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_pid_max:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_perf_event_paranoid:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.perf_event_paranoid set to 2">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_perf_event_paranoid:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_perf_event_paranoid:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_perf_event_max_sample_rate:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.perf_event_max_sample_rate set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_perf_event_max_sample_rate:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_perf_event_max_sample_rate:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_perf_cpu_time_max_percent:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.perf_cpu_time_max_percent set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_perf_cpu_time_max_percent:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_perf_cpu_time_max_percent:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_panic_on_oops:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.panic_on_oops set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_panic_on_oops:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_panic_on_oops:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_modules_disabled:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.modules_disabled set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_modules_disabled:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_modules_disabled:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_kptr_restrict:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.kptr_restrict set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_kptr_restrict:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_kptr_restrict:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_kexec_load_disabled:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.kexec_load_disabled set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_kexec_load_disabled:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_kexec_load_disabled:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_dmesg_restrict:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.dmesg_restrict set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_dmesg_restrict:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_dmesg_restrict:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_core_pattern:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.core_pattern set to |/bin/false">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_core_pattern:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_core_pattern:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_fs_suid_dumpable:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter fs.suid_dumpable set to 0">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_fs_suid_dumpable:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_fs_suid_dumpable:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_fs_protected_symlinks:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter fs.protected_symlinks set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_fs_protected_symlinks:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_fs_protected_symlinks:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_fs_protected_regular:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter fs.protected_regular set to 2">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_fs_protected_regular:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_fs_protected_regular:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_fs_protected_hardlinks:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter fs.protected_hardlinks set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_fs_protected_hardlinks:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_fs_protected_hardlinks:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_fs_protected_fifos:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter fs.protected_fifos set to 2">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_fs_protected_fifos:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_fs_protected_fifos:ste:1"/>
              </unix-def:sysctl_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_router_solicitations_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv6_conf_default_router_solicitations">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_default_router_solicitations_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_router_solicitations_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_max_addresses_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv6_conf_default_max_addresses">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_default_max_addresses_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_max_addresses_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_disable_ipv6_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv6_conf_default_disable_ipv6">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_default_disable_ipv6_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_disable_ipv6_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_autoconf_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv6_conf_default_autoconf">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_default_autoconf_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_autoconf_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv6_conf_default_accept_redirects">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_default_accept_redirects_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_redirects_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv6_conf_default_accept_ra_rtr_pref">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_pinfo_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv6_conf_default_accept_ra_pinfo">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_default_accept_ra_pinfo_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_pinfo_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_defrtr_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv6_conf_default_accept_ra_defrtr">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_default_accept_ra_defrtr_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_defrtr_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv6_conf_default_accept_ra">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_default_accept_ra_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_router_solicitations_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv6_conf_all_router_solicitations">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_all_router_solicitations_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_router_solicitations_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_max_addresses_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv6_conf_all_max_addresses">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_all_max_addresses_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_max_addresses_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv6_conf_all_disable_ipv6">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_all_disable_ipv6_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_disable_ipv6_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_autoconf_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv6_conf_all_autoconf">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_all_autoconf_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_autoconf_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv6_conf_all_accept_ra_rtr_pref">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_pinfo_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv6_conf_all_accept_ra_pinfo">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_all_accept_ra_pinfo_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_ra_pinfo_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_defrtr_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv6_conf_all_accept_ra_defrtr">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv6_conf_all_accept_ra_defrtr_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_ra_defrtr_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv4_tcp_syncookies">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv4_tcp_syncookies_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv4_tcp_syncookies_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv4_ip_local_port_range_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv4_ip_local_port_range">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv4_ip_local_port_range_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv4_ip_local_port_range_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv4_ip_forward_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv4_ip_forward">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv4_ip_forward_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv4_ip_forward_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv4_icmp_ignore_bogus_error_responses">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv4_icmp_echo_ignore_broadcasts">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_shared_media_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv4_conf_default_shared_media">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_default_shared_media_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_shared_media_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv4_conf_default_send_redirects">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_default_send_redirects_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_send_redirects_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv4_conf_default_secure_redirects">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_default_secure_redirects_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_secure_redirects_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv4_conf_default_rp_filter">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_default_rp_filter_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_rp_filter_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv4_conf_default_log_martians">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_default_log_martians_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_log_martians_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv4_conf_default_accept_source_route">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_default_accept_source_route_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_accept_source_route_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv4_conf_default_accept_redirects">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_default_accept_redirects_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_accept_redirects_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_shared_media_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv4_conf_all_shared_media">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_all_shared_media_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_shared_media_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv4_conf_all_send_redirects">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_all_send_redirects_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_send_redirects_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv4_conf_all_secure_redirects">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_all_secure_redirects_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_secure_redirects_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv4_conf_all_rp_filter">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_all_rp_filter_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_rp_filter_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_route_localnet_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv4_conf_all_route_localnet">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_all_route_localnet_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_route_localnet_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv4_conf_all_log_martians">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_all_log_martians_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_log_martians_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv4_conf_all_drop_gratuitous_arp">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_ignore_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv4_conf_all_arp_ignore">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_all_arp_ignore_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_arp_ignore_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_filter_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv4_conf_all_arp_filter">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_all_arp_filter_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_arp_filter_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv4_conf_all_accept_source_route">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_all_accept_source_route_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_accept_source_route_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv4_conf_all_accept_redirects">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_all_accept_redirects_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_accept_redirects_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_local_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_ipv4_conf_all_accept_local">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_ipv4_conf_all_accept_local_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_accept_local_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_net_core_bpf_jit_harden_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains net_core_bpf_jit_harden">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_net_core_bpf_jit_harden_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_net_core_bpf_jit_harden_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_kernel_yama_ptrace_scope_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains kernel_yama_ptrace_scope">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_kernel_yama_ptrace_scope_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_kernel_yama_ptrace_scope_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_kernel_unprivileged_bpf_disabled_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains kernel_unprivileged_bpf_disabled">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_kernel_unprivileged_bpf_disabled_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_kernel_unprivileged_bpf_disabled_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_kernel_sysrq_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains kernel_sysrq">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_kernel_sysrq_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_kernel_sysrq_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_kernel_randomize_va_space_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains kernel_randomize_va_space">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_kernel_randomize_va_space_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_kernel_randomize_va_space_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_kernel_pid_max_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains kernel_pid_max">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_kernel_pid_max_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_kernel_pid_max_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_kernel_perf_event_paranoid_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains kernel_perf_event_paranoid">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_kernel_perf_event_paranoid_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_kernel_perf_event_paranoid_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_kernel_perf_event_max_sample_rate_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains kernel_perf_event_max_sample_rate">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_kernel_perf_event_max_sample_rate_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_kernel_perf_event_max_sample_rate_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_kernel_perf_cpu_time_max_percent_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains kernel_perf_cpu_time_max_percent">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_kernel_perf_cpu_time_max_percent_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_kernel_perf_cpu_time_max_percent_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_kernel_panic_on_oops_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains kernel_panic_on_oops">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_kernel_panic_on_oops_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_kernel_panic_on_oops_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_kernel_modules_disabled_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains kernel_modules_disabled">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_kernel_modules_disabled_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_kernel_modules_disabled_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_kernel_kptr_restrict_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains kernel_kptr_restrict">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_kernel_kptr_restrict_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_kernel_kptr_restrict_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_kernel_kexec_load_disabled_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains kernel_kexec_load_disabled">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_kernel_kexec_load_disabled_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_kernel_kexec_load_disabled_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_kernel_dmesg_restrict_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains kernel_dmesg_restrict">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_kernel_dmesg_restrict_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_kernel_dmesg_restrict_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_kernel_core_pattern_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains kernel_core_pattern">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_kernel_core_pattern_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_kernel_core_pattern_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_fs_suid_dumpable_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains fs_suid_dumpable">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_fs_suid_dumpable_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_fs_suid_dumpable_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_fs_protected_symlinks_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains fs_protected_symlinks">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_fs_protected_symlinks_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_fs_protected_symlinks_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_fs_protected_regular_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains fs_protected_regular">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_fs_protected_regular_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_fs_protected_regular_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_fs_protected_hardlinks_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains fs_protected_hardlinks">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_fs_protected_hardlinks_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_fs_protected_hardlinks_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sysctl_fs_protected_fifos_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that only one file contains fs_protected_fifos">
                <ind-def:object object_ref="oval:ssg-oject_sysctl_fs_protected_fifos_defined_in_one_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sysctl_fs_protected_fifos_defined_in_one_file:ste:1"/>
              </ind-def:variable_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_crypto_fips_enabled:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter crypto.fips_enabled set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_crypto_fips_enabled:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_crypto_fips_enabled:ste:1"/>
              </unix-def:sysctl_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sysconfig_nozeroconf_yes:tst:1" version="1" check="all" comment="check NOZEROCONF=yes in /etc/sysconfig/network">
                <ind-def:object object_ref="oval:ssg-obj_sysconfig_nozeroconf_yes:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sys_uid_min_not_defined:tst:1" version="1" check_existence="none_exist" check="all" comment="SYS_UID_MIN not defined in /etc/login.defs">
                <ind-def:object object_ref="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sys_uid_max_not_defined:tst:1" version="1" check_existence="none_exist" check="all" comment="SYS_UID_MAX not defined in /etc/login.defs">
                <ind-def:object object_ref="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sudoersd_without_includes:tst:1" version="1" check_existence="none_exist" check="all" comment="audit augenrules rmmod">
                <ind-def:object object_ref="oval:ssg-object_sudoersd_without_includes:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sudoers_without_include:tst:1" version="1" check_existence="none_exist" check="all" comment="audit augenrules rmmod">
                <ind-def:object object_ref="oval:ssg-object_sudoers_without_include:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sudoers_targetpw_config:tst:1" version="1" check_existence="only_one_exists" check="all" comment="Ensure invoking user's password for privilege escalation when using sudo">
                <ind-def:object object_ref="oval:ssg-object_test_sudoers_targetpw_config:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sudoers_runaspw_config:tst:1" version="1" check_existence="only_one_exists" check="all" comment="Ensure invoking user's password for privilege escalation when using sudo">
                <ind-def:object object_ref="oval:ssg-object_test_sudoers_runaspw_config:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sudoers_rootpw_config:tst:1" version="1" check_existence="only_one_exists" check="all" comment="Ensure invoking user's password for privilege escalation when using sudo">
                <ind-def:object object_ref="oval:ssg-object_test_sudoers_rootpw_config:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:variable_test id="oval:ssg-test_sudoers_passwd_n_files:tst:1" version="1" check_existence="all_exist" check="all" comment="Verify that results come from only one file">
                <ind-def:object object_ref="oval:ssg-obj_sudoers_passwd_n_files:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sudoers_passwd_n_files:ste:1"/>
              </ind-def:variable_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sudoers_no_command_negation:tst:1" version="1" check_existence="none_exist" check="all" comment="Make sure that no command in user spec contains negation">
                <ind-def:object object_ref="oval:ssg-object_sudoers_no_command_negation:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sudoers_explicit_command_args:tst:1" version="1" check_existence="none_exist" check="all" comment="Make sure that no command in user spec is without any argument">
                <ind-def:object object_ref="oval:ssg-object_sudoers_explicit_command_args:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sudoers_default_includedir:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules rmmod">
                <ind-def:object object_ref="oval:ssg-object_sudoers_default_includedir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sudoers_default_includedir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_vm_mmap_min_addr:tst:1" version="1" check="all" comment="vm.mmap_min_addr static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_vm_mmap_min_addr:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_vm_mmap_min_addr:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_user_max_user_namespaces:tst:1" version="1" check="all" comment="user.max_user_namespaces static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_user_max_user_namespaces:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_user_max_user_namespaces:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" version="1" check="all" comment="net.ipv6.conf.default.router_solicitations static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_router_solicitations:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_router_solicitations:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_max_addresses:tst:1" version="1" check="all" comment="net.ipv6.conf.default.max_addresses static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_max_addresses:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_max_addresses:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" check="all" comment="net.ipv6.conf.default.disable_ipv6 static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_disable_ipv6:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_autoconf:tst:1" version="1" check="all" comment="net.ipv6.conf.default.autoconf static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_autoconf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_autoconf:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_rtr_pref static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_pinfo static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_pinfo:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_defrtr static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_defrtr:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" version="1" check="all" comment="net.ipv6.conf.all.router_solicitations static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_router_solicitations:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_router_solicitations:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_max_addresses:tst:1" version="1" check="all" comment="net.ipv6.conf.all.max_addresses static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_max_addresses:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_max_addresses:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" check="all" comment="net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_disable_ipv6:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_autoconf:tst:1" version="1" check="all" comment="net.ipv6.conf.all.autoconf static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_autoconf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_autoconf:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_rtr_pref static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_pinfo static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_pinfo:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_defrtr static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_defrtr:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1" check="all" comment="net.ipv4.tcp_syncookies static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_local_port_range:tst:1" version="1" check="all" comment="net.ipv4.ip_local_port_range static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_local_port_range:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_local_port_range:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_forward:tst:1" version="1" check="all" comment="net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_forward:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_forward:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" check="all" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" check="all" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_shared_media:tst:1" version="1" check="all" comment="net.ipv4.conf.default.shared_media static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_shared_media:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_shared_media:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.send_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_send_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.secure_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1" check="all" comment="net.ipv4.conf.default.rp_filter static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1" check="all" comment="net.ipv4.conf.default.log_martians static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1" check="all" comment="net.ipv4.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_shared_media:tst:1" version="1" check="all" comment="net.ipv4.conf.all.shared_media static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_shared_media:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_shared_media:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.send_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_send_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.secure_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1" check="all" comment="net.ipv4.conf.all.rp_filter static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_route_localnet:tst:1" version="1" check="all" comment="net.ipv4.conf.all.route_localnet static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_route_localnet:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_route_localnet:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1" check="all" comment="net.ipv4.conf.all.log_martians static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" version="1" check="all" comment="net.ipv4.conf.all.drop_gratuitous_arp static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_arp_ignore:tst:1" version="1" check="all" comment="net.ipv4.conf.all.arp_ignore static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_arp_ignore:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_arp_ignore:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_arp_filter:tst:1" version="1" check="all" comment="net.ipv4.conf.all.arp_filter static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_arp_filter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_arp_filter:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_local:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_local static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_local:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_local:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_core_bpf_jit_harden:tst:1" version="1" check="all" comment="net.core.bpf_jit_harden static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_core_bpf_jit_harden:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_core_bpf_jit_harden:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_yama_ptrace_scope:tst:1" version="1" check="all" comment="kernel.yama.ptrace_scope static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_yama_ptrace_scope:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_yama_ptrace_scope:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:tst:1" version="1" check="all" comment="kernel.unprivileged_bpf_disabled static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_unprivileged_bpf_disabled:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_sysrq:tst:1" version="1" check="all" comment="kernel.sysrq static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_sysrq:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_sysrq:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_randomize_va_space:tst:1" version="1" check="all" comment="kernel.randomize_va_space static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_randomize_va_space:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_randomize_va_space:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_pid_max:tst:1" version="1" check="all" comment="kernel.pid_max static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_pid_max:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_pid_max:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_paranoid:tst:1" version="1" check="all" comment="kernel.perf_event_paranoid static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_paranoid:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_perf_event_paranoid:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1" check="all" comment="kernel.perf_event_max_sample_rate static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_perf_event_max_sample_rate:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1" check="all" comment="kernel.perf_cpu_time_max_percent static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_perf_cpu_time_max_percent:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_panic_on_oops:tst:1" version="1" check="all" comment="kernel.panic_on_oops static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_panic_on_oops:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_panic_on_oops:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_modules_disabled:tst:1" version="1" check="all" comment="kernel.modules_disabled static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_modules_disabled:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_modules_disabled:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_kptr_restrict:tst:1" version="1" check="all" comment="kernel.kptr_restrict static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_kptr_restrict:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_kptr_restrict:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_kexec_load_disabled:tst:1" version="1" check="all" comment="kernel.kexec_load_disabled static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_kexec_load_disabled:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_kexec_load_disabled:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_dmesg_restrict:tst:1" version="1" check="all" comment="kernel.dmesg_restrict static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_dmesg_restrict:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_dmesg_restrict:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_core_pattern:tst:1" version="1" check="all" comment="kernel.core_pattern static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_core_pattern:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_core_pattern:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_fs_suid_dumpable:tst:1" version="1" check="all" comment="fs.suid_dumpable static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_fs_suid_dumpable:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_fs_suid_dumpable:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_fs_protected_symlinks:tst:1" version="1" check="all" comment="fs.protected_symlinks static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_fs_protected_symlinks:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_fs_protected_symlinks:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_fs_protected_regular:tst:1" version="1" check="all" comment="fs.protected_regular static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_fs_protected_regular:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_fs_protected_regular:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_fs_protected_hardlinks:tst:1" version="1" check="all" comment="fs.protected_hardlinks static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_fs_protected_hardlinks:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_fs_protected_hardlinks:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_fs_protected_fifos:tst:1" version="1" check="all" comment="fs.protected_fifos static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_fs_protected_fifos:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_fs_protected_fifos:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_vm_mmap_min_addr:tst:1" version="1" check_existence="all_exist" check="all" comment="vm.mmap_min_addr static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_vm_mmap_min_addr:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_vm_mmap_min_addr:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_user_max_user_namespaces:tst:1" version="1" check_existence="all_exist" check="all" comment="user.max_user_namespaces static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_user_max_user_namespaces:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_user_max_user_namespaces:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_router_solicitations:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.default.router_solicitations static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_router_solicitations:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_router_solicitations:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_max_addresses:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.default.max_addresses static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_max_addresses:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_max_addresses:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.default.disable_ipv6 static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_disable_ipv6:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_autoconf:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.default.autoconf static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_autoconf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_autoconf:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.default.accept_redirects static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.default.accept_ra_rtr_pref static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.default.accept_ra_pinfo static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_pinfo:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.default.accept_ra_defrtr static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_defrtr:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.default.accept_ra static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_router_solicitations:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.all.router_solicitations static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_router_solicitations:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_router_solicitations:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_max_addresses:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.all.max_addresses static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_max_addresses:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_max_addresses:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.all.disable_ipv6 static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_disable_ipv6:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_autoconf:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.all.autoconf static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_autoconf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_autoconf:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.all.accept_ra_rtr_pref static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.all.accept_ra_pinfo static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_pinfo:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.all.accept_ra_defrtr static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_defrtr:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_tcp_syncookies:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.tcp_syncookies static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_tcp_syncookies:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_ip_local_port_range:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.ip_local_port_range static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_ip_local_port_range:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_local_port_range:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_ip_forward:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.ip_forward static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_ip_forward:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_forward:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_shared_media:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.default.shared_media static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_shared_media:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_shared_media:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_send_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.default.send_redirects static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_send_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_send_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_secure_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.default.secure_redirects static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_secure_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_rp_filter:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.default.rp_filter static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_rp_filter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_log_martians:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.default.log_martians static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_log_martians:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_source_route:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.default.accept_source_route static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_accept_source_route:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.default.accept_redirects static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_accept_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_shared_media:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.all.shared_media static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_shared_media:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_shared_media:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_send_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.all.send_redirects static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_send_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_send_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_secure_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.all.secure_redirects static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_secure_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_rp_filter:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.all.rp_filter static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_rp_filter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_route_localnet:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.all.route_localnet static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_route_localnet:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_route_localnet:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_log_martians:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.all.log_martians static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_log_martians:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.all.drop_gratuitous_arp static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_arp_ignore:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.all.arp_ignore static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_arp_ignore:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_arp_ignore:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_arp_filter:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.all.arp_filter static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_arp_filter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_arp_filter:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_source_route:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.all.accept_source_route static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_source_route:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.all.accept_redirects static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_local:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.all.accept_local static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_local:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_local:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_core_bpf_jit_harden:tst:1" version="1" check_existence="all_exist" check="all" comment="net.core.bpf_jit_harden static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_core_bpf_jit_harden:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_core_bpf_jit_harden:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_yama_ptrace_scope:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.yama.ptrace_scope static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_yama_ptrace_scope:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_yama_ptrace_scope:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_unprivileged_bpf_disabled:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.unprivileged_bpf_disabled static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_unprivileged_bpf_disabled:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_unprivileged_bpf_disabled:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_sysrq:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.sysrq static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_sysrq:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_sysrq:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_randomize_va_space:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.randomize_va_space static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_randomize_va_space:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_randomize_va_space:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_pid_max:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.pid_max static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_pid_max:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_pid_max:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_perf_event_paranoid:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.perf_event_paranoid static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_perf_event_paranoid:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_perf_event_paranoid:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_perf_event_max_sample_rate:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.perf_event_max_sample_rate static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_perf_event_max_sample_rate:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_perf_event_max_sample_rate:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_perf_cpu_time_max_percent:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.perf_cpu_time_max_percent static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_perf_cpu_time_max_percent:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_perf_cpu_time_max_percent:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_panic_on_oops:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.panic_on_oops static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_panic_on_oops:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_panic_on_oops:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_modules_disabled:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.modules_disabled static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_modules_disabled:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_modules_disabled:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_kptr_restrict:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.kptr_restrict static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_kptr_restrict:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_kptr_restrict:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_kexec_load_disabled:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.kexec_load_disabled static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_kexec_load_disabled:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_kexec_load_disabled:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_exec_shield:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.exec-shield static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_exec_shield:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_dmesg_restrict:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.dmesg_restrict static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_dmesg_restrict:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_dmesg_restrict:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_core_pattern:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.core_pattern static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_core_pattern:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_core_pattern:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_fs_suid_dumpable:tst:1" version="1" check_existence="all_exist" check="all" comment="fs.suid_dumpable static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_fs_suid_dumpable:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_fs_suid_dumpable:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_fs_protected_symlinks:tst:1" version="1" check_existence="all_exist" check="all" comment="fs.protected_symlinks static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_fs_protected_symlinks:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_fs_protected_symlinks:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_fs_protected_regular:tst:1" version="1" check_existence="all_exist" check="all" comment="fs.protected_regular static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_fs_protected_regular:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_fs_protected_regular:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_fs_protected_hardlinks:tst:1" version="1" check_existence="all_exist" check="all" comment="fs.protected_hardlinks static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_fs_protected_hardlinks:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_fs_protected_hardlinks:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_fs_protected_fifos:tst:1" version="1" check_existence="all_exist" check="all" comment="fs.protected_fifos static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_fs_protected_fifos:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_fs_protected_fifos:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_vm_mmap_min_addr:tst:1" version="1" check="all" comment="vm.mmap_min_addr static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_vm_mmap_min_addr:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_vm_mmap_min_addr:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_user_max_user_namespaces:tst:1" version="1" check="all" comment="user.max_user_namespaces static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_user_max_user_namespaces:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_user_max_user_namespaces:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" version="1" check="all" comment="net.ipv6.conf.default.router_solicitations static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_router_solicitations:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_router_solicitations:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_max_addresses:tst:1" version="1" check="all" comment="net.ipv6.conf.default.max_addresses static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_max_addresses:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_max_addresses:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" check="all" comment="net.ipv6.conf.default.disable_ipv6 static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_disable_ipv6:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_autoconf:tst:1" version="1" check="all" comment="net.ipv6.conf.default.autoconf static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_autoconf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_autoconf:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_rtr_pref static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_pinfo static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_pinfo:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_defrtr static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_defrtr:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" version="1" check="all" comment="net.ipv6.conf.all.router_solicitations static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_router_solicitations:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_router_solicitations:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_max_addresses:tst:1" version="1" check="all" comment="net.ipv6.conf.all.max_addresses static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_max_addresses:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_max_addresses:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" check="all" comment="net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_disable_ipv6:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_autoconf:tst:1" version="1" check="all" comment="net.ipv6.conf.all.autoconf static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_autoconf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_autoconf:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_rtr_pref static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_pinfo static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_pinfo:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_defrtr static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_defrtr:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1" check="all" comment="net.ipv4.tcp_syncookies static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_tcp_syncookies:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_ip_local_port_range:tst:1" version="1" check="all" comment="net.ipv4.ip_local_port_range static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_ip_local_port_range:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_local_port_range:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_ip_forward:tst:1" version="1" check="all" comment="net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_ip_forward:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_forward:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" check="all" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" check="all" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_shared_media:tst:1" version="1" check="all" comment="net.ipv4.conf.default.shared_media static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_shared_media:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_shared_media:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.send_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_send_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_send_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.secure_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_secure_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1" check="all" comment="net.ipv4.conf.default.rp_filter static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_rp_filter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1" check="all" comment="net.ipv4.conf.default.log_martians static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_log_martians:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1" check="all" comment="net.ipv4.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_source_route:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_shared_media:tst:1" version="1" check="all" comment="net.ipv4.conf.all.shared_media static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_shared_media:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_shared_media:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.send_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_send_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_send_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.secure_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_secure_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1" check="all" comment="net.ipv4.conf.all.rp_filter static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_rp_filter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_route_localnet:tst:1" version="1" check="all" comment="net.ipv4.conf.all.route_localnet static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_route_localnet:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_route_localnet:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1" check="all" comment="net.ipv4.conf.all.log_martians static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_log_martians:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" version="1" check="all" comment="net.ipv4.conf.all.drop_gratuitous_arp static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_arp_ignore:tst:1" version="1" check="all" comment="net.ipv4.conf.all.arp_ignore static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_arp_ignore:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_arp_ignore:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_arp_filter:tst:1" version="1" check="all" comment="net.ipv4.conf.all.arp_filter static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_arp_filter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_arp_filter:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_source_route:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_local:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_local static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_local:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_local:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_core_bpf_jit_harden:tst:1" version="1" check="all" comment="net.core.bpf_jit_harden static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_core_bpf_jit_harden:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_core_bpf_jit_harden:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_yama_ptrace_scope:tst:1" version="1" check="all" comment="kernel.yama.ptrace_scope static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_yama_ptrace_scope:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_yama_ptrace_scope:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_unprivileged_bpf_disabled:tst:1" version="1" check="all" comment="kernel.unprivileged_bpf_disabled static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_unprivileged_bpf_disabled:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_unprivileged_bpf_disabled:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_sysrq:tst:1" version="1" check="all" comment="kernel.sysrq static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_sysrq:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_sysrq:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_randomize_va_space:tst:1" version="1" check="all" comment="kernel.randomize_va_space static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_randomize_va_space:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_randomize_va_space:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_pid_max:tst:1" version="1" check="all" comment="kernel.pid_max static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_pid_max:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_pid_max:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_perf_event_paranoid:tst:1" version="1" check="all" comment="kernel.perf_event_paranoid static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_perf_event_paranoid:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_perf_event_paranoid:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1" check="all" comment="kernel.perf_event_max_sample_rate static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_perf_event_max_sample_rate:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_perf_event_max_sample_rate:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1" check="all" comment="kernel.perf_cpu_time_max_percent static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_perf_cpu_time_max_percent:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_perf_cpu_time_max_percent:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_panic_on_oops:tst:1" version="1" check="all" comment="kernel.panic_on_oops static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_panic_on_oops:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_panic_on_oops:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_modules_disabled:tst:1" version="1" check="all" comment="kernel.modules_disabled static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_modules_disabled:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_modules_disabled:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_kptr_restrict:tst:1" version="1" check="all" comment="kernel.kptr_restrict static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_kptr_restrict:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_kptr_restrict:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_kexec_load_disabled:tst:1" version="1" check="all" comment="kernel.kexec_load_disabled static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_kexec_load_disabled:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_kexec_load_disabled:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_dmesg_restrict:tst:1" version="1" check="all" comment="kernel.dmesg_restrict static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_dmesg_restrict:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_dmesg_restrict:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_core_pattern:tst:1" version="1" check="all" comment="kernel.core_pattern static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_core_pattern:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_core_pattern:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_fs_suid_dumpable:tst:1" version="1" check="all" comment="fs.suid_dumpable static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_fs_suid_dumpable:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_fs_suid_dumpable:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_fs_protected_symlinks:tst:1" version="1" check="all" comment="fs.protected_symlinks static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_fs_protected_symlinks:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_fs_protected_symlinks:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_fs_protected_regular:tst:1" version="1" check="all" comment="fs.protected_regular static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_fs_protected_regular:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_fs_protected_regular:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_fs_protected_hardlinks:tst:1" version="1" check="all" comment="fs.protected_hardlinks static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_fs_protected_hardlinks:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_fs_protected_hardlinks:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_fs_protected_fifos:tst:1" version="1" check="all" comment="fs.protected_fifos static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_fs_protected_fifos:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_fs_protected_fifos:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_vm_mmap_min_addr:tst:1" version="1" check="all" comment="vm.mmap_min_addr static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_vm_mmap_min_addr:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_vm_mmap_min_addr:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_user_max_user_namespaces:tst:1" version="1" check="all" comment="user.max_user_namespaces static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_user_max_user_namespaces:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_user_max_user_namespaces:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" version="1" check="all" comment="net.ipv6.conf.default.router_solicitations static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_router_solicitations:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_router_solicitations:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_max_addresses:tst:1" version="1" check="all" comment="net.ipv6.conf.default.max_addresses static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_max_addresses:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_max_addresses:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" check="all" comment="net.ipv6.conf.default.disable_ipv6 static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_disable_ipv6:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_autoconf:tst:1" version="1" check="all" comment="net.ipv6.conf.default.autoconf static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_autoconf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_autoconf:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_rtr_pref static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_pinfo static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_pinfo:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_defrtr static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_defrtr:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" version="1" check="all" comment="net.ipv6.conf.all.router_solicitations static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_router_solicitations:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_router_solicitations:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_max_addresses:tst:1" version="1" check="all" comment="net.ipv6.conf.all.max_addresses static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_max_addresses:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_max_addresses:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" check="all" comment="net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_disable_ipv6:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_autoconf:tst:1" version="1" check="all" comment="net.ipv6.conf.all.autoconf static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_autoconf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_autoconf:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_rtr_pref static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_pinfo static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_pinfo:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_defrtr static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_defrtr:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1" check="all" comment="net.ipv4.tcp_syncookies static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_tcp_syncookies:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_local_port_range:tst:1" version="1" check="all" comment="net.ipv4.ip_local_port_range static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_ip_local_port_range:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_local_port_range:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_forward:tst:1" version="1" check="all" comment="net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_ip_forward:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_ip_forward:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" check="all" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" check="all" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_shared_media:tst:1" version="1" check="all" comment="net.ipv4.conf.default.shared_media static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_shared_media:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_shared_media:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.send_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_send_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_send_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.secure_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1" check="all" comment="net.ipv4.conf.default.rp_filter static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_rp_filter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1" check="all" comment="net.ipv4.conf.default.log_martians static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_log_martians:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1" check="all" comment="net.ipv4.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_shared_media:tst:1" version="1" check="all" comment="net.ipv4.conf.all.shared_media static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_shared_media:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_shared_media:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.send_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_send_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_send_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.secure_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1" check="all" comment="net.ipv4.conf.all.rp_filter static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_rp_filter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_route_localnet:tst:1" version="1" check="all" comment="net.ipv4.conf.all.route_localnet static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_route_localnet:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_route_localnet:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1" check="all" comment="net.ipv4.conf.all.log_martians static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_log_martians:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" version="1" check="all" comment="net.ipv4.conf.all.drop_gratuitous_arp static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_arp_ignore:tst:1" version="1" check="all" comment="net.ipv4.conf.all.arp_ignore static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_arp_ignore:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_arp_ignore:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_arp_filter:tst:1" version="1" check="all" comment="net.ipv4.conf.all.arp_filter static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_arp_filter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_arp_filter:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_local:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_local static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_local:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_local:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_core_bpf_jit_harden:tst:1" version="1" check="all" comment="net.core.bpf_jit_harden static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_core_bpf_jit_harden:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_core_bpf_jit_harden:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_yama_ptrace_scope:tst:1" version="1" check="all" comment="kernel.yama.ptrace_scope static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_yama_ptrace_scope:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_yama_ptrace_scope:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_unprivileged_bpf_disabled:tst:1" version="1" check="all" comment="kernel.unprivileged_bpf_disabled static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_unprivileged_bpf_disabled:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_unprivileged_bpf_disabled:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_sysrq:tst:1" version="1" check="all" comment="kernel.sysrq static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_sysrq:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_sysrq:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_randomize_va_space:tst:1" version="1" check="all" comment="kernel.randomize_va_space static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_randomize_va_space:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_randomize_va_space:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_pid_max:tst:1" version="1" check="all" comment="kernel.pid_max static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_pid_max:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_pid_max:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_perf_event_paranoid:tst:1" version="1" check="all" comment="kernel.perf_event_paranoid static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_perf_event_paranoid:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_perf_event_paranoid:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1" check="all" comment="kernel.perf_event_max_sample_rate static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_perf_event_max_sample_rate:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_perf_event_max_sample_rate:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1" check="all" comment="kernel.perf_cpu_time_max_percent static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_perf_cpu_time_max_percent:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_perf_cpu_time_max_percent:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_panic_on_oops:tst:1" version="1" check="all" comment="kernel.panic_on_oops static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_panic_on_oops:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_panic_on_oops:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_modules_disabled:tst:1" version="1" check="all" comment="kernel.modules_disabled static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_modules_disabled:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_modules_disabled:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_kptr_restrict:tst:1" version="1" check="all" comment="kernel.kptr_restrict static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_kptr_restrict:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_kptr_restrict:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_kexec_load_disabled:tst:1" version="1" check="all" comment="kernel.kexec_load_disabled static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_kexec_load_disabled:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_kexec_load_disabled:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_dmesg_restrict:tst:1" version="1" check="all" comment="kernel.dmesg_restrict static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_dmesg_restrict:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_dmesg_restrict:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_core_pattern:tst:1" version="1" check="all" comment="kernel.core_pattern static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_core_pattern:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_kernel_core_pattern:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_fs_suid_dumpable:tst:1" version="1" check="all" comment="fs.suid_dumpable static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_fs_suid_dumpable:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_fs_suid_dumpable:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_fs_protected_symlinks:tst:1" version="1" check="all" comment="fs.protected_symlinks static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_fs_protected_symlinks:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_fs_protected_symlinks:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_fs_protected_regular:tst:1" version="1" check="all" comment="fs.protected_regular static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_fs_protected_regular:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_fs_protected_regular:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_fs_protected_hardlinks:tst:1" version="1" check="all" comment="fs.protected_hardlinks static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_fs_protected_hardlinks:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_fs_protected_hardlinks:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_fs_protected_fifos:tst:1" version="1" check="all" comment="fs.protected_fifos static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_fs_protected_fifos:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_fs_protected_fifos:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sssd_ssh_known_hosts_timeout:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of ssh_known_hosts_timeout setting in the /etc/sssd/sssd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_sssd_ssh_known_hosts_timeout:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sssd_ssh_known_hosts_timeout:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sssd_run_as_sssd_user:tst:1" version="1" check="all" comment="tests the value of user setting in SSSD config files">
                <ind-def:object object_ref="oval:ssg-obj_sssd_user_value:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sssd_user_value:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sssd_offline_cred_expiration:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of offline_credentials_expiration setting in the /etc/sssd/sssd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_sssd_offline_cred_expiration:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sssd_memcache_timeout:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of memcache_timeout setting in the /etc/sssd/sssd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_sssd_memcache_timeout:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sssd_memcache_timeout:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sssd_enable_smartcards:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of pam_cert_auth setting in the /etc/sssd/sssd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_sssd_enable_smartcards:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sssd_enable_certmap:tst:1" version="1" check="all" comment="tests the presence of '^\[certmap\/.+\/.+\]$' setting in the /etc/sssd/sssd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_sssd_enable_certmap:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_sssd_conf_exists:tst:1" version="1" check_existence="all_exist" check="all" comment="Testing if /etc/sssd/sssd.conf exists">
                <unix-def:object object_ref="oval:ssg-object_sssd_conf_exists:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sssd_certificate_verification:tst:1" version="1" check_existence="all_exist" check="all" comment="test the value of         certificate_verification in sssd configuration">
                <ind-def:object object_ref="oval:ssg-obj_sssd_certificate_verification:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sssd_certificate_verification:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_x11_use_localhost_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of X11UseLocalhost setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_x11_use_localhost_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_x11_use_localhost_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_x11_use_localhost:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of X11UseLocalhost setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_x11_use_localhost:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_x11_use_localhost:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_use_priv_separation:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of UsePrivilegeSeparation setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_use_priv_separation:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_use_priv_separation:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_use_directory_configuration_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of match setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_use_directory_configuration_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_set_loglevel_verbose_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of LogLevel setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_set_loglevel_verbose_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_set_loglevel_verbose_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_set_loglevel_verbose:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of LogLevel setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_set_loglevel_verbose:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_set_loglevel_verbose:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_set_loglevel_info_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of LogLevel setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_set_loglevel_info_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_set_loglevel_info_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_set_loglevel_info:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of LogLevel setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_set_loglevel_info:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_set_loglevel_info:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_set_keepalive_0_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of ClientAliveCountMax setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_set_keepalive_0_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_set_keepalive_0_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_set_keepalive_0:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of ClientAliveCountMax setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_set_keepalive_0:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_set_keepalive_0:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:variable_test id="oval:ssg-test_sshd_requirement_unset:tst:1" version="1" check="all" comment="Verify if Value of sshd_required is the default">
                <ind-def:object object_ref="oval:ssg-object_sshd_requirement_unknown:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_requirement_unset:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sshd_required:tst:1" version="1" check="all" comment="Verify if Profile set Value sshd_required as required">
                <ind-def:object object_ref="oval:ssg-object_sshd_required:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_required:ste:1"/>
              </ind-def:variable_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_rekey_limit_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of RekeyLimit setting in SSHD config directory">
                <ind-def:object object_ref="oval:ssg-obj_sshd_rekey_limit_config_dir:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_rekey_limit:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of RekeyLimit setting in the file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_rekey_limit:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_print_last_log_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PrintLastLog setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_print_last_log_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_print_last_log_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_print_last_log:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PrintLastLog setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_print_last_log:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_print_last_log:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:variable_test id="oval:ssg-test_sshd_not_required:tst:1" version="1" check="all" comment="Verify if Profile set Value sshd_required as not required">
                <ind-def:object object_ref="oval:ssg-object_sshd_not_required:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_not_required:ste:1"/>
              </ind-def:variable_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_max_sessions:tst:1" version="1" check_existence="all_exist" check="all" comment="maxsessions is configured">
                <ind-def:object object_ref="oval:ssg-object_sshd_max_sessions:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_maxsessions_value_upper_bound:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_maxsessions_value_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_max_auth_tries:tst:1" version="1" check_existence="all_exist" check="all" comment="maxauthtries is configured">
                <ind-def:object object_ref="oval:ssg-object_sshd_max_auth_tries:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_maxauthtries_value_upper_bound:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_maxauthtries_value_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_login_grace_time:tst:1" version="1" check_existence="all_exist" check="all" comment="LoginGraceTime is configured">
                <ind-def:object object_ref="oval:ssg-object_sshd_login_grace_time:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_logingracetime_value_upper_bound:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_logingracetime_value_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_includes_config_files:tst:1" version="1" check="all" comment="tests the presence of 'Include /etc/ssh/sshd_config.d/*.conf' setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_includes_config_files:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_idle_timeout_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="timeout is configured in config directory">
                <ind-def:object object_ref="oval:ssg-object_sshd_idle_timeout_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_timeout_value_upper_bound:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_timeout_value_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_idle_timeout:tst:1" version="1" check_existence="all_exist" check="all" comment="timeout is configured">
                <ind-def:object object_ref="oval:ssg-object_sshd_idle_timeout:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_timeout_value_upper_bound:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_timeout_value_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_enable_x11_forwarding_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of X11Forwarding setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_enable_x11_forwarding_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_enable_x11_forwarding_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_enable_x11_forwarding:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of X11Forwarding setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_enable_x11_forwarding:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_enable_x11_forwarding:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_enable_warning_banner_net_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of Banner setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_enable_warning_banner_net_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_enable_warning_banner_net_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_enable_warning_banner_net:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of Banner setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_enable_warning_banner_net:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_enable_warning_banner_net:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_enable_warning_banner_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of Banner setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_enable_warning_banner_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_enable_warning_banner_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_enable_warning_banner:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of Banner setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_enable_warning_banner:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_enable_warning_banner:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_enable_strictmodes_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of StrictModes setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_enable_strictmodes_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_enable_strictmodes_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_enable_strictmodes:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of StrictModes setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_enable_strictmodes:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_enable_strictmodes:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_enable_pubkey_auth_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PubkeyAuthentication setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_enable_pubkey_auth_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_enable_pubkey_auth_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_enable_pubkey_auth:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PubkeyAuthentication setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_enable_pubkey_auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_enable_pubkey_auth:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_enable_pam_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of UsePAM setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_enable_pam_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_enable_pam_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_enable_pam:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of UsePAM setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_enable_pam:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_enable_pam:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_enable_gssapi_auth_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of GSSAPIAuthentication setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_enable_gssapi_auth_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_enable_gssapi_auth_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_enable_gssapi_auth:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of GSSAPIAuthentication setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_enable_gssapi_auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_enable_gssapi_auth:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_do_not_permit_user_env_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PermitUserEnvironment setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_do_not_permit_user_env_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_do_not_permit_user_env_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_do_not_permit_user_env:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PermitUserEnvironment setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_do_not_permit_user_env:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_do_not_permit_user_env:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_x11_forwarding_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of X11Forwarding setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_x11_forwarding_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_x11_forwarding_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_x11_forwarding:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of X11Forwarding setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_x11_forwarding:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_x11_forwarding:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_user_known_hosts_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of IgnoreUserKnownHosts setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_user_known_hosts_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_user_known_hosts_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_user_known_hosts:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of IgnoreUserKnownHosts setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_user_known_hosts:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_user_known_hosts:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_tcp_forwarding_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of AllowTcpForwarding setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_tcp_forwarding_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_tcp_forwarding_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_tcp_forwarding:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of AllowTcpForwarding setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_tcp_forwarding:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_tcp_forwarding:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_root_password_login_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_root_password_login_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_root_password_login_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_root_password_login:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_root_password_login:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_root_password_login:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_root_login_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_root_login_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_root_login_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_root_login:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_root_login:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_root_login:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_rhosts_rsa:tst:1" version="1" check_existence="none_exist" check="all" comment="Tests the value of the RhostsRSAAuthentication[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_rhosts_rsa:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_rhosts_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of IgnoreRhosts setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_rhosts_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_rhosts_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_rhosts:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of IgnoreRhosts setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_rhosts:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_rhosts:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_pubkey_auth_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PubkeyAuthentication setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_pubkey_auth_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_pubkey_auth_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_pubkey_auth:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PubkeyAuthentication setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_pubkey_auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_pubkey_auth:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_kerb_auth_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of KerberosAuthentication setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_kerb_auth_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_kerb_auth_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_kerb_auth:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of KerberosAuthentication setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_kerb_auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_kerb_auth:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_gssapi_auth_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of GSSAPIAuthentication setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_gssapi_auth_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_gssapi_auth_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_gssapi_auth:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of GSSAPIAuthentication setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_gssapi_auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_gssapi_auth:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_empty_passwords_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PermitEmptyPasswords setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_empty_passwords_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_empty_passwords_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_empty_passwords:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PermitEmptyPasswords setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_empty_passwords:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_empty_passwords:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_compression:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of Compression setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_compression:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_compression:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_clientalivecountmax_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="Tests the value of the ClientAliveCountMax setting in the /etc/ssh/sshd_config.d/ files">
                <ind-def:object object_ref="oval:ssg-obj_sshd_clientalivecountmax_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_clientalivecountmax:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_clientalivecountmax:tst:1" version="1" check_existence="all_exist" check="all" comment="Tests the value of the ClientAliveCountMax setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_clientalivecountmax:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_clientalivecountmax:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_allow_only_protocol2:tst:1" version="1" check_existence="all_exist" check="all" comment="sshd uses protocol 2">
                <ind-def:object object_ref="oval:ssg-object_sshd_allow_only_protocol2:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:partition_test id="oval:ssg-test_srv_partition_nosuid_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" comment="nosuid on /srv optional yes">
                <lin-def:object object_ref="oval:ssg-object_srv_partition_nosuid_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_srv_partition_nosuid_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_snmp_versions:tst:1" version="1" check_existence="none_exist" check="all" comment="Check snmpd configuration">
                <ind-def:object object_ref="oval:ssg-object_snmp_versions:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_snmp_default_communities:tst:1" version="1" check_existence="none_exist" check="all" comment="Check snmpd configuration">
                <ind-def:object object_ref="oval:ssg-object_snmp_default_communities:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_smart_card_required_system_auth:tst:1" version="1" check_existence="all_exist" check="all" comment="Test smartcard authentication is required in /etc/pam.d/system-auth file">
                <ind-def:object object_ref="oval:ssg-object_smart_card_required_system_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_smart_card_required_smartcard_auth:tst:1" version="1" check_existence="all_exist" check="all" comment="Test smartcard authentication is required in /etc/pam.d/smartcard-auth file">
                <ind-def:object object_ref="oval:ssg-object_smart_card_required_smartcard_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_smart_card_enabled_system_auth:tst:1" version="1" check_existence="all_exist" check="all" comment="Test smartcard authentication is enabled in /etc/pam.d/system-auth file">
                <ind-def:object object_ref="oval:ssg-object_smart_card_enabled_system_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sles_15_for_sap:tst:1" version="1" check="all" comment="SLES_SAP-release is version 15">
                <lin-def:object object_ref="oval:ssg-obj_sles_15_for_sap:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sles_15_for_sap:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sles_12_for_sap:tst:1" version="1" check="all" comment="SLES_SAP-release is version 12">
                <lin-def:object object_ref="oval:ssg-obj_sles_12_for_sap:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sles_12_for_sap:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:family_test id="oval:ssg-test_sle15_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_sle15_unix_family:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sle15_unix_family:ste:1"/>
              </ind-def:family_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sle15_server:tst:1" version="1" check="all" comment="sles-release is version 15">
                <lin-def:object object_ref="oval:ssg-obj_sle15_server:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sle15_server:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sle15_desktop:tst:1" version="1" check="all" comment="sled-release is version 15">
                <lin-def:object object_ref="oval:ssg-obj_sle15_desktop:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sle15_desktop:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:family_test id="oval:ssg-test_sle12_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_sle12_unix_family:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sle12_unix_family:ste:1"/>
              </ind-def:family_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sle12_server:tst:1" version="1" check="all" comment="sles-release is version 6">
                <lin-def:object object_ref="oval:ssg-obj_sle12_server:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sle12_server:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sle12_desktop:tst:1" version="1" check="all" comment="sled-release is version 6">
                <lin-def:object object_ref="oval:ssg-obj_sle12_desktop:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sle12_desktop:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sl7:tst:1" version="1" check="all" comment="sl-release is version 7">
                <lin-def:object object_ref="oval:ssg-obj_sl7:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sl7:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sl6:tst:1" version="1" check="all" comment="sl-release is version 6">
                <lin-def:object object_ref="oval:ssg-obj_sl6:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sl6:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_shell_defined_reserved_uid_range:tst:1" version="1" check_existence="any_exist" check="all" state_operator="OR" comment="&lt;0, SYS_UID_MIN&gt; system UIDs having shell set">
                <ind-def:object object_ref="oval:ssg-object_etc_passwd_entries:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_uid_less_than_zero:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_uid_greater_than_or_equal_sys_uid_min:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1" version="1" check_existence="any_exist" check="all" state_operator="OR" comment="&lt;SYS_UID_MIN, SYS_UID_MAX&gt; system UIDS having shell set">
                <ind-def:object object_ref="oval:ssg-object_etc_passwd_entries:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_uid_less_than_sys_uid_min:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_uid_greater_than_or_equal_sys_uid_max:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_shell_defined_default_uid_range:tst:1" version="1" check_existence="any_exist" check="all" state_operator="OR" comment="&lt;0, UID_MIN - 1&gt; system UIDs having shell set">
                <ind-def:object object_ref="oval:ssg-object_etc_passwd_entries:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_uid_less_than_zero:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_uid_greater_than_or_equal_uid_min:ste:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_usbguard_package_usbguard_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package usbguard is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_usbguard_package_usbguard_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_systemd-coredump_package_systemd_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package systemd is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_systemd-coredump_package_systemd_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_syslog_package_rsyslog_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package rsyslog is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_syslog_package_rsyslog_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_syslog-ng_package_syslog-ng_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package syslog-ng is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_syslog-ng_package_syslog-ng_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_sssd_package_sssd-common_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package sssd-common is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_sssd_package_sssd-common_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_sshd_package_openssh-server_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package openssh-server is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_sshd_package_openssh-server_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_usbguard:tst:1" version="1" check="at least one" comment="Test that the usbguard service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_usbguard:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_usbguard:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_syslog-ng:tst:1" version="1" check="at least one" comment="Test that the syslog-ng service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_syslog-ng:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_syslog-ng:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_rsyslog:tst:1" version="1" check="at least one" comment="Test that the rsyslog service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_rsyslog:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_rsyslog:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_rngd:tst:1" version="1" check="at least one" comment="Test that the rngd service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_rngd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_rngd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_pcscd:tst:1" version="1" check="at least one" comment="Test that the pcscd service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_pcscd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_pcscd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_ntpd:tst:1" version="1" check="at least one" comment="Test that the ntpd service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_ntpd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_ntpd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_ntp:tst:1" version="1" check="at least one" comment="Test that the ntp service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_ntp:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_ntp:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_iptables:tst:1" version="1" check="at least one" comment="Test that the iptables service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_iptables:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_iptables:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_ip6tables:tst:1" version="1" check="at least one" comment="Test that the ip6tables service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_ip6tables:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_ip6tables:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_firewalld:tst:1" version="1" check="at least one" comment="Test that the firewalld service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_firewalld:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_firewalld:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_crond:tst:1" version="1" check="at least one" comment="Test that the crond service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_crond:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_crond:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_cron:tst:1" version="1" check="at least one" comment="Test that the cron service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_cron:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_cron:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_chronyd:tst:1" version="1" check="at least one" comment="Test that the chronyd service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_chronyd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_chronyd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_auditd:tst:1" version="1" check="at least one" comment="Test that the auditd service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_auditd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_auditd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_rsyslog_package_rsyslog_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package rsyslog is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_rsyslog_package_rsyslog_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_rsyncd_package_rsync-daemon_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package rsync-daemon is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_rsyncd_package_rsync-daemon_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_rpcsvcgssd_package_nfs-utils_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package nfs-utils is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_rpcsvcgssd_package_nfs-utils_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_rpcidmapd_package_nfs-utils_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package nfs-utils is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_rpcidmapd_package_nfs-utils_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_rpcgssd_package_nfs-utils_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package nfs-utils is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_rpcgssd_package_nfs-utils_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_rngd_package_rng-tools_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package rng-tools is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_rngd_package_rng-tools_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_pcscd_package_pcsc-lite_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package pcsc-lite is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_pcscd_package_pcsc-lite_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_ntpd_package_ntp_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package ntp is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_ntpd_package_ntp_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_ntp_package_ntp_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package ntp is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_ntp_package_ntp_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_systemd-coredump:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the systemd-coredump service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_systemd-coredump:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_systemd-coredump:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_syslog:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the syslog service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_syslog:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_syslog:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_sssd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the sssd service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_sssd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_sssd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_sshd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the sshd service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_sshd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_sshd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_rsyncd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the rsyncd service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_rsyncd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_rsyncd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_rpcsvcgssd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the rpcsvcgssd service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_rpcsvcgssd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_rpcsvcgssd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_rpcidmapd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the rpcidmapd service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_rpcidmapd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_rpcidmapd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_rpcgssd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the rpcgssd service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_rpcgssd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_rpcgssd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_nfslock:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the nfslock service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_nfslock:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_nfslock:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_nfs-server:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the nfs-server service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_nfs-server:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_nfs-server:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_netfs:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the netfs service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_netfs:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_netfs:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_debug-shell:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the debug-shell service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_debug-shell:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_debug-shell:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_bluetooth:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the bluetooth service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_bluetooth:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_bluetooth:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_autofs:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the autofs service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_autofs:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_autofs:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_atd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the atd service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_atd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_atd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_nfslock_package_nfs-utils_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package nfs-utils is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_nfslock_package_nfs-utils_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_nfs-server_package_nfs-utils_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package nfs-utils is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_nfs-server_package_nfs-utils_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_netfs_package_netfs_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package netfs is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_netfs_package_netfs_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_systemd-coredump:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service systemd-coredump is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_systemd-coredump:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_systemd-coredump:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_syslog:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service syslog is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_syslog:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_syslog:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_sssd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service sssd is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_sssd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_sssd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_sshd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service sshd is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_sshd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_sshd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_rsyncd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service rsyncd is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_rsyncd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_rsyncd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_rpcsvcgssd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service rpcsvcgssd is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_rpcsvcgssd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_rpcsvcgssd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_rpcidmapd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service rpcidmapd is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_rpcidmapd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_rpcidmapd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_rpcgssd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service rpcgssd is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_rpcgssd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_rpcgssd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_nfslock:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service nfslock is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_nfslock:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_nfslock:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_nfs-server:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service nfs-server is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_nfs-server:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_nfs-server:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_netfs:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service netfs is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_netfs:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_netfs:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_debug-shell:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service debug-shell is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_debug-shell:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_debug-shell:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_bluetooth:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service bluetooth is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_bluetooth:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_bluetooth:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_autofs:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service autofs is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_autofs:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_autofs:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_atd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service atd is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_atd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_atd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_iptables_package_iptables_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package iptables is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_iptables_package_iptables_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_ip6tables_package_iptables-ipv6_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package iptables-ipv6 is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_ip6tables_package_iptables-ipv6_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_firewalld_package_firewalld_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package firewalld is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_firewalld_package_firewalld_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_debug-shell_package_systemd_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package systemd is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_debug-shell_package_systemd_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_crond_package_cronie_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package cronie is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_crond_package_cronie_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_cron_package_cron_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package cron is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_cron_package_cron_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_chronyd_package_chrony_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package chrony is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_chronyd_package_chrony_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_bluetooth_package_bluez_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package bluez is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_bluetooth_package_bluez_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_autofs_package_autofs_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package autofs is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_autofs_package_autofs_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_auditd_package_audit_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package audit is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_auditd_package_audit_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_atd_package_at_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package at is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_atd_package_at_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_serial_ports_etc_securetty:tst:1" version="1" check_existence="all_exist" check="all" comment="serial ports /etc/securetty">
                <ind-def:object object_ref="oval:ssg-object_serial_ports_etc_securetty:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_selinux_policy:tst:1" version="1" check_existence="all_exist" check="all" comment="Tests the value of the ^[\s]*SELINUXTYPE[\s]*=[\s]*([^#]*) expression in the /etc/selinux/config file">
                <ind-def:object object_ref="oval:ssg-obj_selinux_policy:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_selinux_policy:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_selinux_grub_dir:tst:1" version="1" check_existence="none_exist" check="all" comment="check value selinux|enforcing=0 in /etc/grub.d fail if found">
                <ind-def:object object_ref="oval:ssg-object_selinux_grub_dir:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_selinux_grub2_cfg:tst:1" version="1" check_existence="none_exist" check="all" comment="check value selinux|enforcing=0 in /etc/grub2.cfg, fail if found">
                <ind-def:object object_ref="oval:ssg-object_selinux_grub2_cfg:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_selinux_enforcing:tst:1" version="1" check_existence="all_exist" check="all" comment="/selinux/enforce is 1">
                <ind-def:object object_ref="oval:ssg-object_selinux_enforcing:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:selinuxsecuritycontext_test id="oval:ssg-test_selinux_dev_unlabeled_t:tst:1" version="2" check_existence="any_exist" check="none satisfy" comment="unlabeled_t in /dev">
                <lin-def:object object_ref="oval:ssg-object_selinux_dev_unlabeled_t:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_selinux_dev_unlabeled_t:ste:1"/>
              </lin-def:selinuxsecuritycontext_test>
              <lin-def:selinuxsecuritycontext_test id="oval:ssg-test_selinux_dev_device_t:tst:1" version="2" check_existence="any_exist" check="none satisfy" comment="device_t in /dev">
                <lin-def:object object_ref="oval:ssg-object_selinux_dev_device_t:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_selinux_dev_device_t:ste:1"/>
              </lin-def:selinuxsecuritycontext_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_selinux_default_grub:tst:1" version="1" check_existence="none_exist" check="all" comment="check value selinux|enforcing=0 in /etc/default/grub, fail if found">
                <ind-def:object object_ref="oval:ssg-object_selinux_default_grub:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:selinuxsecuritycontext_test id="oval:ssg-test_selinux_confinement_of_daemons:tst:1" version="2" check_existence="any_exist" check="none satisfy" comment="none satisfy unconfined_service_t in /proc">
                <lin-def:object object_ref="oval:ssg-object_selinux_confinement_of_daemons:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_selinux_confinement_of_daemons:ste:1"/>
              </lin-def:selinuxsecuritycontext_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_screensaver_mode_blank:tst:1" version="1" check_existence="all_exist" check="all" comment="screensaver mode is blank">
                <ind-def:object object_ref="oval:ssg-obj_screensaver_mode_blank:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_screensaver_lock_enabled:tst:1" version="1" check_existence="all_exist" check="all" comment="screensaver lock is enabled">
                <ind-def:object object_ref="oval:ssg-obj_screensaver_lock_enabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_screensaver_lock_delay_setting:tst:1" version="1" check_existence="all_exist" check="all" comment="screensaver lock delay setting is correct">
                <ind-def:object object_ref="oval:ssg-obj_screensaver_lock_delay_setting:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_screensaver_lock_delay_setting:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_screensaver_lock_delay:tst:1" version="1" check_existence="all_exist" check="all" comment="screensaver lock is set correctly">
                <ind-def:object object_ref="oval:ssg-obj_screensaver_lock_delay:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_screensaver_idle_delay_setting:tst:1" version="1" check_existence="all_exist" check="all" comment="screensaver idle delay setting is correct">
                <ind-def:object object_ref="oval:ssg-obj_screensaver_idle_delay_setting:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_screensaver_idle_delay_setting:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_screensaver_idle_delay:tst:1" version="1" check_existence="all_exist" check="all" comment="screensaver idle delay is configured">
                <ind-def:object object_ref="oval:ssg-obj_screensaver_idle_delay:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_screensaver_idle_activation_enabled:tst:1" version="1" check_existence="all_exist" check="all" comment="idle delay is configured">
                <ind-def:object object_ref="oval:ssg-obj_screensaver_idle_activation_enabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_screensaver_disable_user_info:tst:1" version="1" check_existence="all_exist" check="all" comment="screensaver user info is disabled">
                <ind-def:object object_ref="oval:ssg-obj_screensaver_disable_user_info:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:sysctl_test id="oval:ssg-test_runtime_sysctl_kernel_exec_shield:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.exec-shield set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_kernel_exec_shield:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_kernel_exec_shield:ste:1"/>
              </unix-def:sysctl_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rsyslog_remote_tls_cacert:tst:1" version="1" check="all" comment="tests the DefaultNetstreamDriverCAFile configuration">
                <ind-def:object object_ref="oval:ssg-obj_rsyslog_remote_tls_cacert:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rsyslog_remote_tls:tst:1" version="1" check="all" comment="tests the omfwd action configuration">
                <ind-def:object object_ref="oval:ssg-obj_rsyslog_remote_tls:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rsyslog_remote_tls:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rsyslog_nolisten:tst:1" version="1" check_existence="none_exist" check="all" comment="Ensure that the /etc/rsyslog.conf does not contain $InputTCPServerRun | $UDPServerRun | $InputRELPServerRun | $ModLoad imtcp | $ModLoad imudp | $ModLoad imrelp">
                <ind-def:object object_ref="oval:ssg-object_rsyslog_nolisten:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_rsyslog_files_permissions:tst:1" version="1" check_existence="all_exist" check="all" comment="Permissions of system log files are correct">
                <unix-def:object object_ref="oval:ssg-object_rsyslog_files_permissions:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_rsyslog_files_permissions:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_rsyslog_files_ownership:tst:1" version="1" check_existence="all_exist" check="all" comment="System log files are owned by the appropriate user">
                <unix-def:object object_ref="oval:ssg-object_rsyslog_files_ownership:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_rsyslog_files_ownership:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_rsyslog_files_groupownership:tst:1" version="1" check_existence="all_exist" check="all" comment="System log files are owned by the appropriate group">
                <unix-def:object object_ref="oval:ssg-object_rsyslog_files_groupownership:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_rsyslog_files_groupownership:ste:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf">
                <ind-def:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf">
                <ind-def:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf">
                <ind-def:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf">
                <ind-def:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf">
                <ind-def:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf">
                <ind-def:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhvh4_version:tst:1" version="1" check_existence="only_one_exists" check="all" comment="redhat-release-virtualization-host RPM package is installed">
                <lin-def:object object_ref="oval:ssg-obj_rhvh4_version:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhvh4_version:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhevm4_version:tst:1" version="1" check="all" comment="rhevm4-appliance is installed">
                <lin-def:object object_ref="oval:ssg-obj_rhevm4_version:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhevm4_version:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rhevh_rhel9_version:tst:1" version="1" check="all" comment="RHEVH base RHEL is version 9">
                <ind-def:object object_ref="oval:ssg-obj_rhevh_rhel9_version:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhevh_rhel9_version:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rhevh_rhel8_version:tst:1" version="1" check="all" comment="RHEVH base RHEL is version 8">
                <ind-def:object object_ref="oval:ssg-obj_rhevh_rhel8_version:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhevh_rhel8_version:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rhevh_rhel7_version:tst:1" version="1" check="all" comment="RHEVH base RHEL is version 7">
                <ind-def:object object_ref="oval:ssg-obj_rhevh_rhel7_version:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhevh_rhel7_version:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:family_test id="oval:ssg-test_rhel9_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_rhel9_unix_family:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhel9_unix_family:ste:1"/>
              </ind-def:family_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel9:tst:1" version="1" check="all" comment="redhat-release is version 9">
                <lin-def:object object_ref="oval:ssg-obj_rhel9:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel9:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:family_test id="oval:ssg-test_rhel8_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_rhel8_unix_family:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhel8_unix_family:ste:1"/>
              </ind-def:family_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_9:tst:1" version="1" check="all" comment="redhat-release is version 8.9">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_9:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_9:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_8:tst:1" version="1" check="all" comment="redhat-release is version 8.8">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_8:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_8:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_7:tst:1" version="1" check="all" comment="redhat-release is version 8.7">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_7:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_7:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_6:tst:1" version="1" check="all" comment="redhat-release is version 8.6">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_6:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_6:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_5:tst:1" version="1" check="all" comment="redhat-release is version 8.5">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_5:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_5:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_4:tst:1" version="1" check="all" comment="redhat-release is version 8.4">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_4:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_4:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_3:tst:1" version="1" check="all" comment="redhat-release is version 8.3">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_3:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_3:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_2:tst:1" version="1" check="all" comment="redhat-release is version 8.2">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_2:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_2:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_1:tst:1" version="1" check="all" comment="redhat-release is version 8.1">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_1:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_1:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_10:tst:1" version="1" check="all" comment="redhat-release is version 8.10">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_10:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_10:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_0:tst:1" version="1" check="all" comment="redhat-release is version 8.0">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_0:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_0:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8:tst:1" version="1" check="all" comment="redhat-release is version 8">
                <lin-def:object object_ref="oval:ssg-obj_rhel8:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel7_workstation:tst:1" version="1" check="all" comment="redhat-release-workstation is version 7">
                <lin-def:object object_ref="oval:ssg-obj_rhel7_workstation:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel7_workstation:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:family_test id="oval:ssg-test_rhel7_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_rhel7_unix_family:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhel7_unix_family:ste:1"/>
              </ind-def:family_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel7_server:tst:1" version="1" check="all" comment="redhat-release-server is version 7">
                <lin-def:object object_ref="oval:ssg-obj_rhel7_server:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel7_server:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel7_computenode:tst:1" version="1" check="all" comment="redhat-release-computenode is version 7">
                <lin-def:object object_ref="oval:ssg-obj_rhel7_computenode:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel7_computenode:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel7_client:tst:1" version="1" check="all" comment="redhat-release-client is version 7">
                <lin-def:object object_ref="oval:ssg-obj_rhel7_client:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel7_client:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rhcos:tst:1" version="1" check="all" comment="os-release is rhcos">
                <ind-def:object object_ref="oval:ssg-obj_rhcos:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhcos:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rhcos4:tst:1" version="1" check="all" comment="rhcoreos is version 4">
                <ind-def:object object_ref="oval:ssg-obj_rhcos4:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhcos4:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_requiretty_sudoers:tst:1" version="1" check="all" comment="requiretty exists in /etc/sudoers or /etc/sudoers.d/">
                <ind-def:object object_ref="oval:ssg-object_requiretty_sudoers:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_require_rescue_service_runlevel1:tst:1" version="1" check_existence="all_exist" check="all" comment="Tests that the systemd rescue.service is in the runlevel1.target">
                <ind-def:object object_ref="oval:ssg-obj_require_rescue_service_runlevel1:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_require_rescue_service:tst:1" version="1" check_existence="all_exist" check="all" comment="Tests that     /usr/lib/systemd/systemd-sulogin-shell     was not removed from the default systemd rescue.service to ensure that a   password must be entered to access single user mode">
                <ind-def:object object_ref="oval:ssg-obj_require_rescue_service:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_require_emergency_service_emergency_target:tst:1" version="1" check_existence="all_exist" check="all" comment="Tests that the systemd emergency.service is in the emergency.target">
                <ind-def:object object_ref="oval:ssg-obj_require_emergency_service_emergency:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_require_emergency_service:tst:1" version="1" check_existence="all_exist" check="all" comment="Tests that     /usr/lib/systemd/systemd-sulogin-shell     was not removed from the default systemd emergency.service to ensure that a   password must be entered to access single user mode">
                <ind-def:object object_ref="oval:ssg-obj_require_emergency_service:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_removable_partition_doesnt_exist:tst:1" version="1" check_existence="none_exist" check="all" comment="Check if expected removable partitions truly exist on the system">
                <unix-def:object object_ref="oval:ssg-object_removable_partition_doesnt_exist:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_remote_rsyslog_d:tst:1" version="1" check_existence="all_exist" check="all" comment="Ensures system configured to export logs to remote host">
                <ind-def:object object_ref="oval:ssg-object_remote_loghost_rsyslog_d:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_remote_rsyslog_conf:tst:1" version="1" check_existence="all_exist" check="all" comment="Ensures system configured to export logs to remote host">
                <ind-def:object object_ref="oval:ssg-object_remote_loghost_rsyslog_conf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_remote_method_monitoring_daemon:tst:1" version="1" check="all" comment="remote method daemon monitoring configured in rsyslog'">
                <ind-def:object object_ref="oval:ssg-obj_remote_method_monitoring_daemon:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_remote_method_monitoring_authpriv:tst:1" version="1" check="all" comment="remote method authpriv monitoring configured in rsyslog'">
                <ind-def:object object_ref="oval:ssg-obj_remote_method_monitoring_authpriv:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_remote_method_monitoring_auth:tst:1" version="1" check="all" comment="remote method auth monitoring configured in rsyslog'">
                <ind-def:object object_ref="oval:ssg-obj_remote_method_monitoring_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:interface_test id="oval:ssg-test_promisc_interfaces:tst:1" version="1" check="all" comment="check all network interfaces for PROMISC flag">
                <unix-def:object object_ref="oval:ssg-object_promisc_interfaces:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_promisc:ste:1"/>
              </unix-def:interface_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1" version="1" check_existence="all_exist" check="all" comment="proc_sys_kernel is for s390x architecture">
                <ind-def:object object_ref="oval:ssg-object_proc_sys_kernel_osrelease_arch_s390x:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_proc_sys_kernel_osrelease_arch_s390x:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_proc_sys_kernel_osrelease_arch_aarch64:tst:1" version="1" check_existence="all_exist" check="all" comment="proc_sys_kernel is for aarch64 architecture">
                <ind-def:object object_ref="oval:ssg-object_proc_sys_kernel_osrelease_arch_aarch64:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_proc_sys_kernel_osrelease_arch_aarch64:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_proc_sys_kernel_osrelease_64_bit:tst:1" version="1" check_existence="only_one_exists" check="all" comment="Check if kernel nvr arch is 64-bit">
                <ind-def:object object_ref="oval:ssg-object_proc_sys_kernel_osrelease_64_bit:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_proc_sys_kernel_osrelease_64_bit:ste:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:partition_test id="oval:ssg-test_proc_partition_hidepid_optional_no:tst:1" version="2" check_existence="all_exist" check="all" comment="hidepid on /proc optional no">
                <lin-def:object object_ref="oval:ssg-object_proc_partition_hidepid_optional_no:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_proc_partition_hidepid_optional_no:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_proc_no_partition_hidepid_optional_no:tst:1" version="1" check_existence="all_exist" check="all" comment="/proc exists">
                <lin-def:object object_ref="oval:ssg-object_proc_partition_hidepid_optional_no:obj:1"/>
              </lin-def:partition_test>
              <unix-def:file_test id="oval:ssg-test_proc_net_wireless_exists:tst:1" version="1" check_existence="all_exist" check="all" comment="Test if /proc/net/wireless exists">
                <unix-def:object object_ref="oval:ssg-object_proc_net_wireless_exists:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_proc_cpuinfo_64_bit:tst:1" version="1" check="all" comment="Check for CPU flag lm">
                <ind-def:object object_ref="oval:ssg-object_proc_cpuinfo_64_bit:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_proc_cpuinfo_64_bit:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_user-administration-disabled:tst:1" version="1" check_existence="all_exist" check="all" comment="Prevent user from modifying user-administration-disabled">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_user-administration-disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_sys_geolocation:tst:1" version="1" check_existence="all_exist" check="all" comment="Prevent enabling of system geolocation">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_sys_geolocation:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_screensaver_mode_change:tst:1" version="1" check_existence="all_exist" check="all" comment="blank screensaver cannot be changed by user">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_screensaver_mode_change:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_screensaver_lock_locked:tst:1" version="1" check_existence="all_exist" check="all" comment="screensaver lock cannot be changed by user">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_screensaver_lock_locked:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_screensaver_lock:tst:1" version="1" check_existence="all_exist" check="all" comment="screensaver lock cannot be changed by user">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_screensaver_lock:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_removal-action:tst:1" version="1" check_existence="all_exist" check="all" comment="Prevent user from modifying removal-action">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_removal-action:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_remote_access_encryption:tst:1" version="1" check_existence="all_exist" check="all" comment="prevent user from disabling remote access encryption">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_remote_access_encryption:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_remote_access_creds:tst:1" version="1" check_existence="all_exist" check="all" comment="prevent user from disabling remote access credential requirements">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_remote_access_creds:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_power_setting_change:tst:1" version="1" check_existence="all_exist" check="all" comment="Prevent enabling of power settings">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_power_setting_change:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_info_change:tst:1" version="1" check_existence="all_exist" check="all" comment="screensaver prevent user from changing">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_info_change:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_gnome_autorun:tst:1" version="1" check_existence="all_exist" check="all" comment="Prevent user from changing autorun setting">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_gnome_autorun:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_gnome_automount_open:tst:1" version="1" check_existence="all_exist" check="all" comment="Prevent user from changing automount-open setting">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_gnome_automount_open:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_gnome_automount:tst:1" version="1" check_existence="all_exist" check="all" comment="Prevent user from changing automount setting">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_gnome_automount:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_enable_wifi_notification:tst:1" version="1" check_existence="all_exist" check="all" comment="Prevent enabling of wifi notification capability">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_enable_wifi_notification:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_enable_wifi_creation:tst:1" version="1" check_existence="all_exist" check="all" comment="Prevent enabling of wifi creation capability">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_enable_wifi_creation:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_enable_restart_buttons:tst:1" version="1" check_existence="all_exist" check="all" comment="GUI restart and shutdown buttons cannot be enabled">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_enable_restart_buttons:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_enable_ctrlaltdel:tst:1" version="1" check_existence="all_exist" check="all" comment="Prevent enabling of ctrl-alt-del keys">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_enable_ctrlaltdel:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_disable_user_list:tst:1" version="1" check_existence="all_exist" check="all" comment="GUI user list cannot be enabled">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_disable_user_list:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_disable_smartcard:tst:1" version="1" check_existence="all_exist" check="all" comment="GUI smartcard authentication cannot be disabled">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_disable_smartcard:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_clock_geolocation:tst:1" version="1" check_existence="all_exist" check="all" comment="Prevent enabling of clock geolocation">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_clock_geolocation:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_change_idle_activation_locked:tst:1" version="1" check_existence="all_exist" check="all" comment="user cannot change idle_activation_locked">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_change_idle_activation_locked:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_change_idle_activation_enabled:tst:1" version="1" check_existence="all_exist" check="all" comment="user cannot change idle_activation_enabled">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_change_idle_activation_enabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_change_gnome_thumbnailers:tst:1" version="1" check_existence="all_exist" check="all" comment="user cannot enable thumbnailers ">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_change_gnome_thumbnailers:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_banner_gui_enabled_change:tst:1" version="1" check_existence="all_exist" check="all" comment="GUI banner cannot be changed by user">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_banner_gui_enabled_change:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_banner_change:tst:1" version="1" check_existence="all_exist" check="all" comment="GUI banner cannot be changed by user">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_banner_change:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_allowed-failures_change:tst:1" version="1" check_existence="all_exist" check="all" comment="number of login attempts cannot be changed">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_allowed-failures_change:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_postfix_client_configure_mail_alias:tst:1" version="1" check="all" comment="Check if root has the correct mail alias.">
                <ind-def:object object_ref="oval:ssg-obj_root_mail_alias:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_root_mail_alias:ste:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_perms_binary_files:tst:1" version="1" check_existence="none_exist" check="all" comment="binary files go-w">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_binary_files:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_permissions_systemmap_files:tst:1" version="1" check_existence="all_exist" check="all" comment="system.map files readable only by root">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_systemmap_files:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_owner_systemmap:ste:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_permissions_systemmap:ste:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_ucredit:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality_ucredit:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_ucredit:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_retry_system_auth:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality_retry_system_auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_retry_upper_bound:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_retry_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_retry_pwquality_conf:tst:1" version="1" check="all" comment="check the configuration of /etc/security/pwquality.conf">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality_retry_pwquality_conf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_retry_upper_bound:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_retry_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_ocredit:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality_ocredit:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_ocredit:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_minlen:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality_minlen:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_minlen:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_minclass:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality_minclass:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_minclass:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_maxrepeat:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality_maxrepeat:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_maxrepeat:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_maxclassrepeat:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality_maxclassrepeat:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_maxclassrepeat:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_maxclassrepeat_zero_comparison:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_lcredit:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality_lcredit:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_lcredit:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_difok:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality_difok:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_difok:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_dictcheck:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality_dictcheck:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_dictcheck:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_dcredit:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality_dcredit:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_dcredit:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_auth_pam_unix_rounds_is_set:tst:1" version="1" check_existence="all_exist" check="all" comment="Test if rounds attribute of pam_unix.so is set correctly in /etc/pam.d/password-auth ">
                <ind-def:object object_ref="oval:ssg-object_password_auth_pam_unix_rounds:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_auth_pam_unix_rounds:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_auth_pam_unix_rounds_is_default:tst:1" version="1" check_existence="none_exist" check="all" comment="Test if rounds attribute of pam_unix.so is not set in /etc/pam.d/password-auth ">
                <ind-def:object object_ref="oval:ssg-object_password_auth_pam_unix_rounds:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:variable_test id="oval:ssg-test_password_auth_default_pam_unix_rounds_var:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if value of var_password_pam_unix_rounds is the system's default">
                <ind-def:object object_ref="oval:ssg-object_password_auth_default_pam_unix_rounds_var:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_auth_default_pam_unix_rounds_var:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_pass_warn_age:tst:1" version="1" check="all" comment="The value of PASS_WARN_AGE should be set appropriately in /etc/login.defs">
                <ind-def:object object_ref="oval:ssg-object_last_pass_warn_age_instance_value:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_last_pass_warn_age_instance_value:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_pass_min_len:tst:1" version="1" check="all" comment="The value of PASS_MIN_LEN should be set appropriately in /etc/login.defs">
                <ind-def:object object_ref="oval:ssg-object_last_pass_min_len_instance_value:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_last_pass_min_len_instance_value:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_pass_min_days:tst:1" version="1" check="all" comment="The value of PASS_MIN_DAYS should be set appropriately in /etc/login.defs">
                <ind-def:object object_ref="oval:ssg-object_last_pass_min_days_instance_value:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_last_pass_min_days_instance_value:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_pass_max_days:tst:1" version="1" check="all" comment="The value of PASS_MAX_DAYS should be set appropriately in /etc/login.defs">
                <ind-def:object object_ref="oval:ssg-object_last_pass_max_days_instance_value:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_last_pass_max_days_instance_value:ste:1"/>
              </ind-def:variable_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_pam_unix_sha512:tst:1" version="1" check="all" comment="check /etc/pam.d/system-auth for correct settings">
                <ind-def:object object_ref="oval:ssg-object_pam_unix_sha512:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_pam_unix_passwordauth_sha512:tst:1" version="1" check="all" comment="check /etc/pam.d/password-auth for correct settings">
                <ind-def:object object_ref="oval:ssg-object_pam_unix_passwordauth_sha512:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_pam_pkcs11_cert_policy_ocsp_on:tst:1" version="1" check="at least one" comment="Test ocsp_on in /etc/pam_pkcs11/pkcs11.conf">
                <ind-def:object object_ref="oval:ssg-object_pam_pkcs11_cert_policy_ocsp_on:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_pam_pkcs11_cert_policy_ocsp_on:ste:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_xorg-x11-server-common_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package xorg-x11-server-common is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_xorg-x11-server-common_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_vsftpd_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package vsftpd is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_vsftpd_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_vsftpd_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package vsftpd is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_vsftpd_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_vim-enhanced_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package vim-enhanced is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_vim-enhanced_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_usbguard_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package usbguard is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_usbguard_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_tuned_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package tuned is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_tuned_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_tmux_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package tmux is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_tmux_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_telnetd_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package telnetd is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_telnetd_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_telnetd-ssl_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package telnetd-ssl is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_telnetd-ssl_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_tar_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package tar is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_tar_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_syslog-ng_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package syslog-ng is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_syslog-ng_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_sudo_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package sudo is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_sudo_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_sssd-ipa_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package sssd-ipa is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_sssd-ipa_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_setroubleshoot_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package setroubleshoot is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_setroubleshoot_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_setroubleshoot-server_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package setroubleshoot-server is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_setroubleshoot-server_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_setroubleshoot-plugins_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package setroubleshoot-plugins is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_setroubleshoot-plugins_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_sendmail_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package sendmail is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_sendmail_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_screen_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package screen is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_screen_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_scap-security-guide_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package scap-security-guide is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_scap-security-guide_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_samba-common_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package samba-common is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_samba-common_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_rsyslog_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package rsyslog is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_rsyslog_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_rsyslog-gnutls_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package rsyslog-gnutls is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_rsyslog-gnutls_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_rng-tools_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package rng-tools is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_rng-tools_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_rear_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package rear is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_rear_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_python3-abrt-addon_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package python3-abrt-addon is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_python3-abrt-addon_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_prelink_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package prelink is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_prelink_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_policycoreutils_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package policycoreutils is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_policycoreutils_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_pcsc-lite_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package pcsc-lite is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_pcsc-lite_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_pam_ldap_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package pam_ldap is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_pam_ldap_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_openssl-pkcs11_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package openssl-pkcs11 is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_openssl-pkcs11_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_openssh-server_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package openssh-server is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_openssh-server_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_openssh-server_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package openssh-server is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_openssh-server_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_openscap-scanner_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package openscap-scanner is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_openscap-scanner_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_opensc_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package opensc is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_opensc_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_openldap-clients_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package openldap-clients is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_openldap-clients_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_ntpdate_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package ntpdate is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_ntpdate_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_ntp_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package ntp is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_ntp_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_nss-tools_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package nss-tools is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_nss-tools_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_nis_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package nis is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_nis_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_nfs-utils_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package nfs-utils is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_nfs-utils_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_net-snmp_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package net-snmp is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_net-snmp_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_mcstrans_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package mcstrans is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_mcstrans_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_libselinux_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package libselinux is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_libselinux_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_libreswan_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package libreswan is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_libreswan_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_libreport-plugin-rhtsupport_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package libreport-plugin-rhtsupport is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_libreport-plugin-rhtsupport_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_libreport-plugin-logger_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package libreport-plugin-logger is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_libreport-plugin-logger_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_libcap-ng-utils_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package libcap-ng-utils is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_libcap-ng-utils_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_krb5-workstation_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package krb5-workstation is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_krb5-workstation_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_kernel-PAE_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="Package kernel-PAE is installed">
                <lin-def:object object_ref="oval:ssg-obj_package_kernel-PAE_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_iptables_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package iptables is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_iptables_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_iprutils_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package iprutils is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_iprutils_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_inetutils-telnetd_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package inetutils-telnetd is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_inetutils-telnetd_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_gssproxy_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package gssproxy is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_gssproxy_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_gpgkey-9867c58f-601c49ca_installed:tst:1" version="1" check="only one" comment="Fedora 9867c58f release key package is installed">
                <lin-def:object object_ref="oval:ssg-object_package_gpg-pubkey:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_package_gpg-pubkey-9867c58f-601c49ca:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_gpgkey-5323552a-6112bcdc_installed:tst:1" version="1" check="only one" comment="Fedora 5323552a release key package is installed">
                <lin-def:object object_ref="oval:ssg-object_package_gpg-pubkey:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_package_gpg-pubkey-5323552a-6112bcdc:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_gpgkey-45719a39-5f2c0192_installed:tst:1" version="1" check="only one" comment="Fedora 45719a39 release key package is installed">
                <lin-def:object object_ref="oval:ssg-object_package_gpg-pubkey:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_package_gpg-pubkey-45719a39-5f2c0192:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_gpgkey-38ab71f4-60242b08_installed:tst:1" version="1" check="only one" comment="Fedora 38ab71f4 release key package is installed">
                <lin-def:object object_ref="oval:ssg-object_package_gpg-pubkey:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_package_gpg-pubkey-38ab71f4-60242b08:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_gnutls-utils_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package gnutls-utils is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_gnutls-utils_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_geolite2-country_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package geolite2-country is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_geolite2-country_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_geolite2-city_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package geolite2-city is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_geolite2-city_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_gdm_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package gdm is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_gdm_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_gdm_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package gdm is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_gdm_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_fapolicyd_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package fapolicyd is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_fapolicyd_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_esc_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package esc is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_esc_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_dnf-automatic_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package dnf-automatic is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_dnf-automatic_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_dconf_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package dconf is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_dconf_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_cryptsetup-luks_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package cryptsetup-luks is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_cryptsetup-luks_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_cron_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package cron is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_cron_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_chrony_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package chrony is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_chrony_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_binutils_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package binutils is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_binutils_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_bind_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package bind is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_bind_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_avahi_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package avahi is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_avahi_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_audit_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package audit is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_audit_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_audit-audispd-plugins_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package audit-audispd-plugins is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_audit-audispd-plugins_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_audispd-plugins_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package audispd-plugins is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_audispd-plugins_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_aide_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package aide is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_aide_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_abrt_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package abrt is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_abrt_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_abrt-plugin-sosreport_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package abrt-plugin-sosreport is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_abrt-plugin-sosreport_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_abrt-plugin-rhtsupport_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package abrt-plugin-rhtsupport is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_abrt-plugin-rhtsupport_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_abrt-plugin-logger_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package abrt-plugin-logger is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_abrt-plugin-logger_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_abrt-cli_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package abrt-cli is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_abrt-cli_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_abrt-addon-kerneloops_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package abrt-addon-kerneloops is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_abrt-addon-kerneloops_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_abrt-addon-ccpp_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package abrt-addon-ccpp is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_abrt-addon-ccpp_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_MFEhiplsm_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package MFEhiplsm is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_MFEhiplsm_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_GConf2_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package GConf2 is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_GConf2_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <unix-def:file_test id="oval:ssg-test_ownership_var_log_audit_files:tst:1" version="1" check_existence="none_exist" check="all" comment="/var/log/audit files uid root gid root">
                <unix-def:object object_ref="oval:ssg-object_ownership_var_log_audit_files:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_ownership_var_log_audit_files-non_root:tst:1" version="1" check_existence="all_exist" check="all" comment="/var/log/audit files uid root gid root">
                <unix-def:object object_ref="oval:ssg-object_ownership_var_log_audit_files-non_root:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_ownership_var_log_audit_directories:tst:1" version="1" check_existence="none_exist" check="all" comment="/var/log/audit directories uid root gid root">
                <unix-def:object object_ref="oval:ssg-object_ownership_var_log_audit_directories:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_ownership_var_log_audit_directories-non_root:tst:1" version="1" check_existence="all_exist" check="all" comment="/var/log/audit directories uid root gid root">
                <unix-def:object object_ref="oval:ssg-object_ownership_var_log_audit_directories-non_root:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_ownership_binary_files:tst:1" version="1" check_existence="none_exist" check="all" comment="binary files uid root">
                <unix-def:object object_ref="oval:ssg-object_file_ownership_binary_files:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_ownership_binary_directories:tst:1" version="1" check_existence="none_exist" check="all" comment="binary directories uid root">
                <unix-def:object object_ref="oval:ssg-object_file_ownership_binary_directories:obj:1"/>
              </unix-def:file_test>
              <lin-def:partition_test id="oval:ssg-test_opt_partition_nosuid_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" comment="nosuid on /opt optional yes">
                <lin-def:object object_ref="oval:ssg-object_opt_partition_nosuid_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_opt_partition_nosuid_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:rpminfo_test id="oval:ssg-test_opensuse_leap42_installed:tst:1" version="1" check="all" comment="openSUSE Leap 42 is installed">
                <lin-def:object object_ref="oval:ssg-obj_opensuse_leap42_installed:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_opensuse_leap42_installed:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_opensuse_leap15_installed:tst:1" version="1" check="all" comment="openSUSE Leap 15 is installed">
                <lin-def:object object_ref="oval:ssg-obj_opensuse_leap15_installed:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_opensuse_leap15_installed:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_opensuse_installed:tst:1" version="1" check="all" comment="openSUSE is installed">
                <lin-def:object object_ref="oval:ssg-obj_opensuse_installed:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_opensuse_installed:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_openssh-server_version:tst:1" version="1" check="all" comment="OpenSSH is version 7.4 or higher">
                <lin-def:object object_ref="oval:ssg-obj_openssh-server_version:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_openssh-server_version:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_ol9_system:tst:1" version="1" check="all" comment="oraclelinux-release is version 9">
                <lin-def:object object_ref="oval:ssg-obj_ol9_system:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_ol9_system:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_ol8_system:tst:1" version="1" check="all" comment="oraclelinux-release is version 8">
                <lin-def:object object_ref="oval:ssg-obj_ol8_system:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_ol8_system:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_ol7_system:tst:1" version="1" check="all" comment="oraclelinux-release is version 7">
                <lin-def:object object_ref="oval:ssg-obj_ol7_system:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_ol7_system:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_nx_disabled_grub:tst:1" version="1" check_existence="none_exist" check="all" comment="NX is disabled">
                <ind-def:object object_ref="oval:ssg-object_nx_disabled_grub:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ntpd_run_as_ntp_user_systemd:tst:1" version="1" check="all" comment="check /usr/lib/systemd/system/ntpd.service">
                <ind-def:object object_ref="oval:ssg-obj_ntpd_run_as_ntp_user_systemd:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ntpd_run_as_ntp_user_etc_sysconfig_ntpd:tst:1" version="1" check="all" comment="check /etc/sysconfig/ntpd">
                <ind-def:object object_ref="oval:ssg-obj_ntpd_run_as_ntp_user_etc_sysconfig_ntpd:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ntpd_multiple_servers:tst:1" version="1" check_existence="all_exist" check="all" comment="Ensure more than one ntpd NTP server is set">
                <ind-def:object object_ref="oval:ssg-obj_ntpd_multiple_servers:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ntpd_configure_restrictions_ipv6:tst:1" version="1" check_existence="all_exist" check="all" comment="ensure ipv6 restrictions">
                <ind-def:object object_ref="oval:ssg-obj_ntpd_configure_restrictions_ipv6:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ntpd_configure_restrictions_ipv4:tst:1" version="1" check_existence="all_exist" check="all" comment="ensure ipv4 restrictions">
                <ind-def:object object_ref="oval:ssg-obj_ntpd_configure_restrictions_ipv4:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ntp_set_maxpoll:tst:1" version="1" check_existence="all_exist" check="all" comment="check if maxpoll is set in /etc/ntp.conf">
                <ind-def:object object_ref="oval:ssg-obj_ntp_set_maxpoll:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_time_service_set_maxpoll:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ntp_remote_server:tst:1" version="1" check="all" comment="Ensure at least one ntpd NTP server is set">
                <ind-def:object object_ref="oval:ssg-obj_ntp_remote_server:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ntp_no_server:tst:1" version="1" check_existence="none_exist" check="all" comment="check if no server entries in /etc/ntp.conf">
                <ind-def:object object_ref="oval:ssg-obj_ntp_no_server_nor_pool:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ntp_all_server_has_maxpoll:tst:1" version="1" check_existence="all_exist" check="all" comment="check if all server entries have maxpoll set in /etc/ntp.conf">
                <ind-def:object object_ref="oval:ssg-obj_ntp_all_server_has_maxpoll:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_server_has_maxpoll:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_nosuid_etc_fstab_not_cd_dvd_drive:tst:1" version="1" check_existence="all_exist" check="at least one" comment="Check if removable partition is configured with 'nosuid' mount option in /etc/fstab">
                <ind-def:object object_ref="oval:ssg-object_nosuid_etc_fstab_not_cd_dvd_drive:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_nosuid_etc_fstab_not_cd_dvd_drive:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_nosuid_etc_fstab_cd_dvd_drive:tst:1" version="1" check_existence="any_exist" check="all" comment="'nosuid' mount option used for at least one CD / DVD drive alternative names in /etc/fstab">
                <ind-def:object object_ref="oval:ssg-object_nosuid_etc_fstab_cd_dvd_drive:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_nosuid_etc_fstab_cd_dvd_drive:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_nopasswd_etc_sudoers_d:tst:1" version="1" check_existence="none_exist" check="all" comment="NOPASSWD does not exist in /etc/sudoers.d">
                <ind-def:object object_ref="oval:ssg-object_nopasswd_etc_sudoers_d:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_nopasswd_etc_sudoers:tst:1" version="1" check_existence="none_exist" check="all" comment="NOPASSWD does not exist /etc/sudoers">
                <ind-def:object object_ref="oval:ssg-object_nopasswd_etc_sudoers:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_noexec_sudoers:tst:1" version="1" check="all" comment="noexec exists in /etc/sudoers or /etc/sudoers.d/">
                <ind-def:object object_ref="oval:ssg-object_noexec_sudoers:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_noexec_etc_fstab_not_cd_dvd_drive:tst:1" version="1" check_existence="all_exist" check="at least one" comment="Check if removable partition is configured with 'noexec' mount option in /etc/fstab">
                <ind-def:object object_ref="oval:ssg-object_noexec_etc_fstab_not_cd_dvd_drive:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_noexec_etc_fstab_not_cd_dvd_drive:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_noexec_etc_fstab_cd_dvd_drive:tst:1" version="1" check_existence="any_exist" check="all" comment="'noexec' mount option used for at least one CD / DVD drive alternative names in /etc/fstab">
                <ind-def:object object_ref="oval:ssg-object_noexec_etc_fstab_cd_dvd_drive:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_noexec_etc_fstab_cd_dvd_drive:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_noexec_cmd_line:tst:1" version="1" check_existence="none_exist" check="all" comment="NX is not disabled in the kernel command line">
                <ind-def:object object_ref="oval:ssg-obj_noexec_cmd_line:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:partition_test id="oval:ssg-test_nodev_nonroot_local_partitions:tst:1" version="1" check_existence="all_exist" check="all" comment="nodev on local filesystems">
                <lin-def:object object_ref="oval:ssg-object_non_root_partitions:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_local_nodev:ste:1"/>
              </lin-def:partition_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_nodev_etc_fstab_not_cd_dvd_drive:tst:1" version="1" check_existence="all_exist" check="at least one" comment="Check if removable partition is configured with 'nodev' mount option in /etc/fstab">
                <ind-def:object object_ref="oval:ssg-object_nodev_etc_fstab_not_cd_dvd_drive:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_nodev_etc_fstab_not_cd_dvd_drive:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_nodev_etc_fstab_cd_dvd_drive:tst:1" version="1" check_existence="any_exist" check="all" comment="'nodev' mount option used for at least one CD / DVD drive alternative names in /etc/fstab">
                <ind-def:object object_ref="oval:ssg-object_nodev_etc_fstab_cd_dvd_drive:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_nodev_etc_fstab_cd_dvd_drive:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_user_spec_rules:tst:1" version="1" check_existence="none_exist" check="all" comment="make sure that all user specs in sudoers feature a runas spec">
                <ind-def:object object_ref="oval:ssg-object_no_runas_spec:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_tmux_in_shells:tst:1" version="1" check_existence="none_exist" check="all" comment="check that tmux is not listed in /etc/shells">
                <ind-def:object object_ref="oval:ssg-obj_no_tmux_in_shells:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_no_rsh_trust_files_root:tst:1" version="1" check="all" comment="look for .rhosts in /root">
                <unix-def:object object_ref="oval:ssg-object_no_rsh_trust_files_root:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_no_rsh_trust_files_home:tst:1" version="1" check="all" comment="look for .rhosts in /home">
                <unix-def:object object_ref="oval:ssg-object_no_rsh_trust_files_home:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_no_rsh_trust_files_etc:tst:1" version="1" check="all" comment="look for /etc/hosts.equiv">
                <unix-def:object object_ref="oval:ssg-object_no_rsh_trust_files_etc:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_root_or_ALL_in_runas_spec:tst:1" version="1" check_existence="none_exist" check="all" comment="Make sure that no user spec in sudoers has a runas spec that includes root or ALL">
                <ind-def:object object_ref="oval:ssg-root_or_ALL_in_runas_spec:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_no_netrc_files_home:tst:1" version="1" check="all" comment="look for .netrc in /home">
                <unix-def:object object_ref="oval:ssg-object_no_netrc_files_home:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_legacy_plus_entries_etc_shadow:tst:1" version="1" check_existence="none_exist" check="all" comment="check for existence of lines starting with +">
                <ind-def:object object_ref="oval:ssg-object_no_legacy_plus_entries_etc_shadow:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_legacy_plus_entries_etc_passwd:tst:1" version="1" check_existence="none_exist" check="all" comment="check for existence of lines starting with +">
                <ind-def:object object_ref="oval:ssg-object_no_legacy_plus_entries_etc_passwd:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_legacy_plus_entries_etc_group:tst:1" version="1" check_existence="none_exist" check="all" comment="check for existence of lines starting with +">
                <ind-def:object object_ref="oval:ssg-object_no_legacy_plus_entries_etc_group:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_insecure_locks_exports:tst:1" version="1" check_existence="none_exist" check="all" comment="Tests the value of the insecure locks in /etc/exports">
                <ind-def:object object_ref="oval:ssg-obj_no_insecure_locks_exports:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_empty_passwords_etc_shadow:tst:1" version="1" check_existence="none_exist" check="all" comment="make sure there aren't blank or null passwords in /etc/shadow">
                <ind-def:object object_ref="oval:ssg-obj_no_empty_passwords_etc_shadow:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_empty_passwords:tst:1" version="1" check_existence="none_exist" check="all" comment="make sure nullok is not used in /etc/pam.d/system-auth">
                <ind-def:object object_ref="oval:ssg-object_no_empty_passwords:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_direct_root_logins:tst:1" version="1" check_existence="all_exist" check="all" comment="no entries in /etc/securetty">
                <ind-def:object object_ref="oval:ssg-object_no_direct_root_logins:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_no_custom_runlevel1_target:tst:1" version="1" check="all" comment="look for runlevel1.target in /etc/systemd/system">
                <unix-def:object object_ref="oval:ssg-object_no_custom_runlevel1_target:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_no_custom_rescue_service:tst:1" version="1" check="all" comment="look for rescue.service in /etc/systemd/system">
                <unix-def:object object_ref="oval:ssg-object_no_custom_rescue_service:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_no_custom_emergency_target:tst:1" version="1" check="all" comment="look for emergency.target in /etc/systemd/system">
                <unix-def:object object_ref="oval:ssg-object_no_custom_emergency_target:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_no_custom_emergency_service:tst:1" version="1" check="all" comment="look for emergency.service in /etc/systemd/system">
                <unix-def:object object_ref="oval:ssg-object_no_custom_emergency_service:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_cd_dvd_drive_in_etc_fstab:tst:1" version="1" check_existence="none_exist" check="all" comment="'CD/DVD drive is not listed in /etc/fstab">
                <ind-def:object object_ref="oval:ssg-object_no_cd_dvd_drive_in_etc_fstab:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_authenticate_etc_sudoers_d:tst:1" version="1" check_existence="none_exist" check="all" comment="!authenticate does not exist in /etc/sudoers.d">
                <ind-def:object object_ref="oval:ssg-object_no_authenticate_etc_sudoers_d:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_authenticate_etc_sudoers:tst:1" version="1" check_existence="none_exist" check="all" comment="!authenticate does not exist in /etc/sudoers">
                <ind-def:object object_ref="oval:ssg-object_no_authenticate_etc_sudoers:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_network_nmcli_permissions:tst:1" version="1" check_existence="all_exist" check="all" comment="polkit is properly configured to prevent non-privilged users from changing networking settings">
                <ind-def:object object_ref="oval:ssg-object_network_nmcli_permissions:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_network_nmcli_permissions:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_network_ipv6_static_address:tst:1" version="1" check_existence="all_exist" check="all" comment="Set static IPv6 address on each interface">
                <ind-def:object object_ref="oval:ssg-obj_network_ipv6_static_address:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_network_ipv6_privacy_extensions:tst:1" version="1" check_existence="all_exist" check="all" comment="Enable privacy extensions on each interface">
                <ind-def:object object_ref="oval:ssg-obj_network_ipv6_privacy_extensions:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_network_ipv6_disable_rpc_udp6:tst:1" version="1" check_existence="none_exist" check="all" comment="Test for udp6 based rpc services">
                <ind-def:object object_ref="oval:ssg-obj_network_ipv6_disable_rpc_udp6:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_network_ipv6_disable_rpc_tcp6:tst:1" version="1" check_existence="none_exist" check="all" comment="Test for tcp6 based rpc services">
                <ind-def:object object_ref="oval:ssg-obj_network_ipv6_disable_rpc_tcp6:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_network_ipv6_default_gateway:tst:1" version="1" check_existence="all_exist" check="all" comment="Define default gateways">
                <ind-def:object object_ref="oval:ssg-obj_network_ipv6_default_gateway:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_usbguard_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_usbguard_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_usbguard_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_usbguard:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_usbguard_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_usbguard_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_syslog-ng_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_syslog-ng_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_syslog-ng_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_syslog-ng:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_syslog-ng_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_syslog-ng_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_rsyslog_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_rsyslog_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_rsyslog_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_rsyslog:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_rsyslog_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_rsyslog_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_rngd_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_rngd_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_rngd_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_rngd:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_rngd_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_rngd_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_pcscd_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_pcscd_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_pcscd_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_pcscd:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_pcscd_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_pcscd_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_ntpd_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_ntpd_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_ntpd_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_ntpd:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_ntpd_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_ntpd_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_ntp_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_ntp_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_ntp_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_ntp:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_ntp_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_ntp_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_iptables_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_iptables_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_iptables_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_iptables:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_iptables_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_iptables_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_ip6tables_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_ip6tables_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_ip6tables_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_ip6tables:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_ip6tables_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_ip6tables_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_firewalld_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_firewalld_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_firewalld_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_firewalld:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_firewalld_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_firewalld_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_dnf-automatic:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_dnf-automatic_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_dnf-automatic_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_crond_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_crond_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_crond_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_crond:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_crond_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_crond_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_cron_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_cron_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_cron_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_cron:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_cron_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_cron_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_chronyd_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_chronyd_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_chronyd_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_chronyd:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_chronyd_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_chronyd_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_auditd_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_auditd_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_auditd_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_auditd:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_auditd_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_auditd_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:partition_test id="oval:ssg-test_mount_option_var_tmp_bind_compare_source:tst:1" version="1" check="all" comment="Ensure /var/tmp and /tmp have the same source device">
                <lin-def:object object_ref="oval:ssg-object_mount_option_var_tmp_bind_compare_source:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_mount_option_var_tmp_bind_compare_source:ste:1"/>
              </lin-def:partition_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_mount_option_var_tmp_bind:tst:1" version="1" check="all" comment="Ensure bind mount option is on /var/tmp">
                <ind-def:object object_ref="oval:ssg-object_mount_option_var_tmp_bind:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:partition_test id="oval:ssg-test_mount_option_var_tmp:tst:1" version="1" check="all" comment="Ensure /var/tmp is mounted">
                <lin-def:object object_ref="oval:ssg-object_mount_option_var_tmp:obj:1"/>
              </lin-def:partition_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_messages_nx_active:tst:1" version="1" check_existence="none_exist" check="all" comment="No log messages about NX being disabled">
                <ind-def:object object_ref="oval:ssg-obj_messages_nx_active:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpminfo_test id="oval:ssg-test_mcafee_runtime_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="Runtime Libraries package is installed">
                <lin-def:object object_ref="oval:ssg-obj_mcafee_runtime_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_mcafee_management_agent:tst:1" version="1" check_existence="all_exist" check="all" comment="Agent package is installed">
                <lin-def:object object_ref="oval:ssg-obj_mcafee_management_agent:obj:1"/>
              </lin-def:rpminfo_test>
              <unix-def:file_test id="oval:ssg-test_mcafee_auditengine_exists:tst:1" version="1" check_existence="all_exist" check="all" comment="McAfee Policy Auditor installed">
                <unix-def:object object_ref="oval:ssg-object_mcafee_auditengine_exists:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_mcafee_accm_exists:tst:1" version="1" check_existence="all_exist" check="all" comment="McAfee ACCM installed">
                <unix-def:object object_ref="oval:ssg-object_mcafee_accm_exists:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_maxlogins:tst:1" version="1" check="all" comment="the value maxlogins should be set appropriately in /etc/security/limits.conf">
                <ind-def:object object_ref="oval:ssg-object_etc_security_limits_conf_maxlogins:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_maxlogins:ste:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_lsb:tst:1" version="1" check_existence="all_exist" check="all" comment="/etc/lsb-release exists">
                <unix-def:object object_ref="oval:ssg-obj_lsb:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_logwatch_configured_splithosts:tst:1" version="1" check_existence="all_exist" check="all" comment="Test SplitHosts">
                <ind-def:object object_ref="oval:ssg-object_logwatch_configured_splithosts:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_logwatch_configured_hostlimit:tst:1" version="1" check_existence="all_exist" check="all" comment="Test HostLimit">
                <ind-def:object object_ref="oval:ssg-object_logwatch_configured_hostlimit:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_logrotate_conf_no_other_keyword:tst:1" version="1" check_existence="none_exist" check="all" comment="Test if there is no weekly/monthly/yearly keyword">
                <ind-def:object object_ref="oval:ssg-object_logrotate_conf_no_other_keyword:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_logrotate_conf_daily_setting:tst:1" version="1" check_existence="all_exist" check="all" comment="Tests the presence of daily setting in /etc/logrotate.conf file">
                <ind-def:object object_ref="oval:ssg-object_logrotate_conf_daily_setting:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_logfile_sudoers:tst:1" version="1" check="all" comment="logfile exists in /etc/sudoers or /etc/sudoers.d/">
                <ind-def:object object_ref="oval:ssg-object_logfile_sudoers:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_logfile_sudoers:ste:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpminfo_test id="oval:ssg-test_linuxshield_install_antivirus:tst:1" version="1" check_existence="all_exist" check="all" comment="AntiVirus package is installed">
                <lin-def:object object_ref="oval:ssg-obj_linuxshield_install_antivirus:obj:1"/>
              </lin-def:rpminfo_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_limitsd_maxlogins_exists:tst:1" version="1" check="all" comment="the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_etc_security_limitsd_conf_maxlogins_exists:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_limitsd_maxlogins:tst:1" version="1" check="all" comment="the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_etc_security_limitsd_conf_maxlogins:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_maxlogins:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_runmodules-load:tst:1" version="1" check="all" comment="kernel module vfat disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_vfat_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_runmodprobed:tst:1" version="1" check="all" comment="kernel module vfat disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_vfat_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_modprobeconf:tst:1" version="1" check="all" comment="kernel module vfat disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_vfat_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_libmodules-load:tst:1" version="1" check="all" comment="kernel module vfat disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_vfat_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_libmodprobed:tst:1" version="1" check="all" comment="kernel module vfat disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_vfat_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_etcmodules-load:tst:1" version="1" check="all" comment="kernel module vfat disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_vfat_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_disabled:tst:1" version="1" check="all" comment="kernel module vfat disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_vfat_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_runmodules-load:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_usb-storage_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_runmodprobed:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_usb-storage_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_modprobeconf:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_usb-storage_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_libmodules-load:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_usb-storage_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_libmodprobed:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_usb-storage_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_etcmodules-load:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_usb-storage_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_disabled:tst:1" version="1" check="all" comment="kernel module usb-storage disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_usb-storage_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_udf_runmodules-load:tst:1" version="1" check="all" comment="kernel module udf disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_udf_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_udf_runmodprobed:tst:1" version="1" check="all" comment="kernel module udf disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_udf_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_udf_modprobeconf:tst:1" version="1" check="all" comment="kernel module udf disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_udf_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_udf_libmodules-load:tst:1" version="1" check="all" comment="kernel module udf disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_udf_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_udf_libmodprobed:tst:1" version="1" check="all" comment="kernel module udf disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_udf_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_udf_etcmodules-load:tst:1" version="1" check="all" comment="kernel module udf disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_udf_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_udf_disabled:tst:1" version="1" check="all" comment="kernel module udf disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_udf_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_runmodules-load:tst:1" version="1" check="all" comment="kernel module tipc disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_tipc_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_runmodprobed:tst:1" version="1" check="all" comment="kernel module tipc disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_tipc_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_modprobeconf:tst:1" version="1" check="all" comment="kernel module tipc disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_tipc_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_libmodules-load:tst:1" version="1" check="all" comment="kernel module tipc disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_tipc_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_libmodprobed:tst:1" version="1" check="all" comment="kernel module tipc disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_tipc_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_etcmodules-load:tst:1" version="1" check="all" comment="kernel module tipc disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_tipc_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_disabled:tst:1" version="1" check="all" comment="kernel module tipc disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_tipc_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_runmodules-load:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_squashfs_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_runmodprobed:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_squashfs_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_modprobeconf:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_squashfs_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_libmodules-load:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_squashfs_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_libmodprobed:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_squashfs_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_etcmodules-load:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_squashfs_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_disabled:tst:1" version="1" check="all" comment="kernel module squashfs disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_squashfs_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_rds_runmodules-load:tst:1" version="1" check="all" comment="kernel module rds disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_rds_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_rds_runmodprobed:tst:1" version="1" check="all" comment="kernel module rds disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_rds_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_rds_modprobeconf:tst:1" version="1" check="all" comment="kernel module rds disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_rds_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_rds_libmodules-load:tst:1" version="1" check="all" comment="kernel module rds disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_rds_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_rds_libmodprobed:tst:1" version="1" check="all" comment="kernel module rds disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_rds_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_rds_etcmodules-load:tst:1" version="1" check="all" comment="kernel module rds disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_rds_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_rds_disabled:tst:1" version="1" check="all" comment="kernel module rds disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_rds_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_mac80211_runmodules-load:tst:1" version="1" check="all" comment="kernel module mac80211 disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_mac80211_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_mac80211_runmodprobed:tst:1" version="1" check="all" comment="kernel module mac80211 disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_mac80211_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_mac80211_modprobeconf:tst:1" version="1" check="all" comment="kernel module mac80211 disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_mac80211_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_mac80211_libmodules-load:tst:1" version="1" check="all" comment="kernel module mac80211 disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_mac80211_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_mac80211_libmodprobed:tst:1" version="1" check="all" comment="kernel module mac80211 disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_mac80211_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_mac80211_etcmodules-load:tst:1" version="1" check="all" comment="kernel module mac80211 disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_mac80211_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_mac80211_disabled:tst:1" version="1" check="all" comment="kernel module mac80211 disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_mac80211_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_runmodules-load:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_jffs2_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_runmodprobed:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_jffs2_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_modprobeconf:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_jffs2_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_libmodules-load:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_jffs2_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_libmodprobed:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_jffs2_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_etcmodules-load:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_jffs2_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_disabled:tst:1" version="1" check="all" comment="kernel module jffs2 disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_jffs2_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_iwlwifi_runmodules-load:tst:1" version="1" check="all" comment="kernel module iwlwifi disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_iwlwifi_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_iwlwifi_runmodprobed:tst:1" version="1" check="all" comment="kernel module iwlwifi disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_iwlwifi_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_iwlwifi_modprobeconf:tst:1" version="1" check="all" comment="kernel module iwlwifi disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_iwlwifi_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_iwlwifi_libmodules-load:tst:1" version="1" check="all" comment="kernel module iwlwifi disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_iwlwifi_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_iwlwifi_libmodprobed:tst:1" version="1" check="all" comment="kernel module iwlwifi disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_iwlwifi_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_iwlwifi_etcmodules-load:tst:1" version="1" check="all" comment="kernel module iwlwifi disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_iwlwifi_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_iwlwifi_disabled:tst:1" version="1" check="all" comment="kernel module iwlwifi disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_iwlwifi_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_iwlmvm_runmodules-load:tst:1" version="1" check="all" comment="kernel module iwlmvm disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_iwlmvm_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_iwlmvm_runmodprobed:tst:1" version="1" check="all" comment="kernel module iwlmvm disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_iwlmvm_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_iwlmvm_modprobeconf:tst:1" version="1" check="all" comment="kernel module iwlmvm disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_iwlmvm_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_iwlmvm_libmodules-load:tst:1" version="1" check="all" comment="kernel module iwlmvm disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_iwlmvm_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_iwlmvm_libmodprobed:tst:1" version="1" check="all" comment="kernel module iwlmvm disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_iwlmvm_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_iwlmvm_etcmodules-load:tst:1" version="1" check="all" comment="kernel module iwlmvm disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_iwlmvm_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_iwlmvm_disabled:tst:1" version="1" check="all" comment="kernel module iwlmvm disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_iwlmvm_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_runmodules-load:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfsplus_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_runmodprobed:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfsplus_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_modprobeconf:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfsplus_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_libmodules-load:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfsplus_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_libmodprobed:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfsplus_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_etcmodules-load:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfsplus_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_disabled:tst:1" version="1" check="all" comment="kernel module hfsplus disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfsplus_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_runmodules-load:tst:1" version="1" check="all" comment="kernel module hfs disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfs_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_runmodprobed:tst:1" version="1" check="all" comment="kernel module hfs disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfs_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_modprobeconf:tst:1" version="1" check="all" comment="kernel module hfs disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfs_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_libmodules-load:tst:1" version="1" check="all" comment="kernel module hfs disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfs_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_libmodprobed:tst:1" version="1" check="all" comment="kernel module hfs disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfs_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_etcmodules-load:tst:1" version="1" check="all" comment="kernel module hfs disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfs_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_disabled:tst:1" version="1" check="all" comment="kernel module hfs disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfs_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_runmodules-load:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_freevxfs_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_runmodprobed:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_freevxfs_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_modprobeconf:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_freevxfs_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_libmodules-load:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_freevxfs_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_libmodprobed:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_freevxfs_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_etcmodules-load:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_freevxfs_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_disabled:tst:1" version="1" check="all" comment="kernel module freevxfs disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_freevxfs_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_runmodules-load:tst:1" version="1" check="all" comment="kernel module firewire-core disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_firewire-core_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_runmodprobed:tst:1" version="1" check="all" comment="kernel module firewire-core disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_firewire-core_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_modprobeconf:tst:1" version="1" check="all" comment="kernel module firewire-core disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_firewire-core_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_libmodules-load:tst:1" version="1" check="all" comment="kernel module firewire-core disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_firewire-core_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_libmodprobed:tst:1" version="1" check="all" comment="kernel module firewire-core disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_firewire-core_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_etcmodules-load:tst:1" version="1" check="all" comment="kernel module firewire-core disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_firewire-core_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_disabled:tst:1" version="1" check="all" comment="kernel module firewire-core disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_firewire-core_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_runmodules-load:tst:1" version="1" check="all" comment="kernel module dccp disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_dccp_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_runmodprobed:tst:1" version="1" check="all" comment="kernel module dccp disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_dccp_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_modprobeconf:tst:1" version="1" check="all" comment="kernel module dccp disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_dccp_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_libmodules-load:tst:1" version="1" check="all" comment="kernel module dccp disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_dccp_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_libmodprobed:tst:1" version="1" check="all" comment="kernel module dccp disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_dccp_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_etcmodules-load:tst:1" version="1" check="all" comment="kernel module dccp disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_dccp_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_disabled:tst:1" version="1" check="all" comment="kernel module dccp disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_dccp_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_runmodules-load:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_cramfs_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_runmodprobed:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_cramfs_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_modprobeconf:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_cramfs_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_libmodules-load:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_cramfs_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_libmodprobed:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_cramfs_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_etcmodules-load:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_cramfs_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_disabled:tst:1" version="1" check="all" comment="kernel module cramfs disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_cramfs_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_cfg80211_runmodules-load:tst:1" version="1" check="all" comment="kernel module cfg80211 disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_cfg80211_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_cfg80211_runmodprobed:tst:1" version="1" check="all" comment="kernel module cfg80211 disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_cfg80211_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_cfg80211_modprobeconf:tst:1" version="1" check="all" comment="kernel module cfg80211 disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_cfg80211_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_cfg80211_libmodules-load:tst:1" version="1" check="all" comment="kernel module cfg80211 disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_cfg80211_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_cfg80211_libmodprobed:tst:1" version="1" check="all" comment="kernel module cfg80211 disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_cfg80211_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_cfg80211_etcmodules-load:tst:1" version="1" check="all" comment="kernel module cfg80211 disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_cfg80211_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_cfg80211_disabled:tst:1" version="1" check="all" comment="kernel module cfg80211 disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_cfg80211_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_can_runmodules-load:tst:1" version="1" check="all" comment="kernel module can disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_can_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_can_runmodprobed:tst:1" version="1" check="all" comment="kernel module can disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_can_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_can_modprobeconf:tst:1" version="1" check="all" comment="kernel module can disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_can_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_can_libmodules-load:tst:1" version="1" check="all" comment="kernel module can disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_can_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_can_libmodprobed:tst:1" version="1" check="all" comment="kernel module can disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_can_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_can_etcmodules-load:tst:1" version="1" check="all" comment="kernel module can disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_can_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_can_disabled:tst:1" version="1" check="all" comment="kernel module can disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_can_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_runmodules-load:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_bluetooth_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_runmodprobed:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_bluetooth_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_modprobeconf:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_bluetooth_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_libmodules-load:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_bluetooth_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_libmodprobed:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_bluetooth_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_etcmodules-load:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_bluetooth_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_disabled:tst:1" version="1" check="all" comment="kernel module bluetooth disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_bluetooth_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_atm_runmodules-load:tst:1" version="1" check="all" comment="kernel module atm disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_atm_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_atm_runmodprobed:tst:1" version="1" check="all" comment="kernel module atm disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_atm_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_atm_modprobeconf:tst:1" version="1" check="all" comment="kernel module atm disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_atm_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_atm_libmodules-load:tst:1" version="1" check="all" comment="kernel module atm disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_atm_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_atm_libmodprobed:tst:1" version="1" check="all" comment="kernel module atm disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_atm_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_atm_etcmodules-load:tst:1" version="1" check="all" comment="kernel module atm disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_atm_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_atm_disabled:tst:1" version="1" check="all" comment="kernel module atm disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_atm_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_module_ipv6_option_disabled:tst:1" version="1" check="all" comment="ipv6 disabled any modprobe conf file">
                <ind-def:object object_ref="oval:ssg-object_kernel_module_ipv6_option_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_x86_vsyscall_emulation_absence:tst:1" version="1" check_existence="none_exist" check="all" comment="Check /boot/config-.* files for absence of CONFIG_X86_VSYSCALL_EMULATION">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_x86_vsyscall_emulation:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_x86_vsyscall_emulation:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_X86_VSYSCALL_EMULATION=n">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_x86_vsyscall_emulation:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_x86_vsyscall_emulation:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_vmap_stack:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_VMAP_STACK=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_vmap_stack:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_vmap_stack:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_unmap_kernel_at_el0:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_UNMAP_KERNEL_AT_EL0=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_unmap_kernel_at_el0:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_unmap_kernel_at_el0:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_syn_cookies:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_SYN_COOKIES=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_syn_cookies:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_syn_cookies:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_strict_module_rwx:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_STRICT_MODULE_RWX=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_strict_module_rwx:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_strict_module_rwx:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_strict_kernel_rwx:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_STRICT_KERNEL_RWX=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_strict_kernel_rwx:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_strict_kernel_rwx:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_stackprotector_strong:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_STACKPROTECTOR_STRONG=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_stackprotector_strong:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_stackprotector_strong:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_stackprotector:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_STACKPROTECTOR=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_stackprotector:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_stackprotector:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_slub_debug:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_SLUB_DEBUG=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_slub_debug:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_slub_debug:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_slab_merge_default_absence:tst:1" version="1" check_existence="none_exist" check="all" comment="Check /boot/config-.* files for absence of CONFIG_SLAB_MERGE_DEFAULT">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_slab_merge_default:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_slab_merge_default:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_SLAB_MERGE_DEFAULT=n">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_slab_merge_default:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_slab_merge_default:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_slab_frelist_random:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_SLAB_FRELIST_RANDOM=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_slab_frelist_random:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_slab_frelist_random:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_slab_freelist_hardened:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_SLAB_FREELIST_HARDENED=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_slab_freelist_hardened:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_slab_freelist_hardened:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_security_yama:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_SECURITY_YAMA=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_security_yama:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_security_yama:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_security_writable_hooks:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_SECURITY_WRITABLE_HOOKS=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_security_writable_hooks:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_security_writable_hooks:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_security_dmesg_restrict_absence:tst:1" version="1" check_existence="none_exist" check="all" comment="Check /boot/config-.* files for absence of CONFIG_SECURITY_DMESG_RESTRICT">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_security_dmesg_restrict:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_security_dmesg_restrict:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_SECURITY_DMESG_RESTRICT=n">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_security_dmesg_restrict:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_security_dmesg_restrict:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_security:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_SECURITY=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_security:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_security:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_seccomp_filter:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_SECCOMP_FILTER=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_seccomp_filter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_seccomp_filter:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_seccomp:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_SECCOMP=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_seccomp:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_seccomp:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_sched_stack_end_check:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_SCHED_STACK_END_CHECK=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_sched_stack_end_check:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_sched_stack_end_check:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_retpoline:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_RETPOLINE=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_retpoline:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_retpoline:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_refcount_full:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_REFCOUNT_FULL=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_refcount_full:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_refcount_full:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_randomize_memory:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_RANDOMIZE_MEMORY=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_randomize_memory:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_randomize_memory:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_randomize_base:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_RANDOMIZE_BASE=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_randomize_base:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_randomize_base:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_proc_kcore_absence:tst:1" version="1" check_existence="none_exist" check="all" comment="Check /boot/config-.* files for absence of CONFIG_PROC_KCORE">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_proc_kcore:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_proc_kcore:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_PROC_KCORE=n">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_proc_kcore:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_proc_kcore:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_panic_timeout:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_PANIC_TIMEOUT according to var_kernel_config_panic_timeout">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_panic_timeout:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_panic_timeout:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_panic_on_oops:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_PANIC_ON_OOPS=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_panic_on_oops:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_panic_on_oops:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_page_table_isolation:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_PAGE_TABLE_ISOLATION=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_page_table_isolation:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_page_table_isolation:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_page_poisoning_zero:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_PAGE_POISONING_ZERO=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_page_poisoning_zero:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_page_poisoning_zero:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_page_poisoning_no_sanity:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_PAGE_POISONING_NO_SANITY=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_page_poisoning_no_sanity:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_page_poisoning_no_sanity:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_page_poisoning:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_PAGE_POISONING=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_page_poisoning:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_page_poisoning:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_module_sig_sha512:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_MODULE_SIG_SHA512=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_module_sig_sha512:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_module_sig_sha512:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_module_sig_key:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_MODULE_SIG_KEY according to var_kernel_config_module_sig_key">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_module_sig_key:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_module_sig_key:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_module_sig_hash:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_MODULE_SIG_HASH according to var_kernel_config_module_sig_hash">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_module_sig_hash:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_module_sig_hash:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_module_sig_force:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_MODULE_SIG_FORCE=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_module_sig_force:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_module_sig_force:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_module_sig_all:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_MODULE_SIG_ALL=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_module_sig_all:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_module_sig_all:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_module_sig:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_MODULE_SIG=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_module_sig:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_module_sig:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_modify_ldt_syscall_absence:tst:1" version="1" check_existence="none_exist" check="all" comment="Check /boot/config-.* files for absence of CONFIG_MODIFY_LDT_SYSCALL">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_modify_ldt_syscall:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_modify_ldt_syscall:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_MODIFY_LDT_SYSCALL=n">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_modify_ldt_syscall:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_modify_ldt_syscall:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_legacy_vsyscall_xonly_absence:tst:1" version="1" check_existence="none_exist" check="all" comment="Check /boot/config-.* files for absence of CONFIG_LEGACY_VSYSCALL_XONLY">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_xonly:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_legacy_vsyscall_xonly:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_LEGACY_VSYSCALL_XONLY=n">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_xonly:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_legacy_vsyscall_xonly:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_legacy_vsyscall_none:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_LEGACY_VSYSCALL_NONE=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_none:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_legacy_vsyscall_none:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_legacy_vsyscall_emulate_absence:tst:1" version="1" check_existence="none_exist" check="all" comment="Check /boot/config-.* files for absence of CONFIG_LEGACY_VSYSCALL_EMULATE">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_emulate:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_legacy_vsyscall_emulate:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_LEGACY_VSYSCALL_EMULATE=n">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_emulate:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_legacy_vsyscall_emulate:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_legacy_ptys_absence:tst:1" version="1" check_existence="none_exist" check="all" comment="Check /boot/config-.* files for absence of CONFIG_LEGACY_PTYS">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_legacy_ptys:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_legacy_ptys:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_LEGACY_PTYS=n">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_legacy_ptys:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_legacy_ptys:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_kexec_absence:tst:1" version="1" check_existence="none_exist" check="all" comment="Check /boot/config-.* files for absence of CONFIG_KEXEC">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_kexec:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_kexec:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_KEXEC=n">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_kexec:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_kexec:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_ipv6_absence:tst:1" version="1" check_existence="none_exist" check="all" comment="Check /boot/config-.* files for absence of CONFIG_IPV6">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_ipv6:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_ipv6:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_IPV6=n">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_ipv6:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_ipv6:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_ia32_emulation_absence:tst:1" version="1" check_existence="none_exist" check="all" comment="Check /boot/config-.* files for absence of CONFIG_IA32_EMULATION">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_ia32_emulation:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_ia32_emulation:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_IA32_EMULATION=n">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_ia32_emulation:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_ia32_emulation:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_hibernation_absence:tst:1" version="1" check_existence="none_exist" check="all" comment="Check /boot/config-.* files for absence of CONFIG_HIBERNATION">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_hibernation:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_hibernation:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_HIBERNATION=n">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_hibernation:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_hibernation:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_hardened_usercopy_fallback_absence:tst:1" version="1" check_existence="none_exist" check="all" comment="Check /boot/config-.* files for absence of CONFIG_HARDENED_USERCOPY_FALLBACK">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_hardened_usercopy_fallback:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_hardened_usercopy_fallback:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_HARDENED_USERCOPY_FALLBACK=n">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_hardened_usercopy_fallback:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_hardened_usercopy_fallback:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_hardened_usercopy:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_HARDENED_USERCOPY=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_hardened_usercopy:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_hardened_usercopy:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_gcc_plugin_structleak_byref_all:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_gcc_plugin_structleak_byref_all:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_gcc_plugin_structleak_byref_all:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_gcc_plugin_structleak:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_GCC_PLUGIN_STRUCTLEAK=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_gcc_plugin_structleak:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_gcc_plugin_structleak:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_gcc_plugin_stackleak:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_GCC_PLUGIN_STACKLEAK=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_gcc_plugin_stackleak:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_gcc_plugin_stackleak:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_gcc_plugin_randstruct:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_GCC_PLUGIN_RANDSTRUCT=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_gcc_plugin_randstruct:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_gcc_plugin_randstruct:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_gcc_plugin_latent_entropy:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_gcc_plugin_latent_entropy:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_gcc_plugin_latent_entropy:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_fortify_source:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_FORTIFY_SOURCE=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_fortify_source:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_fortify_source:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_devkmem_absence:tst:1" version="1" check_existence="none_exist" check="all" comment="Check /boot/config-.* files for absence of CONFIG_DEVKMEM">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_devkmem:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_devkmem:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_DEVKMEM=n">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_devkmem:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_devkmem:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_default_mmap_min_addr:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_DEFAULT_MMAP_MIN_ADDR=65536">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_default_mmap_min_addr:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_default_mmap_min_addr:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_debug_wx:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_DEBUG_WX=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_debug_wx:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_debug_wx:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_debug_sg:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_DEBUG_SG=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_debug_sg:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_debug_sg:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_debug_notifiers:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_DEBUG_NOTIFIERS=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_debug_notifiers:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_debug_notifiers:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_debug_list:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_DEBUG_LIST=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_debug_list:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_debug_list:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_debug_fs_absence:tst:1" version="1" check_existence="none_exist" check="all" comment="Check /boot/config-.* files for absence of CONFIG_DEBUG_FS">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_debug_fs:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_debug_fs:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_DEBUG_FS=n">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_debug_fs:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_debug_fs:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_debug_credentials:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_DEBUG_CREDENTIALS=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_debug_credentials:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_debug_credentials:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_compat_vdso_absence:tst:1" version="1" check_existence="none_exist" check="all" comment="Check /boot/config-.* files for absence of CONFIG_COMPAT_VDSO">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_compat_vdso:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_compat_vdso:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_COMPAT_VDSO=n">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_compat_vdso:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_compat_vdso:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_compat_brk_absence:tst:1" version="1" check_existence="none_exist" check="all" comment="Check /boot/config-.* files for absence of CONFIG_COMPAT_BRK">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_compat_brk:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_compat_brk:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_COMPAT_BRK=n">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_compat_brk:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_compat_brk:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_bug_on_data_corruption:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_BUG_ON_DATA_CORRUPTION=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_bug_on_data_corruption:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_bug_on_data_corruption:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_bug:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_BUG=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_bug:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_bug:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_binfmt_misc_absence:tst:1" version="1" check_existence="none_exist" check="all" comment="Check /boot/config-.* files for absence of CONFIG_BINFMT_MISC">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_binfmt_misc:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_binfmt_misc:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_BINFMT_MISC=n">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_binfmt_misc:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_binfmt_misc:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_arm64_sw_ttbr0_pan:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_ARM64_SW_TTBR0_PAN=y">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_arm64_sw_ttbr0_pan:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_arm64_sw_ttbr0_pan:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_acpi_custom_method_absence:tst:1" version="1" check_existence="none_exist" check="all" comment="Check /boot/config-.* files for absence of CONFIG_ACPI_CUSTOM_METHOD">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_acpi_custom_method:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_config_acpi_custom_method:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_ACPI_CUSTOM_METHOD=n">
                <ind-def:object object_ref="oval:ssg-object_kernel_config_acpi_custom_method:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_kernel_config_acpi_custom_method:ste:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_kerberos_disable_no_keytab:tst:1" version="1" check_existence="none_exist" check="all" comment="Ensure keytab file does not exist">
                <unix-def:object object_ref="oval:ssg-obj_kerberos_disable_no_keytab:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_installed_env_is_a_podman_container:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if /run/.containerenv exists">
                <unix-def:object object_ref="oval:ssg-object_installed_env_is_a_podman_container:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_installed_env_is_a_docker_container:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if /.dockerenv exists">
                <unix-def:object object_ref="oval:ssg-object_installed_env_is_a_docker_container:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_id_provider_is_set_to_ad:tst:1" version="1" check_existence="all_exist" check="all" comment="SSSD Configuration is set to use Active Directory">
                <ind-def:object object_ref="oval:ssg-object_id_provider_is_set_to_ad:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:partition_test id="oval:ssg-test_home_partition_noexec_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" comment="noexec on /home optional yes">
                <lin-def:object object_ref="oval:ssg-object_home_partition_noexec_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_home_partition_noexec_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_harden_sshd_macs_openssh_conf_crypto_policy:tst:1" version="1" check="all" comment="test the value of MACs setting in the /etc/crypto-policies/back-ends/openssh.config file">
                <ind-def:object object_ref="oval:ssg-obj_harden_sshd_macs_openssh_conf_crypto_policy:obj:1"/>
                <ind-def:state state_ref="oval:ssg-ste_harden_sshd_macs_openssh_conf_crypto_policy:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_harden_sshd_crypto_policy:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of CRYPTO_POLICY setting in the /etc/crypto-policies/back-ends/opensshserver.config file">
                <ind-def:object object_ref="oval:ssg-obj_harden_sshd_crypto_policy:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_harden_sshd_crypto_policy:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_harden_sshd_ciphers_openssh_conf_crypto_policy:tst:1" version="1" check="all" comment="test the value of Ciphers setting in the /etc/crypto-policies/back-ends/openssh.config file">
                <ind-def:object object_ref="oval:ssg-obj_harden_sshd_ciphers_openssh_conf_crypto_policy:obj:1"/>
                <ind-def:state state_ref="oval:ssg-ste_harden_sshd_ciphers_openssh_conf_crypto_policy:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_harden_ssh_client_crypto_policy_RekeyLimit:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the absence of RekeyLimit setting in the /etc/ssh/ssh_config.d/02-ospp.conf file">
                <ind-def:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_RekeyLimit:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_RekeyLimit:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the absence of PubkeyAcceptedKeyTypes setting in the /etc/ssh/ssh_config.d/02-ospp.conf file">
                <ind-def:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_harden_ssh_client_crypto_policy_Match:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the absence of Match setting in the /etc/ssh/ssh_config.d/02-ospp.conf file">
                <ind-def:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_Match:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_Match:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_harden_ssh_client_crypto_policy_MACs:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the absence of MACs setting in the /etc/ssh/ssh_config.d/02-ospp.conf file">
                <ind-def:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_MACs:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_MACs:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_harden_ssh_client_crypto_policy_KexAlgorithms:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the absence of KexAlgorithms setting in the /etc/ssh/ssh_config.d/02-ospp.conf file">
                <ind-def:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_KexAlgorithms:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_KexAlgorithms:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_harden_ssh_client_crypto_policy_GSSAPIAuthentication:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the absence of GSSAPIAuthentication setting in the /etc/ssh/ssh_config.d/02-ospp.conf file">
                <ind-def:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_GSSAPIAuthentication:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_GSSAPIAuthentication:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_harden_ssh_client_crypto_policy_Ciphers:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the absence of Ciphers setting in the /etc/ssh/ssh_config.d/02-ospp.conf file">
                <ind-def:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_Ciphers:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_Ciphers:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_vsyscall_argument_default:tst:1" version="1" check_existence="all_exist" check="all" comment="check for vsyscall=none in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT">
                <ind-def:object object_ref="oval:ssg-object_grub2_vsyscall_argument_default:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_vsyscall_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_vsyscall_argument:tst:1" version="1" check_existence="all_exist" check="all" comment="check for vsyscall=none in /etc/default/grub via GRUB_CMDLINE_LINUX">
                <ind-def:object object_ref="oval:ssg-object_grub2_vsyscall_argument:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_vsyscall_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_uefi_password_usercfg:tst:1" version="1" check_existence="all_exist" check="all" comment="make sure a password is defined in /boot/grub2/user.cfg">
                <ind-def:object object_ref="oval:ssg-object_grub2_uefi_password_usercfg:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_spectre_v2_argument_default:tst:1" version="1" check_existence="all_exist" check="all" comment="check for spectre_v2=on in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT">
                <ind-def:object object_ref="oval:ssg-object_grub2_spectre_v2_argument_default:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_spectre_v2_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_spectre_v2_argument:tst:1" version="1" check_existence="all_exist" check="all" comment="check for spectre_v2=on in /etc/default/grub via GRUB_CMDLINE_LINUX">
                <ind-def:object object_ref="oval:ssg-object_grub2_spectre_v2_argument:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_spectre_v2_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_spec_store_bypass_disable_argument_default:tst:1" version="1" check_existence="all_exist" check="all" comment="check for spec_store_bypass_disable in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT">
                <ind-def:object object_ref="oval:ssg-object_grub2_spec_store_bypass_disable_argument_default:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_spec_store_bypass_disable_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_spec_store_bypass_disable_argument:tst:1" version="1" check_existence="all_exist" check="all" comment="check for spec_store_bypass_disable in /etc/default/grub via GRUB_CMDLINE_LINUX">
                <ind-def:object object_ref="oval:ssg-object_grub2_spec_store_bypass_disable_argument:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_spec_store_bypass_disable_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_slub_debug_argument_default:tst:1" version="1" check_existence="all_exist" check="all" comment="check for slub_debug in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT">
                <ind-def:object object_ref="oval:ssg-object_grub2_slub_debug_argument_default:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_slub_debug_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_slub_debug_argument:tst:1" version="1" check_existence="all_exist" check="all" comment="check for slub_debug in /etc/default/grub via GRUB_CMDLINE_LINUX">
                <ind-def:object object_ref="oval:ssg-object_grub2_slub_debug_argument:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_slub_debug_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_slab_nomerge_argument_default:tst:1" version="1" check_existence="all_exist" check="all" comment="check for slab_nomerge=yes in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT">
                <ind-def:object object_ref="oval:ssg-object_grub2_slab_nomerge_argument_default:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_slab_nomerge_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_slab_nomerge_argument:tst:1" version="1" check_existence="all_exist" check="all" comment="check for slab_nomerge=yes in /etc/default/grub via GRUB_CMDLINE_LINUX">
                <ind-def:object object_ref="oval:ssg-object_grub2_slab_nomerge_argument:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_slab_nomerge_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_rng_core_default_quality_argument_default:tst:1" version="1" check_existence="all_exist" check="all" comment="check for rng_core.default_quality in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT">
                <ind-def:object object_ref="oval:ssg-object_grub2_rng_core_default_quality_argument_default:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_rng_core_default_quality_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_rng_core_default_quality_argument:tst:1" version="1" check_existence="all_exist" check="all" comment="check for rng_core.default_quality in /etc/default/grub via GRUB_CMDLINE_LINUX">
                <ind-def:object object_ref="oval:ssg-object_grub2_rng_core_default_quality_argument:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_rng_core_default_quality_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_pti_argument_default:tst:1" version="1" check_existence="all_exist" check="all" comment="check for pti=on in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT">
                <ind-def:object object_ref="oval:ssg-object_grub2_pti_argument_default:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_pti_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_pti_argument:tst:1" version="1" check_existence="all_exist" check="all" comment="check for pti=on in /etc/default/grub via GRUB_CMDLINE_LINUX">
                <ind-def:object object_ref="oval:ssg-object_grub2_pti_argument:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_pti_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_password_usercfg:tst:1" version="1" check_existence="all_exist" check="all" comment="make sure a password is defined in /boot/grub2/user.cfg">
                <ind-def:object object_ref="oval:ssg-object_grub2_password_usercfg:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_password_grubcfg:tst:1" version="1" check_existence="all_exist" check="all" comment="make sure a password is defined in /boot/grub2/grub.cfg">
                <ind-def:object object_ref="oval:ssg-object_grub2_password_grubcfg:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_page_poison_argument_default:tst:1" version="1" check_existence="all_exist" check="all" comment="check for page_poison=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT">
                <ind-def:object object_ref="oval:ssg-object_grub2_page_poison_argument_default:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_page_poison_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_page_poison_argument:tst:1" version="1" check_existence="all_exist" check="all" comment="check for page_poison=1 in /etc/default/grub via GRUB_CMDLINE_LINUX">
                <ind-def:object object_ref="oval:ssg-object_grub2_page_poison_argument:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_page_poison_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_nousb_argument:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of GRUB_CMDLINE_LINUX setting in the /etc/default/grub file">
                <ind-def:object object_ref="oval:ssg-obj_grub2_nousb_argument:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_nousb_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_nosmep_argument_absent_default:tst:1" version="1" check_existence="all_exist" check="all" comment="check for absence nosmep in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT">
                <ind-def:object object_ref="oval:ssg-object_grub2_nosmep_argument_absent_default:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_nosmep_argument_absent:tst:1" version="1" check_existence="all_exist" check="all" comment="check for absence nosmep in /etc/default/grub via GRUB_CMDLINE_LINUX">
                <ind-def:object object_ref="oval:ssg-object_grub2_nosmep_argument_absent:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_nosmap_argument_absent_default:tst:1" version="1" check_existence="all_exist" check="all" comment="check for absence nosmap in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT">
                <ind-def:object object_ref="oval:ssg-object_grub2_nosmap_argument_absent_default:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_nosmap_argument_absent:tst:1" version="1" check_existence="all_exist" check="all" comment="check for absence nosmap in /etc/default/grub via GRUB_CMDLINE_LINUX">
                <ind-def:object object_ref="oval:ssg-object_grub2_nosmap_argument_absent:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_mds_argument_default:tst:1" version="1" check_existence="all_exist" check="all" comment="check for mds in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT">
                <ind-def:object object_ref="oval:ssg-object_grub2_mds_argument_default:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_mds_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_mds_argument:tst:1" version="1" check_existence="all_exist" check="all" comment="check for mds in /etc/default/grub via GRUB_CMDLINE_LINUX">
                <ind-def:object object_ref="oval:ssg-object_grub2_mds_argument:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_mds_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_mce_argument_default:tst:1" version="1" check_existence="all_exist" check="all" comment="check for mce=0 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT">
                <ind-def:object object_ref="oval:ssg-object_grub2_mce_argument_default:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_mce_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_mce_argument:tst:1" version="1" check_existence="all_exist" check="all" comment="check for mce=0 in /etc/default/grub via GRUB_CMDLINE_LINUX">
                <ind-def:object object_ref="oval:ssg-object_grub2_mce_argument:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_mce_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_l1tf_argument_default:tst:1" version="1" check_existence="all_exist" check="all" comment="check for l1tf in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT">
                <ind-def:object object_ref="oval:ssg-object_grub2_l1tf_argument_default:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_l1tf_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_l1tf_argument:tst:1" version="1" check_existence="all_exist" check="all" comment="check for l1tf in /etc/default/grub via GRUB_CMDLINE_LINUX">
                <ind-def:object object_ref="oval:ssg-object_grub2_l1tf_argument:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_l1tf_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_ipv6_disable_argument_default:tst:1" version="1" check_existence="all_exist" check="all" comment="check for ipv6.disable=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT">
                <ind-def:object object_ref="oval:ssg-object_grub2_ipv6_disable_argument_default:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_ipv6_disable_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_ipv6_disable_argument:tst:1" version="1" check_existence="all_exist" check="all" comment="check for ipv6.disable=1 in /etc/default/grub via GRUB_CMDLINE_LINUX">
                <ind-def:object object_ref="oval:ssg-object_grub2_ipv6_disable_argument:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_ipv6_disable_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_iommu_argument_default:tst:1" version="1" check_existence="all_exist" check="all" comment="check for iommu=force in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT">
                <ind-def:object object_ref="oval:ssg-object_grub2_iommu_argument_default:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_iommu_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_iommu_argument:tst:1" version="1" check_existence="all_exist" check="all" comment="check for iommu=force in /etc/default/grub via GRUB_CMDLINE_LINUX">
                <ind-def:object object_ref="oval:ssg-object_grub2_iommu_argument:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_iommu_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_entries_reference_kernelopts:tst:1" version="1" check_existence="all_exist" check="all" comment="check kernel command line parameters for referenced boot entries reference the $kernelopts variable.">
                <ind-def:object object_ref="oval:ssg-object_grub2_entries_reference_kernelopts:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux_default:tst:1" version="1" check_existence="none_exist" check="all" comment="Check systemd.confirm_spawn=(1|true|yes|on) not in GRUB_CMDLINE_LINUX_DEFAULT">
                <ind-def:object object_ref="oval:ssg-object_grub2_disable_interactive_boot_grub_cmdline_linux_default:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux:tst:1" version="1" check_existence="none_exist" check="all" comment="Check systemd.confirm_spawn=(1|true|yes|on) not in GRUB_CMDLINE_LINUX">
                <ind-def:object object_ref="oval:ssg-object_grub2_disable_interactive_boot_grub_cmdline_linux:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_default_exists:tst:1" version="1" check_existence="all_exist" check="all" comment="check for GRUB_CMDLINE_LINUX_DEFAULT in /etc/default/grub">
                <ind-def:object object_ref="oval:ssg-object_grub2_default_exists:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_audit_backlog_limit_argument_default:tst:1" version="1" check_existence="all_exist" check="all" comment="check for audit_backlog_limit=8192 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT">
                <ind-def:object object_ref="oval:ssg-object_grub2_audit_backlog_limit_argument_default:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_audit_backlog_limit_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_audit_backlog_limit_argument:tst:1" version="1" check_existence="all_exist" check="all" comment="check for audit_backlog_limit=8192 in /etc/default/grub via GRUB_CMDLINE_LINUX">
                <ind-def:object object_ref="oval:ssg-object_grub2_audit_backlog_limit_argument:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_audit_backlog_limit_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_audit_argument_default:tst:1" version="1" check_existence="all_exist" check="all" comment="check for audit=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT">
                <ind-def:object object_ref="oval:ssg-object_grub2_audit_argument_default:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_audit_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_audit_argument:tst:1" version="1" check_existence="all_exist" check="all" comment="check for audit=1 in /etc/default/grub via GRUB_CMDLINE_LINUX">
                <ind-def:object object_ref="oval:ssg-object_grub2_audit_argument:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_audit_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_groupownership_system_commands_dirs:tst:1" version="1" check_existence="none_exist" check="all" comment="system commands are owned by root">
                <unix-def:object object_ref="oval:ssg-object_groupownership_system_commands_dirs:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_gnome_gdm_disable_xdmcp_config_file_exists:tst:1" version="1" check_existence="all_exist" check="all" comment="The configuration file /etc/gdm/custom.conf exists for gnome_gdm_disable_xdmcp">
                <unix-def:object object_ref="oval:ssg-obj_gnome_gdm_disable_xdmcp_config_file:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_gnome_gdm_disable_xdmcp:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of Enable setting in the /etc/gdm/custom.conf file">
                <ind-def:object object_ref="oval:ssg-obj_gnome_gdm_disable_xdmcp:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_gnome_gdm_disable_xdmcp:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_gnome_disable_thumbnailers:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable thumbnailers in GNOME3">
                <ind-def:object object_ref="oval:ssg-obj_gnome_disable_thumbnailers:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_gid_passwd_group_same:tst:1" version="1" check_existence="all_exist" check="all" comment="Verify all GIDs referenced in /etc/passwd are defined in /etc/group">
                <ind-def:object object_ref="oval:ssg-object_gid_passwd_group_same:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_gid_passwd_group_same:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_gdm_login_banner_text_setting:tst:1" version="1" check_existence="all_exist" check="all" comment="login banner text is correctly set">
                <ind-def:object object_ref="oval:ssg-obj_gdm_login_banner_text_setting:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_gdm_login_banner_text_setting:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ftp_present_banner:tst:1" version="1" check_existence="all_exist" check="all" comment="Banner for FTP Users">
                <ind-def:object object_ref="oval:ssg-object_test_ftp_present_banner:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ftp_log_transactions_protocol:tst:1" version="1" check_existence="all_exist" check="all" comment="log ftp transactions">
                <ind-def:object object_ref="oval:ssg-object_test_ftp_log_transactions_protocol:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ftp_log_transactions_format:tst:1" version="1" check_existence="all_exist" check="all" comment="log ftp transactions">
                <ind-def:object object_ref="oval:ssg-object_test_ftp_log_transactions_format:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ftp_log_transactions_enable:tst:1" version="1" check_existence="all_exist" check="all" comment="log ftp transactions">
                <ind-def:object object_ref="oval:ssg-object_test_ftp_log_transactions_enable:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_force_opensc_card_drivers:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that force_card_driver is configured for opensc">
                <ind-def:object object_ref="oval:ssg-object_force_opensc_card_drivers:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_force_opensc_card_drivers:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_firewalld_input_drop:tst:1" version="1" check_existence="all_exist" check="all" comment="Check /etc/firewalld/firewalld.conf DefaultZone for drop">
                <ind-def:object object_ref="oval:ssg-obj_firewalld_input_drop:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpmverifyfile_test id="oval:ssg-test_files_fail_md5_hash:tst:1" version="1" check_existence="none_exist" check="all" comment="verify file md5 hashes">
                <lin-def:object object_ref="oval:ssg-object_files_fail_md5_hash:obj:1"/>
              </lin-def:rpmverifyfile_test>
              <unix-def:file_test id="oval:ssg-test_file_permissionsdir_permissions_library_dirs_3:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /usr/lib64/">
                <unix-def:object object_ref="oval:ssg-object_file_permissionsdir_permissions_library_dirs_3:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissionsdir_permissions_library_dirs_2:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /usr/lib/">
                <unix-def:object object_ref="oval:ssg-object_file_permissionsdir_permissions_library_dirs_2:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissionsdir_permissions_library_dirs_1:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /lib64/">
                <unix-def:object object_ref="oval:ssg-object_file_permissionsdir_permissions_library_dirs_1:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissionsdir_permissions_library_dirs_0:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /lib/">
                <unix-def:object object_ref="oval:ssg-object_file_permissionsdir_permissions_library_dirs_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_5:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /usr/local/sbin/">
                <unix-def:object object_ref="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_5:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_4:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /usr/local/bin/">
                <unix-def:object object_ref="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_4:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_3:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /usr/sbin/">
                <unix-def:object object_ref="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_3:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_2:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /usr/bin/">
                <unix-def:object object_ref="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_2:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_1:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /sbin/">
                <unix-def:object object_ref="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_1:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_0:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /bin/">
                <unix-def:object object_ref="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_var_log_syslog_0:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /var/log/syslog">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_var_log_syslog_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_var_log_messages_0:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /var/log/messages">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_var_log_messages_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_var_log_audit:tst:1" version="1" check="all" comment="/var/log/audit files mode 0600">
                <unix-def:object object_ref="oval:ssg-object_var_log_audit_files:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_not_mode_0600:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_var_log_audit-non_root:tst:1" version="1" check="all" comment="/var/log/audit files mode 0640">
                <unix-def:object object_ref="oval:ssg-object_var_log_audit_files-non_root:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_not_mode_0640:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_var_log_0:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /var/log/">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_var_log_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_ungroupowned:tst:1" version="1" check_existence="none_exist" check="all" comment="files with no group owner">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_ungroupowned:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_unauthorized_world_write:tst:1" version="1" check_existence="none_exist" check="all" comment="world writable files">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_unauthorized_world_write:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_unauthorized_suid:tst:1" version="1" check_existence="none_exist" check="all" comment="suid files outside system RPMs">
                <unix-def:object object_ref="oval:ssg-obj_file_permissions_unauthorized_suid_unowned:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_unauthorized_sgid:tst:1" version="1" check_existence="none_exist" check="all" comment="sgid files outside system RPMs">
                <unix-def:object object_ref="oval:ssg-obj_file_permissions_unauthorized_sgid_unowned:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_sshd_pub_key_0:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /etc/ssh/">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_sshd_pub_key_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_sshd_private_key_0:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /etc/ssh/">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_sshd_private_key_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_library_dirs_3:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /usr/lib64/">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_library_dirs_3:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_library_dirs_2:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /usr/lib/">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_library_dirs_2:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_library_dirs_1:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /lib64/">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_library_dirs_1:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_library_dirs_0:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /lib/">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_library_dirs_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_home_dirs:tst:1" version="1" check_existence="any_exist" check="all" comment="All home directories have proper permissions">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_home_dirs_dirs:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_permissions_home_dirs_dirs:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_grub2_cfg_0:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /boot/grub2/grub.cfg">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_grub2_cfg_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_etc_shadow_0:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /etc/shadow">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_etc_shadow_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_etc_passwd_0:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /etc/passwd">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_etc_passwd_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_etc_motd_0:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /etc/motd">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_etc_motd_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_etc_issue_0:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /etc/issue">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_etc_issue_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_etc_gshadow_0:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /etc/gshadow">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_etc_gshadow_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_etc_group_0:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /etc/group">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_etc_group_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_etc_audit_rulesd_0:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /etc/audit/rules.d/">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_etc_audit_rulesd_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_etc_audit_auditd_0:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /etc/audit/auditd.conf">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_etc_audit_auditd_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_efi_grub2_cfg_0:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /boot/grub2/grub.cfg">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_efi_grub2_cfg_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_backup_etc_shadow_0:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /etc/shadow-">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_backup_etc_shadow_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_backup_etc_passwd_0:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /etc/passwd-">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_backup_etc_passwd_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_backup_etc_gshadow_0:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /etc/gshadow-">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_backup_etc_gshadow_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_backup_etc_group_0:tst:1" version="3" check_existence="none_exist" check="all" comment="Testing mode of /etc/group-">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_backup_etc_group_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_audit_log:tst:1" version="1" check="all" comment="audit log files mode 0600">
                <unix-def:object object_ref="oval:ssg-object_audit_log_files:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_not_mode_0600:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_audit_log-non_root:tst:1" version="1" check="all" comment="audit log files mode 0640">
                <unix-def:object object_ref="oval:ssg-object_audit_log_files-non_root:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_not_mode_0640:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_ownership_library_dirs_3:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /usr/lib64/">
                <unix-def:object object_ref="oval:ssg-object_file_ownership_library_dirs_3:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_ownership_library_dirs_2:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /usr/lib/">
                <unix-def:object object_ref="oval:ssg-object_file_ownership_library_dirs_2:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_ownership_library_dirs_1:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /lib64/">
                <unix-def:object object_ref="oval:ssg-object_file_ownership_library_dirs_1:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_ownership_library_dirs_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /lib/">
                <unix-def:object object_ref="oval:ssg-object_file_ownership_library_dirs_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_ownership_audit_configuration_1:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /etc/audit/rules.d/">
                <unix-def:object object_ref="oval:ssg-object_file_ownership_audit_configuration_1:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_ownership_audit_configuration_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /etc/audit/">
                <unix-def:object object_ref="oval:ssg-object_file_ownership_audit_configuration_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_ownerdir_ownership_library_dirs_3:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /usr/lib64/">
                <unix-def:object object_ref="oval:ssg-object_file_ownerdir_ownership_library_dirs_3:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_ownerdir_ownership_library_dirs_2:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /usr/lib/">
                <unix-def:object object_ref="oval:ssg-object_file_ownerdir_ownership_library_dirs_2:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_ownerdir_ownership_library_dirs_1:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /lib64/">
                <unix-def:object object_ref="oval:ssg-object_file_ownerdir_ownership_library_dirs_1:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_ownerdir_ownership_library_dirs_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /lib/">
                <unix-def:object object_ref="oval:ssg-object_file_ownerdir_ownership_library_dirs_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_ownerdir_ownership_binary_dirs_5:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /usr/local/sbin/">
                <unix-def:object object_ref="oval:ssg-object_file_ownerdir_ownership_binary_dirs_5:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_ownerdir_ownership_binary_dirs_4:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /usr/local/bin/">
                <unix-def:object object_ref="oval:ssg-object_file_ownerdir_ownership_binary_dirs_4:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_ownerdir_ownership_binary_dirs_3:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /usr/sbin/">
                <unix-def:object object_ref="oval:ssg-object_file_ownerdir_ownership_binary_dirs_3:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_ownerdir_ownership_binary_dirs_2:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /usr/bin/">
                <unix-def:object object_ref="oval:ssg-object_file_ownerdir_ownership_binary_dirs_2:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_ownerdir_ownership_binary_dirs_1:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /sbin/">
                <unix-def:object object_ref="oval:ssg-object_file_ownerdir_ownership_binary_dirs_1:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_ownerdir_ownership_binary_dirs_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /bin/">
                <unix-def:object object_ref="oval:ssg-object_file_ownerdir_ownership_binary_dirs_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_var_log_syslog_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /var/log/syslog">
                <unix-def:object object_ref="oval:ssg-object_file_owner_var_log_syslog_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_var_log_messages_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /var/log/messages">
                <unix-def:object object_ref="oval:ssg-object_file_owner_var_log_messages_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_var_log_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /var/log/">
                <unix-def:object object_ref="oval:ssg-object_file_owner_var_log_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_grub2_cfg_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /boot/grub2/grub.cfg">
                <unix-def:object object_ref="oval:ssg-object_file_owner_grub2_cfg_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_etc_shadow_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /etc/shadow">
                <unix-def:object object_ref="oval:ssg-object_file_owner_etc_shadow_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_etc_passwd_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /etc/passwd">
                <unix-def:object object_ref="oval:ssg-object_file_owner_etc_passwd_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_etc_motd_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /etc/motd">
                <unix-def:object object_ref="oval:ssg-object_file_owner_etc_motd_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_etc_issue_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /etc/issue">
                <unix-def:object object_ref="oval:ssg-object_file_owner_etc_issue_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_etc_gshadow_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /etc/gshadow">
                <unix-def:object object_ref="oval:ssg-object_file_owner_etc_gshadow_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_etc_group_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /etc/group">
                <unix-def:object object_ref="oval:ssg-object_file_owner_etc_group_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_efi_grub2_cfg_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /boot/grub2/grub.cfg">
                <unix-def:object object_ref="oval:ssg-object_file_owner_efi_grub2_cfg_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_backup_etc_shadow_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /etc/shadow-">
                <unix-def:object object_ref="oval:ssg-object_file_owner_backup_etc_shadow_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_backup_etc_passwd_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /etc/passwd-">
                <unix-def:object object_ref="oval:ssg-object_file_owner_backup_etc_passwd_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_backup_etc_gshadow_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /etc/gshadow-">
                <unix-def:object object_ref="oval:ssg-object_file_owner_backup_etc_gshadow_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_backup_etc_group_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing user ownership of /etc/group-">
                <unix-def:object object_ref="oval:ssg-object_file_owner_backup_etc_group_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupownership_audit_configuration_1:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /etc/audit/rules.d/">
                <unix-def:object object_ref="oval:ssg-object_file_groupownership_audit_configuration_1:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupownership_audit_configuration_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /etc/audit/">
                <unix-def:object object_ref="oval:ssg-object_file_groupownership_audit_configuration_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_3:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /usr/lib64/">
                <unix-def:object object_ref="oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_3:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_2:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /usr/lib/">
                <unix-def:object object_ref="oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_2:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_1:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /lib64/">
                <unix-def:object object_ref="oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_1:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /lib/">
                <unix-def:object object_ref="oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_3:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /usr/lib64/">
                <unix-def:object object_ref="oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_3:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_2:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /usr/lib/">
                <unix-def:object object_ref="oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_2:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_1:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /lib64/">
                <unix-def:object object_ref="oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_1:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /lib/">
                <unix-def:object object_ref="oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_var_log_syslog_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /var/log/syslog">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_var_log_syslog_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_var_log_messages_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /var/log/messages">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_var_log_messages_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_var_log_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /var/log/">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_var_log_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_grub2_cfg_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /boot/grub2/grub.cfg">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_grub2_cfg_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_etc_shadow_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /etc/shadow">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_etc_shadow_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_etc_passwd_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /etc/passwd">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_etc_passwd_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_etc_motd_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /etc/motd">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_etc_motd_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_etc_issue_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /etc/issue">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_etc_issue_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_etc_gshadow_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /etc/gshadow">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_etc_gshadow_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_etc_group_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /etc/group">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_etc_group_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_efi_grub2_cfg_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /boot/grub2/grub.cfg">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_efi_grub2_cfg_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_backup_etc_shadow_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /etc/shadow-">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_backup_etc_shadow_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_backup_etc_passwd_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /etc/passwd-">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_backup_etc_passwd_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_backup_etc_gshadow_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /etc/gshadow-">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_backup_etc_gshadow_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_backup_etc_group_0:tst:1" version="1" check_existence="none_exist" check="all" comment="Testing group ownership of /etc/group-">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_backup_etc_group_0:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_cron_deny_not_exist:tst:1" version="1" check_existence="none_exist" check="all" comment="Test that that /etc/cron.deny does not exist">
                <unix-def:object object_ref="oval:ssg-object_file_cron_deny_not_exist:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_at_deny_not_exist:tst:1" version="1" check_existence="none_exist" check="all" comment="Test that that /etc/at.deny does not exist">
                <unix-def:object object_ref="oval:ssg-object_file_at_deny_not_exist:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_fedora_vendor_product:tst:1" version="1" check="all" comment="CPE vendor is 'fedoraproject' and 'product' is fedora">
                <ind-def:object object_ref="oval:ssg-object_fedora_vendor_product:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpminfo_test id="oval:ssg-test_fedora_release_rpm:tst:1" version="1" check="all" comment="fedora-release RPM packages are installed">
                <lin-def:object object_ref="oval:ssg-object_fedora_release_rpm:obj:1"/>
              </lin-def:rpminfo_test>
              <ind-def:variable_test id="oval:ssg-test_existence_of_var_umask_for_daemons_as_number_variable:tst:1" version="1" check="all" comment="Verify the existence of var_umask_for_daemons_as_number variable">
                <ind-def:object object_ref="oval:ssg-object_var_umask_for_daemons_umask_as_number:obj:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1" version="1" check="all" comment="Verify the existence of var_accounts_user_umask_as_number variable">
                <ind-def:object object_ref="oval:ssg-object_var_accounts_user_umask_umask_as_number:obj:1"/>
              </ind-def:variable_test>
              <unix-def:file_test id="oval:ssg-test_etc_system_fips:tst:1" version="1" check_existence="all_exist" check="all" comment="/etc/system-fips exists">
                <unix-def:object object_ref="oval:ssg-object_etc_system_fips:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_etc_selinux_config:tst:1" version="1" check_existence="all_exist" check="all" comment="/selinux/enforce is 1">
                <ind-def:object object_ref="oval:ssg-object_etc_selinux_config:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_etc_selinux_config:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_etc_securetty_exists:tst:1" version="1" check_existence="all_exist" check="all" comment="/etc/securetty file exists">
                <ind-def:object object_ref="oval:ssg-object_etc_securetty_exists:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_etc_profiled_tmout:tst:1" version="2" check_existence="all_exist" check="all" comment="TMOUT in /etc/profile.d/*.sh">
                <ind-def:object object_ref="oval:ssg-object_etc_profiled_tmout:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_etc_profile_tmout:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_etc_profile_tmout:tst:1" version="2" check_existence="all_exist" check="all" comment="TMOUT in /etc/profile">
                <ind-def:object object_ref="oval:ssg-object_etc_profile_tmout:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_etc_profile_tmout:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:variable_test id="oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1" version="1" check_existence="all_exist" check="all" comment="There should not exist duplicate user name entries in /etc/passwd">
                <ind-def:object object_ref="oval:ssg-object_count_of_all_usernames_from_etc_passwd:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_etc_passwd_no_duplicate_user_names:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_etc_passwd_no_duplicate_user_ids:tst:1" version="1" check_existence="all_exist" check="all" comment="There should not exist duplicate user ids in /etc/passwd">
                <ind-def:object object_ref="oval:ssg-obj_count_of_all_uids:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_no_duplicate_uids:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_etc_login_defs_encrypt_method:tst:1" version="1" check="all" comment="The value of ENCRYPT_METHOD should be set appropriately in /etc/login.defs">
                <ind-def:object object_ref="oval:ssg-object_last_encrypt_method_instance_value:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_last_encrypt_method_instance_value:ste:1"/>
              </ind-def:variable_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_etc_libuser_conf_cryptstyle:tst:1" version="1" check="all" comment="The password hashing algorithm should be set correctly in /etc/libuser.conf">
                <ind-def:object object_ref="oval:ssg-object_etc_libuser_conf_cryptstyle:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:variable_test id="oval:ssg-test_etc_group_no_duplicate_group_names:tst:1" version="1" check_existence="all_exist" check="all" comment="There should not exist duplicate group names in /etc/passwd">
                <ind-def:object object_ref="oval:ssg-obj_count_of_all_group_names:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_no_duplicate_group_names:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_etc_group_no_duplicate_group_ids:tst:1" version="1" check_existence="all_exist" check="all" comment="There should not exist duplicate group ids in /etc/passwd">
                <ind-def:object object_ref="oval:ssg-obj_count_of_all_group_ids:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_no_duplicate_group_ids:ste:1"/>
              </ind-def:variable_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_etc_default_useradd_inactive:tst:1" version="1" check="all" comment="the value INACTIVE parameter should be set appropriately in /etc/default/useradd">
                <ind-def:object object_ref="oval:ssg-object_etc_default_useradd_inactive:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_etc_default_useradd_inactive:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_etc_default_useradd_inactive_nonnegative:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:environmentvariable58_test id="oval:ssg-test_env_var_ends:tst:1" version="1" check="none satisfy" comment="environment variable PATH ends with : or .">
                <ind-def:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_ends_colon_period:ste:1"/>
              </ind-def:environmentvariable58_test>
              <ind-def:environmentvariable58_test id="oval:ssg-test_env_var_contains_relative_path:tst:1" version="1" check="none satisfy" comment="environment variable PATH contains relative paths">
                <ind-def:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_contains_relative_path:ste:1"/>
              </ind-def:environmentvariable58_test>
              <ind-def:environmentvariable58_test id="oval:ssg-test_env_var_contains_doubleperiod:tst:1" version="1" check="none satisfy" comment="environment variable PATH doesn't contain . twice in a row">
                <ind-def:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_contains_double_period:ste:1"/>
              </ind-def:environmentvariable58_test>
              <ind-def:environmentvariable58_test id="oval:ssg-test_env_var_contains_doublecolon:tst:1" version="1" check="none satisfy" comment="environment variable PATH doesn't contain : twice in a row">
                <ind-def:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_contains_double_colon:ste:1"/>
              </ind-def:environmentvariable58_test>
              <ind-def:environmentvariable58_test id="oval:ssg-test_env_var_begins_slash:tst:1" version="1" check="none satisfy" comment="environment variable PATH starts with an absolute path /">
                <ind-def:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_begins_slash:ste:1"/>
              </ind-def:environmentvariable58_test>
              <ind-def:environmentvariable58_test id="oval:ssg-test_env_var_begins:tst:1" version="1" check="none satisfy" comment="environment variable PATH starts with : or .">
                <ind-def:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_begins_colon_period:ste:1"/>
              </ind-def:environmentvariable58_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_zipl_installed:tst:1" version="1" check="all" comment="system has package zipl installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_zipl_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_yum_installed:tst:1" version="1" check="all" comment="system has package yum installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_yum_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_usbguard_installed:tst:1" version="1" check="all" comment="system has package usbguard installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_usbguard_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_tftp_server_installed:tst:1" version="1" check="all" comment="system has package tftp-server installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_tftp_server_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_systemd_installed:tst:1" version="1" check="all" comment="system has package systemd installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_systemd_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_sudo_installed:tst:1" version="1" check="all" comment="system has package sudo installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_sudo_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_sssd-common_installed:tst:1" version="1" check="all" comment="system has package sssd-common installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_sssd-common_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_postfix_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package postfix is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_env_has_postfix_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_polkit_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package polkit is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_env_has_polkit_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_pam_installed:tst:1" version="1" check="all" comment="system has package pam installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_pam_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_ovirt-host_installed:tst:1" version="1" check="all" comment="system has package ovirt-host installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_ovirt-host_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_ovirt-engine_installed:tst:1" version="1" check="all" comment="system has package ovirt-engine installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_ovirt-engine_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_ntp_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package ntp is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_env_has_ntp_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_nss-pam-ldapd_installed:tst:1" version="1" check="all" comment="system has package nss-pam-ldapd installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_nss-pam-ldapd_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_net-snmp_installed:tst:1" version="1" check="all" comment="system has package net-snmp installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_net-snmp_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_login_defs_installed:tst:1" version="1" check="all" comment="system has package shadow-utils installed, which provides the /etc/login.defs file.">
                <lin-def:object object_ref="oval:ssg-obj_env_has_login_defs_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_libuser_installed:tst:1" version="1" check="all" comment="system has package libuser installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_libuser_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_grub2_installed:tst:1" version="1" check="all" comment="system has package grub2-common installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_grub2_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_gdm_installed:tst:1" version="1" check="all" comment="system has package gdm installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_gdm_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_chrony_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package chrony is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_env_has_chrony_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_audit_installed:tst:1" version="1" check="all" comment="system has package audit installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_audit_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ensure_gpgcheck_never_disabled:tst:1" version="1" check_existence="none_exist" check="all" comment="check for existence of gpgcheck=0 in /etc/yum.repos.d/ files">
                <ind-def:object object_ref="oval:ssg-obj_ensure_gpgcheck_never_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ensure_gpgcheck_globally_activated:tst:1" version="1" check_existence="all_exist" check="all" comment="check value of gpgcheck in /etc/dnf/dnf.conf">
                <ind-def:object object_ref="oval:ssg-object_ensure_gpgcheck_globally_activated:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_enable_syscall_audit_augenrules:tst:1" version="1" check_existence="none_exist" check="all" comment="check that no audit rule exists in /etc/audit/rules.d/*.rules that disables all syscall auditing">
                <ind-def:object object_ref="oval:ssg-object_enable_syscall_audit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_enable_syscall_audit_auditctl:tst:1" version="1" check_existence="none_exist" check="all" comment="check that no audit rule exists in /etc/audit/audit.rules that disables all syscall auditing">
                <ind-def:object object_ref="oval:ssg-object_enable_syscall_audit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_enable_pam_namespace:tst:1" version="1" check="all" comment="tests the presence of pam_namespace.so module in the /etc/pam.d/login file">
                <ind-def:object object_ref="oval:ssg-obj_enable_pam_namespace:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_enable_gnome_smartcard:tst:1" version="1" check_existence="all_exist" check="all" comment="Enable GUI Login Smartcard authentication">
                <ind-def:object object_ref="oval:ssg-obj_enable_gnome_smartcard:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_enable_dracut_fips_module:tst:1" version="1" check_existence="all_exist" check="all" comment="add_dracutmodules contains fips">
                <ind-def:object object_ref="oval:ssg-object_enable_dracut_fips_module:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_enable_dracut_fips_module:ste:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_efi_dir_existence:tst:1" version="1" check="all" comment="Verify if /sys/firmware/efi folder exists">
                <unix-def:object object_ref="oval:ssg-object_file_sys_firmware_efi:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_dnf-automatic_security_updates_only_config_file_exists:tst:1" version="1" check_existence="all_exist" check="all" comment="The configuration file /etc/dnf/automatic.conf exists for dnf-automatic_security_updates_only">
                <unix-def:object object_ref="oval:ssg-obj_dnf-automatic_security_updates_only_config_file:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_dnf-automatic_security_updates_only:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of upgrade_type setting in the /etc/dnf/automatic.conf file">
                <ind-def:object object_ref="oval:ssg-obj_dnf-automatic_security_updates_only:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_dnf-automatic_security_updates_only:ste:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_dnf-automatic_apply_updates_config_file_exists:tst:1" version="1" check_existence="all_exist" check="all" comment="The configuration file /etc/dnf/automatic.conf exists for dnf-automatic_apply_updates">
                <unix-def:object object_ref="oval:ssg-obj_dnf-automatic_apply_updates_config_file:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_dnf-automatic_apply_updates:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of apply_updates setting in the /etc/dnf/automatic.conf file">
                <ind-def:object object_ref="oval:ssg-obj_dnf-automatic_apply_updates:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_dnf-automatic_apply_updates:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_display_login_attempts_silent:tst:1" version="1" check_existence="none_exist" check="all" comment="Forbid 'silent' option for pam_lastlog">
                <ind-def:object object_ref="oval:ssg-obj_display_login_attempts_silent:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_display_login_attempts:tst:1" version="1" check="all" comment="Check the pam_lastlog configuration">
                <ind-def:object object_ref="oval:ssg-obj_display_login_attempts:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disallow_bypass_password_sudo:tst:1" version="1" check_existence="none_exist" check="all" comment="Check absence of conf pam_succeed_if in /etc/pam.d/sudo">
                <ind-def:object object_ref="oval:ssg-obj_disallow_bypass_password_sudo:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:symlink_test id="oval:ssg-test_disable_xwindows_runlevel_target:tst:1" version="1" check_existence="all_exist" check="all" comment="default.target systemd softlink exists">
                <unix-def:object object_ref="oval:ssg-object_disable_xwindows_runlevel_target:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_disable_xwindows_runlevel_target:ste:1"/>
              </unix-def:symlink_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_wifi_notification:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable wifi notification">
                <ind-def:object object_ref="oval:ssg-obj_disable_wifi_notification:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_wifi_creation:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable wifi creation">
                <ind-def:object object_ref="oval:ssg-obj_disable_wifi_creation:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_user_list:tst:1" version="1" check_existence="all_exist" check="all" comment="GUI user list is disabled">
                <ind-def:object object_ref="oval:ssg-obj_disable_user_list:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_sys_geolocation:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable system geolocation">
                <ind-def:object object_ref="oval:ssg-obj_disable_sys_geolocation:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_restart_buttons:tst:1" version="1" check_existence="all_exist" check="all" comment="GUI restart and shutdown buttons are disabled">
                <ind-def:object object_ref="oval:ssg-obj_disable_restart_buttons:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_host_auth_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of HostbasedAuthentication setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_disable_host_auth_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_disable_host_auth_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_host_auth:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of HostbasedAuthentication setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_disable_host_auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_disable_host_auth:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_guest_login:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable GDM Guest Login">
                <ind-def:object object_ref="oval:ssg-obj_disable_guest_login:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_gnome_power_setting:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable power settings">
                <ind-def:object object_ref="oval:ssg-obj_disable_gnome_power_setting:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_gnome_ctrlaltdel:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable Ctrl-Alt-Del">
                <ind-def:object object_ref="oval:ssg-obj_disable_gnome_ctrlaltdel:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:symlink_test id="oval:ssg-test_disable_ctrlaltdel_exists:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable Ctrl-Alt-Del key sequence override exists">
                <unix-def:object object_ref="oval:ssg-object_disable_ctrlaltdel_exists:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_disable_ctrlaltdel_exists:ste:1"/>
              </unix-def:symlink_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_clock_geolocation:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable clock geolocation">
                <ind-def:object object_ref="oval:ssg-obj_disable_clock_geolocation:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_automatic_login:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable GDM Automatic Login">
                <ind-def:object object_ref="oval:ssg-obj_disable_automatic_login:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_directory_acccess_var_log_audit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_directory_acccess_var_log_audit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_directory_acccess_var_log_audit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_directory_acccess_var_log_audit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_dir_world_writable_uid_gt_zero:tst:1" version="1" check="all" comment="check for local directories that are world writable and have uid greater than 0">
                <unix-def:object object_ref="oval:ssg-all_local_directories_uid_zero:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_uid_is_not_root_and_world_writable:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_dir_world_writable_uid_gt_value:tst:1" version="1" check="all" comment="check for local directories that are world writable and have uid greater than or equal to 1000">
                <unix-def:object object_ref="oval:ssg-all_local_directories_uid:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_uid_is_user_and_world_writable:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_dir_world_writable_gid_gt_value:tst:1" version="1" check="all" comment="check for local directories that are world writable and have gid greater than or equal to 1000">
                <unix-def:object object_ref="oval:ssg-all_local_directories_gid:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_gid_is_user_and_world_writable:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_dir_perms_world_writable_sticky_bits:tst:1" version="1" check_existence="all_exist" check="all" comment="all local world-writable directories have sticky bit set">
                <unix-def:object object_ref="oval:ssg-object_only_local_directories:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_world_writable_and_not_sticky:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_dir_permissions_var_log_audit:tst:1" version="1" check="all" comment="/var/log/audit mode 0700">
                <unix-def:object object_ref="oval:ssg-object_var_log_audit_directory:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_not_mode_0700:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_dir_permissions_var_log_audit-non_root:tst:1" version="1" check="all" comment="/var/log/audit files mode 0750">
                <unix-def:object object_ref="oval:ssg-object_var_log_audit_directory-non_root:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_not_mode_0750:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_dir_permissions_audit_log:tst:1" version="1" check="all" comment="/var/log/audit mode 0700">
                <unix-def:object object_ref="oval:ssg-object_audit_log_directory:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_not_mode_0700:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_dir_permissions_audit_log-non_root:tst:1" version="1" check="all" comment="/var/log/audit files mode 0750">
                <unix-def:object object_ref="oval:ssg-object_audit_log_directory-non_root:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_not_mode_0750:ste:1"/>
              </unix-def:file_test>
              <lin-def:partition_test id="oval:ssg-test_dev_shm_partition_nosuid_optional_no:tst:1" version="2" check_existence="all_exist" check="all" comment="nosuid on /dev/shm optional no">
                <lin-def:object object_ref="oval:ssg-object_dev_shm_partition_nosuid_optional_no:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_dev_shm_partition_nosuid_optional_no:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_dev_shm_partition_noexec_optional_no:tst:1" version="2" check_existence="all_exist" check="all" comment="noexec on /dev/shm optional no">
                <lin-def:object object_ref="oval:ssg-object_dev_shm_partition_noexec_optional_no:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_dev_shm_partition_noexec_optional_no:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_dev_shm_partition_nodev_optional_no:tst:1" version="2" check_existence="all_exist" check="all" comment="nodev on /dev/shm optional no">
                <lin-def:object object_ref="oval:ssg-object_dev_shm_partition_nodev_optional_no:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_dev_shm_partition_nodev_optional_no:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_dev_shm_no_partition_nosuid_optional_no:tst:1" version="1" check_existence="all_exist" check="all" comment="/dev/shm exists">
                <lin-def:object object_ref="oval:ssg-object_dev_shm_partition_nosuid_optional_no:obj:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_dev_shm_no_partition_noexec_optional_no:tst:1" version="1" check_existence="all_exist" check="all" comment="/dev/shm exists">
                <lin-def:object object_ref="oval:ssg-object_dev_shm_partition_noexec_optional_no:obj:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_dev_shm_no_partition_nodev_optional_no:tst:1" version="1" check_existence="all_exist" check="all" comment="/dev/shm exists">
                <lin-def:object object_ref="oval:ssg-object_dev_shm_partition_nodev_optional_no:obj:1"/>
              </lin-def:partition_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_defaultkernel_sysconfig_kernel:tst:1" version="1" check_existence="all_exist" check="all" comment="check for DEFAULTKERNEL set to kernel-PAE in /etc/sysconfig/kernel">
                <ind-def:object object_ref="oval:ssg-object_defaultkernel_sysconfig_kernel:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_debian_9:tst:1" version="1" check="all" comment="Check Debian version">
                <ind-def:object object_ref="oval:ssg-obj_debian_9:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_debian_11:tst:1" version="1" check="all" comment="Check Debian version">
                <ind-def:object object_ref="oval:ssg-obj_debian_11:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_debian_10:tst:1" version="1" check="all" comment="Check Debian version">
                <ind-def:object object_ref="oval:ssg-obj_debian_10:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_debian:tst:1" version="1" check_existence="all_exist" check="all" comment="/etc/debian_version exists">
                <unix-def:object object_ref="oval:ssg-obj_debian:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_dconf_user_profile:tst:1" version="1" check_existence="all_exist" check="all" comment="dconf user profile exists">
                <ind-def:object object_ref="oval:ssg-obj_dconf_user_profile:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:variable_test id="oval:ssg-test_dconf_local_up_to_date:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if the local dconf DB is up-to-date with keyfiles in the local tree.">
                <ind-def:object object_ref="oval:ssg-object_local_db_modified_time:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_local_db_is_up_to_date:ste:1"/>
              </ind-def:variable_test>
              <unix-def:file_test id="oval:ssg-test_dconf_local_no_keyfiles:tst:1" version="1" check_existence="none_exist" check="all" comment="no keyfiles applicable to the local database">
                <unix-def:object object_ref="oval:ssg-obj_dconf_local_config:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_dconf_gnome_lock_screen_on_smartcard_removal:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of removal-action setting in the /etc/dconf/db/local.d/ file">
                <ind-def:object object_ref="oval:ssg-obj_dconf_gnome_lock_screen_on_smartcard_removal:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_dconf_gnome_lock_screen_on_smartcard_removal:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_dconf_gnome_disable_user_admin:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of user-administration-disabled setting in the /etc/dconf/db/local.d/ file">
                <ind-def:object object_ref="oval:ssg-obj_dconf_gnome_disable_user_admin:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_dconf_gnome_disable_user_admin:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_dconf_gnome_disable_autorun:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable autorun in GNOME">
                <ind-def:object object_ref="oval:ssg-obj_dconf_gnome_disable_autorun:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_dconf_gnome_disable_automount_open:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable automount-open in GNOME">
                <ind-def:object object_ref="oval:ssg-obj_dconf_gnome_disable_automount_open:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_dconf_gnome_disable_automount:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable automount in GNOME3">
                <ind-def:object object_ref="oval:ssg-obj_dconf_gnome_disable_automount:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:variable_test id="oval:ssg-test_dconf_distro_up_to_date:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if the distro dconf DB is up-to-date with keyfiles in the distro tree.">
                <ind-def:object object_ref="oval:ssg-object_distro_db_modified_time:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_distro_db_is_up_to_date:ste:1"/>
              </ind-def:variable_test>
              <unix-def:file_test id="oval:ssg-test_dconf_distro_no_keyfiles:tst:1" version="1" check_existence="none_exist" check="all" comment="no keyfiles applicable to the distro database">
                <unix-def:object object_ref="oval:ssg-obj_dconf_distro_config:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_crypto_policy_nss_config:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if /etc/crypto-policies/back-ends/nss.config exists">
                <unix-def:object object_ref="oval:ssg-object_crypto_policy_nss_config:obj:1"/>
              </unix-def:file_test>
              <ind-def:variable_test id="oval:ssg-test_crypto_policies_updated:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if update-crypto-policies has been run">
                <ind-def:object object_ref="oval:ssg-object_crypto_policies_config_file_modified_time:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_crypto_current_file_newer_than_config_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_cron_logging_rsyslog_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="cron is configured in /etc/rsyslog.d">
                <ind-def:object object_ref="oval:ssg-obj_cron_logging_rsyslog_dir:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_cron_logging_rsyslog:tst:1" version="1" check_existence="all_exist" check="all" comment="cron is configured in /etc/rsyslog.conf">
                <ind-def:object object_ref="oval:ssg-obj_cron_logging_rsyslog:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_cron_daily_logrotate_existence:tst:1" version="1" check_existence="all_exist" check="all" comment="Tests the existence of /etc/cron.daily/logrotate file (and verify it actually calls logrotate utility)">
                <ind-def:object object_ref="oval:ssg-object_cron_daily_logrotate_existence:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if argument selinux=0 is present in the line starting with 'BOOT_IMAGE' in /proc/cmdline">
                <ind-def:object object_ref="oval:ssg-object_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if argument selinux=0 is present in the line starting with 'options ' in /boot/loader/entries/ostree-2-.*.conf">
                <ind-def:object object_ref="oval:ssg-object_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if argument selinux=0 is present in the line starting with 'options ' in /boot/loader/entries/ostree-1-.*.conf">
                <ind-def:object object_ref="oval:ssg-object_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:ste:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_coreos_enable_selinux_kernel_argument_file_boot_loader_entries_ostree_2_conf_absent:tst:1" version="1" check_existence="none_exist" check="all" comment="Check if /boot/loader/entries/ostree-2-.*.conf does not exist">
                <unix-def:object object_ref="oval:ssg-object_coreos_enable_selinux_kernel_argument_file_boot_loader_entries_ostree_2_conf_absent:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_coredump_disable_storage:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of Storage setting in the /etc/systemd/coredump.conf file">
                <ind-def:object object_ref="oval:ssg-obj_coredump_disable_storage:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_coredump_disable_storage:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_coredump_disable_backtraces:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of ProcessSizeMax setting in the /etc/systemd/coredump.conf file">
                <ind-def:object object_ref="oval:ssg-obj_coredump_disable_backtraces:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_coredump_disable_backtraces:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_core_dumps_limitsconf:tst:1" version="1" check="all" comment="Tests the value of the ^[\s]*\*[\s]+(hard|-)[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.conf file">
                <ind-def:object object_ref="oval:ssg-object_core_dumps_limitsconf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_core_dumps_limitsconf:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_core_dumps_limits_d_exists:tst:1" version="1" check="all" comment="Tests for existance of the ^[\s]*\*[\s]+(hard|-)[\s]+core setting in the /etc/security/limits.d directory">
                <ind-def:object object_ref="oval:ssg-object_core_dumps_limits_d_exists:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_core_dumps_limits_d:tst:1" version="1" check="all" comment="Tests the value of the ^[\s]*\*[\s]+(hard|-)[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.d directory">
                <ind-def:object object_ref="oval:ssg-object_core_dumps_limits_d:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_core_dumps_limits_d:ste:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_configure_usbguard_auditbackend_config_file_exists:tst:1" version="1" check_existence="all_exist" check="all" comment="The configuration file /etc/usbguard/usbguard-daemon.conf exists for configure_usbguard_auditbackend">
                <unix-def:object object_ref="oval:ssg-obj_configure_usbguard_auditbackend_config_file:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_usbguard_auditbackend:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of AuditBackend setting in the /etc/usbguard/usbguard-daemon.conf file">
                <ind-def:object object_ref="oval:ssg-obj_configure_usbguard_auditbackend:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_configure_usbguard_auditbackend:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_tmux_lock_command:tst:1" version="1" check_existence="all_exist" check="all" comment="check lock-command is set to vlock in /etc/tmux.conf">
                <ind-def:object object_ref="oval:ssg-obj_configure_tmux_lock_command:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_tmux_lock_after_time:tst:1" version="1" check_existence="all_exist" check="all" comment="check lock-after-time is set to 900 in /etc/tmux.conf">
                <ind-def:object object_ref="oval:ssg-obj_configure_tmux_lock_after_time:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_ssh_crypto_policy:tst:1" version="1" check_existence="none_exist" check="all" comment="Check that the SSH configuration mandates usage of system-wide crypto policies.">
                <ind-def:object object_ref="oval:ssg-object_configure_ssh_crypto_policy:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_remote_access_encryption:tst:1" version="1" check_existence="all_exist" check="all" comment="configure remote access encryption">
                <ind-def:object object_ref="oval:ssg-obj_configure_remote_access_encryption:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_remote_access_creds:tst:1" version="1" check_existence="all_exist" check="all" comment="configure remote access credentials">
                <ind-def:object object_ref="oval:ssg-obj_configure_remote_access_creds:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_openssl_crypto_policy:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that the configuration mandates usage of system-wide crypto policies.">
                <ind-def:object object_ref="oval:ssg-object_configure_openssl_crypto_policy:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_opensc_nss_db:tst:1" version="1" check_existence="all_exist" check="all" comment="Check opensc library is configured in /etc/pki/nssdb/pkcs11.txt">
                <ind-def:object object_ref="oval:ssg-object_configure_opensc_nss_db:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_opensc_card_drivers:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that card_drivers is configured for opensc">
                <ind-def:object object_ref="oval:ssg-object_configure_opensc_card_drivers:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_configure_opensc_card_drivers:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_mount_option_var_tmp_bind_tmp:tst:1" version="1" check="all" comment="Ensure /var/tmp is configured to bind mount to /tmp">
                <ind-def:object object_ref="oval:ssg-object_configure_mount_option_var_tmp_bind_tmp:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_libreswan_crypto_policy:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that the libreswan configuration includes the crypto policy config file">
                <ind-def:object object_ref="oval:ssg-object_configure_libreswan_crypto_policy:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:variable_test id="oval:ssg-test_configure_kerberos_crypto_policy_symlink:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if kerberos configuration symlink and crypto policy kerberos backend symlink point to same file">
                <ind-def:object object_ref="oval:ssg-object_symlink_kerberos_crypto_policy_configuration:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_symlink_kerberos_crypto_policy_backend:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_configure_kerberos_crypto_policy_nosymlink:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if kerberos configuration symlink links to the crypto-policy backend file">
                <ind-def:object object_ref="oval:ssg-object_symlink_kerberos_crypto_policy_configuration:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_location_of_kerberos_crypto_policy_backend:ste:1"/>
              </ind-def:variable_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_gnutls_tls_crypto_policy:tst:1" version="1" check="all" comment="tests the presence of '+VERS-ALL:-VERS-DTLS0.9:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS1.0' setting in the /etc/crypto-policies/back-ends/gnutls.config file">
                <ind-def:object object_ref="oval:ssg-obj_configure_gnutls_tls_crypto_policy:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_crypto_policy_current:tst:1" version="1" check_existence="only_one_exists" check="all" comment="check for crypto policy correctly configured in /etc/crypto-policies/state/current">
                <ind-def:object object_ref="oval:ssg-object_configure_crypto_policy_current:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_configure_crypto_policy_current:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_crypto_policy:tst:1" version="1" check_existence="only_one_exists" check="all" comment="check for crypto policy correctly configured in /etc/crypto-policies/config">
                <ind-def:object object_ref="oval:ssg-object_configure_crypto_policy:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_configure_crypto_policy:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_bind_crypto_policy:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that the configuration includes the policy config file.">
                <ind-def:object object_ref="oval:ssg-object_configure_bind_crypto_policy:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_bashrc_exec_tmux:tst:1" version="1" check_existence="all_exist" check="all" comment="check tmux is configured to exec on the last line of /etc/bashrc">
                <ind-def:object object_ref="oval:ssg-obj_configure_bashrc_exec_tmux:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_allowed_failures:tst:1" version="1" check_existence="all_exist" check="all" comment="Set number of login tries">
                <ind-def:object object_ref="oval:ssg-obj_configure_allowed_failures:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_chronyd_server_directive_with_server:tst:1" version="1" check="all" comment="Ensure at least one time source is set with server directive">
                <ind-def:object object_ref="oval:ssg-object_chronyd_server_directive:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_chronyd_server_directive_no_pool:tst:1" version="1" check_existence="none_exist" check="all" comment="Ensure no time source is set with pool directive">
                <ind-def:object object_ref="oval:ssg-object_chronyd_no_pool_directive:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_chronyd_run_as_chrony_user_config_file_exists:tst:1" version="1" check_existence="all_exist" check="all" comment="The configuration file /etc/sysconfig/chronyd exists for chronyd_run_as_chrony_user">
                <unix-def:object object_ref="oval:ssg-obj_chronyd_run_as_chrony_user_config_file:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_chronyd_run_as_chrony_user:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of OPTIONS setting in the /etc/sysconfig/chronyd file">
                <ind-def:object object_ref="oval:ssg-obj_chronyd_run_as_chrony_user:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_chronyd_run_as_chrony_user:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_chronyd_remote_server:tst:1" version="1" check="all" comment="Ensure at least one NTP server is set">
                <ind-def:object object_ref="oval:ssg-object_chronyd_remote_server:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_chronyd_no_chronyc_network:tst:1" version="1" check_existence="all_exist" check="all" comment="check if cmdport is 0 in /etc/chrony.conf">
                <ind-def:object object_ref="oval:ssg-obj_chronyd_cmdport_value:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_chronyd_cmdport_value_0:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_chronyd_multiple_servers:tst:1" version="1" check_existence="all_exist" check="all" comment="Ensure more than one chronyd NTP server is set">
                <ind-def:object object_ref="oval:ssg-object_chronyd_multiple_servers:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_chronyd_client_only:tst:1" version="1" check_existence="all_exist" check="all" comment="check if port is 0 in /etc/chrony.conf">
                <ind-def:object object_ref="oval:ssg-obj_chronyd_port_value:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_chronyd_port_value_0:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_chrony_set_maxpoll:tst:1" version="1" check_existence="all_exist" check="all" comment="check if maxpoll is set in /etc/chrony.conf">
                <ind-def:object object_ref="oval:ssg-obj_chrony_set_maxpoll:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_time_service_set_maxpoll:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_chrony_no_server_nor_pool:tst:1" version="1" check_existence="none_exist" check="all" comment="check if no server entries have server or pool set in /etc/chrony.conf">
                <ind-def:object object_ref="oval:ssg-obj_chrony_no_server_nor_pool:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_chrony_all_server_has_maxpoll:tst:1" version="1" check_existence="all_exist" check="all" comment="check if all server entries have maxpoll set in /etc/chrony.conf">
                <ind-def:object object_ref="oval:ssg-obj_chrony_all_server_has_maxpoll:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_server_has_maxpoll:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_centos9_version:tst:1" version="1" check="all" comment="Check os-release VERSION_ID">
                <ind-def:object object_ref="oval:ssg-obj_version_centos9:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_version_centos9:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_centos9_name:tst:1" version="1" check="all" comment="Check os-release ID">
                <ind-def:object object_ref="oval:ssg-obj_name_centos9:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_name_centos9:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_centos8_version:tst:1" version="1" check="all" comment="Check os-release VERSION_ID">
                <ind-def:object object_ref="oval:ssg-obj_version_centos8:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_version_centos8:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_centos8_name:tst:1" version="1" check="all" comment="Check os-release ID">
                <ind-def:object object_ref="oval:ssg-obj_name_centos8:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_name_centos8:ste:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpminfo_test id="oval:ssg-test_centos7:tst:1" version="1" check="all" comment="centos-release is version 7">
                <lin-def:object object_ref="oval:ssg-obj_centos7:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_centos7:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_centos6:tst:1" version="1" check="all" comment="centos-release is version 6">
                <lin-def:object object_ref="oval:ssg-obj_centos6:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_centos6:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_bootloader_uefi_superuser_differ_from_other_users:tst:1" version="1" check_existence="all_exist" check="all" comment="superuser           is defined in /boot/grub2/grub.cfg. Superuser is not           equal to other system account nor root, admin, administrator">
                <ind-def:object object_ref="oval:ssg-object_bootloader_uefi_unique_superuser:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_bootloader_uefi_superuser_differ_from_other_users:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_bootloader_superuser_differ_from_other_users:tst:1" version="1" check_existence="all_exist" check="all" comment="superuser           is defined in /boot/grub2/grub.cfg. Superuser is not           equal to other system account nor root, admin, administrator">
                <ind-def:object object_ref="oval:ssg-object_bootloader_unique_superuser:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_bootloader_superuser_differ_from_other_users:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_bootloader_superuser:tst:1" version="2" check_existence="all_exist" check="all" comment="superuser is defined in /boot/grub2/grub.cfg files.">
                <ind-def:object object_ref="oval:ssg-object_bootloader_superuser:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_bootloader_disable_recovery_set_to_true:tst:1" version="1" check_existence="all_exist" check="all" comment="Check for GRUB_DISABLE_RECOVERY=true in /etc/default/grub">
                <ind-def:object object_ref="oval:ssg-object_bootloader_disable_recovery_argument:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_bootloader_disable_recovery_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:partition_test id="oval:ssg-test_boot_partition_nosuid_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" comment="nosuid on /boot optional yes">
                <lin-def:object object_ref="oval:ssg-object_boot_partition_nosuid_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_boot_partition_nosuid_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_boot_partition_noexec_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" comment="noexec on /boot optional yes">
                <lin-def:object object_ref="oval:ssg-object_boot_partition_noexec_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_boot_partition_noexec_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_boot_partition_nodev_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" comment="nodev on /boot optional yes">
                <lin-def:object object_ref="oval:ssg-object_boot_partition_nodev_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_boot_partition_nodev_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_boot_partition_noauto_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" comment="noauto on /boot optional yes">
                <lin-def:object object_ref="oval:ssg-object_boot_partition_noauto_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_boot_partition_noauto_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_banner_gui_enabled:tst:1" version="1" check_existence="all_exist" check="all" comment="GUI banner is enabled">
                <ind-def:object object_ref="oval:ssg-obj_banner_gui_enabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_banner_etc_motd:tst:1" version="1" check_existence="any_exist" check="all" comment="correct banner in /etc/motd">
                <ind-def:object object_ref="oval:ssg-object_banner_etc_motd:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_banner_etc_motd:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_banner_etc_issue:tst:1" version="1" check="at least one" comment="correct banner in /etc/issue">
                <ind-def:object object_ref="oval:ssg-object_banner_etc_issue:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_banner_etc_issue:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_write_logs_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of write_logs setting in the /etc/audit/auditd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_auditd_write_logs_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_write_logs:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of write_logs setting in the /etc/audit/auditd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_auditd_write_logs:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_write_logs:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_overflow_action:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of overflow_action setting in the /etc/audit/auditd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_auditd_overflow_action:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_overflow_action:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_name_format:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of name_format setting in the /etc/audit/auditd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_auditd_name_format:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_name_format:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_log_format:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of log_format setting in the /etc/audit/auditd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_auditd_log_format:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_log_format:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_local_events_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of local_events setting in the /etc/audit/auditd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_auditd_local_events_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_local_events:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of local_events setting in the /etc/audit/auditd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_auditd_local_events:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_local_events:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_freq:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of freq setting in the /etc/audit/auditd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_auditd_freq:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_freq:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_space_left_percentage:tst:1" version="1" check="all" comment="admin space left action ">
                <ind-def:object object_ref="oval:ssg-object_auditd_data_retention_space_left_percentage:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_data_retention_space_left_percentage:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_space_left_action:tst:1" version="2" check="all" comment="space left action">
                <ind-def:object object_ref="oval:ssg-object_auditd_data_retention_space_left_action:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_data_retention_space_left_action:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_num_logs:tst:1" version="1" check="all" comment="admin space left action ">
                <ind-def:object object_ref="oval:ssg-object_auditd_data_retention_num_logs:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_data_retention_num_logs:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_max_log_file_action:tst:1" version="1" check="all" comment="admin space left action ">
                <ind-def:object object_ref="oval:ssg-object_auditd_data_retention_max_log_file_action:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_data_retention_max_log_file_action:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_max_log_file:tst:1" version="1" check="all" comment="max log file size">
                <ind-def:object object_ref="oval:ssg-object_auditd_data_retention_max_log_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_data_retention_max_log_file:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_flush:tst:1" version="1" check="all" comment="test the value of flush parameter in /etc/audit/auditd.conf">
                <ind-def:object object_ref="oval:ssg-object_auditd_data_retention_flush:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_data_retention_flush:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_admin_space_left_action:tst:1" version="1" check="all" comment="space left action">
                <ind-def:object object_ref="oval:ssg-object_auditd_data_retention_admin_space_left_action:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_data_retention_admin_space_left_action:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_action_mail_acct:tst:1" version="1" check="all" comment="email account for actions">
                <ind-def:object object_ref="oval:ssg-object_auditd_data_retention_action_mail_acct:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_data_retention_action_mail_acct:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_data_disk_full_action:tst:1" version="1" check="all" comment="disk error action">
                <ind-def:object object_ref="oval:ssg-object_auditd_data_disk_full_action:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_data_disk_full_action:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_data_disk_error_action:tst:1" version="1" check="all" comment="disk full action">
                <ind-def:object object_ref="oval:ssg-object_auditd_data_disk_error_action:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_data_disk_error_action:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_conf_log_group_not_root:tst:1" version="1" check_existence="none_exist" check="all" comment="log_group = root">
                <ind-def:object object_ref="oval:ssg-object_auditd_conf_log_group_root:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_conf_log_group_is_set:tst:1" version="1" check_existence="all_exist" check="all" comment="log_group is set">
                <ind-def:object object_ref="oval:ssg-object_auditd_conf_log_group_is_set:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_conf_log_file_not_set:tst:1" version="1" check_existence="none_exist" check="all" comment="log_file not set">
                <ind-def:object object_ref="oval:ssg-object_auditd_conf_log_file:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_audispd_syslog_plugin_activated:tst:1" version="1" check="all" comment="audispd syslog plugin activated">
                <ind-def:object object_ref="oval:ssg-object_auditd_audispd_syslog_plugin_activated:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_audispd_encrypt_sent_records:tst:1" version="1" check="all" comment="setting in audisp-remote.conf">
                <ind-def:object object_ref="oval:ssg-object_auditd_audispd_encrypt_sent_records:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_audispd_configure_remote_server:tst:1" version="1" check="all" comment="remote server to send audit records">
                <ind-def:object object_ref="oval:ssg-object_auditd_audispd_configure_remote_server:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_audispd_configure_remote_server:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_shadow_augen:tst:1" version="1" check="all" comment="audit augenrules shadow">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_shadow_augen:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_shadow_auditctl:tst:1" version="1" check="all" comment="audit shadow">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_shadow_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_passwd_augen:tst:1" version="1" check="all" comment="audit augenrules passwd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_passwd_augen:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_passwd_auditctl:tst:1" version="1" check="all" comment="audit passwd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_passwd_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_opasswd_augen:tst:1" version="1" check="all" comment="audit augenrules opasswd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_opasswd_augen:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_opasswd_auditctl:tst:1" version="1" check="all" comment="audit opasswd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_opasswd_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_gshadow_augen:tst:1" version="1" check="all" comment="audit augenrules gshadow">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_gshadow_augen:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_gshadow_auditctl:tst:1" version="1" check="all" comment="audit gshadow">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_gshadow_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_group_augen:tst:1" version="1" check="all" comment="audit augenrules group">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_group_augen:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_group_auditctl:tst:1" version="1" check="all" comment="audit group">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_group_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_augen:tst:1" version="1" check="all" comment="audit augenrules /etc/shadow">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow_augen:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_auditctl:tst:1" version="1" check="all" comment="audit /etc/shadow">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_augen:tst:1" version="1" check="all" comment="audit augenrules /etc/security/opasswd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd_augen:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:tst:1" version="1" check="all" comment="audit /etc/security/opasswd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_augen:tst:1" version="1" check="all" comment="audit augenrules /etc/passwd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd_augen:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_auditctl:tst:1" version="1" check="all" comment="audit /etc/passwd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_augen:tst:1" version="1" check="all" comment="audit augenrules /etc/gshadow">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow_augen:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_auditctl:tst:1" version="1" check="all" comment="audit /etc/gshadow">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_group_augen:tst:1" version="1" check="all" comment="audit augenrules /etc/group">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_group_augen:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_group_auditctl:tst:1" version="1" check="all" comment="audit /etc/group">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_group_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_shadow_openat_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_shadow_openat_64bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_shadow_openat_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_shadow_openat_64bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_shadow_openat_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_shadow_openat_32bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_shadow_openat_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_shadow_openat_32bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_64bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_64bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_32bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_32bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_shadow_open_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_64bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_shadow_open_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_64bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_shadow_open_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_32bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_shadow_open_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_32bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_passwd_openat_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_passwd_openat_64bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_passwd_openat_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_passwd_openat_64bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_passwd_openat_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_passwd_openat_32bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_passwd_openat_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_passwd_openat_32bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_64bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_64bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_32bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_32bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_passwd_open_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_64bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_passwd_open_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_64bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_passwd_open_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_32bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_passwd_open_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_32bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_gshadow_openat_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_openat_64bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_gshadow_openat_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_openat_64bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_gshadow_openat_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_openat_32bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_gshadow_openat_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_openat_32bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_64bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_64bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_32bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_32bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_gshadow_open_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_64bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_gshadow_open_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_64bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_gshadow_open_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_32bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_gshadow_open_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_32bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_group_openat_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_group_openat_64bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_group_openat_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_group_openat_64bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_group_openat_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_group_openat_32bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_group_openat_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_group_openat_32bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_64bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_64bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_32bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_32bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_group_open_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_group_open_64bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_group_open_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_group_open_64bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_group_open_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_group_open_32bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_group_open_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_group_open_32bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_augenrules:tst:1" version="1" check="all" comment="audit augenrules sudoers">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_d_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_auditctl:tst:1" version="1" check="all" comment="audit auditctl sudoers">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_d_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_augenrules:tst:1" version="1" check="all" comment="audit augenrules sudoers">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_auditctl:tst:1" version="1" check="all" comment="audit auditctl sudoers">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_usernetctl_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules usernetctl">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_usernetctl_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_usernetctl_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl usernetctl">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_usernetctl_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_userhelper_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules userhelper">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_userhelper_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_userhelper_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl userhelper">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_userhelper_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules unix_chkpwd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_unix_chkpwd_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl unix_chkpwd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_unix_chkpwd_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_umount_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules umount">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_umount_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_umount_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl umount">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_umount_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_sudoedit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules sudoedit">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_sudoedit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_sudoedit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl sudoedit">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_sudoedit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_sudo_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules sudo">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_sudo_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_sudo_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl sudo">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_sudo_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_su_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules su">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_su_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_su_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl su">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_su_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules ssh_keysign">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_ssh_keysign_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl ssh_keysign">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_ssh_keysign_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_pt_chown_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules pt_chown">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_pt_chown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_pt_chown_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl pt_chown">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_pt_chown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_passwd_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules passwd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_passwd_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_passwd_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl passwd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_passwd_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_newuidmap_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules newuidmap">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newuidmap_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_newuidmap_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl newuidmap">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newuidmap_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_newgrp_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules newgrp">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newgrp_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_newgrp_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl newgrp">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newgrp_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_newgidmap_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules newgidmap">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newgidmap_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_newgidmap_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl newgidmap">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newgidmap_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_mount_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules mount">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_mount_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_mount_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl mount">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_mount_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_gpasswd_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules gpasswd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_gpasswd_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_gpasswd_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl gpasswd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_gpasswd_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_crontab_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules crontab">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_crontab_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_crontab_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl crontab">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_crontab_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_chsh_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules chsh">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_chsh_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_chsh_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl chsh">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_chsh_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_chage_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules chage">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_chage_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_chage_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl chage">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_chage_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_at_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules at">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_at_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_at_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl at">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_at_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_seunshare_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules seunshare">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_execution_seunshare_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_seunshare_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl seunshare">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_execution_seunshare_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_setsebool_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules setsebool">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_execution_setsebool_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_setsebool_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl setsebool">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_execution_setsebool_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_semanage_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules semanage">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_execution_semanage_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_semanage_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl semanage">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_execution_semanage_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_restorecon_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules restorecon">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_execution_restorecon_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_restorecon_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl restorecon">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_execution_restorecon_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_chcon_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules chcon">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_execution_chcon_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_chcon_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl chcon">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_execution_chcon_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_augenrules:tst:1" version="1" check="all" comment="audit augenrules">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_auditctl:tst:1" version="1" check="all" comment="audit auditctl">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_order_64bit_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_order_64bit_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_order_64bit_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_order_64bit_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_order_64bit_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_order_64bit_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_order_64bit_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_order_64bit_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_order_32bit_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_order_32bit_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_order_32bit_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="Test order of audit 32bit auditctl eperm rules order">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_order_32bit_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_order_32bit_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_order_32bit_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_order_32bit_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_order_32bit_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_order_64bit_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_order_64bit_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_order_64bit_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_order_64bit_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_order_64bit_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_order_64bit_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_order_64bit_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_order_64bit_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_order_32bit_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_order_32bit_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_order_32bit_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="Test order of audit 32bit auditctl eperm rules order">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_order_32bit_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_order_32bit_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_order_32bit_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_order_32bit_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_order_32bit_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="Test order of audit 32bit auditctl eperm rules order">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_artw_etc_localtime_augenrules:tst:1" version="1" check="all" comment="audit /etc/localtime watch augenrules">
                <ind-def:object object_ref="oval:ssg-object_artw_etc_localtime_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_artw_etc_localtime_auditctl:tst:1" version="1" check="all" comment="audit /etc/localtime watch auditctl">
                <ind-def:object object_ref="oval:ssg-object_artw_etc_localtime_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arse_wtmp_augenrules:tst:1" version="1" check="all" comment="audit augenrules wtmp">
                <ind-def:object object_ref="oval:ssg-object_arse_wtmp_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arse_wtmp_auditctl:tst:1" version="1" check="all" comment="audit auditctl wtmp">
                <ind-def:object object_ref="oval:ssg-object_arse_wtmp_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arse_utmp_augenrules:tst:1" version="1" check="all" comment="audit augenrules utmp">
                <ind-def:object object_ref="oval:ssg-object_arse_utmp_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arse_utmp_auditctl:tst:1" version="1" check="all" comment="audit auditctl utmp">
                <ind-def:object object_ref="oval:ssg-object_arse_utmp_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arse_btmp_augenrules:tst:1" version="1" check="all" comment="audit augenrules btmp">
                <ind-def:object object_ref="oval:ssg-object_arse_btmp_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arse_btmp_auditctl:tst:1" version="1" check="all" comment="audit auditctl btmp">
                <ind-def:object object_ref="oval:ssg-object_arse_btmp_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arpc_suid_sgid_augenrules:tst:1" version="1" check_existence="all_exist" check="all" comment="audit augenrules suid sgid">
                <ind-def:object object_ref="oval:ssg-object_arpc_suid_sgid_augenrules:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_audit_rules_privileged_commands:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arpc_suid_sgid_auditctl:tst:1" version="1" check_existence="all_exist" check="all" comment="audit auditctl suid sgid">
                <ind-def:object object_ref="oval:ssg-object_arpc_suid_sgid_auditctl:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_audit_rules_privileged_commands:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:variable_test id="oval:ssg-test_arpc_bin_count_equals_rules_count_augenrules:tst:1" version="1" check_existence="all_exist" check="all" comment="audit augenrules binaries count matches rules count">
                <ind-def:object object_ref="oval:ssg-object_count_of_suid_sgid_binaries_on_system:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_count_of_privileged_commands_having_audit_definition_augenrules:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_arpc_bin_count_equals_rules_count_auditctl:tst:1" version="1" check_existence="all_exist" check="all" comment="audit auditctl binaries count matches rules count">
                <ind-def:object object_ref="oval:ssg-object_count_of_suid_sgid_binaries_on_system:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_count_of_privileged_commands_having_audit_definition_auditctl:ste:1"/>
              </ind-def:variable_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arnm_etc_sysconfig_network_augenrules:tst:1" version="1" check="all" comment="audit /etc/sysconfig/network augenrules">
                <ind-def:object object_ref="oval:ssg-object_arnm_etc_sysconfig_network_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arnm_etc_sysconfig_network_auditctl:tst:1" version="1" check="all" comment="audit /etc/sysconfig/network auditctl">
                <ind-def:object object_ref="oval:ssg-object_arnm_etc_sysconfig_network_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arnm_etc_issue_net_augenrules:tst:1" version="1" check="all" comment="audit /etc/issue.net augenrules">
                <ind-def:object object_ref="oval:ssg-object_arnm_etc_issue_net_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arnm_etc_issue_net_auditctl:tst:1" version="1" check="all" comment="audit /etc/issue.net auditctl">
                <ind-def:object object_ref="oval:ssg-object_arnm_etc_issue_net_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arnm_etc_issue_augenrules:tst:1" version="1" check="all" comment="audit /etc/issue augenrules">
                <ind-def:object object_ref="oval:ssg-object_arnm_etc_issue_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arnm_etc_issue_auditctl:tst:1" version="1" check="all" comment="audit /etc/issue auditctl">
                <ind-def:object object_ref="oval:ssg-object_arnm_etc_issue_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arnm_etc_hosts_augenrules:tst:1" version="1" check="all" comment="audit /etc/hosts augenrules">
                <ind-def:object object_ref="oval:ssg-object_arnm_etc_hosts_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arnm_etc_hosts_auditctl:tst:1" version="1" check="all" comment="audit /etc/hosts auditctl">
                <ind-def:object object_ref="oval:ssg-object_arnm_etc_hosts_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_armm_selinux_watch_augenrules:tst:1" version="1" check="all" comment="audit selinux changes augenrules">
                <ind-def:object object_ref="oval:ssg-object_armm_selinux_watch_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_armm_selinux_watch_auditctl:tst:1" version="1" check="all" comment="audit selinux changes auditctl">
                <ind-def:object object_ref="oval:ssg-object_armm_selinux_watch_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arle_tallylog_augenrules:tst:1" version="1" check="all" comment="audit augenrules tallylog">
                <ind-def:object object_ref="oval:ssg-object_arle_tallylog_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arle_tallylog_auditctl:tst:1" version="1" check="all" comment="audit auditctl tallylog">
                <ind-def:object object_ref="oval:ssg-object_arle_tallylog_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arle_lastlog_augenrules:tst:1" version="1" check="all" comment="audit augenrules lastlog">
                <ind-def:object object_ref="oval:ssg-object_arle_lastlog_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arle_lastlog_auditctl:tst:1" version="1" check="all" comment="audit auditctl lastlog">
                <ind-def:object object_ref="oval:ssg-object_arle_lastlog_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arle_faillock_augenrules:tst:1" version="1" check="all" comment="audit augenrules faillock">
                <ind-def:object object_ref="oval:ssg-object_arle_faillock_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arle_faillock_auditctl:tst:1" version="1" check="all" comment="audit auditctl faillock">
                <ind-def:object object_ref="oval:ssg-object_arle_faillock_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ari_locked_augenrules:tst:1" version="1" check="all" comment="audit augenrules configuration locked">
                <ind-def:object object_ref="oval:ssg-object_ari_locked_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ari_locked_auditctl:tst:1" version="1" check="all" comment="audit auditctl configuration locked">
                <ind-def:object object_ref="oval:ssg-object_ari_locked_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_x86_vsyscall_emulation_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_x86_vsyscall_emulation_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_x86_vsyscall_emulation:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_vmap_stack_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_vmap_stack_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_vmap_stack:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_unmap_kernel_at_el0_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_unmap_kernel_at_el0_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_unmap_kernel_at_el0:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_syn_cookies_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_syn_cookies_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_syn_cookies:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_strict_module_rwx_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_strict_module_rwx_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_strict_module_rwx:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_strict_kernel_rwx_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_strict_kernel_rwx_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_strict_kernel_rwx:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_stackprotector_strong_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_stackprotector_strong_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_stackprotector_strong:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_stackprotector_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_stackprotector_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_stackprotector:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_slub_debug_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_slub_debug_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_slub_debug:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_slab_merge_default_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_slab_merge_default_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_slab_merge_default:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_slab_frelist_random_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_slab_frelist_random_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_slab_frelist_random:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_slab_freelist_hardened_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_slab_freelist_hardened_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_slab_freelist_hardened:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_security_yama_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_security_yama_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_security_yama:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_security_writable_hooks_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_security_writable_hooks_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_security_writable_hooks:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_security_dmesg_restrict_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_security_dmesg_restrict_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_security_dmesg_restrict:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_security_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_security_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_security:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_seccomp_filter_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_seccomp_filter_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_seccomp_filter:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_seccomp_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_seccomp_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_seccomp:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_sched_stack_end_check_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_sched_stack_end_check_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_sched_stack_end_check:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_retpoline_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_retpoline_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_retpoline:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_refcount_full_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_refcount_full_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_refcount_full:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_randomize_memory_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_randomize_memory_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_randomize_memory:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_randomize_base_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_randomize_base_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_randomize_base:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_proc_kcore_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_proc_kcore_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_proc_kcore:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_panic_timeout_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_panic_timeout_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_panic_timeout:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_panic_on_oops_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_panic_on_oops_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_panic_on_oops:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_page_table_isolation_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_page_table_isolation_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_page_table_isolation:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_page_poisoning_zero_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_page_poisoning_zero_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_page_poisoning_zero:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_page_poisoning_no_sanity_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_page_poisoning_no_sanity_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_page_poisoning_no_sanity:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_page_poisoning_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_page_poisoning_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_page_poisoning:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_module_sig_sha512_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_module_sig_sha512_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_module_sig_sha512:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_module_sig_key_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_module_sig_key_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_module_sig_key:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_module_sig_hash_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_module_sig_hash_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_module_sig_hash:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_module_sig_force_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_module_sig_force_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_module_sig_force:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_module_sig_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_module_sig_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_module_sig:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_module_sig_all_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_module_sig_all_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_module_sig_all:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_modify_ldt_syscall_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_modify_ldt_syscall_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_modify_ldt_syscall:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_legacy_vsyscall_xonly_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_legacy_vsyscall_xonly_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_legacy_vsyscall_xonly:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_legacy_vsyscall_none_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_legacy_vsyscall_none_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_legacy_vsyscall_none:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_legacy_vsyscall_emulate_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_legacy_vsyscall_emulate_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_legacy_vsyscall_emulate:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_legacy_ptys_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_legacy_ptys_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_legacy_ptys:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_kexec_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_kexec_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_kexec:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_ipv6_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_ipv6_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_ipv6:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_ia32_emulation_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_ia32_emulation_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_ia32_emulation:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_hibernation_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_hibernation_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_hibernation:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_hardened_usercopy_fallback_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_hardened_usercopy_fallback_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_hardened_usercopy_fallback:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_hardened_usercopy_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_hardened_usercopy_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_hardened_usercopy:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_gcc_plugin_structleak_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_gcc_plugin_structleak_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_gcc_plugin_structleak:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_gcc_plugin_structleak_byref_all_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_gcc_plugin_structleak_byref_all_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_gcc_plugin_structleak_byref_all:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_gcc_plugin_stackleak_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_gcc_plugin_stackleak_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_gcc_plugin_stackleak:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_gcc_plugin_randstruct_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_gcc_plugin_randstruct_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_gcc_plugin_randstruct:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_gcc_plugin_latent_entropy_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_gcc_plugin_latent_entropy_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_gcc_plugin_latent_entropy:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_fortify_source_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_fortify_source_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_fortify_source:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_devkmem_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_devkmem_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_devkmem:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_default_mmap_min_addr_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_default_mmap_min_addr_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_default_mmap_min_addr:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_debug_wx_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_debug_wx_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_debug_wx:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_debug_sg_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_debug_sg_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_debug_sg:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_debug_notifiers_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_debug_notifiers_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_debug_notifiers:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_debug_list_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_debug_list_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_debug_list:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_debug_fs_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_debug_fs_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_debug_fs:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_debug_credentials_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_debug_credentials_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_debug_credentials:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_compat_vdso_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_compat_vdso_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_compat_vdso:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_compat_brk_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_compat_brk_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_compat_brk:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_bug_on_data_corruption_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_bug_on_data_corruption_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_bug_on_data_corruption:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_bug_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_bug_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_bug:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_binfmt_misc_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_binfmt_misc_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_binfmt_misc:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_arm64_sw_ttbr0_pan_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_arm64_sw_ttbr0_pan_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_arm64_sw_ttbr0_pan:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_all_kernels_config_acpi_custom_method_compliant:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if all installed kernels are compliant">
                <ind-def:object object_ref="oval:ssg-object_var_kernel_config_acpi_custom_method_count:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_kernel_config_acpi_custom_method:ste:1"/>
              </ind-def:variable_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_aide_verify_rsyslogd:tst:1" version="1" check_existence="all_exist" check="all" comment="rsyslogd is checked in /etc/aide.conf">
                <ind-def:object object_ref="oval:ssg-object_aide_verify_rsyslogd:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_aide_verify_autrace:tst:1" version="1" check_existence="all_exist" check="all" comment="autrace is checked in /etc/aide.conf">
                <ind-def:object object_ref="oval:ssg-object_aide_verify_autrace:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_aide_verify_ausearch:tst:1" version="1" check_existence="all_exist" check="all" comment="ausearch is checked in /etc/aide.conf">
                <ind-def:object object_ref="oval:ssg-object_aide_verify_ausearch:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_aide_verify_aureport:tst:1" version="1" check_existence="all_exist" check="all" comment="aureport is checked in /etc/aide.conf">
                <ind-def:object object_ref="oval:ssg-object_aide_verify_aureport:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_aide_verify_augenrules:tst:1" version="1" check_existence="all_exist" check="all" comment="augenrules is checked in /etc/aide.conf">
                <ind-def:object object_ref="oval:ssg-object_aide_verify_augenrules:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_aide_verify_auditd:tst:1" version="1" check_existence="all_exist" check="all" comment="auditd is checked in /etc/aide.conf">
                <ind-def:object object_ref="oval:ssg-object_aide_verify_auditd:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_aide_verify_auditctl:tst:1" version="1" check_existence="all_exist" check="all" comment="auditctl is checked in /etc/aide.conf">
                <ind-def:object object_ref="oval:ssg-object_aide_verify_auditctl:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_aide_verify_audispd:tst:1" version="1" check_existence="all_exist" check="all" comment="audispd is checked in /etc/aide.conf">
                <ind-def:object object_ref="oval:ssg-object_aide_verify_audispd:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_aide_var_cron_checking:tst:1" version="1" check_existence="all_exist" check="all" comment="run aide with cron">
                <ind-def:object object_ref="oval:ssg-object_aide_var_cron_checking:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_aide_periodic_cron_checking:tst:1" version="1" check_existence="all_exist" check="all" comment="run aide with cron">
                <ind-def:object object_ref="oval:ssg-object_test_aide_periodic_cron_checking:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_aide_operational_database_absolute_path:tst:1" version="1" check_existence="all_exist" check="all" comment="Testing existence of operational aide database file">
                <unix-def:object object_ref="oval:ssg-object_aide_operational_database_absolute_path:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_aide_crontabs_checking:tst:1" version="2" check_existence="all_exist" check="all" comment="run aide with cron.(daily|weekly)">
                <ind-def:object object_ref="oval:ssg-object_aide_crontabs_checking:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_aide_crond_checking:tst:1" version="1" check_existence="all_exist" check="all" comment="run aide with cron">
                <ind-def:object object_ref="oval:ssg-object_test_aide_crond_checking:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_aide_build_new_database_absolute_path:tst:1" version="1" check_existence="all_exist" check="all" comment="Testing existence of new aide database file">
                <unix-def:object object_ref="oval:ssg-object_aide_build_new_database_absolute_path:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1" version="1" check_existence="none_exist" check="all" comment="Check if there aren't directories in root's path having write permission set for group or other">
                <unix-def:object object_ref="oval:ssg-object_accounts_root_path_dirs_no_group_other_write:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_root_gid_zero:tst:1" version="1" check="all" comment="test that there are no accounts with UID 0 except root in the /etc/passwd file">
                <ind-def:object object_ref="oval:ssg-object_accounts_root_gid_zero:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_root_gid_zero:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_unix_auth:tst:1" version="1" check_existence="none_exist" check="all" comment="No more than one pam_unix.so is expected in auth section of system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_unix_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_auth:tst:1" version="1" check_existence="all_exist" check="all" comment="One and only one occurrence is expected in auth section of system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_account:tst:1" version="1" check_existence="all_exist" check="all" comment="One and only one occurrence is expected in auth section of system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_account:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_unix_auth:tst:1" version="1" check_existence="none_exist" check="all" comment="No more than one pam_unix.so is expected in auth section of password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_unix_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_auth:tst:1" version="1" check_existence="all_exist" check="all" comment="One and only one occurrence is expected in auth section of password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_account:tst:1" version="1" check_existence="all_exist" check="all" comment="One and only one occurrence is expected in auth section of password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_account:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_system:tst:1" version="1" check_existence="all_exist" check="all" comment="Check the expected unlock_time value in system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_system:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_unlock_time_parameter_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_password:tst:1" version="1" check_existence="all_exist" check="all" comment="Check the expected unlock_time value in password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_password:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_unlock_time_parameter_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_pamd_system:tst:1" version="1" check_existence="none_exist" check="all" comment="Check the absence of unlock_time parameter in system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_system:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_pamd_password:tst:1" version="1" check_existence="none_exist" check="all" comment="Check the absence of unlock_time parameter in password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_password:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_faillock_conf:tst:1" version="1" check_existence="none_exist" check="all" comment="Check the absence of unlock_time parameter in /etc/security/faillock.conf">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_faillock_conf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_faillock_conf:tst:1" version="1" check_existence="all_exist" check="all" comment="Check the expected unlock_time value in in /etc/security/faillock.conf">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_faillock_conf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_unlock_time_parameter_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_unix_auth:tst:1" version="1" check_existence="none_exist" check="all" comment="No more than one pam_unix.so is expected in auth section of system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_interval_system_pam_unix_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_faillock_auth:tst:1" version="1" check_existence="all_exist" check="all" comment="One and only one occurrence is expected in auth section of system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_interval_system_pam_faillock_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_faillock_account:tst:1" version="1" check_existence="all_exist" check="all" comment="One and only one occurrence is expected in auth section of system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_interval_system_pam_faillock_account:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_unix_auth:tst:1" version="1" check_existence="none_exist" check="all" comment="No more than one pam_unix.so is expected in auth section of password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_interval_password_pam_unix_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_faillock_auth:tst:1" version="1" check_existence="all_exist" check="all" comment="One and only one occurrence is expected in auth section of password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_interval_password_pam_faillock_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_faillock_account:tst:1" version="1" check_existence="all_exist" check="all" comment="One and only one occurrence is expected in auth section of password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_interval_password_pam_faillock_account:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_pamd_system:tst:1" version="1" check_existence="all_exist" check="all" comment="Check the expected fail_interval value in system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_pamd_system:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_interval_parameter_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_pamd_password:tst:1" version="1" check_existence="all_exist" check="all" comment="Check the expected fail_interval value in password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_pamd_password:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_interval_parameter_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_pamd_system:tst:1" version="1" check_existence="none_exist" check="all" comment="Check the absence of fail_interval parameter in system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_pamd_system:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_pamd_password:tst:1" version="1" check_existence="none_exist" check="all" comment="Check the absence of fail_interval parameter in password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_pamd_password:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_faillock_conf:tst:1" version="1" check_existence="none_exist" check="all" comment="Check the absence of fail_interval parameter in /etc/security/faillock.conf">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_faillock_conf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_faillock_conf:tst:1" version="1" check_existence="all_exist" check="all" comment="Check the expected fail_interval value in in /etc/security/faillock.conf">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_faillock_conf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_interval_parameter_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_system_pam_unix_auth:tst:1" version="1" check_existence="none_exist" check="all" comment="No more than one pam_unix.so is expected in auth section of system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_system_pam_unix_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_system_pam_faillock_auth:tst:1" version="1" check_existence="all_exist" check="all" comment="One and only one pattern occurrence is expected in auth section of system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_system_pam_faillock_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_system_pam_faillock_account:tst:1" version="1" check_existence="all_exist" check="all" comment="One and only one pattern occurrence is expected in account section of system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_system_pam_faillock_account:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_password_pam_unix_auth:tst:1" version="1" check_existence="none_exist" check="all" comment="No more than one pam_unix.so is expected in auth section of password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_password_pam_unix_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_password_pam_faillock_auth:tst:1" version="1" check_existence="all_exist" check="all" comment="One and only one pattern occurrence is expected in auth section of system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_password_pam_faillock_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_password_pam_faillock_account:tst:1" version="1" check_existence="all_exist" check="all" comment="One and only one pattern occurrence is expected in account section of password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_password_pam_faillock_account:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_parameter_faillock_conf:tst:1" version="1" check_existence="all_exist" check="all" comment="Check the expected local_users_only parameter in /etc/security/faillock.conf">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_parameter_faillock_conf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_unix_auth:tst:1" version="1" check_existence="none_exist" check="all" comment="No more than one pam_unix.so is expected in auth section of system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_unix_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_faillock_auth:tst:1" version="1" check_existence="only_one_exists" check="all" comment="One and only one occurrence is expected in auth section of system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_faillock_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_faillock_account:tst:1" version="1" check_existence="only_one_exists" check="all" comment="One and only one occurrence is expected in auth section of system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_faillock_account:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_system_pam_unix_auth:tst:1" version="1" check_existence="none_exist" check="all" comment="No more than one pam_unix.so is expected in auth section of system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_system_pam_unix_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_auth:tst:1" version="1" check_existence="only_one_exists" check="all" comment="One and only one pattern occurrence is expected in auth section of system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_account:tst:1" version="1" check_existence="only_one_exists" check="all" comment="One and only one pattern occurrence is expected in account section of system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_account:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_password_pam_unix_auth:tst:1" version="1" check_existence="none_exist" check="all" comment="No more than one pam_unix.so is expected in auth section of password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_password_pam_unix_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_auth:tst:1" version="1" check_existence="only_one_exists" check="all" comment="One and only one pattern occurrence is expected in auth section of system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_account:tst:1" version="1" check_existence="only_one_exists" check="all" comment="One and only one pattern occurrence is expected in account section of password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_account:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_pamd_system:tst:1" version="1" check_existence="all_exist" check="all" comment="Check the expected even_deny_root parameter in system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_pamd_system:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_pamd_password:tst:1" version="1" check_existence="all_exist" check="all" comment="Check the expected even_deny_root parameter in password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_pamd_password:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_no_pamd_system:tst:1" version="1" check_existence="none_exist" check="all" comment="Check the absence of even_deny_root parameter in system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_pamd_system:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_no_pamd_password:tst:1" version="1" check_existence="none_exist" check="all" comment="Check the absence of even_deny_root parameter in password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_pamd_password:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_no_faillock_conf:tst:1" version="1" check_existence="none_exist" check="all" comment="Check the absence of even_deny_root parameter in /etc/security/faillock.conf">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_faillock_conf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_faillock_conf:tst:1" version="1" check_existence="all_exist" check="all" comment="Check the expected even_deny_root parameter in /etc/security/faillock.conf">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_faillock_conf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_unix_auth:tst:1" version="1" check_existence="none_exist" check="all" comment="No more than one pam_unix.so is expected in auth section of password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_unix_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_faillock_auth:tst:1" version="1" check_existence="only_one_exists" check="all" comment="One and only one occurrence is expected in auth section of password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_faillock_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_faillock_account:tst:1" version="1" check_existence="only_one_exists" check="all" comment="One and only one occurrence is expected in auth section of password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_faillock_account:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_pamd_system:tst:1" version="1" check_existence="all_exist" check="all" comment="Check the expected deny value in system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_system:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_deny_parameter_upper_bound:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_deny_parameter_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_pamd_password:tst:1" version="1" check_existence="all_exist" check="all" comment="Check the expected deny value in password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_password:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_deny_parameter_upper_bound:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_deny_parameter_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_pamd_system:tst:1" version="1" check_existence="none_exist" check="all" comment="Check the absence of deny parameter in system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_system:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_pamd_password:tst:1" version="1" check_existence="none_exist" check="all" comment="Check the absence of deny parameter in password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_password:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_faillock_conf:tst:1" version="1" check_existence="none_exist" check="all" comment="Check the absence of deny parameter in /etc/security/faillock.conf">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_faillock_conf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_faillock_conf:tst:1" version="1" check_existence="all_exist" check="all" comment="Check the expected deny value in in /etc/security/faillock.conf">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_faillock_conf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_deny_parameter_upper_bound:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_deny_parameter_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_unix_remember:tst:1" version="1" check_existence="all_exist" check="all" comment="Test if remember attribute of pam_unix.so is set correctly in /etc/pam.d/system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_password_pam_unix_remember:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_password_pam_unix_remember:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_pwquality_system_auth:tst:1" version="1" check_existence="only_one_exists" check="all" comment="check the configuration of /etc/pam.d/system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_password_pam_pwquality_system_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_pwquality_password_auth:tst:1" version="1" check_existence="only_one_exists" check="all" comment="check the configuration of /etc/pam.d/password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_password_pam_pwquality_password_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth">
                <ind-def:object object_ref="oval:ssg-obj_accounts_password_pam_pwhistory_remember_system_auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_password_pam_pwhistory_remember_system_auth:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/password-auth">
                <ind-def:object object_ref="oval:ssg-obj_accounts_password_pam_pwhistory_remember_password_auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_password_pam_pwhistory_remember_password_auth:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_pwhistory_remember:tst:1" version="1" check_existence="all_exist" check="all" comment="Test if remember attribute of pam_pwhistory.so is set correctly in /etc/pam.d/system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_password_pam_pwhistory_remember:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_password_pam_unix_remember:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_faillock:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth">
                <ind-def:object object_ref="oval:ssg-obj_accounts_password_pam_faillock:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_enforce_root:tst:1" version="1" check="all" comment="tests the presence of 'enforce_for_root' setting in the /etc/security/pwquality.conf file">
                <ind-def:object object_ref="oval:ssg-obj_accounts_password_pam_enforce_root:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_enforce_local:tst:1" version="1" check="all" comment="tests the presence of 'local_users_only' setting in the /etc/security/pwquality.conf file">
                <ind-def:object object_ref="oval:ssg-obj_accounts_password_pam_enforce_local:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:shadow_test id="oval:ssg-test_accounts_password_all_shadowed_sha512:tst:1" version="1" check_existence="none_exist" check="all" comment="password hashes are shadowed using sha512">
                <unix-def:object object_ref="oval:ssg-object_accounts_password_all_shadowed_sha512:obj:1"/>
              </unix-def:shadow_test>
              <unix-def:password_test id="oval:ssg-test_accounts_password_all_shadowed:tst:1" version="1" check="all" comment="password hashes are shadowed">
                <unix-def:object object_ref="oval:ssg-object_accounts_password_all_shadowed:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_accounts_password_all_shadowed:ste:1"/>
              </unix-def:password_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_no_uid_except_root:tst:1" version="1" check_existence="none_exist" check="all" comment="test that there are no accounts with UID 0 except root in the /etc/passwd file">
                <ind-def:object object_ref="oval:ssg-object_accounts_no_uid_except_root:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_logon_fail_delay:tst:1" version="1" check_existence="all_exist" check="all" comment="check FAIL_DELAY in /etc/login.defs">
                <ind-def:object object_ref="oval:ssg-object_accounts_logon_fail_delay:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_logon_fail_delay:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_have_homedir_login_defs:tst:1" version="1" check_existence="all_exist" check="all" comment="Check value of CREATE_HOME in /etc/login.defs">
                <ind-def:object object_ref="oval:ssg-obj_accounts_have_homedir_login_defs:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_authorized_local_users:tst:1" version="1" check_existence="any_exist" check="all" comment="query /etc/passwd">
                <ind-def:object object_ref="oval:ssg-object_accounts_authorized_local_users:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_authorized_local_users:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_PAE_NX_cpu_support:tst:1" version="1" check_existence="all_exist" check="all" comment="CPUs support PAE kernel or NX bit">
                <ind-def:object object_ref="oval:ssg-obj_PAE_NX_cpu_support:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_NX_cpu_support:tst:1" version="1" check_existence="all_exist" check="all" comment="CPUs support for NX bit">
                <ind-def:object object_ref="oval:ssg-obj_NX_cpu_support:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_unlinkat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_unlinkat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_unlinkat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_unlinkat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_unlink_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_unlink_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_unlink_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_unlink_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_truncate_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_truncate_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_truncate_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_truncate_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_setxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_setxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_setxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_setxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_renameat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_renameat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_renameat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_renameat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_rename_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_rename_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_rename_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_rename_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_removexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_removexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_removexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_removexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_openat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_openat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_openat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_openat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_open_by_handle_at_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_open_by_handle_at_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_open_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_open_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_open_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_open_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_lsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_lsetxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_lsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_lsetxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_lremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_lremovexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_lremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_lremovexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_lchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_lchown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_lchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_lchown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_ftruncate_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_ftruncate_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_ftruncate_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_ftruncate_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_fsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_fsetxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_fsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_fsetxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_fremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_fremovexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_fremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_fremovexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_fchownat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchownat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_fchownat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchownat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_fchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_fchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_fchmodat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchmodat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_fchmodat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchmodat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_fchmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchmod_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_fchmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchmod_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_creat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_creat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_creat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_creat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_chown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_chown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_chown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_chown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_chmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_chmod_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_chmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_chmod_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_unlinkat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_unlinkat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_unlinkat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_unlinkat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_unlink_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_unlink_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_unlink_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_unlink_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_truncate_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_truncate_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_truncate_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_truncate_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_setxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_setxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_setxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_setxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_renameat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_renameat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_renameat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_renameat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_rename_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_rename_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_rename_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_rename_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_removexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_removexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_removexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_removexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_openat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_openat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_openat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_openat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_open_by_handle_at_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_open_by_handle_at_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_open_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_open_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_open_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_open_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_lsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_lsetxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_lsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_lsetxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_lremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_lremovexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_lremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_lremovexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_lchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_lchown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_lchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_lchown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_ftruncate_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_ftruncate_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_ftruncate_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_ftruncate_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_fsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_fsetxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_fsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_fsetxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_fremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_fremovexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_fremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_fremovexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_fchownat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchownat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_fchownat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchownat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_fchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_fchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_fchmodat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchmodat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_fchmodat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchmodat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_fchmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchmod_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_fchmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchmod_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_creat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_creat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_creat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_creat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_chown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_chown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_chown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_chown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_chmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_chmod_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_chmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_chmod_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_art_settimeofday_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit settimeofday">
                <ind-def:object object_ref="oval:ssg-object_64bit_art_settimeofday_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_art_settimeofday_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit settimeofday">
                <ind-def:object object_ref="oval:ssg-object_64bit_art_settimeofday_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_art_clock_settime_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit clock_settime">
                <ind-def:object object_ref="oval:ssg-object_64bit_art_clock_settime_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_art_clock_settime_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit clock_settime">
                <ind-def:object object_ref="oval:ssg-object_64bit_art_clock_settime_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_art_adjtimex_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit adjtimex">
                <ind-def:object object_ref="oval:ssg-object_64bit_art_adjtimex_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_art_adjtimex_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit adjtimex">
                <ind-def:object object_ref="oval:ssg-object_64bit_art_adjtimex_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_unlinkat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit unlinkat">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_unlinkat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_unlinkat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit unlinkat">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_unlinkat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_unlink_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit unlink">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_unlink_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_unlink_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit unlink">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_unlink_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_umount2_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit umount2">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_umount2_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_umount2_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit umount2">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_umount2_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_setxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit setxattr">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_setxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_setxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit setxattr">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_setxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_sethostname_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit sethostname">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_sethostname_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_sethostname_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit sethostname">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_sethostname_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_setdomainname_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit setdomainname">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_setdomainname_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_setdomainname_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit setdomainname">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_setdomainname_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_rmdir_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit rmdir">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_rmdir_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_rmdir_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit rmdir">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_rmdir_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_renameat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit renameat">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_renameat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_renameat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit renameat">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_renameat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_rename_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit rename">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_rename_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_rename_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit rename">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_rename_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_removexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit removexattr">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_removexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_removexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit removexattr">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_removexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_mount_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit mount">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_mount_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_mount_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit mount">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_mount_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_lsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit lsetxattr">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_lsetxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_lsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit lsetxattr">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_lsetxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_lremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit lremovexattr">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_lremovexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_lremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit lremovexattr">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_lremovexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_lchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit lchown">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_lchown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_lchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit lchown">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_lchown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_init_module_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit init_module">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_init_module_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_init_module_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit init_module">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_init_module_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit fsetxattr">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_fsetxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit fsetxattr">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_fsetxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit fremovexattr">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_fremovexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit fremovexattr">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_fremovexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_finit_module_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit finit_module">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_finit_module_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_finit_module_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit finit_module">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_finit_module_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fchownat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit fchownat">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_fchownat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fchownat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit fchownat">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_fchownat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit fchown">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_fchown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit fchown">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_fchown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fchmodat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit fchmodat">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_fchmodat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fchmodat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit fchmodat">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_fchmodat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fchmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit fchmod">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_fchmod_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fchmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit fchmod">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_fchmod_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_delete_module_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit delete_module">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_delete_module_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_delete_module_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit delete_module">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_delete_module_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_chown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit chown">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_chown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_chown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit chown">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_chown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_chmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit chmod">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_chmod_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_chmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit chmod">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_chmod_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_unlinkat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_unlinkat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_unlinkat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_unlinkat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_unlink_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_unlink_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_unlink_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_unlink_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_truncate_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_truncate_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_truncate_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_truncate_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_setxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_setxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_setxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_setxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_renameat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_renameat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_renameat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_renameat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_rename_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_rename_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_rename_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_rename_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_removexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_removexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_removexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_removexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_openat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_openat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_openat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_openat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_open_by_handle_at_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_open_by_handle_at_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_open_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_open_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_open_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_open_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_lsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_lsetxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_lsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_lsetxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_lremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_lremovexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_lremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_lremovexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_lchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_lchown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_lchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_lchown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_ftruncate_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_ftruncate_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_ftruncate_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_ftruncate_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_fsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_fsetxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_fsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_fsetxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_fremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_fremovexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_fremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_fremovexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_fchownat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchownat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_fchownat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchownat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_fchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_fchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_fchmodat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchmodat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_fchmodat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchmodat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_fchmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchmod_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_fchmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchmod_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_creat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_creat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_creat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_creat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_chown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_chown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_chown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_chown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_chmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_chmod_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_chmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_chmod_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_unlinkat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_unlinkat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_unlinkat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_unlinkat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_unlink_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_unlink_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_unlink_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_unlink_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_truncate_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_truncate_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_truncate_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_truncate_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_setxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_setxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_setxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_setxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_renameat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_renameat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_renameat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_renameat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_rename_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_rename_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_rename_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_rename_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_removexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_removexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_removexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_removexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_openat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_openat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_openat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_openat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_open_by_handle_at_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_open_by_handle_at_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_open_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_open_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_open_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_open_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_lsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_lsetxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_lsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_lsetxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_lremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_lremovexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_lremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_lremovexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_lchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_lchown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_lchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_lchown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_ftruncate_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_ftruncate_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_ftruncate_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_ftruncate_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_fsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_fsetxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_fsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_fsetxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_fremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_fremovexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_fremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_fremovexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_fchownat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchownat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_fchownat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchownat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_fchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_fchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_fchmodat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchmodat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_fchmodat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchmodat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_fchmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchmod_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_fchmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchmod_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_creat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_creat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_creat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_creat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_chown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_chown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_chown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_chown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_chmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_chmod_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_chmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_chmod_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_art_stime_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit stime">
                <ind-def:object object_ref="oval:ssg-object_32bit_art_stime_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_art_stime_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit stime">
                <ind-def:object object_ref="oval:ssg-object_32bit_art_stime_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_art_settimeofday_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit settimeofday">
                <ind-def:object object_ref="oval:ssg-object_32bit_art_settimeofday_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_art_settimeofday_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit settimeofday">
                <ind-def:object object_ref="oval:ssg-object_32bit_art_settimeofday_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_art_clock_settime_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit clock_settime">
                <ind-def:object object_ref="oval:ssg-object_32bit_art_clock_settime_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_art_clock_settime_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit clock_settime">
                <ind-def:object object_ref="oval:ssg-object_32bit_art_clock_settime_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_art_adjtimex_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit adjtimex">
                <ind-def:object object_ref="oval:ssg-object_32bit_art_adjtimex_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_art_adjtimex_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit adjtimex">
                <ind-def:object object_ref="oval:ssg-object_32bit_art_adjtimex_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_unlinkat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit unlinkat">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_unlinkat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_unlinkat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit unlinkat">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_unlinkat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_unlink_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit unlink">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_unlink_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_unlink_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit unlink">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_unlink_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_umount_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit umount">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_umount_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_umount_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit umount">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_umount_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_umount2_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit umount2">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_umount2_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_umount2_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit umount2">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_umount2_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_setxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit setxattr">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_setxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_setxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit setxattr">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_setxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_sethostname_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit sethostname">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_sethostname_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_sethostname_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit sethostname">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_sethostname_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_setdomainname_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit setdomainname">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_setdomainname_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_setdomainname_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit setdomainname">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_setdomainname_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_rmdir_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit rmdir">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_rmdir_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_rmdir_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit rmdir">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_rmdir_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_renameat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit renameat">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_renameat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_renameat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit renameat">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_renameat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_rename_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit rename">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_rename_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_rename_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit rename">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_rename_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_removexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit removexattr">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_removexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_removexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit removexattr">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_removexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_mount_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit mount">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_mount_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_mount_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit mount">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_mount_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_lsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit lsetxattr">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_lsetxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_lsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit lsetxattr">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_lsetxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_lremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit lremovexattr">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_lremovexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_lremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit lremovexattr">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_lremovexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_lchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit lchown">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_lchown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_lchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit lchown">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_lchown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_init_module_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit init_module">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_init_module_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_init_module_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit init_module">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_init_module_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit fsetxattr">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_fsetxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit fsetxattr">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_fsetxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit fremovexattr">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_fremovexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit fremovexattr">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_fremovexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_finit_module_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit finit_module">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_finit_module_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_finit_module_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit finit_module">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_finit_module_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fchownat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit fchownat">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_fchownat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fchownat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit fchownat">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_fchownat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit fchown">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_fchown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit fchown">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_fchown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fchmodat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit fchmodat">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_fchmodat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fchmodat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit fchmodat">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_fchmodat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fchmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit fchmod">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_fchmod_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fchmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit fchmod">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_fchmod_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_delete_module_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit delete_module">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_delete_module_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_delete_module_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit delete_module">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_delete_module_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_chown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit chown">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_chown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_chown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit chown">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_chown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_chmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit chmod">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_chmod_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_chmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit chmod">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_chmod_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-no_files_unowned_by_user_test:tst:1" version="1" check_existence="none_exist" check="all" comment="Check user ids on all files on the system">
                <unix-def:object object_ref="oval:ssg-file_permissions_unowned_object:obj:1"/>
              </unix-def:file_test>
            </tests>
            <objects>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_vm_mmap_min_addr:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_vm_mmap_min_addr:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_vm_mmap_min_addr:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_user_max_user_namespaces:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_user_max_user_namespaces:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_user_max_user_namespaces:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_default_router_solicitations:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_default_router_solicitations:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_default_router_solicitations:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_default_max_addresses:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_default_max_addresses:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_default_max_addresses:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_default_disable_ipv6:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_default_disable_ipv6:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_default_disable_ipv6:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_default_autoconf:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_default_autoconf:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_default_autoconf:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_default_accept_redirects:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_default_accept_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_default_accept_redirects:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_default_accept_ra_pinfo:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_default_accept_ra_pinfo:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_default_accept_ra_defrtr:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_default_accept_ra_defrtr:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_default_accept_ra:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_default_accept_ra:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_default_accept_ra:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_all_router_solicitations:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_all_router_solicitations:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_all_router_solicitations:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_all_max_addresses:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_all_max_addresses:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_all_max_addresses:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_all_disable_ipv6:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_all_disable_ipv6:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_all_disable_ipv6:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_all_autoconf:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_all_autoconf:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_all_autoconf:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_all_accept_ra_pinfo:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_all_accept_ra_pinfo:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv6_conf_all_accept_ra_defrtr:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv6_conf_all_accept_ra_defrtr:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv4_tcp_syncookies:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv4_tcp_syncookies:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv4_tcp_syncookies:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv4_ip_local_port_range:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv4_ip_local_port_range:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv4_ip_local_port_range:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv4_ip_forward:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv4_ip_forward:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv4_ip_forward:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_default_shared_media:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_default_shared_media:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_default_shared_media:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_default_send_redirects:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_default_send_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_default_send_redirects:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_default_secure_redirects:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_default_secure_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_default_secure_redirects:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_default_rp_filter:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_default_rp_filter:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_default_rp_filter:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_default_log_martians:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_default_log_martians:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_default_log_martians:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_default_accept_source_route:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_default_accept_source_route:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_default_accept_source_route:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_default_accept_redirects:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_default_accept_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_default_accept_redirects:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_all_shared_media:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_all_shared_media:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_all_shared_media:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_all_send_redirects:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_all_send_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_all_send_redirects:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_all_secure_redirects:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_all_secure_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_all_secure_redirects:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_all_rp_filter:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_all_rp_filter:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_all_rp_filter:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_all_route_localnet:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_all_route_localnet:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_all_route_localnet:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_all_log_martians:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_all_log_martians:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_all_log_martians:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_all_arp_ignore:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_all_arp_ignore:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_all_arp_ignore:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_all_arp_filter:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_all_arp_filter:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_all_arp_filter:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_all_accept_source_route:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_all_accept_source_route:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_all_accept_source_route:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_all_accept_redirects:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_all_accept_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_all_accept_redirects:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_ipv4_conf_all_accept_local:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_ipv4_conf_all_accept_local:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_ipv4_conf_all_accept_local:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_net_core_bpf_jit_harden:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_net_core_bpf_jit_harden:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_net_core_bpf_jit_harden:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_kernel_yama_ptrace_scope:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_kernel_yama_ptrace_scope:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_kernel_yama_ptrace_scope:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_kernel_unprivileged_bpf_disabled:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_kernel_unprivileged_bpf_disabled:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_kernel_unprivileged_bpf_disabled:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_kernel_sysrq:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_kernel_sysrq:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_kernel_sysrq:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_kernel_randomize_va_space:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_kernel_randomize_va_space:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_kernel_randomize_va_space:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_kernel_pid_max:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_kernel_pid_max:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_kernel_pid_max:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_kernel_perf_event_paranoid:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_kernel_perf_event_paranoid:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_kernel_perf_event_paranoid:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_kernel_perf_event_max_sample_rate:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_kernel_perf_event_max_sample_rate:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_kernel_perf_event_max_sample_rate:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_kernel_perf_cpu_time_max_percent:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_kernel_perf_cpu_time_max_percent:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_kernel_perf_cpu_time_max_percent:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_kernel_panic_on_oops:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_kernel_panic_on_oops:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_kernel_panic_on_oops:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_kernel_modules_disabled:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_kernel_modules_disabled:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_kernel_modules_disabled:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_kernel_kptr_restrict:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_kernel_kptr_restrict:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_kernel_kptr_restrict:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_kernel_kexec_load_disabled:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_kernel_kexec_load_disabled:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_kernel_kexec_load_disabled:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_kernel_dmesg_restrict:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_kernel_dmesg_restrict:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_kernel_dmesg_restrict:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_kernel_core_pattern:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_kernel_core_pattern:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_kernel_core_pattern:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_fs_suid_dumpable:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_fs_suid_dumpable:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_fs_suid_dumpable:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_fs_protected_symlinks:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_fs_protected_symlinks:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_fs_protected_symlinks:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_fs_protected_regular:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_fs_protected_regular:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_fs_protected_regular:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_fs_protected_hardlinks:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_fs_protected_hardlinks:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_fs_protected_hardlinks:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_object_symlink_fs_protected_fifos:obj:1" version="1" comment="combine the blank string with symlink paths found">
                <set>
                  <object_reference>oval:ssg-var_obj_symlink_fs_protected_fifos:obj:1</object_reference>
                  <object_reference>oval:ssg-var_obj_blank_fs_protected_fifos:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_vm_mmap_min_addr:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_vm_mmap_min_addr:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_user_max_user_namespaces:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_user_max_user_namespaces:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_default_router_solicitations:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_default_router_solicitations:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_default_max_addresses:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_default_max_addresses:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_default_disable_ipv6:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_default_disable_ipv6:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_default_autoconf:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_default_autoconf:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_default_accept_redirects:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_default_accept_redirects:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_default_accept_ra_rtr_pref:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_default_accept_ra_pinfo:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_default_accept_ra_defrtr:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_default_accept_ra:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_default_accept_ra:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_all_router_solicitations:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_all_router_solicitations:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_all_max_addresses:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_all_max_addresses:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_all_disable_ipv6:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_all_disable_ipv6:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_all_autoconf:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_all_autoconf:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_all_accept_ra_rtr_pref:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_all_accept_ra_pinfo:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv6_conf_all_accept_ra_defrtr:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_tcp_syncookies:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv4_tcp_syncookies:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_ip_local_port_range:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv4_ip_local_port_range:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_ip_forward:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv4_ip_forward:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv4_icmp_ignore_bogus_error_responses:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv4_icmp_echo_ignore_broadcasts:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_default_shared_media:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_default_shared_media:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_default_send_redirects:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_default_send_redirects:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_default_secure_redirects:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_default_secure_redirects:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_default_rp_filter:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_default_rp_filter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_default_log_martians:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_default_log_martians:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_default_accept_source_route:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_default_accept_source_route:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_default_accept_redirects:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_default_accept_redirects:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_all_shared_media:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_all_shared_media:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_all_send_redirects:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_all_send_redirects:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_all_secure_redirects:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_all_secure_redirects:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_all_rp_filter:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_all_rp_filter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_all_route_localnet:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_all_route_localnet:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_all_log_martians:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_all_log_martians:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_all_drop_gratuitous_arp:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_all_arp_ignore:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_all_arp_ignore:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_all_arp_filter:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_all_arp_filter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_all_accept_source_route:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_all_accept_source_route:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_all_accept_redirects:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_all_accept_redirects:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_ipv4_conf_all_accept_local:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_ipv4_conf_all_accept_local:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_net_core_bpf_jit_harden:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_net_core_bpf_jit_harden:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_kernel_yama_ptrace_scope:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_kernel_yama_ptrace_scope:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_kernel_unprivileged_bpf_disabled:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_kernel_unprivileged_bpf_disabled:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_kernel_sysrq:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_kernel_sysrq:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_kernel_randomize_va_space:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_kernel_randomize_va_space:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_kernel_pid_max:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_kernel_pid_max:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_kernel_perf_event_paranoid:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_kernel_perf_event_paranoid:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_kernel_perf_event_max_sample_rate:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_kernel_perf_event_max_sample_rate:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_kernel_perf_cpu_time_max_percent:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_kernel_perf_cpu_time_max_percent:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_kernel_panic_on_oops:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_kernel_panic_on_oops:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_kernel_modules_disabled:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_kernel_modules_disabled:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_kernel_kptr_restrict:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_kernel_kptr_restrict:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_kernel_kexec_load_disabled:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_kernel_kexec_load_disabled:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_kernel_dmesg_restrict:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_kernel_dmesg_restrict:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_kernel_core_pattern:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_kernel_core_pattern:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_fs_suid_dumpable:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_fs_suid_dumpable:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_fs_protected_symlinks:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_fs_protected_symlinks:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_fs_protected_regular:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_fs_protected_regular:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_fs_protected_hardlinks:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_fs_protected_hardlinks:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_symlink_fs_protected_fifos:obj:1" version="1" comment="variable object of the symlinks found">
                <ind-def:var_ref>oval:ssg-local_var_symlinks_fs_protected_fifos:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_vm_mmap_min_addr:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_vm_mmap_min_addr:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_user_max_user_namespaces:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_user_max_user_namespaces:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_default_router_solicitations:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_default_router_solicitations:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_default_max_addresses:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_default_max_addresses:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_default_disable_ipv6:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_default_disable_ipv6:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_default_autoconf:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_default_autoconf:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_default_accept_redirects:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_default_accept_redirects:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_default_accept_ra_rtr_pref:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_default_accept_ra_pinfo:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_default_accept_ra_defrtr:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_default_accept_ra:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_default_accept_ra:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_all_router_solicitations:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_all_router_solicitations:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_all_max_addresses:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_all_max_addresses:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_all_disable_ipv6:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_all_disable_ipv6:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_all_autoconf:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_all_autoconf:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_all_accept_ra_rtr_pref:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_all_accept_ra_pinfo:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv6_conf_all_accept_ra_defrtr:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv4_tcp_syncookies:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv4_tcp_syncookies:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv4_ip_local_port_range:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv4_ip_local_port_range:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv4_ip_forward:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv4_ip_forward:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv4_icmp_ignore_bogus_error_responses:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv4_icmp_echo_ignore_broadcasts:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_default_shared_media:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_default_shared_media:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_default_send_redirects:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_default_send_redirects:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_default_secure_redirects:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_default_secure_redirects:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_default_rp_filter:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_default_rp_filter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_default_log_martians:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_default_log_martians:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_default_accept_source_route:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_default_accept_source_route:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_default_accept_redirects:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_default_accept_redirects:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_all_shared_media:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_all_shared_media:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_all_send_redirects:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_all_send_redirects:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_all_secure_redirects:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_all_secure_redirects:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_all_rp_filter:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_all_rp_filter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_all_route_localnet:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_all_route_localnet:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_all_log_martians:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_all_log_martians:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_all_drop_gratuitous_arp:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_all_arp_ignore:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_all_arp_ignore:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_all_arp_filter:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_all_arp_filter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_all_accept_source_route:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_all_accept_source_route:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_all_accept_redirects:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_all_accept_redirects:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_ipv4_conf_all_accept_local:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_ipv4_conf_all_accept_local:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_net_core_bpf_jit_harden:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_net_core_bpf_jit_harden:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_kernel_yama_ptrace_scope:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_kernel_yama_ptrace_scope:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_kernel_unprivileged_bpf_disabled:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_kernel_unprivileged_bpf_disabled:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_kernel_sysrq:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_kernel_sysrq:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_kernel_randomize_va_space:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_kernel_randomize_va_space:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_kernel_pid_max:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_kernel_pid_max:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_kernel_perf_event_paranoid:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_kernel_perf_event_paranoid:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_kernel_perf_event_max_sample_rate:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_kernel_perf_event_max_sample_rate:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_kernel_perf_cpu_time_max_percent:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_kernel_perf_cpu_time_max_percent:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_kernel_panic_on_oops:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_kernel_panic_on_oops:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_kernel_modules_disabled:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_kernel_modules_disabled:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_kernel_kptr_restrict:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_kernel_kptr_restrict:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_kernel_kexec_load_disabled:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_kernel_kexec_load_disabled:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_kernel_dmesg_restrict:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_kernel_dmesg_restrict:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_kernel_core_pattern:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_kernel_core_pattern:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_fs_suid_dumpable:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_fs_suid_dumpable:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_fs_protected_symlinks:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_fs_protected_symlinks:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_fs_protected_regular:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_fs_protected_regular:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_fs_protected_hardlinks:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_fs_protected_hardlinks:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-var_obj_blank_fs_protected_fifos:obj:1" version="1" comment="variable object of the blank string">
                <ind-def:var_ref>oval:ssg-local_var_blank_path_fs_protected_fifos:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-root_or_ALL_in_runas_spec:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*((?!root\b)[\w]+)\s*(\w+)\s*=\s*(.*,)?\s*\([\w\s]*\b(root|ALL)\b[\w\s]*\)</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_vm_mmap_min_addr_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_vm_mmap_min_addr_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_user_max_user_namespaces_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_user_max_user_namespaces_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_default_router_solicitations_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_router_solicitations_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_default_max_addresses_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_max_addresses_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_default_disable_ipv6_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_disable_ipv6_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_default_autoconf_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_autoconf_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_default_accept_redirects_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_accept_redirects_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_default_accept_ra_pinfo_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_accept_ra_pinfo_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_default_accept_ra_defrtr_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_accept_ra_defrtr_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_default_accept_ra_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_accept_ra_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_all_router_solicitations_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_router_solicitations_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_all_max_addresses_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_max_addresses_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_all_disable_ipv6_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_disable_ipv6_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_all_autoconf_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_autoconf_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_all_accept_ra_pinfo_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_accept_ra_pinfo_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv6_conf_all_accept_ra_defrtr_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_accept_ra_defrtr_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv4_tcp_syncookies_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_tcp_syncookies_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv4_ip_local_port_range_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_ip_local_port_range_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv4_ip_forward_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_ip_forward_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_default_shared_media_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_shared_media_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_default_send_redirects_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_send_redirects_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_default_secure_redirects_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_secure_redirects_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_default_rp_filter_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_rp_filter_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_default_log_martians_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_log_martians_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_default_accept_source_route_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_accept_source_route_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_default_accept_redirects_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_accept_redirects_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_all_shared_media_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_shared_media_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_all_send_redirects_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_send_redirects_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_all_secure_redirects_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_secure_redirects_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_all_rp_filter_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_rp_filter_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_all_route_localnet_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_route_localnet_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_all_log_martians_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_log_martians_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_all_arp_ignore_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_arp_ignore_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_all_arp_filter_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_arp_filter_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_all_accept_source_route_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_accept_source_route_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_all_accept_redirects_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_accept_redirects_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_ipv4_conf_all_accept_local_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_accept_local_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_net_core_bpf_jit_harden_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_net_core_bpf_jit_harden_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_kernel_yama_ptrace_scope_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_kernel_yama_ptrace_scope_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_kernel_unprivileged_bpf_disabled_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_kernel_unprivileged_bpf_disabled_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_kernel_sysrq_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_kernel_sysrq_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_kernel_randomize_va_space_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_kernel_randomize_va_space_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_kernel_pid_max_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_kernel_pid_max_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_kernel_perf_event_paranoid_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_kernel_perf_event_paranoid_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_kernel_perf_event_max_sample_rate_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_kernel_perf_event_max_sample_rate_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_kernel_perf_cpu_time_max_percent_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_kernel_perf_cpu_time_max_percent_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_kernel_panic_on_oops_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_kernel_panic_on_oops_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_kernel_modules_disabled_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_kernel_modules_disabled_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_kernel_kptr_restrict_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_kernel_kptr_restrict_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_kernel_kexec_load_disabled_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_kernel_kexec_load_disabled_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_kernel_dmesg_restrict_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_kernel_dmesg_restrict_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_kernel_core_pattern_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_kernel_core_pattern_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_fs_suid_dumpable_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_fs_suid_dumpable_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_fs_protected_symlinks_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_fs_protected_symlinks_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_fs_protected_regular_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_fs_protected_regular_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_fs_protected_hardlinks_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_fs_protected_hardlinks_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-oject_sysctl_fs_protected_fifos_defined_in_one_file:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_unique_sysctl_fs_protected_fifos_counter:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_yum_ensure_gpgcheck_repo_metadata:obj:1" version="1" comment="repo_gpgcheck set in /etc/dnf/dnf.conf">
                <ind-def:filepath>/etc/dnf/dnf.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*repo_gpgcheck\s*=\s*(1|True|yes)\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_yum_ensure_gpgcheck_local_packages:obj:1" version="1" comment="localpkg_gpgcheck set in /etc/dnf/dnf.conf">
                <ind-def:filepath>/etc/dnf/dnf.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*localpkg_gpgcheck\s*=\s*(1|True|yes)\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_yum_clean_components_post_updating:obj:1" version="1" comment="clean_requirements_on_remove set in /etc/dnf/dnf.conf">
                <ind-def:filepath>/etc/dnf/dnf.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*clean_requirements_on_remove\s*=\s*(1|True|yes)\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:symlink_object id="oval:ssg-object_vm_mmap_min_addr_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_vm_mmap_min_addr:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_vm_mmap_min_addr:ste:1</filter>
              </unix-def:symlink_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_virtual_consoles_etc_securetty:obj:1" version="1" comment="virtual consoles /etc/securetty">
                <ind-def:filepath>/etc/securetty</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^vc/[0-9]+$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_vdsm_nopasswd_etc_sudoers_d:obj:1" version="1">
                <ind-def:path>/etc/sudoers.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^(?!(#|vdsm.*)).*[\s]+NOPASSWD[\s]*\:.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_vdsm_nopasswd_etc_sudoers:obj:1" version="1">
                <ind-def:filepath>/etc/sudoers</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?!(#|vdsm.*)).*[\s]+NOPASSWD[\s]*\:.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-object_var_umask_for_daemons_umask_as_number:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-var_umask_for_daemons_umask_as_number:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_rfp_syslog_config:obj:1" version="1" comment="Make variable object for use">
                <ind-def:var_ref>oval:ssg-var_rfp_syslog_config:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_rfp_include_config_regex:obj:1" version="1" comment="Make variable object from regex variable">
                <ind-def:var_ref>oval:ssg-var_rfp_include_config_regex:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_rfp_all_log_files:obj:1" version="1" comment="Filter out empty string">
                <set>
                  <object_reference>oval:ssg-object_var_rfp_include_config_regex:obj:1</object_reference>
                  <object_reference>oval:ssg-object_var_rfp_syslog_config:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_rfo_syslog_config:obj:1" version="1" comment="Make variable object for use">
                <ind-def:var_ref>oval:ssg-var_rfo_syslog_config:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_rfo_include_config_regex:obj:1" version="1" comment="Make variable object from regex variable">
                <ind-def:var_ref>oval:ssg-var_rfo_include_config_regex:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_rfo_all_log_files:obj:1" version="1" comment="Filter out empty string">
                <set>
                  <object_reference>oval:ssg-object_var_rfo_include_config_regex:obj:1</object_reference>
                  <object_reference>oval:ssg-object_var_rfo_syslog_config:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_rfg_syslog_config:obj:1" version="1" comment="Make variable object for use">
                <ind-def:var_ref>oval:ssg-var_rfg_syslog_config:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_rfg_include_config_regex:obj:1" version="1" comment="Make variable object from regex variable">
                <ind-def:var_ref>oval:ssg-var_rfg_include_config_regex:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_rfg_all_log_files:obj:1" version="1" comment="Filter out empty string">
                <set>
                  <object_reference>oval:ssg-object_var_rfg_include_config_regex:obj:1</object_reference>
                  <object_reference>oval:ssg-object_var_rfg_syslog_config:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_removable_partition_is_cd_dvd_drive:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-var_removable_partition:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <lin-def:partition_object id="oval:ssg-object_var_partition_nosuid_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/var</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_var_partition_noexec_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/var</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_var_partition_nodev_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/var</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_var_log_partition_nosuid_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/var/log</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_var_log_partition_noexec_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/var/log</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_var_log_partition_nodev_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/var/log</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_var_log_audit_partition_nosuid_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/var/log/audit</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_var_log_audit_partition_noexec_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/var/log/audit</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_var_log_audit_partition_nodev_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/var/log/audit</lin-def:mount_point>
              </lin-def:partition_object>
              <unix-def:file_object id="oval:ssg-object_var_log_audit_files:obj:1" version="1" comment="/var/log/audit files">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/var/log/audit</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_not_mode_0600:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_var_log_audit_files-non_root:obj:1" version="1" comment="/var/log/audit files">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/var/log/audit</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_not_mode_0640:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_var_log_audit_directory:obj:1" version="1" comment="/var/log/audit files">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/var/log/audit</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_not_mode_0700:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_var_log_audit_directory-non_root:obj:1" version="1" comment="/var/log/audit files">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/var/log/audit</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_not_mode_0750:ste:1</filter>
              </unix-def:file_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_x86_vsyscall_emulation_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_x86_vsyscall_emulation_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_vmap_stack_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_vmap_stack_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_unmap_kernel_at_el0_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_unmap_kernel_at_el0_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_syn_cookies_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_syn_cookies_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_strict_module_rwx_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_strict_module_rwx_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_strict_kernel_rwx_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_strict_kernel_rwx_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_stackprotector_strong_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_stackprotector_strong_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_stackprotector_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_stackprotector_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_slub_debug_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_slub_debug_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_slab_merge_default_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_slab_merge_default_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_slab_frelist_random_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_slab_frelist_random_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_slab_freelist_hardened_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_slab_freelist_hardened_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_security_yama_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_security_yama_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_security_writable_hooks_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_security_writable_hooks_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_security_dmesg_restrict_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_security_dmesg_restrict_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_security_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_security_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_seccomp_filter_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_seccomp_filter_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_seccomp_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_seccomp_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_sched_stack_end_check_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_sched_stack_end_check_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_retpoline_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_retpoline_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_refcount_full_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_refcount_full_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_randomize_memory_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_randomize_memory_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_randomize_base_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_randomize_base_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_proc_kcore_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_proc_kcore_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_panic_timeout_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_panic_timeout_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_panic_on_oops_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_panic_on_oops_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_page_table_isolation_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_page_table_isolation_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_page_poisoning_zero_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_page_poisoning_zero_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_page_poisoning_no_sanity_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_page_poisoning_no_sanity_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_page_poisoning_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_page_poisoning_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_module_sig_sha512_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_module_sig_sha512_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_module_sig_key_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_module_sig_key_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_module_sig_hash_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_module_sig_hash_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_module_sig_force_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_module_sig_force_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_module_sig_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_module_sig_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_module_sig_all_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_module_sig_all_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_modify_ldt_syscall_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_modify_ldt_syscall_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_legacy_vsyscall_xonly_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_legacy_vsyscall_xonly_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_legacy_vsyscall_none_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_legacy_vsyscall_none_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_legacy_vsyscall_emulate_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_legacy_vsyscall_emulate_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_legacy_ptys_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_legacy_ptys_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_kexec_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_kexec_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_ipv6_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_ipv6_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_ia32_emulation_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_ia32_emulation_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_hibernation_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_hibernation_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_hardened_usercopy_fallback_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_hardened_usercopy_fallback_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_hardened_usercopy_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_hardened_usercopy_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_gcc_plugin_structleak_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_gcc_plugin_structleak_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_gcc_plugin_structleak_byref_all_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_gcc_plugin_structleak_byref_all_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_gcc_plugin_stackleak_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_gcc_plugin_stackleak_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_gcc_plugin_randstruct_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_gcc_plugin_randstruct_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_gcc_plugin_latent_entropy_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_gcc_plugin_latent_entropy_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_fortify_source_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_fortify_source_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_devkmem_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_devkmem_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_default_mmap_min_addr_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_default_mmap_min_addr_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_debug_wx_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_debug_wx_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_debug_sg_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_debug_sg_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_debug_notifiers_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_debug_notifiers_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_debug_list_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_debug_list_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_debug_fs_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_debug_fs_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_debug_credentials_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_debug_credentials_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_compat_vdso_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_compat_vdso_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_compat_brk_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_compat_brk_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_bug_on_data_corruption_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_bug_on_data_corruption_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_bug_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_bug_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_binfmt_misc_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_binfmt_misc_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_arm64_sw_ttbr0_pan_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_arm64_sw_ttbr0_pan_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_kernel_config_acpi_custom_method_count:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_var_config_acpi_custom_method_count_kernels_installed:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_accounts_user_umask_umask_as_number:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-var_accounts_user_umask_umask_as_number:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <unix-def:symlink_object id="oval:ssg-object_user_max_user_namespaces_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_user_max_user_namespaces:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_user_max_user_namespaces:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:password_object id="oval:ssg-object_user_accounts:obj:1" version="1">
                <unix-def:username operation="pattern match">.*</unix-def:username>
              </unix-def:password_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_use_pty_sudoers:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/sudoers(|\.d/.*)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*Defaults.*\buse_pty.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_use_pam_wheel_for_su:obj:1" version="1" comment="check /etc/pam.d/su for correct setting">
                <ind-def:filepath>/etc/pam.d/su</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*auth[\s]+required[\s]+pam_wheel\.so[\s]+use_uid$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:family_object id="oval:ssg-object_unix_family:obj:1" version="1"/>
              <unix-def:password_object id="oval:ssg-object_uefi_user_accounts:obj:1" version="1">
                <unix-def:username operation="pattern match">.*</unix-def:username>
              </unix-def:password_object>
              <lin-def:partition_object id="oval:ssg-object_tmp_partition_nosuid_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/tmp</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_tmp_partition_noexec_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/tmp</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_tmp_partition_nodev_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/tmp</lin-def:mount_point>
              </lin-def:partition_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_test_sudoers_targetpw_config:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Defaults !targetpw$\r?\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_test_sudoers_runaspw_config:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Defaults !runaspw$\r?\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_test_sudoers_rootpw_config:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Defaults !rootpw$\r?\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_test_ftp_present_banner:obj:1" version="1" comment="Banner for FTP Users">
                <ind-def:filepath>/etc/vsftpd/vsftpd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*banner_file=/etc/issue[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_test_ftp_log_transactions_protocol:obj:1" version="1" comment="log ftp transactions">
                <ind-def:filepath>/etc/vsftpd/vsftpd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*log_ftp_protocol[\s]*=[\s]*YES$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_test_ftp_log_transactions_format:obj:1" version="1" comment="log ftp transactions">
                <ind-def:filepath>/etc/vsftpd/vsftpd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*xferlog_std_format[\s]*=[\s]*NO$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_test_ftp_log_transactions_enable:obj:1" version="1" comment="log ftp transactions">
                <ind-def:filepath>/etc/vsftpd/vsftpd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*xferlog_enable[\s]*=[\s]*YES$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_test_aide_periodic_cron_checking:obj:1" version="1" comment="run aide with cron">
                <ind-def:filepath>/etc/crontab</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(([0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*(\*|([0-7]|mon|tue|wed|thu|fri|sat|sun)|[0-7]-[0-7]))|@(hourly|daily|weekly))[\s]*root[\s]*\/usr\/sbin\/aide[\s]*\-\-check.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_test_aide_crond_checking:obj:1" version="1" comment="run aide with cron">
                <ind-def:path>/etc/cron.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^(([0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*(\*|([0-7]|mon|tue|wed|thu|fri|sat|sun)|[0-7]-[0-7]))|@(hourly|daily|weekly))[\s]*root[\s]*\/usr\/sbin\/aide[\s]*\-\-check.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_system_using_opal:obj:1" version="1">
                <unix-def:filepath>/sys/firmware/opal</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_system_privileged_commands:obj:1" version="1" comment="system files with setuid or setgid permission set">
                <unix-def:behaviors recurse="directories" recurse_direction="down" recurse_file_system="local" max_depth="-1"/>
                <unix-def:path>/</unix-def:path>
                <unix-def:filename operation="pattern match">[a-z]+</unix-def:filename>
                <filter action="include">oval:ssg-state_setuid_or_setgid_set:ste:1</filter>
                <filter>oval:ssg-state_dev_proc_sys_dirs:ste:1</filter>
              </unix-def:file_object>
              <unix-def:uname_object id="oval:ssg-object_system_info_architecture_x86_64:obj:1" version="1" comment="64 bit architecture"/>
              <unix-def:uname_object id="oval:ssg-object_system_info_architecture_x86:obj:1" version="1" comment="32 bit architecture"/>
              <unix-def:uname_object id="oval:ssg-object_system_info_architecture_s390_64:obj:1" version="1" comment="64 bit architecture"/>
              <unix-def:uname_object id="oval:ssg-object_system_info_architecture_ppcle_64:obj:1" version="1" comment="64 bit architecture"/>
              <unix-def:uname_object id="oval:ssg-object_system_info_architecture_ppc_64:obj:1" version="1" comment="64 bit architecture"/>
              <unix-def:uname_object id="oval:ssg-object_system_info_architecture_aarch_64:obj:1" version="1" comment="64 bit architecture"/>
              <ind-def:textfilecontent54_object id="oval:ssg-object_system_auth_pam_unix_rounds:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*password\s+(?:(?:sufficient)|(?:required))\s+pam_unix\.so.*rounds=([0-9]*).*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-object_system_auth_default_pam_unix_rounds_var:obj:1" version="1" comment="All modified times of all keyfiles">
                <ind-def:var_ref>oval:ssg-var_password_pam_unix_rounds:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_vm_mmap_min_addr:obj:1" version="1">
                <unix-def:name>vm.mmap_min_addr</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_user_max_user_namespaces:obj:1" version="1">
                <unix-def:name>user.max_user_namespaces</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.default.router_solicitations</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_max_addresses:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.default.max_addresses</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.default.disable_ipv6</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_autoconf:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.default.autoconf</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.default.accept_redirects</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.default.accept_ra_rtr_pref</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.default.accept_ra_pinfo</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.default.accept_ra_defrtr</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.default.accept_ra</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.all.router_solicitations</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_max_addresses:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.all.max_addresses</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.all.disable_ipv6</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_autoconf:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.all.autoconf</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.all.accept_ra_rtr_pref</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.all.accept_ra_pinfo</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.all.accept_ra_defrtr</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_tcp_syncookies:obj:1" version="1">
                <unix-def:name>net.ipv4.tcp_syncookies</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_ip_local_port_range:obj:1" version="1">
                <unix-def:name>net.ipv4.ip_local_port_range</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_ip_forward:obj:1" version="1">
                <unix-def:name>net.ipv4.ip_forward</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
                <unix-def:name>net.ipv4.icmp_ignore_bogus_error_responses</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
                <unix-def:name>net.ipv4.icmp_echo_ignore_broadcasts</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_shared_media:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.default.shared_media</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_send_redirects:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.default.send_redirects</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.default.secure_redirects</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_rp_filter:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.default.rp_filter</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_log_martians:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.default.log_martians</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.default.accept_source_route</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.default.accept_redirects</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_shared_media:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.all.shared_media</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_send_redirects:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.all.send_redirects</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.all.secure_redirects</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_rp_filter:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.all.rp_filter</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_route_localnet:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.all.route_localnet</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_log_martians:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.all.log_martians</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.all.drop_gratuitous_arp</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.all.arp_ignore</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_arp_filter:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.all.arp_filter</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.all.accept_source_route</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.all.accept_redirects</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_accept_local:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.all.accept_local</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_core_bpf_jit_harden:obj:1" version="1">
                <unix-def:name>net.core.bpf_jit_harden</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_yama_ptrace_scope:obj:1" version="1">
                <unix-def:name>kernel.yama.ptrace_scope</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_unprivileged_bpf_disabled:obj:1" version="1">
                <unix-def:name>kernel.unprivileged_bpf_disabled</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_sysrq:obj:1" version="1">
                <unix-def:name>kernel.sysrq</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_randomize_va_space:obj:1" version="1">
                <unix-def:name>kernel.randomize_va_space</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_pid_max:obj:1" version="1">
                <unix-def:name>kernel.pid_max</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_perf_event_paranoid:obj:1" version="1">
                <unix-def:name>kernel.perf_event_paranoid</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_perf_event_max_sample_rate:obj:1" version="1">
                <unix-def:name>kernel.perf_event_max_sample_rate</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_perf_cpu_time_max_percent:obj:1" version="1">
                <unix-def:name>kernel.perf_cpu_time_max_percent</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_panic_on_oops:obj:1" version="1">
                <unix-def:name>kernel.panic_on_oops</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_modules_disabled:obj:1" version="1">
                <unix-def:name>kernel.modules_disabled</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_kptr_restrict:obj:1" version="1">
                <unix-def:name>kernel.kptr_restrict</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_kexec_load_disabled:obj:1" version="1">
                <unix-def:name>kernel.kexec_load_disabled</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_dmesg_restrict:obj:1" version="1">
                <unix-def:name>kernel.dmesg_restrict</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_core_pattern:obj:1" version="1">
                <unix-def:name>kernel.core_pattern</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_fs_suid_dumpable:obj:1" version="1">
                <unix-def:name>fs.suid_dumpable</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_fs_protected_symlinks:obj:1" version="1">
                <unix-def:name>fs.protected_symlinks</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_fs_protected_regular:obj:1" version="1">
                <unix-def:name>fs.protected_regular</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_fs_protected_hardlinks:obj:1" version="1">
                <unix-def:name>fs.protected_hardlinks</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_fs_protected_fifos:obj:1" version="1">
                <unix-def:name>fs.protected_fifos</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_kernel_exec_shield:obj:1" version="1">
                <unix-def:name>kernel.exec-shield</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_crypto_fips_enabled:obj:1" version="1">
                <unix-def:name>crypto.fips_enabled</unix-def:name>
              </unix-def:sysctl_object>
              <ind-def:variable_object id="oval:ssg-object_symlink_kerberos_crypto_policy_configuration:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-var_symlink_kerberos_crypto_policy_configuration:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_sudoersd_without_includes:obj:1" version="1">
                <ind-def:path>/etc/sudoers.d/</ind-def:path>
                <ind-def:filename operation="pattern match">.*</ind-def:filename>
                <ind-def:pattern operation="pattern match">^#include(dir)?[\s]+.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_sudoers_without_include:obj:1" version="1">
                <ind-def:filepath>/etc/sudoers</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^#include[\s]+.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_sudoers_no_command_negation:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?:\s*[^#=]+)=(?:\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,!\n][^,\n]+,)*\s*(?:\([^\)]+\))?\s*(?!\s*\()(!\S+).*</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_sudoers_explicit_command_args:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?:\s*[^#=]+)=(?:\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,\s]+(?:[ \t]+[^,\s]+)+[ \t]*,)*(\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,\s]+[ \t]*(?:,|$))</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_sudoers_default_includedir:obj:1" version="1">
                <ind-def:filepath>/etc/sudoers</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^#includedir[\s]+(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_vm_mmap_min_addr:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_user_max_user_namespaces:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.router_solicitations[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_max_addresses:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.max_addresses[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.disable_ipv6[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_autoconf:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.autoconf[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_max_addresses:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.max_addresses[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_autoconf:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.autoconf[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_local_port_range:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.ip_local_port_range[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_forward:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_shared_media:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.shared_media[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_shared_media:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.shared_media[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_route_localnet:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.route_localnet[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.drop_gratuitous_arp[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_ignore[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_arp_filter:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_filter[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_local:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_local[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_core_bpf_jit_harden:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_yama_ptrace_scope:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_sysrq:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_randomize_va_space:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_pid_max:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_paranoid:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_panic_on_oops:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.panic_on_oops[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_modules_disabled:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.modules_disabled[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_kptr_restrict:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_kexec_load_disabled:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_dmesg_restrict:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_core_pattern:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.core_pattern[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_fs_suid_dumpable:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_fs_protected_symlinks:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_fs_protected_regular:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*fs.protected_regular[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_fs_protected_hardlinks:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_fs_protected_fifos:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*fs.protected_fifos[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_vm_mmap_min_addr:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_user_max_user_namespaces:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.router_solicitations[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_max_addresses:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.max_addresses[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.disable_ipv6[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_autoconf:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.autoconf[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_max_addresses:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.max_addresses[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_autoconf:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.autoconf[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_tcp_syncookies:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_ip_local_port_range:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.ip_local_port_range[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_ip_forward:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_shared_media:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.shared_media[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_send_redirects:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_rp_filter:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_log_martians:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_shared_media:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.shared_media[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_send_redirects:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_rp_filter:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_route_localnet:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.route_localnet[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_log_martians:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.drop_gratuitous_arp[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_ignore[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_arp_filter:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_filter[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_local:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_local[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_core_bpf_jit_harden:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_yama_ptrace_scope:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_unprivileged_bpf_disabled:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_sysrq:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_randomize_va_space:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_pid_max:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_perf_event_paranoid:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_perf_event_max_sample_rate:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_perf_cpu_time_max_percent:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_panic_on_oops:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.panic_on_oops[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_modules_disabled:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.modules_disabled[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_kptr_restrict:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_kexec_load_disabled:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_exec_shield:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.exec-shield[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_dmesg_restrict:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_core_pattern:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.core_pattern[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_fs_suid_dumpable:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_fs_protected_symlinks:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_fs_protected_regular:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*fs.protected_regular[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_fs_protected_hardlinks:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_fs_protected_fifos:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*fs.protected_fifos[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_vm_mmap_min_addr:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_vm_mmap_min_addr:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_vm_mmap_min_addr:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_user_max_user_namespaces:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_user_max_user_namespaces:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_user_max_user_namespaces:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_router_solicitations:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_router_solicitations:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_max_addresses:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_max_addresses:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_max_addresses:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_disable_ipv6:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_disable_ipv6:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_autoconf:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_autoconf:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_autoconf:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_accept_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_accept_redirects:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_accept_ra_pinfo:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_accept_ra_pinfo:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_accept_ra_defrtr:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_accept_ra_defrtr:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_ra:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_accept_ra:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_accept_ra:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_router_solicitations:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_router_solicitations:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_max_addresses:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_max_addresses:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_max_addresses:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_disable_ipv6:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_disable_ipv6:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_autoconf:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_autoconf:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_autoconf:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_accept_ra_pinfo:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_accept_ra_pinfo:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_accept_ra_defrtr:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_accept_ra_defrtr:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_tcp_syncookies:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_tcp_syncookies:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_tcp_syncookies:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_ip_local_port_range:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_ip_local_port_range:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_ip_local_port_range:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_ip_forward:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_ip_forward:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_ip_forward:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_shared_media:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_shared_media:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_shared_media:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_send_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_send_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_send_redirects:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_secure_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_secure_redirects:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_rp_filter:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_rp_filter:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_rp_filter:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_log_martians:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_log_martians:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_log_martians:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_accept_source_route:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_accept_source_route:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_accept_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_accept_redirects:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_shared_media:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_shared_media:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_shared_media:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_send_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_send_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_send_redirects:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_secure_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_secure_redirects:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_rp_filter:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_rp_filter:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_rp_filter:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_route_localnet:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_route_localnet:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_route_localnet:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_log_martians:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_log_martians:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_log_martians:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_arp_ignore:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_arp_ignore:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_arp_filter:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_arp_filter:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_arp_filter:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_accept_source_route:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_accept_source_route:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_accept_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_accept_redirects:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_accept_local:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_accept_local:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_accept_local:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_net_core_bpf_jit_harden:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_net_core_bpf_jit_harden:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_net_core_bpf_jit_harden:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_yama_ptrace_scope:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_kernel_yama_ptrace_scope:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_yama_ptrace_scope:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_unprivileged_bpf_disabled:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_kernel_unprivileged_bpf_disabled:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_unprivileged_bpf_disabled:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_sysrq:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_kernel_sysrq:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_sysrq:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_randomize_va_space:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_kernel_randomize_va_space:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_randomize_va_space:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_pid_max:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_kernel_pid_max:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_pid_max:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_perf_event_paranoid:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_kernel_perf_event_paranoid:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_perf_event_paranoid:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_perf_event_max_sample_rate:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_kernel_perf_event_max_sample_rate:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_perf_event_max_sample_rate:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_perf_cpu_time_max_percent:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_kernel_perf_cpu_time_max_percent:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_perf_cpu_time_max_percent:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_panic_on_oops:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_kernel_panic_on_oops:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_panic_on_oops:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_modules_disabled:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_kernel_modules_disabled:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_modules_disabled:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_kptr_restrict:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_kernel_kptr_restrict:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_kptr_restrict:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_kexec_load_disabled:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_kernel_kexec_load_disabled:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_kexec_load_disabled:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_dmesg_restrict:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_kernel_dmesg_restrict:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_dmesg_restrict:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_core_pattern:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_kernel_core_pattern:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_kernel_core_pattern:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_fs_suid_dumpable:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_fs_suid_dumpable:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_fs_suid_dumpable:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_fs_protected_symlinks:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_fs_protected_symlinks:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_fs_protected_symlinks:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_fs_protected_regular:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_fs_protected_regular:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_fs_protected_regular:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_fs_protected_hardlinks:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_fs_protected_hardlinks:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_fs_protected_hardlinks:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_unfiltered_sysctls_fs_protected_fifos:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_etc_sysctls_fs_protected_fifos:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_run_usr_sysctls_fs_protected_fifos:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_vm_mmap_min_addr:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_vm_mmap_min_addr:obj:1</object_reference>
                  <filter>oval:ssg-state_vm_mmap_min_addr_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_user_max_user_namespaces:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_user_max_user_namespaces:obj:1</object_reference>
                  <filter>oval:ssg-state_user_max_user_namespaces_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_router_solicitations:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv6_conf_default_router_solicitations_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_max_addresses:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_max_addresses:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv6_conf_default_max_addresses_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_disable_ipv6:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv6_conf_default_disable_ipv6_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_autoconf:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_autoconf:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv6_conf_default_autoconf_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_redirects:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv6_conf_default_accept_redirects_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv6_conf_default_accept_ra_rtr_pref_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_ra_pinfo:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv6_conf_default_accept_ra_pinfo_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_ra_defrtr:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv6_conf_default_accept_ra_defrtr_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_accept_ra:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_ra:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv6_conf_default_accept_ra_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_router_solicitations:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv6_conf_all_router_solicitations_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_max_addresses:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_max_addresses:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv6_conf_all_max_addresses_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_disable_ipv6:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv6_conf_all_disable_ipv6_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_autoconf:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_autoconf:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv6_conf_all_autoconf_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv6_conf_all_accept_ra_rtr_pref_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_accept_ra_pinfo:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv6_conf_all_accept_ra_pinfo_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_accept_ra_defrtr:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv6_conf_all_accept_ra_defrtr_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_tcp_syncookies:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_tcp_syncookies:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv4_tcp_syncookies_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_ip_local_port_range:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_ip_local_port_range:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv4_ip_local_port_range_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_ip_forward:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_ip_forward:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv4_ip_forward_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv4_icmp_ignore_bogus_error_responses_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv4_icmp_echo_ignore_broadcasts_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_shared_media:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_shared_media:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv4_conf_default_shared_media_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_send_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_send_redirects:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv4_conf_default_send_redirects_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_secure_redirects:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv4_conf_default_secure_redirects_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_rp_filter:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_rp_filter:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv4_conf_default_rp_filter_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_log_martians:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_log_martians:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv4_conf_default_log_martians_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_accept_source_route:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv4_conf_default_accept_source_route_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_accept_redirects:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv4_conf_default_accept_redirects_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_shared_media:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_shared_media:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv4_conf_all_shared_media_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_send_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_send_redirects:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv4_conf_all_send_redirects_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_secure_redirects:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv4_conf_all_secure_redirects_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_rp_filter:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_rp_filter:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv4_conf_all_rp_filter_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_route_localnet:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_route_localnet:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv4_conf_all_route_localnet_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_log_martians:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_log_martians:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv4_conf_all_log_martians_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv4_conf_all_drop_gratuitous_arp_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_arp_ignore:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv4_conf_all_arp_ignore_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_arp_filter:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_arp_filter:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv4_conf_all_arp_filter_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_accept_source_route:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv4_conf_all_accept_source_route_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_accept_redirects:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv4_conf_all_accept_redirects_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_accept_local:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_accept_local:obj:1</object_reference>
                  <filter>oval:ssg-state_net_ipv4_conf_all_accept_local_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_net_core_bpf_jit_harden:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_net_core_bpf_jit_harden:obj:1</object_reference>
                  <filter>oval:ssg-state_net_core_bpf_jit_harden_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_yama_ptrace_scope:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_yama_ptrace_scope:obj:1</object_reference>
                  <filter>oval:ssg-state_kernel_yama_ptrace_scope_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_unprivileged_bpf_disabled:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_unprivileged_bpf_disabled:obj:1</object_reference>
                  <filter>oval:ssg-state_kernel_unprivileged_bpf_disabled_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_sysrq:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_sysrq:obj:1</object_reference>
                  <filter>oval:ssg-state_kernel_sysrq_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_randomize_va_space:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_randomize_va_space:obj:1</object_reference>
                  <filter>oval:ssg-state_kernel_randomize_va_space_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_pid_max:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_pid_max:obj:1</object_reference>
                  <filter>oval:ssg-state_kernel_pid_max_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_perf_event_paranoid:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_perf_event_paranoid:obj:1</object_reference>
                  <filter>oval:ssg-state_kernel_perf_event_paranoid_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_perf_event_max_sample_rate:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_perf_event_max_sample_rate:obj:1</object_reference>
                  <filter>oval:ssg-state_kernel_perf_event_max_sample_rate_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_perf_cpu_time_max_percent:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_perf_cpu_time_max_percent:obj:1</object_reference>
                  <filter>oval:ssg-state_kernel_perf_cpu_time_max_percent_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_panic_on_oops:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_panic_on_oops:obj:1</object_reference>
                  <filter>oval:ssg-state_kernel_panic_on_oops_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_modules_disabled:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_modules_disabled:obj:1</object_reference>
                  <filter>oval:ssg-state_kernel_modules_disabled_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_kptr_restrict:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_kptr_restrict:obj:1</object_reference>
                  <filter>oval:ssg-state_kernel_kptr_restrict_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_kexec_load_disabled:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_kexec_load_disabled:obj:1</object_reference>
                  <filter>oval:ssg-state_kernel_kexec_load_disabled_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_dmesg_restrict:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_dmesg_restrict:obj:1</object_reference>
                  <filter>oval:ssg-state_kernel_dmesg_restrict_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_kernel_core_pattern:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_kernel_core_pattern:obj:1</object_reference>
                  <filter>oval:ssg-state_kernel_core_pattern_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_fs_suid_dumpable:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_fs_suid_dumpable:obj:1</object_reference>
                  <filter>oval:ssg-state_fs_suid_dumpable_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_fs_protected_symlinks:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_fs_protected_symlinks:obj:1</object_reference>
                  <filter>oval:ssg-state_fs_protected_symlinks_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_fs_protected_regular:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_fs_protected_regular:obj:1</object_reference>
                  <filter>oval:ssg-state_fs_protected_regular_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_fs_protected_hardlinks:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_fs_protected_hardlinks:obj:1</object_reference>
                  <filter>oval:ssg-state_fs_protected_hardlinks_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_set_sysctls_fs_protected_fifos:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_set_unfiltered_sysctls_fs_protected_fifos:obj:1</object_reference>
                  <filter>oval:ssg-state_fs_protected_fifos_filepath_is_symlink:ste:1</filter>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_vm_mmap_min_addr:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_vm_mmap_min_addr:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_vm_mmap_min_addr:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_user_max_user_namespaces:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_user_max_user_namespaces:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_user_max_user_namespaces:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_router_solicitations:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_router_solicitations:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_max_addresses:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_max_addresses:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_max_addresses:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_autoconf:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_autoconf:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_autoconf:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_default_accept_ra:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_router_solicitations:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_router_solicitations:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_max_addresses:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_max_addresses:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_max_addresses:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_autoconf:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_autoconf:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_autoconf:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_tcp_syncookies:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_tcp_syncookies:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_ip_local_port_range:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_ip_local_port_range:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_local_port_range:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_ip_forward:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_ip_forward:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_forward:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_shared_media:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_shared_media:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_shared_media:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_send_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_send_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_secure_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_rp_filter:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_rp_filter:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_log_martians:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_log_martians:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_source_route:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_shared_media:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_shared_media:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_shared_media:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_send_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_send_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_secure_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_rp_filter:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_rp_filter:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_route_localnet:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_route_localnet:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_route_localnet:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_log_martians:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_log_martians:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_arp_ignore:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_arp_ignore:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_arp_filter:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_arp_filter:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_arp_filter:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_source_route:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_ipv4_conf_all_accept_local:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_local:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_local:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_net_core_bpf_jit_harden:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_net_core_bpf_jit_harden:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_net_core_bpf_jit_harden:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_yama_ptrace_scope:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_kernel_yama_ptrace_scope:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_yama_ptrace_scope:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_unprivileged_bpf_disabled:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_kernel_unprivileged_bpf_disabled:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_sysrq:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_kernel_sysrq:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_sysrq:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_randomize_va_space:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_kernel_randomize_va_space:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_randomize_va_space:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_pid_max:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_kernel_pid_max:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_pid_max:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_perf_event_paranoid:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_kernel_perf_event_paranoid:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_paranoid:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_perf_event_max_sample_rate:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_kernel_perf_event_max_sample_rate:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_perf_cpu_time_max_percent:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_kernel_perf_cpu_time_max_percent:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_panic_on_oops:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_kernel_panic_on_oops:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_panic_on_oops:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_modules_disabled:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_kernel_modules_disabled:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_modules_disabled:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_kptr_restrict:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_kernel_kptr_restrict:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_kptr_restrict:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_kexec_load_disabled:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_kernel_kexec_load_disabled:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_kexec_load_disabled:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_dmesg_restrict:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_kernel_dmesg_restrict:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_dmesg_restrict:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_kernel_core_pattern:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_kernel_core_pattern:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_kernel_core_pattern:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_fs_suid_dumpable:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_fs_suid_dumpable:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_fs_suid_dumpable:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_fs_protected_symlinks:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_fs_protected_symlinks:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_fs_protected_symlinks:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_fs_protected_regular:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_fs_protected_regular:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_fs_protected_regular:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_fs_protected_hardlinks:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_fs_protected_hardlinks:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_fs_protected_hardlinks:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_fs_protected_fifos:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_run_sysctld_fs_protected_fifos:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_usr_lib_sysctld_fs_protected_fifos:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_vm_mmap_min_addr:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_user_max_user_namespaces:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.router_solicitations[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_max_addresses:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.max_addresses[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.disable_ipv6[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_autoconf:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.autoconf[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_max_addresses:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.max_addresses[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_autoconf:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.autoconf[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_tcp_syncookies:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_ip_local_port_range:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.ip_local_port_range[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_ip_forward:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_shared_media:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.shared_media[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_send_redirects:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_rp_filter:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_log_martians:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_shared_media:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.shared_media[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_send_redirects:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_rp_filter:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_route_localnet:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.route_localnet[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_log_martians:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.drop_gratuitous_arp[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_ignore[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_arp_filter:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_filter[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_local:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_local[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_core_bpf_jit_harden:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_yama_ptrace_scope:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_unprivileged_bpf_disabled:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_sysrq:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_randomize_va_space:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_pid_max:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_perf_event_paranoid:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_perf_event_max_sample_rate:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_perf_cpu_time_max_percent:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_panic_on_oops:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.panic_on_oops[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_modules_disabled:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.modules_disabled[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_kptr_restrict:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_kexec_load_disabled:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_dmesg_restrict:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_core_pattern:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.core_pattern[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_fs_suid_dumpable:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_fs_protected_symlinks:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_fs_protected_regular:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*fs.protected_regular[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_fs_protected_hardlinks:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_fs_protected_fifos:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*fs.protected_fifos[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_vm_mmap_min_addr:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_vm_mmap_min_addr:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_vm_mmap_min_addr:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_user_max_user_namespaces:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_user_max_user_namespaces:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_user_max_user_namespaces:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_default_router_solicitations:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_router_solicitations:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_max_addresses:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_default_max_addresses:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_max_addresses:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_autoconf:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_default_autoconf:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_autoconf:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_default_accept_ra:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_all_router_solicitations:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_router_solicitations:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_max_addresses:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_all_max_addresses:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_max_addresses:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_autoconf:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_all_autoconf:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_autoconf:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_tcp_syncookies:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv4_tcp_syncookies:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_tcp_syncookies:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_ip_local_port_range:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv4_ip_local_port_range:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_ip_local_port_range:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_ip_forward:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv4_ip_forward:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_ip_forward:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_shared_media:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_default_shared_media:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_shared_media:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_send_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_default_send_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_send_redirects:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_default_secure_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_rp_filter:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_default_rp_filter:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_rp_filter:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_log_martians:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_default_log_martians:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_log_martians:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_default_accept_source_route:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_default_accept_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_shared_media:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_all_shared_media:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_shared_media:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_send_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_all_send_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_send_redirects:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_all_secure_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_rp_filter:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_all_rp_filter:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_rp_filter:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_route_localnet:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_all_route_localnet:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_route_localnet:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_log_martians:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_all_log_martians:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_log_martians:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_all_arp_ignore:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_arp_ignore:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_arp_filter:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_all_arp_filter:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_arp_filter:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_source_route:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_redirects:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_ipv4_conf_all_accept_local:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_local:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_local:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_net_core_bpf_jit_harden:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_net_core_bpf_jit_harden:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_net_core_bpf_jit_harden:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_yama_ptrace_scope:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_kernel_yama_ptrace_scope:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_kernel_yama_ptrace_scope:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_unprivileged_bpf_disabled:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_kernel_unprivileged_bpf_disabled:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_kernel_unprivileged_bpf_disabled:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_sysrq:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_kernel_sysrq:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_kernel_sysrq:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_randomize_va_space:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_kernel_randomize_va_space:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_kernel_randomize_va_space:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_pid_max:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_kernel_pid_max:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_kernel_pid_max:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_perf_event_paranoid:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_kernel_perf_event_paranoid:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_kernel_perf_event_paranoid:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_perf_event_max_sample_rate:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_kernel_perf_event_max_sample_rate:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_kernel_perf_event_max_sample_rate:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_perf_cpu_time_max_percent:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_kernel_perf_cpu_time_max_percent:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_kernel_perf_cpu_time_max_percent:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_panic_on_oops:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_kernel_panic_on_oops:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_kernel_panic_on_oops:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_modules_disabled:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_kernel_modules_disabled:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_kernel_modules_disabled:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_kptr_restrict:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_kernel_kptr_restrict:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_kernel_kptr_restrict:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_kexec_load_disabled:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_kernel_kexec_load_disabled:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_kernel_kexec_load_disabled:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_dmesg_restrict:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_kernel_dmesg_restrict:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_kernel_dmesg_restrict:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_kernel_core_pattern:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_kernel_core_pattern:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_kernel_core_pattern:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_fs_suid_dumpable:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_fs_suid_dumpable:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_fs_suid_dumpable:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_fs_protected_symlinks:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_fs_protected_symlinks:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_fs_protected_symlinks:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_fs_protected_regular:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_fs_protected_regular:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_fs_protected_regular:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_fs_protected_hardlinks:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_fs_protected_hardlinks:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_fs_protected_hardlinks:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_fs_protected_fifos:obj:1" version="1">
                <set>
                  <object_reference>oval:ssg-object_static_sysctl_fs_protected_fifos:obj:1</object_reference>
                  <object_reference>oval:ssg-object_static_etc_sysctld_fs_protected_fifos:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_vm_mmap_min_addr:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_user_max_user_namespaces:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.router_solicitations[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_max_addresses:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.max_addresses[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.disable_ipv6[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_autoconf:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.autoconf[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_max_addresses:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.max_addresses[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_autoconf:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.autoconf[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_tcp_syncookies:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_ip_local_port_range:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.ip_local_port_range[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_ip_forward:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_shared_media:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.shared_media[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_send_redirects:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_rp_filter:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_log_martians:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_shared_media:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.shared_media[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_send_redirects:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_rp_filter:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_route_localnet:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.route_localnet[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_log_martians:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.drop_gratuitous_arp[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_ignore[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_arp_filter:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_filter[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_local:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_local[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_core_bpf_jit_harden:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_yama_ptrace_scope:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_unprivileged_bpf_disabled:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_sysrq:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_randomize_va_space:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_pid_max:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_perf_event_paranoid:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_perf_event_max_sample_rate:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_perf_cpu_time_max_percent:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_panic_on_oops:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.panic_on_oops[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_modules_disabled:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.modules_disabled[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_kptr_restrict:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*(\d+)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_kexec_load_disabled:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_dmesg_restrict:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_core_pattern:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.core_pattern[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_fs_suid_dumpable:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_fs_protected_symlinks:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_fs_protected_regular:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*fs.protected_regular[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_fs_protected_hardlinks:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_fs_protected_fifos:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*fs.protected_fifos[\s]*=[\s]*(.*)[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_sssd_conf_exists:obj:1" version="1" comment="/etc/sssd/sssd.conf">
                <unix-def:filepath>/etc/sssd/sssd.conf</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:variable_object id="oval:ssg-object_sshd_requirement_unknown:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-sshd_required:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_sshd_required:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-sshd_required:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_sshd_not_required:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-sshd_required:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_sshd_max_sessions:obj:1" version="2">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*(?i)MaxSessions[\s]+(\d+)[\s]*(?:#.*)?$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_sshd_max_auth_tries:obj:1" version="2">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*(?i)MaxAuthTries[\s]+(\d+)[\s]*(?:#.*)?$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_sshd_login_grace_time:obj:1" version="2">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*(?i)LoginGraceTime[\s]+(\d+)[\s]*(?:#.*)?$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_sshd_idle_timeout_config_dir:obj:1" version="2">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*(?i)ClientAliveInterval[\s]+(\d+)[\s]*(?:#.*)?$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_sshd_idle_timeout:obj:1" version="2">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*(?i)ClientAliveInterval[\s]+(\d+)[\s]*(?:#.*)?$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_sshd_allow_only_protocol2:obj:1" version="3">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*(?i)Protocol[\s]+2[\s]*(?:|(?:#.*))?$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:partition_object id="oval:ssg-object_srv_partition_nosuid_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/srv</lin-def:mount_point>
              </lin-def:partition_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_snmp_versions:obj:1" version="1">
                <ind-def:filepath>/etc/snmp/snmpd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*(com2se|rocommunity|rwcommunity)</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_snmp_default_communities:obj:1" version="1">
                <ind-def:filepath>/etc/snmp/snmpd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^((?!#).)*(public|private).*</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_smart_card_required_system_auth:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-variable_smart_card_required_system_auth:var:1" var_check="at least one"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_smart_card_required_smartcard_auth:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath>/etc/pam.d/smartcard-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-variable_smart_card_required_smartcard_auth:var:1" var_check="at least one"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_smart_card_enabled_system_auth:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-variable_smart_card_enabled_system_auth:var:1" var_check="at least one"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_serial_ports_etc_securetty:obj:1" version="1" comment="serial ports /etc/securetty">
                <ind-def:filepath>/etc/securetty</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^ttyS[0-9]+$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_selinux_grub_dir:obj:1" version="1" comment="check value selinux|enforcing=0 in /etc/grub.d, fail if found">
                <ind-def:path>/etc/grub.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^.*(selinux|enforcing)=0.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_selinux_grub2_cfg:obj:1" version="1" comment="check value selinux|enforcing=0 in /etc/grub2.cfg, fail if found">
                <ind-def:filepath>/etc/grub2.cfg</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.*(selinux|enforcing)=0.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_selinux_enforcing:obj:1" version="1">
                <ind-def:filepath>/etc/selinux/config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*SELINUX[\s]*=[\s]*enforcing[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:selinuxsecuritycontext_object id="oval:ssg-object_selinux_dev_unlabeled_t:obj:1" version="1" comment="unlabeled_t in /dev">
                <lin-def:filepath var_ref="oval:ssg-variable_dev_device_files:var:1" var_check="at least one"/>
                <filter action="include">oval:ssg-state_selinux_dev_unlabeled_t:ste:1</filter>
              </lin-def:selinuxsecuritycontext_object>
              <lin-def:selinuxsecuritycontext_object id="oval:ssg-object_selinux_dev_device_t:obj:1" version="1" comment="device_t in /dev">
                <lin-def:filepath var_ref="oval:ssg-variable_dev_device_files:var:1" var_check="at least one"/>
                <filter action="include">oval:ssg-state_selinux_dev_device_t:ste:1</filter>
              </lin-def:selinuxsecuritycontext_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_selinux_default_grub:obj:1" version="1" comment="check value selinux|enforcing=0 in /etc/default/grub, fail if found">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*GRUB_CMDLINE_LINUX.*(selinux|enforcing)=0.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:selinuxsecuritycontext_object id="oval:ssg-object_selinux_confinement_of_daemons:obj:1" version="1" comment="find unconfined_service_t in /proc">
                <lin-def:behaviors max_depth="1" recurse_direction="down"/>
                <lin-def:path>/proc</lin-def:path>
                <lin-def:filename operation="pattern match">^.*$</lin-def:filename>
                <filter action="include">oval:ssg-state_selinux_confinement_of_daemons:ste:1</filter>
              </lin-def:selinuxsecuritycontext_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_rsyslog_nolisten:obj:1" version="2">
                <ind-def:filepath>/etc/rsyslog.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*\$((?:Input(?:TCP|RELP)|UDP)ServerRun|ModLoad[\s]+(imtcp|imudp|imrelp))</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_rsyslog_files_permissions:obj:1" version="1" comment="Various system log files">
                <unix-def:filepath var_ref="oval:ssg-var_rfp_log_files_paths:var:1" var_check="at least one"/>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_rsyslog_files_ownership:obj:1" version="1" comment="Various system log files">
                <unix-def:filepath var_ref="oval:ssg-var_rfo_log_files_paths:var:1" var_check="at least one"/>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_rsyslog_files_groupownership:obj:1" version="1" comment="Various system log files">
                <unix-def:filepath var_ref="oval:ssg-var_rfg_log_files_paths:var:1" var_check="at least one"/>
              </unix-def:file_object>
              <ind-def:environmentvariable58_object id="oval:ssg-object_root_path_no_dot:obj:1" version="1">
                <ind-def:pid xsi:nil="true" datatype="int"/>
                <ind-def:name>PATH</ind-def:name>
              </ind-def:environmentvariable58_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_rfp_rsyslog_include_config_value:obj:1" version="1" comment="rsyslog's $IncludeConfig directive and include() object values">
                <ind-def:filepath>/etc/rsyslog.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_rfp_log_files_paths:obj:1" version="1" comment="All rsyslog configuration files">
                <ind-def:filepath operation="pattern match" var_ref="oval:ssg-var_rfp_all_log_files:var:1" var_check="at least one"/>
                <ind-def:pattern operation="pattern match">^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
                <filter>oval:ssg-state_permissions_ignore_include_paths:ste:1</filter>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_rfo_rsyslog_include_config_value:obj:1" version="1" comment="rsyslog's $IncludeConfig directive and include() object values">
                <ind-def:filepath>/etc/rsyslog.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_rfo_log_files_paths:obj:1" version="1" comment="All rsyslog configuration files">
                <ind-def:filepath operation="pattern match" var_ref="oval:ssg-var_rfo_all_log_files:var:1" var_check="at least one"/>
                <ind-def:pattern operation="pattern match">^[^(#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
                <filter>oval:ssg-state_owner_ignore_include_paths:ste:1</filter>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_rfg_rsyslog_include_config_value:obj:1" version="1" comment="rsyslog's $IncludeConfig directive and include() object values">
                <ind-def:filepath>/etc/rsyslog.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_rfg_log_files_paths:obj:1" version="1" comment="All rsyslog configuration files">
                <ind-def:filepath operation="pattern match" var_ref="oval:ssg-var_rfg_all_log_files:var:1" var_check="at least one"/>
                <ind-def:pattern operation="pattern match">^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
                <filter>oval:ssg-state_groupownership_ignore_include_paths:ste:1</filter>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_requiretty_sudoers:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/sudoers(|\.d/.*)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*Defaults.*\brequiretty.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_removable_partition_doesnt_exist:obj:1" version="1">
                <unix-def:filepath var_ref="oval:ssg-var_removable_partition:var:1" var_check="at least one"/>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_remote_loghost_rsyslog_d:obj:1" version="1">
                <ind-def:path>/etc/rsyslog.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.+\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_remote_loghost_rsyslog_conf:obj:1" version="1">
                <ind-def:filepath>/etc/rsyslog.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:interface_object id="oval:ssg-object_promisc_interfaces:obj:1" version="1">
                <unix-def:name operation="pattern match">^.*$</unix-def:name>
                <filter action="include">oval:ssg-state_promisc:ste:1</filter>
              </unix-def:interface_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_proc_sys_kernel_osrelease_arch_s390x:obj:1" version="1">
                <ind-def:filepath>/proc/sys/kernel/osrelease</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.*\.(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_proc_sys_kernel_osrelease_arch_aarch64:obj:1" version="1">
                <ind-def:filepath>/proc/sys/kernel/osrelease</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.*\.(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_proc_sys_kernel_osrelease_64_bit:obj:1" version="1">
                <ind-def:filepath>/proc/sys/kernel/osrelease</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.*\.(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:partition_object id="oval:ssg-object_proc_partition_hidepid_optional_no:obj:1" version="1">
                <lin-def:mount_point>/proc</lin-def:mount_point>
              </lin-def:partition_object>
              <unix-def:file_object id="oval:ssg-object_proc_net_wireless_exists:obj:1" version="1" comment="/proc/net/wireless file">
                <unix-def:filepath>/proc/net/wireless</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_proc_cpuinfo_64_bit:obj:1" version="1">
                <ind-def:filepath>/proc/cpuinfo</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^flags\s+:\s+(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_password_auth_pam_unix_rounds:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*password\s+(?:(?:sufficient)|(?:required))\s+pam_unix\.so.*rounds=([0-9]*).*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-object_password_auth_default_pam_unix_rounds_var:obj:1" version="1" comment="All modified times of all keyfiles">
                <ind-def:var_ref>oval:ssg-var_password_pam_unix_rounds:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_pam_unix_sha512:obj:1" version="1" comment="check /etc/pam.d/system-auth for correct settings">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*password[\s]+(?:(?:required)|(?:sufficient))[\s]+pam_unix\.so[\s]+.*sha512.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_pam_unix_passwordauth_sha512:obj:1" version="1" comment="check /etc/pam.d/password-auth for correct settings">
                <ind-def:filepath>/etc/pam.d/password-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*password[\s]+(?:(?:required)|(?:sufficient))[\s]+pam_unix\.so[\s]+.*sha512.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_pam_pkcs11_cert_policy_ocsp_on:obj:1" version="1">
                <ind-def:filepath>/etc/pam_pkcs11/pam_pkcs11.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*cert_policy[ ]=(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:rpminfo_object id="oval:ssg-object_package_gpg-pubkey:obj:1" version="1">
                <lin-def:name>gpg-pubkey</lin-def:name>
              </lin-def:rpminfo_object>
              <unix-def:file_object id="oval:ssg-object_ownership_var_log_audit_files:obj:1" version="1" comment="/var/log/audit files">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
                <unix-def:path>/var/log/audit</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_owner_not_root_root_var_log_audit:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_ownership_var_log_audit_files-non_root:obj:1" version="1" comment="/var/log/audit files">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
                <unix-def:path>/var/log/audit</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_ownership_var_log_audit_directories:obj:1" version="1" comment="/var/log/audit directories">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
                <unix-def:path>/var/log/audit</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_owner_not_root_root_var_log_audit:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_ownership_var_log_audit_directories-non_root:obj:1" version="1" comment="/var/log/audit directories">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
                <unix-def:path>/var/log/audit</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1</filter>
              </unix-def:file_object>
              <lin-def:partition_object id="oval:ssg-object_opt_partition_nosuid_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/opt</lin-def:mount_point>
              </lin-def:partition_object>
              <unix-def:file_object id="oval:ssg-object_only_local_directories:obj:1" version="1" comment="only local directories">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_world_writable_and_not_sticky:ste:1</filter>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_nx_disabled_grub:obj:1" version="1">
                <ind-def:filepath>/boot/grub2/grub.cfg</ind-def:filepath>
                <ind-def:pattern operation="pattern match">[\s]*noexec[\s]*=[\s]*off</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_nosuid_etc_fstab_not_cd_dvd_drive:obj:1" version="1">
                <ind-def:filepath>/etc/fstab</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_nosuid:var:1" var_check="at least one"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_nosuid_etc_fstab_cd_dvd_drive:obj:1" version="1">
                <ind-def:filepath>/etc/fstab</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-variable_cd_dvd_drive_regex_pattern_nosuid:var:1" var_check="at least one"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_nopasswd_etc_sudoers_d:obj:1" version="1">
                <ind-def:path>/etc/sudoers.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^(?!#).*[\s]+NOPASSWD[\s]*\:.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_nopasswd_etc_sudoers:obj:1" version="1">
                <ind-def:filepath>/etc/sudoers</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?!#).*[\s]+NOPASSWD[\s]*\:.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:partition_object id="oval:ssg-object_non_root_partitions:obj:1" version="1">
                <lin-def:mount_point operation="pattern match">^/\w.*$</lin-def:mount_point>
                <filter action="include">oval:ssg-state_local_nodev:ste:1</filter>
              </lin-def:partition_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_noexec_sudoers:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/sudoers(|\.d/.*)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*Defaults.*\bnoexec.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_noexec_etc_fstab_not_cd_dvd_drive:obj:1" version="1">
                <ind-def:filepath>/etc/fstab</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_noexec:var:1" var_check="at least one"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_noexec_etc_fstab_cd_dvd_drive:obj:1" version="1">
                <ind-def:filepath>/etc/fstab</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-variable_cd_dvd_drive_regex_pattern_noexec:var:1" var_check="at least one"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_nodev_etc_fstab_not_cd_dvd_drive:obj:1" version="1">
                <ind-def:filepath>/etc/fstab</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_nodev:var:1" var_check="at least one"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_nodev_etc_fstab_cd_dvd_drive:obj:1" version="1">
                <ind-def:filepath>/etc/fstab</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-variable_cd_dvd_drive_regex_pattern_nodev:var:1" var_check="at least one"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_no_runas_spec:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*((?!root\b)[\w]+)\s*(\w+)\s*=\s*(.*,)?\s*[^\(\s]</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_no_rsh_trust_files_root:obj:1" version="1" comment="look for .rhosts in /root">
                <unix-def:path>/root</unix-def:path>
                <unix-def:filename operation="pattern match">^\.rhosts$</unix-def:filename>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_no_rsh_trust_files_home:obj:1" version="1" comment="look for .rhosts in /home">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all"/>
                <unix-def:path>/home</unix-def:path>
                <unix-def:filename operation="pattern match">^\.rhosts$</unix-def:filename>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_no_rsh_trust_files_etc:obj:1" version="1" comment="look for /etc/hosts.equiv">
                <unix-def:path>/etc</unix-def:path>
                <unix-def:filename operation="pattern match">^hosts\.equiv$</unix-def:filename>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_no_netrc_files_home:obj:1" version="1" comment="look for .netrc in /home">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all"/>
                <unix-def:path>/home</unix-def:path>
                <unix-def:filename operation="pattern match">^\.netrc$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_no_legacy_plus_entries_etc_shadow:obj:1" version="1" comment="lines starting with +">
                <ind-def:filepath>/etc/shadow</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\+.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_no_legacy_plus_entries_etc_passwd:obj:1" version="1" comment="lines starting with +">
                <ind-def:filepath>/etc/passwd</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\+.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_no_legacy_plus_entries_etc_group:obj:1" version="1" comment="lines starting with +">
                <ind-def:filepath>/etc/group</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\+.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_no_empty_passwords:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[^#]*\bnullok\b.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_no_direct_root_logins:obj:1" version="1" comment="no entries /etc/securetty">
                <ind-def:filepath>/etc/securetty</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_no_custom_runlevel1_target:obj:1" version="1" comment="look for runlevel1.target in /etc/systemd/system">
                <unix-def:behaviors recurse="directories" recurse_direction="down" recurse_file_system="all"/>
                <unix-def:path>/etc/systemd/system</unix-def:path>
                <unix-def:filename operation="pattern match">^runlevel1.target$</unix-def:filename>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_no_custom_rescue_service:obj:1" version="1" comment="look for rescue.service in /etc/systemd/system">
                <unix-def:behaviors recurse="directories" recurse_direction="down" recurse_file_system="all"/>
                <unix-def:path>/etc/systemd/system</unix-def:path>
                <unix-def:filename operation="pattern match">^rescue.service$</unix-def:filename>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_no_custom_emergency_target:obj:1" version="1" comment="look for emergency.target in /etc/systemd/system">
                <unix-def:behaviors recurse="directories" recurse_direction="down" recurse_file_system="all"/>
                <unix-def:path>/etc/systemd/system</unix-def:path>
                <unix-def:filename operation="pattern match">^emergency.target$</unix-def:filename>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_no_custom_emergency_service:obj:1" version="1" comment="look for emergency.service in /etc/systemd/system">
                <unix-def:behaviors recurse="directories" recurse_direction="down" recurse_file_system="all"/>
                <unix-def:path>/etc/systemd/system</unix-def:path>
                <unix-def:filename operation="pattern match">^emergency.service$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_no_cd_dvd_drive_in_etc_fstab:obj:1" version="1">
                <ind-def:filepath>/etc/fstab</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names:var:1" var_check="at least one"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_no_authenticate_etc_sudoers_d:obj:1" version="1">
                <ind-def:path>/etc/sudoers.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^(?!#).*[\s]+\!authenticate.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_no_authenticate_etc_sudoers:obj:1" version="1">
                <ind-def:filepath>/etc/sudoers</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?!#).*[\s]+\!authenticate.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_network_nmcli_permissions:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/polkit-1/localauthority/20-org.d/.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\[.*\]\n\s*Identity=default\n\s*Action=org\.freedesktop\.NetworkManager\.\*\n\s*ResultAny=no\n\s*ResultInactive=no\n\s*(ResultActive=auth_admin)\n*\s*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv6_conf_default_router_solicitations_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_default_router_solicitations:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_router_solicitations:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv6_conf_default_max_addresses_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_default_max_addresses:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_max_addresses:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv6_conf_default_disable_ipv6_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_default_disable_ipv6:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_disable_ipv6:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv6_conf_default_autoconf_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_default_autoconf:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_autoconf:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv6_conf_default_accept_redirects_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_default_accept_redirects:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_accept_redirects:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv6_conf_default_accept_ra_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_default_accept_ra:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_accept_ra:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv6_conf_default_accept_ra_rtr_pref_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_default_accept_ra_rtr_pref:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv6_conf_default_accept_ra_pinfo_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_default_accept_ra_pinfo:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_accept_ra_pinfo:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv6_conf_default_accept_ra_defrtr_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_default_accept_ra_defrtr:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_accept_ra_defrtr:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv6_conf_all_router_solicitations_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_all_router_solicitations:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_router_solicitations:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv6_conf_all_max_addresses_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_all_max_addresses:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_max_addresses:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv6_conf_all_disable_ipv6_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_all_disable_ipv6:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_disable_ipv6:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv6_conf_all_autoconf_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_all_autoconf:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_autoconf:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv6_conf_all_accept_ra_rtr_pref_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_all_accept_ra_rtr_pref:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv6_conf_all_accept_ra_pinfo_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_all_accept_ra_pinfo:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_accept_ra_pinfo:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv6_conf_all_accept_ra_defrtr_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv6_conf_all_accept_ra_defrtr:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_accept_ra_defrtr:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv4_tcp_syncookies_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv4_tcp_syncookies:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_tcp_syncookies:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv4_ip_local_port_range_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv4_ip_local_port_range:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_ip_local_port_range:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv4_ip_forward_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv4_ip_forward:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_ip_forward:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv4_icmp_ignore_bogus_error_responses_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv4_icmp_ignore_bogus_error_responses:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_icmp_ignore_bogus_error_responses:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv4_icmp_echo_ignore_broadcasts_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv4_icmp_echo_ignore_broadcasts:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_icmp_echo_ignore_broadcasts:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv4_conf_default_shared_media_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_default_shared_media:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_shared_media:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv4_conf_default_send_redirects_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_default_send_redirects:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_send_redirects:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv4_conf_default_secure_redirects_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_default_secure_redirects:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_secure_redirects:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv4_conf_default_rp_filter_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_default_rp_filter:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_rp_filter:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv4_conf_default_log_martians_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_default_log_martians:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_log_martians:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv4_conf_default_accept_source_route_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_default_accept_source_route:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_accept_source_route:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv4_conf_default_accept_redirects_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_default_accept_redirects:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_accept_redirects:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv4_conf_all_shared_media_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_all_shared_media:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_shared_media:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv4_conf_all_send_redirects_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_all_send_redirects:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_send_redirects:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv4_conf_all_secure_redirects_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_all_secure_redirects:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_secure_redirects:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv4_conf_all_rp_filter_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_all_rp_filter:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_rp_filter:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv4_conf_all_route_localnet_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_all_route_localnet:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_route_localnet:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv4_conf_all_log_martians_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_all_log_martians:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_log_martians:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv4_conf_all_drop_gratuitous_arp_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_all_drop_gratuitous_arp:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_drop_gratuitous_arp:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv4_conf_all_arp_ignore_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_all_arp_ignore:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_arp_ignore:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv4_conf_all_arp_filter_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_all_arp_filter:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_arp_filter:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv4_conf_all_accept_source_route_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_all_accept_source_route:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_accept_source_route:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv4_conf_all_accept_redirects_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_all_accept_redirects:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_accept_redirects:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_ipv4_conf_all_accept_local_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_ipv4_conf_all_accept_local:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_accept_local:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_net_core_bpf_jit_harden_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_net_core_bpf_jit_harden:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_net_core_bpf_jit_harden:ste:1</filter>
              </unix-def:symlink_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_usbguard_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_usbguard_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_syslog-ng_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_syslog-ng_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rsyslog_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rsyslog_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rngd_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rngd_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_pcscd_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_pcscd_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ntpd_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ntpd_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ntp_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ntp_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_iptables_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_iptables_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ip6tables_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ip6tables_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_firewalld_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_firewalld_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_dnf-automatic_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_crond_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_crond_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_cron_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_cron_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_chronyd_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_chronyd_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_auditd_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_auditd_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:partition_object id="oval:ssg-object_mountvar_own_partition:obj:1" version="1">
                <lin-def:mount_point>/var</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_mountvar_log_own_partition:obj:1" version="1">
                <lin-def:mount_point>/var/log</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_mountvar_log_audit_own_partition:obj:1" version="1">
                <lin-def:mount_point>/var/log/audit</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_mountusr_own_partition:obj:1" version="1">
                <lin-def:mount_point>/usr</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_mounttmp_own_partition:obj:1" version="1">
                <lin-def:mount_point>/tmp</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_mountsrv_own_partition:obj:1" version="1">
                <lin-def:mount_point>/srv</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_mountopt_own_partition:obj:1" version="1">
                <lin-def:mount_point>/opt</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_mounthome_own_partition:obj:1" version="1">
                <lin-def:mount_point>/home</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_mountboot_own_partition:obj:1" version="1">
                <lin-def:mount_point>/boot</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_mount_option_var_tmp_bind_compare_source:obj:1" version="1">
                <lin-def:mount_point operation="pattern match">^/tmp$</lin-def:mount_point>
              </lin-def:partition_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_mount_option_var_tmp_bind:obj:1" version="1" comment="look for the partition mount point in /etc/mtab">
                <ind-def:filepath>/etc/mtab</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:partition_object id="oval:ssg-object_mount_option_var_tmp:obj:1" version="1">
                <lin-def:mount_point operation="pattern match">^/var/tmp$</lin-def:mount_point>
              </lin-def:partition_object>
              <unix-def:file_object id="oval:ssg-object_mcafee_auditengine_exists:obj:1" version="1">
                <unix-def:path>/opt/McAfee/auditengine/bin</unix-def:path>
                <unix-def:filename>auditmanager</unix-def:filename>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_mcafee_accm_exists:obj:1" version="1">
                <unix-def:path>/opt/McAfee/accm/bin</unix-def:path>
                <unix-def:filename>accm</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_logwatch_configured_splithosts:obj:1" version="1">
                <ind-def:filepath>/etc/logwatch/conf/logwatch.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]SplitHosts[\s]*=[\s]*yes[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_logwatch_configured_hostlimit:obj:1" version="1">
                <ind-def:filepath>/etc/logwatch/conf/logwatch.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]HostLimit[\s]*=[\s]*no[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_logrotate_conf_no_other_keyword:obj:1" version="2">
                <ind-def:filepath>/etc/logrotate.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*(weekly|monthly|yearly)[\s#]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_logrotate_conf_daily_setting:obj:1" version="2">
                <ind-def:filepath>/etc/logrotate.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*daily[\s#]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_logfile_sudoers:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/sudoers(|\.d/.*)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*Defaults.*\blogfile=("(?:\\"|\\\\|[^"\\\n])*"\B|[^"](?:(?:\\,|\\"|\\ |\\\\|[^", \\\n])*)\b).*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-object_local_db_modified_time:obj:1" version="1" comment="All modified times of all keyfiles">
                <ind-def:var_ref>oval:ssg-var_dconf_local_db_modified_time:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_last_uid_min_from_etc_login_defs:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath>/etc/login.defs</ind-def:filepath>
                <ind-def:pattern operation="pattern match">.*(?:^|\n)\s*(UID_MIN[\s]+[\d]+)\s*(?:$|\n)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath>/etc/login.defs</ind-def:filepath>
                <ind-def:pattern operation="pattern match">.*(?:^|\n)\s*(SYS_UID_MIN[\s]+[\d]+)\s*(?:$|\n)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath>/etc/login.defs</ind-def:filepath>
                <ind-def:pattern operation="pattern match">.*(?:^|\n)\s*(SYS_UID_MAX[\s]+[\d]+)\s*(?:$|\n)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-object_last_pass_warn_age_instance_value:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-variable_last_pass_warn_age_instance_value:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_last_pass_warn_age_from_etc_login_defs:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath>/etc/login.defs</ind-def:filepath>
                <ind-def:pattern operation="pattern match">.*\n[^#]*(PASS_WARN_AGE\s+\d+)\s*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-object_last_pass_min_len_instance_value:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-variable_last_pass_min_len_instance_value:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_last_pass_min_len_from_etc_login_defs:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath>/etc/login.defs</ind-def:filepath>
                <ind-def:pattern operation="pattern match">.*\n[^#]*(PASS_MIN_LEN\s+\d+)\s*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-object_last_pass_min_days_instance_value:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-variable_last_pass_min_days_instance_value:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_last_pass_min_days_from_etc_login_defs:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath>/etc/login.defs</ind-def:filepath>
                <ind-def:pattern operation="pattern match">.*\n[^#]*(PASS_MIN_DAYS\s+\d+)\s*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-object_last_pass_max_days_instance_value:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-variable_last_pass_max_days_instance_value:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_last_pass_max_days_from_etc_login_defs:obj:1" version="1">
                <ind-def:filepath>/etc/login.defs</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?:.*\n)*\s*[^#]*(PASS_MAX_DAYS\s+\d+)\s*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-object_last_encrypt_method_instance_value:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-variable_last_encrypt_method_instance_value:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_last_encrypt_method_from_etc_login_defs:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath>/etc/login.defs</ind-def:filepath>
                <ind-def:pattern operation="pattern match">.*\n[^#]*(ENCRYPT_METHOD\s+\w+)\s*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:symlink_object id="oval:ssg-object_kernel_yama_ptrace_scope_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_kernel_yama_ptrace_scope:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_kernel_yama_ptrace_scope:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_kernel_unprivileged_bpf_disabled_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_kernel_unprivileged_bpf_disabled:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_kernel_unprivileged_bpf_disabled:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_kernel_sysrq_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_kernel_sysrq:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_kernel_sysrq:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_kernel_randomize_va_space_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_kernel_randomize_va_space:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_kernel_randomize_va_space:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_kernel_pid_max_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_kernel_pid_max:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_kernel_pid_max:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_kernel_perf_event_paranoid_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_kernel_perf_event_paranoid:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_kernel_perf_event_paranoid:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_kernel_perf_event_max_sample_rate_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_kernel_perf_event_max_sample_rate:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_kernel_perf_event_max_sample_rate:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_kernel_perf_cpu_time_max_percent_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_kernel_perf_cpu_time_max_percent:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_kernel_perf_cpu_time_max_percent:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_kernel_panic_on_oops_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_kernel_panic_on_oops:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_kernel_panic_on_oops:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_kernel_modules_disabled_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_kernel_modules_disabled:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_kernel_modules_disabled:ste:1</filter>
              </unix-def:symlink_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_module_ipv6_option_disabled:obj:1" version="1" comment="ipv6 disabled any modprobe conf file">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*options\s+ipv6\s+.*disable=1.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:symlink_object id="oval:ssg-object_kernel_kptr_restrict_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_kernel_kptr_restrict:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_kernel_kptr_restrict:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_kernel_kexec_load_disabled_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_kernel_kexec_load_disabled:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_kernel_kexec_load_disabled:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_kernel_dmesg_restrict_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_kernel_dmesg_restrict:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_kernel_dmesg_restrict:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_kernel_core_pattern_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_kernel_core_pattern:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_kernel_core_pattern:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_x86_vsyscall_emulation_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_x86_vsyscall_emulation:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_X86_VSYSCALL_EMULATION="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_vmap_stack_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_vmap_stack:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_VMAP_STACK="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_unmap_kernel_at_el0_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_unmap_kernel_at_el0:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_UNMAP_KERNEL_AT_EL0="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_syn_cookies_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_syn_cookies:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_SYN_COOKIES="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_strict_module_rwx_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_strict_module_rwx:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_STRICT_MODULE_RWX="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_strict_kernel_rwx_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_strict_kernel_rwx:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_STRICT_KERNEL_RWX="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_stackprotector_strong_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_stackprotector_strong:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_STACKPROTECTOR_STRONG="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_stackprotector_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_stackprotector:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_STACKPROTECTOR="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_slub_debug_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_slub_debug:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_SLUB_DEBUG="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_slab_merge_default_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_slab_merge_default:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_SLAB_MERGE_DEFAULT="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_slab_frelist_random_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_slab_frelist_random:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_SLAB_FRELIST_RANDOM="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_slab_freelist_hardened_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_slab_freelist_hardened:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_SLAB_FREELIST_HARDENED="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_security_yama_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_security_yama:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_SECURITY_YAMA="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_security_writable_hooks_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_security_writable_hooks:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_SECURITY_WRITABLE_HOOKS="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_security_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_security_dmesg_restrict_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_security_dmesg_restrict:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_SECURITY_DMESG_RESTRICT="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_security:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_SECURITY="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_seccomp_filter_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_seccomp_filter:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_SECCOMP_FILTER="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_seccomp_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_seccomp:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_SECCOMP="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_sched_stack_end_check_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_sched_stack_end_check:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_SCHED_STACK_END_CHECK="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_retpoline_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_retpoline:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_RETPOLINE="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_refcount_full_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_refcount_full:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_REFCOUNT_FULL="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_randomize_memory_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_randomize_memory:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_RANDOMIZE_MEMORY="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_randomize_base_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_randomize_base:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_RANDOMIZE_BASE="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_proc_kcore_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_proc_kcore:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_PROC_KCORE="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_panic_timeout_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_panic_timeout:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_PANIC_TIMEOUT="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_panic_on_oops_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_panic_on_oops:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_PANIC_ON_OOPS="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_page_table_isolation_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_page_table_isolation:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_PAGE_TABLE_ISOLATION="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_page_poisoning_zero_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_page_poisoning_zero:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_PAGE_POISONING_ZERO="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_page_poisoning_no_sanity_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_page_poisoning_no_sanity:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_PAGE_POISONING_NO_SANITY="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_page_poisoning_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_page_poisoning:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_PAGE_POISONING="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_module_sig_sha512_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_module_sig_sha512:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_MODULE_SIG_SHA512="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_module_sig_key_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_module_sig_key:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_MODULE_SIG_KEY="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_module_sig_hash_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_module_sig_hash:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_MODULE_SIG_HASH="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_module_sig_force_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_module_sig_force:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_MODULE_SIG_FORCE="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_module_sig_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_module_sig_all_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_module_sig_all:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_MODULE_SIG_ALL="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_module_sig:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_MODULE_SIG="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_modify_ldt_syscall_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_modify_ldt_syscall:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_MODIFY_LDT_SYSCALL="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_legacy_vsyscall_xonly_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_legacy_vsyscall_xonly:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_LEGACY_VSYSCALL_XONLY="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_legacy_vsyscall_none_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_legacy_vsyscall_none:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_LEGACY_VSYSCALL_NONE="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_legacy_vsyscall_emulate_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_legacy_vsyscall_emulate:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_LEGACY_VSYSCALL_EMULATE="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_legacy_ptys_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_legacy_ptys:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_LEGACY_PTYS="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_kexec_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_kexec:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_KEXEC="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_ipv6_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_ipv6:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_IPV6="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_ia32_emulation_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_ia32_emulation:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_IA32_EMULATION="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_hibernation_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_hibernation:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_HIBERNATION="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_hardened_usercopy_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_hardened_usercopy_fallback_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_hardened_usercopy_fallback:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_HARDENED_USERCOPY_FALLBACK="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_hardened_usercopy:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_HARDENED_USERCOPY="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_gcc_plugin_structleak_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_gcc_plugin_structleak_byref_all_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_gcc_plugin_structleak_byref_all:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_gcc_plugin_structleak:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_GCC_PLUGIN_STRUCTLEAK="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_gcc_plugin_stackleak_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_gcc_plugin_stackleak:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_GCC_PLUGIN_STACKLEAK="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_gcc_plugin_randstruct_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_gcc_plugin_randstruct:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_GCC_PLUGIN_RANDSTRUCT="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_gcc_plugin_latent_entropy_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_gcc_plugin_latent_entropy:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_GCC_PLUGIN_LATENT_ENTROPY="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_fortify_source_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_fortify_source:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_FORTIFY_SOURCE="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_devkmem_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_devkmem:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_DEVKMEM="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_default_mmap_min_addr_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_default_mmap_min_addr:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_DEFAULT_MMAP_MIN_ADDR="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_debug_wx_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_debug_wx:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_DEBUG_WX="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_debug_sg_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_debug_sg:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_DEBUG_SG="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_debug_notifiers_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_debug_notifiers:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_DEBUG_NOTIFIERS="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_debug_list_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_debug_list:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_DEBUG_LIST="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_debug_fs_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_debug_fs:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_DEBUG_FS="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_debug_credentials_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_debug_credentials:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_DEBUG_CREDENTIALS="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_compat_vdso_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_compat_vdso:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_COMPAT_VDSO="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_compat_brk_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_compat_brk:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_COMPAT_BRK="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_bug_on_data_corruption_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_bug_on_data_corruption:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_BUG_ON_DATA_CORRUPTION="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_bug_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_bug:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_BUG="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_binfmt_misc_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_binfmt_misc:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_BINFMT_MISC="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_arm64_sw_ttbr0_pan_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_arm64_sw_ttbr0_pan:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_ARM64_SW_TTBR0_PAN="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_kernel_config_acpi_custom_method_files:obj:1" version="1" comment="Collect the kernel config files">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^config-.*$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_config_acpi_custom_method:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/config-.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^CONFIG_ACPI_CUSTOM_METHOD="?(.*?)"?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:symlink_object id="oval:ssg-object_kerberos_crypto_policy_configuration:obj:1" version="1" comment="kerberos crypto-policy configuration softlink">
                <unix-def:filepath>/etc/krb5.conf.d/crypto-policies</unix-def:filepath>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_kerberos_crypto_policy_backend:obj:1" version="1" comment="kerberos crypto-policy backend softlink">
                <unix-def:filepath>/etc/crypto-policies/back-ends/krb5.config</unix-def:filepath>
              </unix-def:symlink_object>
              <unix-def:file_object id="oval:ssg-object_installed_env_is_a_podman_container:obj:1" version="1" comment="Check file /run/.containerenv">
                <unix-def:filepath>/run/.containerenv</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_installed_env_is_a_docker_container:obj:1" version="1" comment="Check file /.dockerenv">
                <unix-def:filepath>/.dockerenv</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_id_provider_is_set_to_ad:obj:1" version="1">
                <ind-def:filepath>/etc/sssd/sssd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*\[domain\/[^]]*]([^\n\[\]]*\n+)+?[\s]*id_provider[ \t]*=[ \t]*((?i)ad)[ \t]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:partition_object id="oval:ssg-object_home_partition_noexec_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/home</lin-def:mount_point>
              </lin-def:partition_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_vsyscall_argument_default:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_vsyscall_argument:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_uefi_password_usercfg:obj:1" version="1">
                <ind-def:filepath>/boot/grub2/user.cfg</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*GRUB2_PASSWORD=grub\.pbkdf2\.sha512.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_spectre_v2_argument_default:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_spectre_v2_argument:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_spec_store_bypass_disable_argument_default:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_spec_store_bypass_disable_argument:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_slub_debug_argument_default:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_slub_debug_argument:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_slab_nomerge_argument_default:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_slab_nomerge_argument:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_rng_core_default_quality_argument_default:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_rng_core_default_quality_argument:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_pti_argument_default:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_pti_argument:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_password_usercfg:obj:1" version="1">
                <ind-def:filepath>/boot/grub2/user.cfg</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*GRUB2_PASSWORD=grub\.pbkdf2\.sha512.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_password_grubcfg:obj:1" version="1">
                <ind-def:filepath>/boot/grub2/grub.cfg</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*password_pbkdf2[\s]+.*[\s]+grub\.pbkdf2\.sha512.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_page_poison_argument_default:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_page_poison_argument:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_nosmep_argument_absent_default:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(?!.*\bnosmep\b).*"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_nosmep_argument_absent:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(?!.*\bnosmep\b.*).*"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_nosmap_argument_absent_default:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(?!.*\bnosmap\b).*"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_nosmap_argument_absent:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(?!.*\bnosmap\b.*).*"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_mds_argument_default:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_mds_argument:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_mce_argument_default:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_mce_argument:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_l1tf_argument_default:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_l1tf_argument:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_ipv6_disable_argument_default:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_ipv6_disable_argument:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_iommu_argument_default:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_iommu_argument:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_entries_reference_kernelopts:obj:1" version="1">
                <ind-def:path>/boot/loader/entries/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^options(?:\s+.*)?\s+\$kernelopts\b.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_disable_interactive_boot_grub_cmdline_linux_default:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT=".*systemd.confirm_spawn=(?:1|yes|true|on).*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_disable_interactive_boot_grub_cmdline_linux:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX=".*systemd.confirm_spawn=(?:1|yes|true|on).*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_default_exists:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT=.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_audit_backlog_limit_argument_default:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_audit_backlog_limit_argument:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_audit_argument_default:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_audit_argument:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_groupownership_system_commands_dirs:obj:1" version="1" comment="system commands files">
                <unix-def:path operation="pattern match">^\/s?bin|^\/usr\/s?bin|^\/usr\/local\/s?bin</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_groupowner_system_commands_dirs_not_root:ste:1</filter>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_gid_passwd_group_same_var:obj:1" version="1">
                <ind-def:filepath>/etc/group</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[^:]+:[^:]+:([0-9]+):</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_gid_passwd_group_same:obj:1" version="1">
                <ind-def:filepath>/etc/passwd</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[^:]+:[^:]+:[0-9]+:([0-9]+):</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:symlink_object id="oval:ssg-object_fs_suid_dumpable_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_fs_suid_dumpable:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_fs_suid_dumpable:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_fs_protected_symlinks_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_fs_protected_symlinks:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_fs_protected_symlinks:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_fs_protected_regular_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_fs_protected_regular:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_fs_protected_regular:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_fs_protected_hardlinks_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_fs_protected_hardlinks:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_fs_protected_hardlinks:ste:1</filter>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_fs_protected_fifos_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
                <unix-def:filepath var_ref="oval:ssg-local_var_conf_files_fs_protected_fifos:var:1" var_check="all"/>
                <filter>oval:ssg-state_symlink_points_outside_usual_dirs_fs_protected_fifos:ste:1</filter>
              </unix-def:symlink_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_force_opensc_card_drivers:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/opensc.*.conf$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]+force_card_driver[\s]+=[\s]+(\S+);$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:rpmverifyfile_object id="oval:ssg-object_files_fail_mode:obj:1" version="1" comment="rpm verify of all files">
                <lin-def:behaviors nomd5="true" noghostfiles="true"/>
                <lin-def:name operation="pattern match">.*</lin-def:name>
                <lin-def:epoch operation="pattern match">.*</lin-def:epoch>
                <lin-def:version operation="pattern match">.*</lin-def:version>
                <lin-def:release operation="pattern match">.*</lin-def:release>
                <lin-def:arch operation="pattern match">.*</lin-def:arch>
                <lin-def:filepath operation="pattern match">.*</lin-def:filepath>
                <filter action="include">oval:ssg-state_files_fail_mode:ste:1</filter>
              </lin-def:rpmverifyfile_object>
              <lin-def:rpmverifyfile_object id="oval:ssg-object_files_fail_md5_hash:obj:1" version="1" comment="rpm verify of all files">
                <lin-def:behaviors nomd5="false"/>
                <lin-def:name operation="pattern match">.*</lin-def:name>
                <lin-def:epoch operation="pattern match">.*</lin-def:epoch>
                <lin-def:version operation="pattern match">.*</lin-def:version>
                <lin-def:release operation="pattern match">.*</lin-def:release>
                <lin-def:arch operation="pattern match">.*</lin-def:arch>
                <lin-def:filepath operation="pattern match">^/(bin|sbin|lib|lib64|usr)/.+$</lin-def:filepath>
                <filter action="include">oval:ssg-state_files_fail_md5_hash:ste:1</filter>
              </lin-def:rpmverifyfile_object>
              <unix-def:file_object id="oval:ssg-object_file_sys_firmware_efi:obj:1" version="1" comment="/sys/firmware/efi">
                <unix-def:path>/sys/firmware/efi</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissionsdir_permissions_library_dirs_3:obj:1" version="1" comment="/usr/lib64/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/usr/lib64</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-exclude_symlinks_dir_permissions_library_dirs:ste:1</filter>
                <filter>oval:ssg-state_file_permissionsdir_permissions_library_dirs_3_mode_0755or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissionsdir_permissions_library_dirs_2:obj:1" version="1" comment="/usr/lib/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/usr/lib</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-exclude_symlinks_dir_permissions_library_dirs:ste:1</filter>
                <filter>oval:ssg-state_file_permissionsdir_permissions_library_dirs_2_mode_0755or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissionsdir_permissions_library_dirs_1:obj:1" version="1" comment="/lib64/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/lib64</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-exclude_symlinks_dir_permissions_library_dirs:ste:1</filter>
                <filter>oval:ssg-state_file_permissionsdir_permissions_library_dirs_1_mode_0755or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissionsdir_permissions_library_dirs_0:obj:1" version="1" comment="/lib/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/lib</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-exclude_symlinks_dir_permissions_library_dirs:ste:1</filter>
                <filter>oval:ssg-state_file_permissionsdir_permissions_library_dirs_0_mode_0755or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_5:obj:1" version="1" comment="/usr/local/sbin/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/usr/local/sbin</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1</filter>
                <filter>oval:ssg-state_file_permissionsdir_permissions_binary_dirs_5_mode_0755or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_4:obj:1" version="1" comment="/usr/local/bin/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/usr/local/bin</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1</filter>
                <filter>oval:ssg-state_file_permissionsdir_permissions_binary_dirs_4_mode_0755or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_3:obj:1" version="1" comment="/usr/sbin/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/usr/sbin</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1</filter>
                <filter>oval:ssg-state_file_permissionsdir_permissions_binary_dirs_3_mode_0755or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_2:obj:1" version="1" comment="/usr/bin/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/usr/bin</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1</filter>
                <filter>oval:ssg-state_file_permissionsdir_permissions_binary_dirs_2_mode_0755or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_1:obj:1" version="1" comment="/sbin/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/sbin</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1</filter>
                <filter>oval:ssg-state_file_permissionsdir_permissions_binary_dirs_1_mode_0755or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_0:obj:1" version="1" comment="/bin/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/bin</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1</filter>
                <filter>oval:ssg-state_file_permissionsdir_permissions_binary_dirs_0_mode_0755or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_var_log_syslog_0:obj:1" version="1" comment="/var/log/syslog">
                <unix-def:filepath>/var/log/syslog</unix-def:filepath>
                <filter>oval:ssg-exclude_symlinks__var_log_syslog:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_var_log_syslog_0_mode_0640or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_var_log_messages_0:obj:1" version="1" comment="/var/log/messages">
                <unix-def:filepath>/var/log/messages</unix-def:filepath>
                <filter>oval:ssg-exclude_symlinks__var_log_messages:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_var_log_messages_0_mode_0640or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_var_log_0:obj:1" version="1" comment="/var/log/">
                <unix-def:path>/var/log</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-exclude_symlinks__var_log:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_var_log_0_mode_0755or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_ungroupowned:obj:1" version="1" comment="all local files">
                <unix-def:behaviors recurse="directories" recurse_direction="down" recurse_file_system="local"/>
                <unix-def:path>/</unix-def:path>
                <unix-def:filename operation="pattern match">.*</unix-def:filename>
                <filter>oval:ssg-state_file_permissions_ungroupowned:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_unauthorized_world_write:obj:1" version="1" comment="world writable">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_file_permissions_unauthorized_world_write:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_unauthorized_world_write_exclude_special_selinux_files:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_unauthorized_world_write_exclude_proc:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_unauthorized_world_write_exclude_sys:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_systemmap_files:obj:1" version="1" comment="system.mapfiles">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^System\.map.*$</unix-def:filename>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_sshd_pub_key_0:obj:1" version="1" comment="/etc/ssh/">
                <unix-def:path>/etc/ssh</unix-def:path>
                <unix-def:filename operation="pattern match">^.*.pub$</unix-def:filename>
                <filter>oval:ssg-exclude_symlinks__sshd_pub_key:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_sshd_pub_key_0_mode_0644or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_sshd_private_key_0:obj:1" version="1" comment="/etc/ssh/">
                <unix-def:path>/etc/ssh</unix-def:path>
                <unix-def:filename operation="pattern match">^.*_key$</unix-def:filename>
                <filter>oval:ssg-exclude_symlinks__sshd_private_key:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_sshd_private_key_0_mode_0600or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_library_dirs_3:obj:1" version="1" comment="/usr/lib64/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/usr/lib64</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter>oval:ssg-exclude_symlinks__library_dirs:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_library_dirs_3_mode_7755or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_library_dirs_2:obj:1" version="1" comment="/usr/lib/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/usr/lib</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter>oval:ssg-exclude_symlinks__library_dirs:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_library_dirs_2_mode_7755or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_library_dirs_1:obj:1" version="1" comment="/lib64/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/lib64</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter>oval:ssg-exclude_symlinks__library_dirs:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_library_dirs_1_mode_7755or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_library_dirs_0:obj:1" version="1" comment="/lib/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/lib</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter>oval:ssg-exclude_symlinks__library_dirs:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_library_dirs_0_mode_7755or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:password_object id="oval:ssg-object_file_permissions_home_dirs_objects:obj:1" version="1">
                <unix-def:username operation="not equal">nobody</unix-def:username>
                <filter action="include">oval:ssg-state_file_permissions_home_dirs_interactive_uids:ste:1</filter>
              </unix-def:password_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_home_dirs_dirs:obj:1" version="1">
                <unix-def:path var_ref="oval:ssg-var_file_permissions_home_dirs_dirs:var:1" var_check="at least one"/>
                <unix-def:filename xsi:nil="true"/>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_grub2_cfg_0:obj:1" version="1" comment="/boot/grub2/grub.cfg">
                <unix-def:filepath>/boot/grub2/grub.cfg</unix-def:filepath>
                <filter>oval:ssg-exclude_symlinks__grub2_cfg:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_grub2_cfg_0_mode_0600or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_etc_shadow_0:obj:1" version="1" comment="/etc/shadow">
                <unix-def:filepath>/etc/shadow</unix-def:filepath>
                <filter>oval:ssg-exclude_symlinks__etc_shadow:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_etc_shadow_0_mode_0000or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_etc_passwd_0:obj:1" version="1" comment="/etc/passwd">
                <unix-def:filepath>/etc/passwd</unix-def:filepath>
                <filter>oval:ssg-exclude_symlinks__etc_passwd:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_etc_passwd_0_mode_0644or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_etc_motd_0:obj:1" version="1" comment="/etc/motd">
                <unix-def:filepath>/etc/motd</unix-def:filepath>
                <filter>oval:ssg-exclude_symlinks__etc_motd:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_etc_motd_0_mode_0644or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_etc_issue_0:obj:1" version="1" comment="/etc/issue">
                <unix-def:filepath>/etc/issue</unix-def:filepath>
                <filter>oval:ssg-exclude_symlinks__etc_issue:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_etc_issue_0_mode_0644or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_etc_gshadow_0:obj:1" version="1" comment="/etc/gshadow">
                <unix-def:filepath>/etc/gshadow</unix-def:filepath>
                <filter>oval:ssg-exclude_symlinks__etc_gshadow:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_etc_gshadow_0_mode_0000or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_etc_group_0:obj:1" version="1" comment="/etc/group">
                <unix-def:filepath>/etc/group</unix-def:filepath>
                <filter>oval:ssg-exclude_symlinks__etc_group:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_etc_group_0_mode_0644or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_etc_audit_rulesd_0:obj:1" version="1" comment="/etc/audit/rules.d/">
                <unix-def:path>/etc/audit/rules.d</unix-def:path>
                <unix-def:filename operation="pattern match">^.*rules$</unix-def:filename>
                <filter>oval:ssg-exclude_symlinks__etc_audit_rulesd:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_etc_audit_rulesd_0_mode_0640or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_etc_audit_auditd_0:obj:1" version="1" comment="/etc/audit/auditd.conf">
                <unix-def:filepath>/etc/audit/auditd.conf</unix-def:filepath>
                <filter>oval:ssg-exclude_symlinks__etc_audit_auditd:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_etc_audit_auditd_0_mode_0640or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_efi_grub2_cfg_0:obj:1" version="1" comment="/boot/grub2/grub.cfg">
                <unix-def:filepath>/boot/grub2/grub.cfg</unix-def:filepath>
                <filter>oval:ssg-exclude_symlinks__efi_grub2_cfg:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_efi_grub2_cfg_0_mode_0700or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_binary_files:obj:1" version="1" comment="binary files">
                <unix-def:path operation="pattern match">^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_perms_binary_files_nogroupwrite_noworldwrite:ste:1</filter>
                <filter>oval:ssg-state_perms_binary_files_symlink:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_backup_etc_shadow_0:obj:1" version="1" comment="/etc/shadow-">
                <unix-def:filepath>/etc/shadow-</unix-def:filepath>
                <filter>oval:ssg-exclude_symlinks__backup_etc_shadow:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_backup_etc_shadow_0_mode_0000or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_backup_etc_passwd_0:obj:1" version="1" comment="/etc/passwd-">
                <unix-def:filepath>/etc/passwd-</unix-def:filepath>
                <filter>oval:ssg-exclude_symlinks__backup_etc_passwd:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_backup_etc_passwd_0_mode_0644or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_backup_etc_gshadow_0:obj:1" version="1" comment="/etc/gshadow-">
                <unix-def:filepath>/etc/gshadow-</unix-def:filepath>
                <filter>oval:ssg-exclude_symlinks__backup_etc_gshadow:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_backup_etc_gshadow_0_mode_0000or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_backup_etc_group_0:obj:1" version="1" comment="/etc/group-">
                <unix-def:filepath>/etc/group-</unix-def:filepath>
                <filter>oval:ssg-exclude_symlinks__backup_etc_group:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_backup_etc_group_0_mode_0644or_stricter_:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_ownership_library_dirs_3:obj:1" version="1" comment="/usr/lib64/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/usr/lib64</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter>oval:ssg-symlink_file_ownership_library_dirs_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_ownership_library_dirs_uid_0_3:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_ownership_library_dirs_2:obj:1" version="1" comment="/usr/lib/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/usr/lib</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter>oval:ssg-symlink_file_ownership_library_dirs_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_ownership_library_dirs_uid_0_2:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_ownership_library_dirs_1:obj:1" version="1" comment="/lib64/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/lib64</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter>oval:ssg-symlink_file_ownership_library_dirs_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_ownership_library_dirs_uid_0_1:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_ownership_library_dirs_0:obj:1" version="1" comment="/lib/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/lib</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter>oval:ssg-symlink_file_ownership_library_dirs_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_ownership_library_dirs_uid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_ownership_binary_files:obj:1" version="1" comment="binary files">
                <unix-def:path operation="pattern match">^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_owner_binaries_not_root:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_ownership_binary_directories:obj:1" version="1" comment="binary directories">
                <unix-def:path operation="pattern match">^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_owner_binaries_not_root:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_ownership_audit_configuration_1:obj:1" version="1" comment="/etc/audit/rules.d/">
                <unix-def:path>/etc/audit/rules.d</unix-def:path>
                <unix-def:filename operation="pattern match">^.*\.rules$</unix-def:filename>
                <filter>oval:ssg-symlink_file_ownership_audit_configuration_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_ownership_audit_configuration_uid_0_1:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_ownership_audit_configuration_0:obj:1" version="1" comment="/etc/audit/">
                <unix-def:path>/etc/audit</unix-def:path>
                <unix-def:filename operation="pattern match">^audit(\.rules|d\.conf)$</unix-def:filename>
                <filter>oval:ssg-symlink_file_ownership_audit_configuration_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_ownership_audit_configuration_uid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_ownerdir_ownership_library_dirs_3:obj:1" version="1" comment="/usr/lib64/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/usr/lib64</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-symlink_file_ownerdir_ownership_library_dirs_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_3:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_ownerdir_ownership_library_dirs_2:obj:1" version="1" comment="/usr/lib/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/usr/lib</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-symlink_file_ownerdir_ownership_library_dirs_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_2:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_ownerdir_ownership_library_dirs_1:obj:1" version="1" comment="/lib64/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/lib64</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-symlink_file_ownerdir_ownership_library_dirs_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_1:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_ownerdir_ownership_library_dirs_0:obj:1" version="1" comment="/lib/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/lib</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-symlink_file_ownerdir_ownership_library_dirs_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_ownerdir_ownership_binary_dirs_5:obj:1" version="1" comment="/usr/local/sbin/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/usr/local/sbin</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_5:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_ownerdir_ownership_binary_dirs_4:obj:1" version="1" comment="/usr/local/bin/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/usr/local/bin</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_4:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_ownerdir_ownership_binary_dirs_3:obj:1" version="1" comment="/usr/sbin/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/usr/sbin</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_3:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_ownerdir_ownership_binary_dirs_2:obj:1" version="1" comment="/usr/bin/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/usr/bin</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_2:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_ownerdir_ownership_binary_dirs_1:obj:1" version="1" comment="/sbin/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/sbin</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_1:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_ownerdir_ownership_binary_dirs_0:obj:1" version="1" comment="/bin/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/bin</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_var_log_syslog_0:obj:1" version="1" comment="/var/log/syslog">
                <unix-def:filepath>/var/log/syslog</unix-def:filepath>
                <filter>oval:ssg-symlink_file_owner_var_log_syslog_uid_104:ste:1</filter>
                <filter>oval:ssg-state_file_owner_var_log_syslog_uid_104_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_var_log_messages_0:obj:1" version="1" comment="/var/log/messages">
                <unix-def:filepath>/var/log/messages</unix-def:filepath>
                <filter>oval:ssg-symlink_file_owner_var_log_messages_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_owner_var_log_messages_uid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_var_log_0:obj:1" version="1" comment="/var/log/">
                <unix-def:path>/var/log</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-symlink_file_owner_var_log_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_owner_var_log_uid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_grub2_cfg_0:obj:1" version="1" comment="/boot/grub2/grub.cfg">
                <unix-def:filepath>/boot/grub2/grub.cfg</unix-def:filepath>
                <filter>oval:ssg-symlink_file_owner_grub2_cfg_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_owner_grub2_cfg_uid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_etc_shadow_0:obj:1" version="1" comment="/etc/shadow">
                <unix-def:filepath>/etc/shadow</unix-def:filepath>
                <filter>oval:ssg-symlink_file_owner_etc_shadow_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_owner_etc_shadow_uid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_etc_passwd_0:obj:1" version="1" comment="/etc/passwd">
                <unix-def:filepath>/etc/passwd</unix-def:filepath>
                <filter>oval:ssg-symlink_file_owner_etc_passwd_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_owner_etc_passwd_uid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_etc_motd_0:obj:1" version="1" comment="/etc/motd">
                <unix-def:filepath>/etc/motd</unix-def:filepath>
                <filter>oval:ssg-symlink_file_owner_etc_motd_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_owner_etc_motd_uid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_etc_issue_0:obj:1" version="1" comment="/etc/issue">
                <unix-def:filepath>/etc/issue</unix-def:filepath>
                <filter>oval:ssg-symlink_file_owner_etc_issue_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_owner_etc_issue_uid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_etc_gshadow_0:obj:1" version="1" comment="/etc/gshadow">
                <unix-def:filepath>/etc/gshadow</unix-def:filepath>
                <filter>oval:ssg-symlink_file_owner_etc_gshadow_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_owner_etc_gshadow_uid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_etc_group_0:obj:1" version="1" comment="/etc/group">
                <unix-def:filepath>/etc/group</unix-def:filepath>
                <filter>oval:ssg-symlink_file_owner_etc_group_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_owner_etc_group_uid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_efi_grub2_cfg_0:obj:1" version="1" comment="/boot/grub2/grub.cfg">
                <unix-def:filepath>/boot/grub2/grub.cfg</unix-def:filepath>
                <filter>oval:ssg-symlink_file_owner_efi_grub2_cfg_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_owner_efi_grub2_cfg_uid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_backup_etc_shadow_0:obj:1" version="1" comment="/etc/shadow-">
                <unix-def:filepath>/etc/shadow-</unix-def:filepath>
                <filter>oval:ssg-symlink_file_owner_backup_etc_shadow_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_owner_backup_etc_shadow_uid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_backup_etc_passwd_0:obj:1" version="1" comment="/etc/passwd-">
                <unix-def:filepath>/etc/passwd-</unix-def:filepath>
                <filter>oval:ssg-symlink_file_owner_backup_etc_passwd_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_owner_backup_etc_passwd_uid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_backup_etc_gshadow_0:obj:1" version="1" comment="/etc/gshadow-">
                <unix-def:filepath>/etc/gshadow-</unix-def:filepath>
                <filter>oval:ssg-symlink_file_owner_backup_etc_gshadow_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_owner_backup_etc_gshadow_uid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_backup_etc_group_0:obj:1" version="1" comment="/etc/group-">
                <unix-def:filepath>/etc/group-</unix-def:filepath>
                <filter>oval:ssg-symlink_file_owner_backup_etc_group_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_owner_backup_etc_group_uid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupownership_audit_configuration_1:obj:1" version="1" comment="/etc/audit/rules.d/">
                <unix-def:path>/etc/audit/rules.d</unix-def:path>
                <unix-def:filename operation="pattern match">^.*\.rules$</unix-def:filename>
                <filter>oval:ssg-symlink_file_groupownership_audit_configuration_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_groupownership_audit_configuration_gid_0_1:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupownership_audit_configuration_0:obj:1" version="1" comment="/etc/audit/">
                <unix-def:path>/etc/audit</unix-def:path>
                <unix-def:filename operation="pattern match">^audit(\.rules|d\.conf)$</unix-def:filename>
                <filter>oval:ssg-symlink_file_groupownership_audit_configuration_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_groupownership_audit_configuration_gid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_3:obj:1" version="1" comment="/usr/lib64/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/usr/lib64</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-symlink_file_groupownerroot_permissions_syslibrary_files_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_gid_0_3:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_2:obj:1" version="1" comment="/usr/lib/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/usr/lib</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-symlink_file_groupownerroot_permissions_syslibrary_files_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_gid_0_2:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_1:obj:1" version="1" comment="/lib64/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/lib64</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-symlink_file_groupownerroot_permissions_syslibrary_files_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_gid_0_1:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_0:obj:1" version="1" comment="/lib/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/lib</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-symlink_file_groupownerroot_permissions_syslibrary_files_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_gid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_3:obj:1" version="1" comment="/usr/lib64/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/usr/lib64</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-symlink_file_groupownerdir_group_ownership_library_dirs_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_gid_0_3:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_2:obj:1" version="1" comment="/usr/lib/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/usr/lib</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-symlink_file_groupownerdir_group_ownership_library_dirs_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_gid_0_2:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_1:obj:1" version="1" comment="/lib64/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/lib64</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-symlink_file_groupownerdir_group_ownership_library_dirs_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_gid_0_1:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_0:obj:1" version="1" comment="/lib/">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/lib</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-symlink_file_groupownerdir_group_ownership_library_dirs_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_gid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_var_log_syslog_0:obj:1" version="1" comment="/var/log/syslog">
                <unix-def:filepath>/var/log/syslog</unix-def:filepath>
                <filter>oval:ssg-symlink_file_groupowner_var_log_syslog_uid_4:ste:1</filter>
                <filter>oval:ssg-state_file_groupowner_var_log_syslog_gid_4_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_var_log_messages_0:obj:1" version="1" comment="/var/log/messages">
                <unix-def:filepath>/var/log/messages</unix-def:filepath>
                <filter>oval:ssg-symlink_file_groupowner_var_log_messages_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_groupowner_var_log_messages_gid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_var_log_0:obj:1" version="1" comment="/var/log/">
                <unix-def:path>/var/log</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-symlink_file_groupowner_var_log_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_groupowner_var_log_gid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_grub2_cfg_0:obj:1" version="1" comment="/boot/grub2/grub.cfg">
                <unix-def:filepath>/boot/grub2/grub.cfg</unix-def:filepath>
                <filter>oval:ssg-symlink_file_groupowner_grub2_cfg_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_groupowner_grub2_cfg_gid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_etc_shadow_0:obj:1" version="1" comment="/etc/shadow">
                <unix-def:filepath>/etc/shadow</unix-def:filepath>
                <filter>oval:ssg-symlink_file_groupowner_etc_shadow_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_groupowner_etc_shadow_gid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_etc_passwd_0:obj:1" version="1" comment="/etc/passwd">
                <unix-def:filepath>/etc/passwd</unix-def:filepath>
                <filter>oval:ssg-symlink_file_groupowner_etc_passwd_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_groupowner_etc_passwd_gid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_etc_motd_0:obj:1" version="1" comment="/etc/motd">
                <unix-def:filepath>/etc/motd</unix-def:filepath>
                <filter>oval:ssg-symlink_file_groupowner_etc_motd_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_groupowner_etc_motd_gid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_etc_issue_0:obj:1" version="1" comment="/etc/issue">
                <unix-def:filepath>/etc/issue</unix-def:filepath>
                <filter>oval:ssg-symlink_file_groupowner_etc_issue_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_groupowner_etc_issue_gid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_etc_gshadow_0:obj:1" version="1" comment="/etc/gshadow">
                <unix-def:filepath>/etc/gshadow</unix-def:filepath>
                <filter>oval:ssg-symlink_file_groupowner_etc_gshadow_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_groupowner_etc_gshadow_gid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_etc_group_0:obj:1" version="1" comment="/etc/group">
                <unix-def:filepath>/etc/group</unix-def:filepath>
                <filter>oval:ssg-symlink_file_groupowner_etc_group_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_groupowner_etc_group_gid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_efi_grub2_cfg_0:obj:1" version="1" comment="/boot/grub2/grub.cfg">
                <unix-def:filepath>/boot/grub2/grub.cfg</unix-def:filepath>
                <filter>oval:ssg-symlink_file_groupowner_efi_grub2_cfg_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_groupowner_efi_grub2_cfg_gid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_backup_etc_shadow_0:obj:1" version="1" comment="/etc/shadow-">
                <unix-def:filepath>/etc/shadow-</unix-def:filepath>
                <filter>oval:ssg-symlink_file_groupowner_backup_etc_shadow_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_groupowner_backup_etc_shadow_gid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_backup_etc_passwd_0:obj:1" version="1" comment="/etc/passwd-">
                <unix-def:filepath>/etc/passwd-</unix-def:filepath>
                <filter>oval:ssg-symlink_file_groupowner_backup_etc_passwd_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_groupowner_backup_etc_passwd_gid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_backup_etc_gshadow_0:obj:1" version="1" comment="/etc/gshadow-">
                <unix-def:filepath>/etc/gshadow-</unix-def:filepath>
                <filter>oval:ssg-symlink_file_groupowner_backup_etc_gshadow_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_groupowner_backup_etc_gshadow_gid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_backup_etc_group_0:obj:1" version="1" comment="/etc/group-">
                <unix-def:filepath>/etc/group-</unix-def:filepath>
                <filter>oval:ssg-symlink_file_groupowner_backup_etc_group_uid_0:ste:1</filter>
                <filter>oval:ssg-state_file_groupowner_backup_etc_group_gid_0_0:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_cron_deny_not_exist:obj:1" version="1" comment="/etc/cron.deny">
                <unix-def:filepath>/etc/cron.deny</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_at_deny_not_exist:obj:1" version="1" comment="/etc/at.deny">
                <unix-def:filepath>/etc/at.deny</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_fedora_vendor_product:obj:1" version="1">
                <ind-def:filepath>/etc/system-release-cpe</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^cpe:\/o:fedoraproject:fedora:[\d]+$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:rpminfo_object id="oval:ssg-object_fedora_release_rpm:obj:1" version="1">
                <lin-def:name operation="pattern match">fedora-release.*</lin-def:name>
              </lin-def:rpminfo_object>
              <unix-def:file_object id="oval:ssg-object_etc_system_fips:obj:1" version="1">
                <unix-def:filepath>/etc/system-fips</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_etc_selinux_config:obj:1" version="1">
                <ind-def:filepath>/etc/selinux/config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^SELINUX=(.*)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_etc_security_limitsd_conf_maxlogins_exists:obj:1" version="1">
                <ind-def:path>/etc/security/limits.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_etc_security_limitsd_conf_maxlogins:obj:1" version="1">
                <ind-def:path>/etc/security/limits.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_etc_security_limits_conf_maxlogins:obj:1" version="1">
                <ind-def:filepath>/etc/security/limits.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_etc_securetty_exists:obj:1" version="1" comment="/etc/securetty file exists">
                <ind-def:filepath>/etc/securetty</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_etc_profiled_tmout:obj:1" version="3">
                <ind-def:path>/etc/profile.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.sh$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*TMOUT=([\w$]+).*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_etc_profile_tmout:obj:1" version="3">
                <ind-def:filepath>/etc/profile</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*TMOUT=([\w$]+).*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_etc_passwd_entries:obj:1" version="1">
                <ind-def:filepath>/etc/passwd</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?!root).*:x:([\d]+):[\d]+:[^:]*:[^:]*:(?!\/usr\/sbin\/nologin|\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt|\/bin\/false|\/usr\/bin\/false).*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_etc_passwd_content:obj:1" version="1">
                <ind-def:filepath>/etc/passwd</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^([^:]+):.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_etc_libuser_conf_cryptstyle:obj:1" version="1" comment="The password hashing algorithm should be set correctly in /etc/libuser.conf">
                <ind-def:filepath>/etc/libuser.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*crypt_style[\s]+=[\s]+(?i)sha512[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_etc_default_useradd_inactive:obj:1" version="1">
                <ind-def:filepath>/etc/default/useradd</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*INACTIVE\s*=\s*(\d+)\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_ensure_gpgcheck_globally_activated:obj:1" version="1" comment="gpgcheck set in /etc/dnf/dnf.conf">
                <ind-def:filepath>/etc/dnf/dnf.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*gpgcheck\s*=\s*1\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_enable_syscall_audit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+task,never[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_enable_syscall_audit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+task,never[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_enable_dracut_fips_module:obj:1" version="1">
                <ind-def:filepath>/etc/dracut.conf.d/40-fips.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*add_dracutmodules\+="\s*(\w*)\s*"\s*(?:#.*)?$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-object_distro_db_modified_time:obj:1" version="1" comment="All modified times of all keyfiles">
                <ind-def:var_ref>oval:ssg-var_dconf_distro_db_modified_time:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <unix-def:symlink_object id="oval:ssg-object_disable_xwindows_runlevel_target:obj:1" version="1" comment="default.target systemd softlink exists">
                <unix-def:filepath>/etc/systemd/system/default.target</unix-def:filepath>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_disable_ctrlaltdel_exists:obj:1" version="1" comment="Disable Ctrl-Alt-Del key sequence override exists">
                <unix-def:filepath>/etc/systemd/system/ctrl-alt-del.target</unix-def:filepath>
              </unix-def:symlink_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_directory_acccess_var_log_audit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_access_var_log_audit_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_directory_acccess_var_log_audit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_access_var_log_audit_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:partition_object id="oval:ssg-object_dev_shm_partition_nosuid_optional_no:obj:1" version="1">
                <lin-def:mount_point>/dev/shm</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_dev_shm_partition_noexec_optional_no:obj:1" version="1">
                <lin-def:mount_point>/dev/shm</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_dev_shm_partition_nodev_optional_no:obj:1" version="1">
                <lin-def:mount_point>/dev/shm</lin-def:mount_point>
              </lin-def:partition_object>
              <unix-def:file_object id="oval:ssg-object_dev_device_files:obj:1" version="1" comment="device files within /dev directory">
                <unix-def:behaviors recurse_direction="down"/>
                <unix-def:path>/dev</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_block_or_char_device_file:ste:1</filter>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_defaultkernel_sysconfig_kernel:obj:1" version="1">
                <ind-def:filepath>/etc/sysconfig/kernel</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*DEFAULTKERNEL[\s]*=[\s]*kernel-PAE$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_crypto_policy_nss_config:obj:1" version="1">
                <unix-def:filepath>/etc/crypto-policies/back-ends/nss.config</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:variable_object id="oval:ssg-object_crypto_policies_config_file_modified_time:obj:1" version="1" comment="Crypto policy current file timestamp">
                <ind-def:var_ref>oval:ssg-variable_crypto_policies_config_file_timestamp:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_cron_daily_logrotate_existence:obj:1" version="1">
                <ind-def:filepath>/etc/cron.daily/logrotate</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*/usr/sbin/logrotate[\s\S]*/etc/logrotate.conf$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-object_count_of_suid_sgid_binaries_on_system:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-variable_count_of_suid_sgid_binaries_on_system:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_count_of_all_usernames_from_etc_passwd:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/proc/cmdline</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^BOOT_IMAGE(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/loader/entries/ostree-2-.*.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^options (.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/loader/entries/ostree-1-.*.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^options (.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_coreos_enable_selinux_kernel_argument_file_boot_loader_entries_ostree_2_conf_absent:obj:1" version="1">
                <unix-def:filepath operation="pattern match">^/boot/loader/entries/ostree-2-.*.conf</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_core_dumps_limitsconf:obj:1" version="1">
                <ind-def:filepath>/etc/security/limits.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*\*[\s]+(?:hard|-)[\s]+core[\s]+([\d]+)</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_core_dumps_limits_d_exists:obj:1" version="1">
                <ind-def:path>/etc/security/limits.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*\*[\s]+(?:hard|-)[\s]+core</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_core_dumps_limits_d:obj:1" version="1">
                <ind-def:path>/etc/security/limits.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*\*[\s]+(?:hard|-)[\s]+core[\s]+([\d]+)</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_configure_ssh_crypto_policy:obj:1" version="1">
                <ind-def:filepath>/etc/sysconfig/sshd</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*(?i)CRYPTO_POLICY\s*=.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_configure_openssl_crypto_policy:obj:1" version="1">
                <ind-def:filepath>/etc/pki/tls/openssl.cnf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*\[\s*crypto_policy\s*\]\s*\n*\s*\.include\s*(?:=\s*)?/etc/crypto-policies/back-ends/opensslcnf.config\s*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_configure_opensc_nss_db:obj:1" version="1">
                <ind-def:filepath>/etc/pki/nssdb/pkcs11.txt</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^library=opensc.*.so$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_configure_opensc_card_drivers:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/opensc.*.conf$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]+card_drivers[\s]+=[\s]+(\S+);$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_configure_mount_option_var_tmp_bind_tmp:obj:1" version="1" comment="look for the partition mount point in /etc/mtab">
                <ind-def:filepath>/etc/fstab</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_configure_libreswan_crypto_policy:obj:1" version="1">
                <ind-def:filepath>/etc/ipsec.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*include\s+/etc/crypto-policies/back-ends/libreswan.config\s*(?:#.*)?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_configure_crypto_policy_current:obj:1" version="1">
                <ind-def:filepath>/etc/crypto-policies/state/current</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?!#)(\S+)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_configure_crypto_policy:obj:1" version="1">
                <ind-def:filepath>/etc/crypto-policies/config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?!#)(\S+)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_configure_bind_crypto_policy:obj:1" version="1">
                <ind-def:filepath>/etc/named.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*include\s+"/etc/crypto-policies/back-ends/bind.config"\s*;\s*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_chronyd_server_directive:obj:1" version="1" comment="Matches server entries in Chrony conf files">
                <ind-def:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*server.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_chronyd_remote_server:obj:1" version="1" comment="Ensure at least one NTP server is set">
                <ind-def:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*(?:server|pool)[\s]+.+$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_chronyd_no_pool_directive:obj:1" version="1" comment="Matches pool entires in Chrony conf files">
                <ind-def:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]+pool.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_chronyd_multiple_servers:obj:1" version="1" comment="Ensure more than one chronyd NTP server is set">
                <ind-def:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^([\s]*server[\s]+.+$){2,}$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_bootloader_unique_superuser:obj:1" version="1">
                <ind-def:filepath>/boot/grub2/grub.cfg</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*set[\s]+superusers="(?i)\b(?!(?:root|admin|administrator)\b)(\w+)"$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_bootloader_uefi_unique_superuser:obj:1" version="1">
                <ind-def:filepath>/boot/grub2/grub.cfg</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*set[\s]+superusers="(?i)\b(?!(?:root|admin|administrator)\b)(\w+)"$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_bootloader_superuser:obj:1" version="2">
                <ind-def:filepath>/boot/grub2/grub.cfg</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*set[\s]+superusers=("?)[a-zA-Z_]+\1$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_bootloader_disable_recovery_argument:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_DISABLE_RECOVERY=(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:partition_object id="oval:ssg-object_boot_partition_nosuid_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/boot</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_boot_partition_noexec_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/boot</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_boot_partition_nodev_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/boot</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_boot_partition_noauto_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/boot</lin-def:mount_point>
              </lin-def:partition_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_banner_etc_motd:obj:1" version="1">
                <ind-def:behaviors singleline="true" multiline="false"/>
                <ind-def:filepath>/etc/motd</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_banner_etc_issue:obj:1" version="1">
                <ind-def:behaviors singleline="true" multiline="false"/>
                <ind-def:filepath operation="pattern match">^/etc/issue(\.d/.*)?$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_space_left_percentage:obj:1" version="2">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*space_left[\s]+=[\s]+(\d+)%[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_space_left_action:obj:1" version="2">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*space_left_action[ ]+=[ ]+(\S+)[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_num_logs:obj:1" version="2">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*num_logs[ ]+=[ ]+(\d+)[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_max_log_file_action:obj:1" version="2">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*max_log_file_action[ ]+=[ ]+(\S+)[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_max_log_file:obj:1" version="2">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*max_log_file[ ]+=[ ]+(\d+)[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_flush:obj:1" version="1">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*flush[ ]+=[ ]+(\S+)[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_admin_space_left_action:obj:1" version="2">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*admin_space_left_action[ ]+=[ ]+(\S+)[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_action_mail_acct:obj:1" version="2">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*action_mail_acct[ ]+=[ ]+(\S+)[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_data_disk_full_action:obj:1" version="2">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*disk_full_action[ ]+=[ ]+(\S+)[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_data_disk_error_action:obj:1" version="2">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*disk_error_action[ ]+=[ ]+(\S+)[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_conf_log_group_root:obj:1" version="1" comment="log_group = root">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*log_group[ ]+=[ ]+root[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_conf_log_group_is_set:obj:1" version="1" comment="log_group is set">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*log_group[ ]+=.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_conf_log_file:obj:1" version="1">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(log_file\s*=\s*.*)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_audispd_syslog_plugin_activated:obj:1" version="1">
                <ind-def:filepath>/etc/audit/plugins.d/syslog.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*active[ ]+=[ ]+yes[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_audispd_encrypt_sent_records:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audisp-remote.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*transport[ ]+=[ ]+KRB5[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_audispd_configure_remote_server:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audisp-remote.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*remote_server[ ]+=[ ]+(\S+)[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_shadow_augen:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/etc\/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_shadow_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/etc\/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_passwd_augen:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/etc\/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_passwd_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/etc\/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_opasswd_augen:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/etc\/security\/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_opasswd_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/etc\/security\/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_gshadow_augen:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/etc\/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_gshadow_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/etc\/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_group_augen:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/etc\/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_group_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/etc\/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow_augen:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd_augen:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/security/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/security/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd_augen:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow_augen:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_group_augen:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s+]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_group_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_openat_64bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_shadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_openat_64bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_shadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_openat_32bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_shadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_openat_32bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_shadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_64bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_shadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_64bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_shadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_32bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_shadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_32bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_shadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_64bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_shadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_64bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_shadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_32bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_shadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_32bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_shadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_openat_64bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_passwd_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_openat_64bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_passwd_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_openat_32bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_passwd_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_openat_32bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_passwd_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_64bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_passwd_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_64bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_passwd_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_32bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_passwd_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_32bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_passwd_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_64bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_passwd_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_64bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_passwd_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_32bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_passwd_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_32bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_passwd_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_openat_64bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_gshadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_openat_64bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_gshadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_openat_32bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_gshadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_openat_32bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_gshadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_64bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_gshadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_64bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_gshadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_32bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_gshadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_32bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_gshadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_64bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_gshadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_64bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_gshadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_32bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_gshadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_32bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_gshadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_openat_64bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_group_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_openat_64bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_group_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_openat_32bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_group_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_openat_32bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_group_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_64bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_group_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_64bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_group_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_32bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_group_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_32bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_group_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_64bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_group_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_64bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_group_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_32bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_group_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_32bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_group_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_d_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/sudoers\.d/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_d_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/sudoers\.d/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/sudoers[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/sudoers[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_usernetctl_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/usernetctl(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_usernetctl_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/usernetctl(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_userhelper_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/userhelper(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_userhelper_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/userhelper(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_unix_chkpwd_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/unix_chkpwd(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_unix_chkpwd_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/unix_chkpwd(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_umount_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/umount(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_umount_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/umount(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_sudoedit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/sudoedit(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_sudoedit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/sudoedit(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_sudo_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/sudo(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_sudo_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/sudo(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_su_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/su(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_su_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/su(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_ssh_keysign_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/libexec\/openssh\/ssh-keysign(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_ssh_keysign_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/libexec\/openssh\/ssh-keysign(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_pt_chown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/libexec\/pt_chown(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_pt_chown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/libexec\/pt_chown(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_passwd_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/passwd(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_passwd_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/passwd(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newuidmap_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newuidmap(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newuidmap_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newuidmap(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newgrp_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newgrp(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newgrp_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newgrp(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newgidmap_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newgidmap(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newgidmap_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newgidmap(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_mount_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/mount(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_mount_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/mount(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_gpasswd_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/gpasswd(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_gpasswd_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/gpasswd(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_crontab_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/crontab(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_crontab_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/crontab(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_chsh_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chsh(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_chsh_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chsh(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_chage_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chage(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_chage_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chage(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_at_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/at(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_at_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/at(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_seunshare_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/seunshare(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_seunshare_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/seunshare(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_setsebool_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/setsebool(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_setsebool_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/setsebool(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_semanage_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/semanage(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_semanage_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/semanage(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_restorecon_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/restorecon(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_restorecon_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/restorecon(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_chcon_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chcon(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_chcon_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chcon(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_augenrules:obj:1" version="1">
                <ind-def:filepath>/usr/lib/systemd/system/auditd.service</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_auditctl:obj:1" version="1">
                <ind-def:filepath>/usr/lib/systemd/system/auditd.service</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_audit_log_files:obj:1" version="1" comment="/var/log/audit files">
                <unix-def:filepath operation="pattern match" var_ref="oval:ssg-audit_log_file_path:var:1" var_check="all"/>
                <filter action="include">oval:ssg-state_not_mode_0600:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_audit_log_files-non_root:obj:1" version="1" comment="audit log files">
                <unix-def:filepath operation="pattern match" var_ref="oval:ssg-audit_log_file_path:var:1" var_check="all"/>
                <filter action="include">oval:ssg-state_not_mode_0640:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_audit_log_directory:obj:1" version="1" comment="audit log files">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path var_ref="oval:ssg-audit_log_dir:var:1" var_check="all"/>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_not_mode_0700:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_audit_log_directory-non_root:obj:1" version="1" comment="audit log files">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path var_ref="oval:ssg-audit_log_dir:var:1" var_check="all"/>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_not_mode_0750:ste:1</filter>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_openat_eperm_augenrules_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_openat_auditctl_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_openat_eacces_augenrules_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_openat_order_64bit_auditctl_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_openat_eperm_augenrules_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_openat_auditctl_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_openat_eacces_augenrules_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_openat_auditctl_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_open_eperm_augenrules_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_open_auditctl_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_open_eacces_augenrules_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_open_order_64bit_auditctl_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_eperm_augenrules_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_auditctl_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_eacces_augenrules_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_auditctl_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_eperm_augenrules_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_auditctl_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_eacces_augenrules_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_open_by_handle_at_order_64bit_auditctl_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_eperm_augenrules_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_auditctl_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_eacces_augenrules_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_auditctl_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_artw_etc_localtime_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-w[\s]+\/etc\/localtime[\s]+-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_artw_etc_localtime_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-w[\s]+\/etc\/localtime[\s]+-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arse_wtmp_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w\s+/var/log/wtmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arse_wtmp_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w\s+/var/log/wtmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arse_utmp_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w\s+/var/run/utmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arse_utmp_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w\s+/var/run/utmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arse_btmp_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w\s+/var/log/btmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arse_btmp_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w\s+/var/log/btmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arpc_suid_sgid_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a always,exit (?:-F path=([\S]+) )+-F auid&gt;=1000 -F auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
                <filter>oval:ssg-state_proper_audit_rule_but_for_unprivileged_command:ste:1</filter>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arpc_suid_sgid_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a always,exit (?:-F path=([\S]+) )+-F auid&gt;=1000 -F auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
                <filter>oval:ssg-state_proper_audit_rule_but_for_unprivileged_command:ste:1</filter>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arnm_etc_sysconfig_network_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/sysconfig/network[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arnm_etc_sysconfig_network_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/sysconfig/network[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arnm_etc_issue_net_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/issue\.net[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arnm_etc_issue_net_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/issue\.net[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arnm_etc_issue_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/issue[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arnm_etc_issue_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/issue[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arnm_etc_hosts_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/hosts[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arnm_etc_hosts_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/hosts[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_armm_selinux_watch_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/selinux/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_armm_selinux_watch_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/selinux/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arle_tallylog_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/var\/log\/tallylog[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arle_tallylog_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/var\/log\/tallylog[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arle_lastlog_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/var\/log\/lastlog[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arle_lastlog_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/var\/log\/lastlog[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arle_faillock_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/var\/run\/faillock[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arle_faillock_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/var\/run\/faillock[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_ari_locked_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-e\s+2\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_ari_locked_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-e\s+2\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_verify_rsyslogd:obj:1" version="1">
                <ind-def:filepath>/etc/aide.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^/usr/sbin/rsyslogd\s+([^\n]+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_verify_autrace:obj:1" version="1">
                <ind-def:filepath>/etc/aide.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^/usr/sbin/autrace\s+([^\n]+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_verify_ausearch:obj:1" version="1">
                <ind-def:filepath>/etc/aide.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^/usr/sbin/ausearch\s+([^\n]+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_verify_aureport:obj:1" version="1">
                <ind-def:filepath>/etc/aide.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^/usr/sbin/aureport\s+([^\n]+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_verify_augenrules:obj:1" version="1">
                <ind-def:filepath>/etc/aide.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^/usr/sbin/augenrules\s+([^\n]+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_verify_auditd:obj:1" version="1">
                <ind-def:filepath>/etc/aide.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^/usr/sbin/auditd\s+([^\n]+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_verify_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/aide.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\/usr\/sbin\/auditctl\s+([^\n]+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_verify_audispd:obj:1" version="1">
                <ind-def:filepath>/etc/aide.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^/usr/sbin/audispd\s+([^\n]+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_var_cron_checking:obj:1" version="1" comment="run aide with cron">
                <ind-def:filepath>/var/spool/cron/root</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(([0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*(\*|([0-7]|mon|tue|wed|thu|fri|sat|sun)|[0-7]-[0-7]))|@(hourly|daily|weekly))[\s]*(root)?[\s]*\/usr\/sbin\/aide[\s]*\-\-check.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_operational_database_filename:obj:1" version="1">
                <ind-def:filepath>/etc/aide.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^database=file:@@{DBDIR}/([a-z.]+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_aide_operational_database_absolute_path:obj:1" version="1">
                <unix-def:filepath var_ref="oval:ssg-variable_aide_operational_database_absolute_path:var:1" var_check="at least one"/>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_crontabs_checking:obj:1" version="1" comment="run aide with cron.(daily|weekly)">
                <ind-def:path operation="pattern match">^/etc/cron.(daily|weekly)$</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*\/usr\/sbin\/aide[\s]*\-\-check.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_build_new_database_filename:obj:1" version="1">
                <ind-def:filepath>/etc/aide.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^database_out=file:@@{DBDIR}/([a-z.]+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_aide_build_new_database_absolute_path:obj:1" version="1">
                <unix-def:filepath var_ref="oval:ssg-variable_aide_build_new_database_absolute_path:var:1" var_check="at least one"/>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_build_database_dirpath:obj:1" version="1">
                <ind-def:filepath>/etc/aide.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^@@define[\s]DBDIR[\s]+(/.*)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:interface_object id="oval:ssg-object_active_wifi_interfaces:obj:1" version="1">
                <unix-def:name operation="pattern match">^wl.*$</unix-def:name>
              </unix-def:interface_object>
              <ind-def:environmentvariable58_object id="oval:ssg-object_accounts_root_path_dirs_no_write_pathenv:obj:1" version="1">
                <ind-def:pid xsi:nil="true" datatype="int"/>
                <ind-def:name>PATH</ind-def:name>
              </ind-def:environmentvariable58_object>
              <unix-def:file_object id="oval:ssg-object_accounts_root_path_dirs_no_group_other_write:obj:1" version="1" comment="root's path directories with wrong group / other write permissions">
                <unix-def:path var_ref="oval:ssg-var_accounts_root_path_dirs_no_write:var:1" var_check="at least one"/>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_accounts_root_path_dirs_wrong_perms:ste:1</filter>
                <filter>oval:ssg-state_accounts_root_path_dirs_symlink:ste:1</filter>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_root_gid_zero:obj:1" version="1">
                <ind-def:filepath>/etc/passwd</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^root:.+:\d+:(\d+).+</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_unix_auth:obj:1" version="1" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of system-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_unix_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_auth:obj:1" version="1" comment="Check common definition of pam_faillock.so in auth section of system-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_auth_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_account:obj:1" version="1" comment="Check common definition of pam_faillock.so in account section of system-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_account_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_unix_auth:obj:1" version="1" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of password-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_unix_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_auth:obj:1" version="1" comment="Check common definition of pam_faillock.so in auth section of password-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_auth_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_account:obj:1" version="1" comment="Check common definition of pam_faillock.so in account section of password-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_account_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_system:obj:1" version="1" comment="Get the pam_faillock.so unlock_time parameter from system-auth file">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_unlock_time_parameter_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_password:obj:1" version="1" comment="Get the pam_faillock.so unlock_time parameter from password-auth file">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_unlock_time_parameter_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_faillock_conf:obj:1" version="1" comment="Check the expected pam_faillock.so unlock_time parameter in /etc/security/faillock.conf">
                <ind-def:filepath operation="pattern match">^/etc/security/faillock.conf$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_faillock_conf_unlock_time_parameter_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_interval_system_pam_unix_auth:obj:1" version="1" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of system-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_unix_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_interval_system_pam_faillock_auth:obj:1" version="1" comment="Check common definition of pam_faillock.so in auth section of system-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_auth_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_interval_system_pam_faillock_account:obj:1" version="1" comment="Check common definition of pam_faillock.so in account section of system-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_account_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_interval_password_pam_unix_auth:obj:1" version="1" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of password-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_unix_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_interval_password_pam_faillock_auth:obj:1" version="1" comment="Check common definition of pam_faillock.so in auth section of password-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_auth_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_interval_password_pam_faillock_account:obj:1" version="1" comment="Check common definition of pam_faillock.so in account section of password-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_account_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_pamd_system:obj:1" version="1" comment="Get the pam_faillock.so fail_interval parameter from system-auth file">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_fail_interval_parameter_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_pamd_password:obj:1" version="1" comment="Get the pam_faillock.so fail_interval parameter from password-auth file">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_fail_interval_parameter_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_faillock_conf:obj:1" version="1" comment="Check the expected pam_faillock.so fail_interval parameter in /etc/security/faillock.conf">
                <ind-def:filepath operation="pattern match">^/etc/security/faillock.conf$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_interval_faillock_conf_fail_interval_parameter_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_system_pam_unix_auth:obj:1" version="1" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of system-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_enforce_local_pam_unix_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_system_pam_faillock_auth:obj:1" version="1" comment="Check common definition of pam_faillock.so in auth section of system-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_enforce_local_pam_faillock_auth_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_system_pam_faillock_account:obj:1" version="1" comment="Check common definition of pam_faillock.so in account section of system-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_enforce_local_pam_faillock_account_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_password_pam_unix_auth:obj:1" version="1" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of password-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_enforce_local_pam_unix_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_password_pam_faillock_auth:obj:1" version="1" comment="Check common definition of pam_faillock.so in auth section of password-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_enforce_local_pam_faillock_auth_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_password_pam_faillock_account:obj:1" version="1" comment="Check common definition of pam_faillock.so in account section of password-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_enforce_local_pam_faillock_account_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_enforce_local_parameter_faillock_conf:obj:1" version="1" comment="Try to get the local_users_only parameter from /etc/security/faillock.conf">
                <ind-def:filepath operation="pattern match">^/etc/security/faillock.conf$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_enforce_local_faillock_conf_parameter_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_unix_auth:obj:1" version="1" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of system-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_unix_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_faillock_auth:obj:1" version="1" comment="Check common definition of pam_faillock.so in auth section of system-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_auth_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_faillock_account:obj:1" version="1" comment="Check common definition of pam_faillock.so in account section of system-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_account_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_system_pam_unix_auth:obj:1" version="1" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of system-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_unix_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_auth:obj:1" version="1" comment="Check common definition of pam_faillock.so in auth section of system-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_auth_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_account:obj:1" version="1" comment="Check common definition of pam_faillock.so in account section of system-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_account_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_password_pam_unix_auth:obj:1" version="1" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of password-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_unix_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_auth:obj:1" version="1" comment="Check common definition of pam_faillock.so in auth section of password-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_auth_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_account:obj:1" version="1" comment="Check common definition of pam_faillock.so in account section of password-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_account_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_pamd_system:obj:1" version="1" comment="Get the pam_faillock.so even_deny_root parameter from system-auth file">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_parameter_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_pamd_password:obj:1" version="1" comment="Get the pam_faillock.so even_deny_root parameter from password-auth file">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_parameter_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_faillock_conf:obj:1" version="1" comment="Try to get the even_deny_root parameter from /etc/security/faillock.conf">
                <ind-def:filepath operation="pattern match">^/etc/security/faillock.conf$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_faillock_conf_parameter_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_unix_auth:obj:1" version="1" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of password-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_unix_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_faillock_auth:obj:1" version="1" comment="Check common definition of pam_faillock.so in auth section of password-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_auth_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_faillock_account:obj:1" version="1" comment="Check common definition of pam_faillock.so in account section of password-auth">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_account_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_system:obj:1" version="1" comment="Get the pam_faillock.so deny parameter from system-auth file">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_deny_parameter_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_password:obj:1" version="1" comment="Get the pam_faillock.so deny parameter from password-auth file">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_deny_parameter_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_faillock_conf:obj:1" version="1" comment="Check the expected pam_faillock.so deny parameter in /etc/security/faillock.conf">
                <ind-def:filepath operation="pattern match">^/etc/security/faillock.conf$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_faillock_conf_deny_parameter_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_unix_remember:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*password\s+(?:(?:sufficient)|(?:required))\s+pam_unix\.so.*remember=([0-9]*).*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_pwquality_system_auth:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^password[\s]*requisite[\s]*pam_pwquality\.so</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_pwquality_password_auth:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/password-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^password[\s]*requisite[\s]*pam_pwquality\.so</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_pwhistory_remember:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*password\s+(?:(?:requisite)|(?:required))\s+pam_pwhistory\.so.*remember=([0-9]*).*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:shadow_object id="oval:ssg-object_accounts_password_all_shadowed_sha512:obj:1" version="1">
                <unix-def:username operation="pattern match">.*</unix-def:username>
                <filter>oval:ssg-state_accounts_password_all_shadowed_has_no_password:ste:1</filter>
                <filter>oval:ssg-state_accounts_password_all_shadowed_sha512:ste:1</filter>
              </unix-def:shadow_object>
              <unix-def:password_object id="oval:ssg-object_accounts_password_all_shadowed:obj:1" version="1">
                <unix-def:username operation="pattern match">.*</unix-def:username>
              </unix-def:password_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_no_uid_except_root:obj:1" version="1">
                <ind-def:filepath>/etc/passwd</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?!root:)[^:]*:[^:]*:0</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_logon_fail_delay:obj:1" version="1" comment="FAIL_DELAY value from /etc/login.defs">
                <ind-def:filepath>/etc/login.defs</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*(?i)FAIL_DELAY(?-i)[\s]+([^#\s]*)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_authorized_local_users:obj:1" version="1">
                <ind-def:filepath>/etc/passwd</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^([a-zA-Z0-9_.-]+?):</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
                <filter>oval:ssg-state_default_os_user:ste:1</filter>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_unlinkat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_unlinkat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_unlinkat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_unlinkat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_unlink_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_unlink_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_unlink_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_unlink_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_truncate_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_truncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_truncate_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_truncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_setxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_setxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_setxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_setxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_renameat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_renameat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_renameat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_renameat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_rename_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_rename_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_rename_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_rename_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_removexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_removexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_removexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_removexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_openat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_openat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_openat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_openat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_open_by_handle_at_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_open_by_handle_at_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_open_by_handle_at_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_open_by_handle_at_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_open_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_open_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_open_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_open_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_lsetxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_lsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_lsetxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_lsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_lremovexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_lremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_lremovexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_lremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_lchown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_lchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_lchown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_lchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_ftruncate_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_ftruncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_ftruncate_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_ftruncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fsetxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fsetxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fremovexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fremovexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchownat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchownat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchownat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchownat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchmodat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchmodat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchmodat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchmodat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchmod_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchmod_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_creat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_creat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_creat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_creat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_chown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_chown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_chown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_chown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_chmod_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_chmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_chmod_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_chmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_unlinkat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_unlinkat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_unlinkat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_unlinkat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_unlink_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_unlink_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_unlink_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_unlink_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_truncate_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_truncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_truncate_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_truncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_setxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_setxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_setxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_setxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_renameat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_renameat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_renameat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_renameat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_rename_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_rename_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_rename_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_rename_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_removexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_removexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_removexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_removexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_openat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_openat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_openat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_openat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_open_by_handle_at_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_open_by_handle_at_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_open_by_handle_at_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_open_by_handle_at_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_open_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_open_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_open_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_open_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_lsetxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_lsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_lsetxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_lsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_lremovexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_lremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_lremovexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_lremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_lchown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_lchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_lchown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_lchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_ftruncate_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_ftruncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_ftruncate_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_ftruncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fsetxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fsetxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fremovexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fremovexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchownat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchownat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchownat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchownat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchmodat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchmodat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchmodat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchmodat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchmod_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchmod_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_creat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_creat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_creat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_creat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_chown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_chown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_chown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_chown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_chmod_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_chmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_chmod_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_chmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_art_settimeofday_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*(-S[\s]+settimeofday[\s]+|([\s]+|[,])settimeofday([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_art_settimeofday_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*(-S[\s]+settimeofday[\s]+|([\s]+|[,])settimeofday([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_art_clock_settime_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+(-S[\s]+clock_settime[\s]+|([\s]+|[,])clock_settime([\s]+|[,]))-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_art_clock_settime_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+(-S[\s]+clock_settime[\s]+|([\s]+|[,])clock_settime([\s]+|[,]))-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_art_adjtimex_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*(-S[\s]+adjtimex[\s]+|([\s]+|[,])adjtimex([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_art_adjtimex_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*(-S[\s]+adjtimex[\s]+|([\s]+|[,])adjtimex([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_unlinkat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_unlinkat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_unlink_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_unlink_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_umount2_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+umount2[\s]+|([\s]+|[,])umount2([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_umount2_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+umount2[\s]+|([\s]+|[,])umount2([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_setxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_setxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_sethostname_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_sethostname_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_setdomainname_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_setdomainname_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_rmdir_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_rmdir_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_renameat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_renameat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_rename_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_rename_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_removexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_removexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_mount_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+mount[\s]+|([\s]+|[,])mount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_mount_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+mount[\s]+|([\s]+|[,])mount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lsetxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lsetxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lremovexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lremovexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lchown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lchown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_init_module_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_init_module_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fsetxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fsetxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fremovexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fremovexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_finit_module_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_finit_module_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchownat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchownat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchmodat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchmodat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchmod_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchmod_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_delete_module_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_delete_module_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_chown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_chown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_chmod_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_chmod_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_unlinkat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_unlinkat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_unlinkat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_unlinkat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_unlink_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_unlink_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_unlink_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_unlink_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_truncate_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_truncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_truncate_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_truncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_setxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_setxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_setxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_setxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_renameat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_renameat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_renameat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_renameat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_rename_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_rename_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_rename_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_rename_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_removexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_removexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_removexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_removexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_openat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_openat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_openat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_openat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_open_by_handle_at_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_open_by_handle_at_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_open_by_handle_at_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_open_by_handle_at_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_open_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_open_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_open_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_open_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_lsetxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_lsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_lsetxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_lsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_lremovexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_lremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_lremovexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_lremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_lchown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_lchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_lchown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_lchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_ftruncate_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_ftruncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_ftruncate_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_ftruncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fsetxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fsetxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fremovexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fremovexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchownat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchownat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchownat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchownat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchmodat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchmodat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchmodat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchmodat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchmod_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchmod_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_creat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_creat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_creat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_creat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_chown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_chown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_chown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_chown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_chmod_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_chmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_chmod_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_chmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_unlinkat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_unlinkat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_unlinkat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_unlinkat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_unlink_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_unlink_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_unlink_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_unlink_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_truncate_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_truncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_truncate_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_truncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_setxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_setxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_setxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_setxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_renameat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_renameat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_renameat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_renameat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_rename_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_rename_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_rename_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_rename_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_removexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_removexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_removexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_removexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_openat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_openat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_openat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_openat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_open_by_handle_at_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_open_by_handle_at_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_open_by_handle_at_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_open_by_handle_at_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_open_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_open_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_open_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_open_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_lsetxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_lsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_lsetxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_lsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_lremovexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_lremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_lremovexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_lremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_lchown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_lchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_lchown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_lchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_ftruncate_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_ftruncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_ftruncate_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_ftruncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fsetxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fsetxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fremovexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fremovexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchownat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchownat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchownat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchownat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchmodat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchmodat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchmodat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchmodat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchmod_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchmod_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_creat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_creat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_creat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_creat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_chown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_chown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_chown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_chown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_chmod_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_chmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_chmod_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_chmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_art_stime_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+stime[\s]+|([\s]+|[,])stime([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_art_stime_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+stime[\s]+|([\s]+|[,])stime([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_art_settimeofday_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+settimeofday[\s]+|([\s]+|[,])settimeofday([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_art_settimeofday_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+settimeofday[\s]+|([\s]+|[,])settimeofday([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_art_clock_settime_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+(-S[\s]+clock_settime[\s]+|([\s]+|[,])clock_settime([\s]+|[,]))-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_art_clock_settime_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+(-S[\s]+clock_settime[\s]+|([\s]+|[,])clock_settime([\s]+|[,]))-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_art_adjtimex_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+adjtimex[\s]+|([\s]+|[,])adjtimex([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_art_adjtimex_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+adjtimex[\s]+|([\s]+|[,])adjtimex([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_unlinkat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_unlinkat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_unlink_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_unlink_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_umount_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+umount[\s]+|([\s]+|[,])umount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_umount_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+umount[\s]+|([\s]+|[,])umount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_umount2_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+umount2[\s]+|([\s]+|[,])umount2([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_umount2_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+umount2[\s]+|([\s]+|[,])umount2([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_setxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_setxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_sethostname_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_sethostname_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_setdomainname_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_setdomainname_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_rmdir_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_rmdir_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_renameat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_renameat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_rename_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_rename_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_removexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_removexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_mount_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+mount[\s]+|([\s]+|[,])mount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_mount_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+mount[\s]+|([\s]+|[,])mount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lsetxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lsetxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lremovexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lremovexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lchown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lchown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_init_module_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_init_module_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fsetxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fsetxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fremovexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fremovexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_finit_module_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_finit_module_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchownat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchownat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchmodat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchmodat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchmod_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchmod_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_delete_module_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_delete_module_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_chown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_chown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_chmod_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_chmod_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_version_wrlinux8:obj:1" version="1" comment="Check WRLinux8 version">
                <ind-def:filepath>/etc/wrlinux-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^VERSION=.8\.0.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_version_wrlinux1019:obj:1" version="1" comment="Check WRLinux1019 version">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^VERSION=.10\.19.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_version_centos9:obj:1" version="1" comment="Check os-release VERSION_ID">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^VERSION_ID="(\d)"$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_version_centos8:obj:1" version="1" comment="Check os-release VERSION_ID">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^VERSION_ID="(\d)"$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_var_tmp_tmp_inst:obj:1" version="1">
                <unix-def:path>/var/tmp/tmp-inst</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_var_tmp_in_namespace_conf:obj:1" version="1">
                <ind-def:filepath>/etc/security/namespace.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*/var/tmp\s+/var/tmp/tmp-inst/\s+level\s+root,adm$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_user_change_lock_delay_lock:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/screensaver/lock-delay$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_user_change_idle_delay_lock:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/session/idle-delay$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_usbguard_rules_nonempty:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/usbguard/(rules|rules\.d/.*)\.conf$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.*\S+.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:family_object id="oval:ssg-obj_unix_wrlinux8:obj:1" version="1"/>
              <ind-def:family_object id="oval:ssg-obj_unix_wrlinux1019:obj:1" version="1"/>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_profile:obj:1" version="1" comment="Umask value from /etc/profile">
                <ind-def:filepath>/etc/profile</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*umask[\s]+([^#\s]*)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_login_defs:obj:1" version="1" comment="Umask value from /etc/login.defs">
                <ind-def:filepath>/etc/login.defs</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*UMASK[\s]+([^#\s]*)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_init_d_functions:obj:1" version="1" comment="Umask value from /etc/init.d/functions">
                <ind-def:filepath>/etc/init.d/functions</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*(?i)UMASK(?-i)[\s]+([^#\s]*)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-obj_umask_for_daemons:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-var_etc_init_d_functions_umask_as_number:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ubuntu_xenial:obj:1" version="1" comment="Check Ubuntu version">
                <ind-def:filepath>/etc/lsb-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^DISTRIB_CODENAME=xenial$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ubuntu_focal:obj:1" version="1" comment="Check Ubuntu version">
                <ind-def:filepath>/etc/lsb-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^DISTRIB_CODENAME=focal$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ubuntu_bionic:obj:1" version="1" comment="Check Ubuntu version">
                <ind-def:filepath>/etc/lsb-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^DISTRIB_CODENAME=bionic$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ubuntu:obj:1" version="1" comment="Check Ubuntu">
                <ind-def:filepath>/etc/lsb-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^DISTRIB_ID=Ubuntu$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_tmp_inst:obj:1" version="1">
                <unix-def:path>/tmp/tmp-inst</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_tmp_in_namespace_conf:obj:1" version="1">
                <ind-def:filepath>/etc/security/namespace.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*/tmp\s+/tmp/tmp-inst/\s+level\s+root,adm$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_timer_running_dnf-automatic:obj:1" version="1" comment="Retrieve the ActiveState property of dnf-automatic">
                <lin-def:unit operation="pattern match">dnf-automatic\.timer</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_usbguard_package_usbguard_installed:obj:1" version="1">
                <lin-def:name>usbguard</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_systemd-coredump_package_systemd_removed:obj:1" version="1">
                <lin-def:name>systemd</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_syslog_package_rsyslog_removed:obj:1" version="1">
                <lin-def:name>rsyslog</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_syslog-ng_package_syslog-ng_installed:obj:1" version="1">
                <lin-def:name>syslog-ng</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_sssd_package_sssd-common_removed:obj:1" version="1">
                <lin-def:name>sssd-common</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_sshd_package_openssh-server_removed:obj:1" version="1">
                <lin-def:name>openssh-server</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_rsyslog_package_rsyslog_installed:obj:1" version="1">
                <lin-def:name>rsyslog</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_rsyncd_package_rsync-daemon_removed:obj:1" version="1">
                <lin-def:name>rsync-daemon</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_rpcsvcgssd_package_nfs-utils_removed:obj:1" version="1">
                <lin-def:name>nfs-utils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_rpcidmapd_package_nfs-utils_removed:obj:1" version="1">
                <lin-def:name>nfs-utils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_rpcgssd_package_nfs-utils_removed:obj:1" version="1">
                <lin-def:name>nfs-utils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_rngd_package_rng-tools_installed:obj:1" version="1">
                <lin-def:name>rng-tools</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_pcscd_package_pcsc-lite_installed:obj:1" version="1">
                <lin-def:name>pcsc-lite</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_ntpd_package_ntp_installed:obj:1" version="1">
                <lin-def:name>ntp</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_ntp_package_ntp_installed:obj:1" version="1">
                <lin-def:name>ntp</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_nfslock_package_nfs-utils_removed:obj:1" version="1">
                <lin-def:name>nfs-utils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_nfs-server_package_nfs-utils_removed:obj:1" version="1">
                <lin-def:name>nfs-utils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_netfs_package_netfs_removed:obj:1" version="1">
                <lin-def:name>netfs</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_iptables_package_iptables_installed:obj:1" version="1">
                <lin-def:name>iptables</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_ip6tables_package_iptables-ipv6_installed:obj:1" version="1">
                <lin-def:name>iptables-ipv6</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_firewalld_package_firewalld_installed:obj:1" version="1">
                <lin-def:name>firewalld</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_debug-shell_package_systemd_removed:obj:1" version="1">
                <lin-def:name>systemd</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_crond_package_cronie_installed:obj:1" version="1">
                <lin-def:name>cronie</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_cron_package_cron_installed:obj:1" version="1">
                <lin-def:name>cron</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_chronyd_package_chrony_installed:obj:1" version="1">
                <lin-def:name>chrony</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_bluetooth_package_bluez_removed:obj:1" version="1">
                <lin-def:name>bluez</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_autofs_package_autofs_removed:obj:1" version="1">
                <lin-def:name>autofs</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_auditd_package_audit_installed:obj:1" version="1">
                <lin-def:name>audit</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_atd_package_at_removed:obj:1" version="1">
                <lin-def:name>at</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_xorg-x11-server-common_removed:obj:1" version="1">
                <lin-def:name>xorg-x11-server-common</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_vsftpd_removed:obj:1" version="1">
                <lin-def:name>vsftpd</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_vsftpd_installed:obj:1" version="1">
                <lin-def:name>vsftpd</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_vim-enhanced_installed:obj:1" version="1">
                <lin-def:name>vim-enhanced</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_usbguard_installed:obj:1" version="1">
                <lin-def:name>usbguard</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_tuned_removed:obj:1" version="1">
                <lin-def:name>tuned</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_tmux_installed:obj:1" version="1">
                <lin-def:name>tmux</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_telnetd_removed:obj:1" version="1">
                <lin-def:name>telnetd</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_telnetd-ssl_removed:obj:1" version="1">
                <lin-def:name>telnetd-ssl</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_tar_installed:obj:1" version="1">
                <lin-def:name>tar</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_syslog-ng_installed:obj:1" version="1">
                <lin-def:name>syslog-ng</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_sudo_installed:obj:1" version="1">
                <lin-def:name>sudo</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_sssd-ipa_installed:obj:1" version="1">
                <lin-def:name>sssd-ipa</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_setroubleshoot_removed:obj:1" version="1">
                <lin-def:name>setroubleshoot</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_setroubleshoot-server_removed:obj:1" version="1">
                <lin-def:name>setroubleshoot-server</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_setroubleshoot-plugins_removed:obj:1" version="1">
                <lin-def:name>setroubleshoot-plugins</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_sendmail_removed:obj:1" version="1">
                <lin-def:name>sendmail</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_screen_installed:obj:1" version="1">
                <lin-def:name>screen</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_scap-security-guide_installed:obj:1" version="1">
                <lin-def:name>scap-security-guide</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_samba-common_removed:obj:1" version="1">
                <lin-def:name>samba-common</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_rsyslog_installed:obj:1" version="1">
                <lin-def:name>rsyslog</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_rsyslog-gnutls_installed:obj:1" version="1">
                <lin-def:name>rsyslog-gnutls</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_rng-tools_installed:obj:1" version="1">
                <lin-def:name>rng-tools</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_rear_installed:obj:1" version="1">
                <lin-def:name>rear</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_python3-abrt-addon_removed:obj:1" version="1">
                <lin-def:name>python3-abrt-addon</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_prelink_removed:obj:1" version="1">
                <lin-def:name>prelink</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_policycoreutils_installed:obj:1" version="1">
                <lin-def:name>policycoreutils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_pcsc-lite_installed:obj:1" version="1">
                <lin-def:name>pcsc-lite</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_pam_ldap_removed:obj:1" version="1">
                <lin-def:name>pam_ldap</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_openssl-pkcs11_installed:obj:1" version="1">
                <lin-def:name>openssl-pkcs11</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_openssh-server_removed:obj:1" version="1">
                <lin-def:name>openssh-server</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_openssh-server_installed:obj:1" version="1">
                <lin-def:name>openssh-server</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_openscap-scanner_installed:obj:1" version="1">
                <lin-def:name>openscap-scanner</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_opensc_installed:obj:1" version="1">
                <lin-def:name>opensc</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_openldap-clients_removed:obj:1" version="1">
                <lin-def:name>openldap-clients</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_ntpdate_removed:obj:1" version="1">
                <lin-def:name>ntpdate</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_ntp_installed:obj:1" version="1">
                <lin-def:name>ntp</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_nss-tools_installed:obj:1" version="1">
                <lin-def:name>nss-tools</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_nis_removed:obj:1" version="1">
                <lin-def:name>nis</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_nfs-utils_removed:obj:1" version="1">
                <lin-def:name>nfs-utils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_net-snmp_removed:obj:1" version="1">
                <lin-def:name>net-snmp</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_mcstrans_removed:obj:1" version="1">
                <lin-def:name>mcstrans</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_libselinux_installed:obj:1" version="1">
                <lin-def:name>libselinux</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_libreswan_installed:obj:1" version="1">
                <lin-def:name>libreswan</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_libreport-plugin-rhtsupport_removed:obj:1" version="1">
                <lin-def:name>libreport-plugin-rhtsupport</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_libreport-plugin-logger_removed:obj:1" version="1">
                <lin-def:name>libreport-plugin-logger</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_libcap-ng-utils_installed:obj:1" version="1">
                <lin-def:name>libcap-ng-utils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_krb5-workstation_removed:obj:1" version="1">
                <lin-def:name>krb5-workstation</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_iptables_installed:obj:1" version="1">
                <lin-def:name>iptables</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_iprutils_removed:obj:1" version="1">
                <lin-def:name>iprutils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_inetutils-telnetd_removed:obj:1" version="1">
                <lin-def:name>inetutils-telnetd</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_gssproxy_removed:obj:1" version="1">
                <lin-def:name>gssproxy</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_gnutls-utils_installed:obj:1" version="1">
                <lin-def:name>gnutls-utils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_geolite2-country_removed:obj:1" version="1">
                <lin-def:name>geolite2-country</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_geolite2-city_removed:obj:1" version="1">
                <lin-def:name>geolite2-city</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_gdm_removed:obj:1" version="1">
                <lin-def:name>gdm</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_gdm_installed:obj:1" version="1">
                <lin-def:name>gdm</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_fapolicyd_installed:obj:1" version="1">
                <lin-def:name>fapolicyd</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_esc_installed:obj:1" version="1">
                <lin-def:name>esc</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_dnf-automatic_installed:obj:1" version="1">
                <lin-def:name>dnf-automatic</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_dconf_installed:obj:1" version="1">
                <lin-def:name>dconf</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_cryptsetup-luks_installed:obj:1" version="1">
                <lin-def:name>cryptsetup-luks</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_cron_installed:obj:1" version="1">
                <lin-def:name>cron</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_chrony_installed:obj:1" version="1">
                <lin-def:name>chrony</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_binutils_installed:obj:1" version="1">
                <lin-def:name>binutils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_bind_removed:obj:1" version="1">
                <lin-def:name>bind</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_avahi_installed:obj:1" version="1">
                <lin-def:name>avahi</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_audit_installed:obj:1" version="1">
                <lin-def:name>audit</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_audit-audispd-plugins_installed:obj:1" version="1">
                <lin-def:name>audit-audispd-plugins</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_audispd-plugins_installed:obj:1" version="1">
                <lin-def:name>audispd-plugins</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_aide_installed:obj:1" version="1">
                <lin-def:name>aide</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_abrt_removed:obj:1" version="1">
                <lin-def:name>abrt</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_abrt-plugin-sosreport_removed:obj:1" version="1">
                <lin-def:name>abrt-plugin-sosreport</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_abrt-plugin-rhtsupport_removed:obj:1" version="1">
                <lin-def:name>abrt-plugin-rhtsupport</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_abrt-plugin-logger_removed:obj:1" version="1">
                <lin-def:name>abrt-plugin-logger</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_abrt-cli_removed:obj:1" version="1">
                <lin-def:name>abrt-cli</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_abrt-addon-kerneloops_removed:obj:1" version="1">
                <lin-def:name>abrt-addon-kerneloops</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_abrt-addon-ccpp_removed:obj:1" version="1">
                <lin-def:name>abrt-addon-ccpp</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_MFEhiplsm_installed:obj:1" version="1">
                <lin-def:name>MFEhiplsm</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_GConf2_installed:obj:1" version="1">
                <lin-def:name>GConf2</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_env_has_postfix_installed:obj:1" version="1">
                <lin-def:name>postfix</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_env_has_polkit_installed:obj:1" version="1">
                <lin-def:name>polkit</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_env_has_ntp_installed:obj:1" version="1">
                <lin-def:name>ntp</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_env_has_chrony_installed:obj:1" version="1">
                <lin-def:name>chrony</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:variable_object id="oval:ssg-obj_system_crypto_policy_value:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-var_system_crypto_policy:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sysconfig_nozeroconf_yes:obj:1" version="1">
                <ind-def:filepath>/etc/sysconfig/network</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*NOZEROCONF[\s]*=[\s]*yes</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-obj_sudoers_passwd_n_files:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-local_variable_counter_sudoers_passwd_n_files:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sssd_user_value:obj:1" version="1" comment="get last user value from each [sssd] section">
                <ind-def:filepath operation="pattern match">^/etc/sssd/(sssd|conf\.d/.*)\.conf$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*\[sssd\].*(?:\n\s*[^[\s].*)*\n\s*user[ \t]*=[ \t]*(\S*)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sssd_ssh_known_hosts_timeout:obj:1" version="1">
                <ind-def:filepath>/etc/sssd/sssd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*\[ssh](?:[^\n\[]*\n+)+?[\s]*ssh_known_hosts_timeout[\s]*=[\s]*(\d+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sssd_offline_cred_expiration:obj:1" version="1">
                <ind-def:filepath>/etc/sssd/sssd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*\[pam](?:[^\n\[]*\n+)+?[\s]*offline_credentials_expiration[\s]*=[\s]*1$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sssd_memcache_timeout:obj:1" version="1">
                <ind-def:filepath>/etc/sssd/sssd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*\[nss](?:[^\n\[]*\n+)+?[\s]*memcache_timeout[\s]*=[\s]*(\d+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sssd_enable_smartcards:obj:1" version="1">
                <ind-def:filepath>/etc/sssd/sssd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*\[pam](?:[^\n\[]*\n+)+?[\s]*pam_cert_auth[\s]*=[\s]*true$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sssd_enable_certmap:obj:1" version="1">
                <ind-def:filepath>/etc/sssd/sssd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*\^\[certmap\/\.\+\/\.\+\]\$[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sssd_certificate_verification:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/sssd/(sssd|conf\.d/.*)\.conf$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*\[sssd](?:[^\n\[]*\n+)+?[\s]*certificate_verification\s*=\s*ocsp_dgst\s*=\s*(\w+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_x11_use_localhost_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)X11UseLocalhost(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_x11_use_localhost:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)X11UseLocalhost(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_use_priv_separation:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)UsePrivilegeSeparation(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_use_directory_configuration_default_not_overriden:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)match(?-i)\s+\S+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_verbose_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_verbose:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_info_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_info:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_set_keepalive_0_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)ClientAliveCountMax(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_set_keepalive_0:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)ClientAliveCountMax(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_rekey_limit_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-sshd_line_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_rekey_limit:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-sshd_line_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_print_last_log_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PrintLastLog(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_print_last_log:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PrintLastLog(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_includes_config_files:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*Include /etc/ssh/sshd_config\.d/\*\.conf[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_enable_x11_forwarding_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)X11Forwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_enable_x11_forwarding:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)X11Forwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_enable_warning_banner_net_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)Banner(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_enable_warning_banner_net:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)Banner(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_enable_warning_banner_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)Banner(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_enable_warning_banner:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)Banner(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_enable_strictmodes_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)StrictModes(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_enable_strictmodes:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)StrictModes(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_enable_pubkey_auth_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PubkeyAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_enable_pubkey_auth:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PubkeyAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_enable_pam_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)UsePAM(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_enable_pam:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)UsePAM(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_enable_gssapi_auth_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_enable_gssapi_auth:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_do_not_permit_user_env_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PermitUserEnvironment(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_do_not_permit_user_env:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PermitUserEnvironment(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_x11_forwarding_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)X11Forwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_x11_forwarding:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)X11Forwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_user_known_hosts_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)IgnoreUserKnownHosts(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_user_known_hosts:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)IgnoreUserKnownHosts(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_tcp_forwarding_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)AllowTcpForwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_tcp_forwarding:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)AllowTcpForwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_root_password_login_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_root_password_login:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_root_login_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_root_login:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_rhosts_rsa:obj:1" version="2">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*(?i)RhostsRSAAuthentication(?-i)[\s]+no[\s]*(?:#.*)?$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_rhosts_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)IgnoreRhosts(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_rhosts:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)IgnoreRhosts(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_pubkey_auth_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PubkeyAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_pubkey_auth:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PubkeyAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_kerb_auth_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)KerberosAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_kerb_auth:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)KerberosAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_gssapi_auth_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_gssapi_auth:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_empty_passwords_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PermitEmptyPasswords(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_empty_passwords:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PermitEmptyPasswords(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_compression:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)Compression(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_config_maxstartups_third_parameter:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?i)^\s*MaxStartups\s+\d+:\d+:(\d+)\s*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_config_maxstartups_second_parameter:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?i)^\s*MaxStartups\s+\d+:(\d+):\d+\s*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_config_maxstartups_first_parameter:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?i)^\s*MaxStartups\s+(\d+):\d+:\d+\s*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_clientalivecountmax_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*(?i)ClientAliveCountMax[\s]+([\d]+)[\s]*(?:#.*)?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_clientalivecountmax:obj:1" version="2">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*(?i)ClientAliveCountMax[\s]+([\d]+)[\s]*(?:#.*)?$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_sles_15_for_sap:obj:1" version="1">
                <lin-def:name>SLES_SAP-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_sles_12_for_sap:obj:1" version="1">
                <lin-def:name>SLES_SAP-release</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:family_object id="oval:ssg-obj_sle15_unix_family:obj:1" version="1"/>
              <lin-def:rpminfo_object id="oval:ssg-obj_sle15_server:obj:1" version="1">
                <lin-def:name>sles-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_sle15_desktop:obj:1" version="1">
                <lin-def:name>sled-release</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:family_object id="oval:ssg-obj_sle12_unix_family:obj:1" version="1"/>
              <lin-def:rpminfo_object id="oval:ssg-obj_sle12_server:obj:1" version="1">
                <lin-def:name>sles-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_sle12_desktop:obj:1" version="1">
                <lin-def:name>sled-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_sl7:obj:1" version="1">
                <lin-def:name>sl-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_sl6:obj:1" version="1">
                <lin-def:name>sl-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_usbguard:obj:1" version="1" comment="Retrieve the ActiveState property of usbguard">
                <lin-def:unit operation="pattern match">^usbguard\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_syslog-ng:obj:1" version="1" comment="Retrieve the ActiveState property of syslog-ng">
                <lin-def:unit operation="pattern match">^syslog-ng\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_rsyslog:obj:1" version="1" comment="Retrieve the ActiveState property of rsyslog">
                <lin-def:unit operation="pattern match">^rsyslog\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_rngd:obj:1" version="1" comment="Retrieve the ActiveState property of rngd">
                <lin-def:unit operation="pattern match">^rngd\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_pcscd:obj:1" version="1" comment="Retrieve the ActiveState property of pcscd">
                <lin-def:unit operation="pattern match">^pcscd\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_ntpd:obj:1" version="1" comment="Retrieve the ActiveState property of ntpd">
                <lin-def:unit operation="pattern match">^ntpd\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_ntp:obj:1" version="1" comment="Retrieve the ActiveState property of ntp">
                <lin-def:unit operation="pattern match">^ntp\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_iptables:obj:1" version="1" comment="Retrieve the ActiveState property of iptables">
                <lin-def:unit operation="pattern match">^iptables\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_ip6tables:obj:1" version="1" comment="Retrieve the ActiveState property of ip6tables">
                <lin-def:unit operation="pattern match">^ip6tables\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_firewalld:obj:1" version="1" comment="Retrieve the ActiveState property of firewalld">
                <lin-def:unit operation="pattern match">^firewalld\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_crond:obj:1" version="1" comment="Retrieve the ActiveState property of crond">
                <lin-def:unit operation="pattern match">^crond\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_cron:obj:1" version="1" comment="Retrieve the ActiveState property of cron">
                <lin-def:unit operation="pattern match">^cron\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_chronyd:obj:1" version="1" comment="Retrieve the ActiveState property of chronyd">
                <lin-def:unit operation="pattern match">^chronyd\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_auditd:obj:1" version="1" comment="Retrieve the ActiveState property of auditd">
                <lin-def:unit operation="pattern match">^auditd\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_systemd-coredump:obj:1" version="1" comment="Retrieve the ActiveState property of systemd-coredump">
                <lin-def:unit operation="pattern match">^systemd-coredump\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_syslog:obj:1" version="1" comment="Retrieve the ActiveState property of syslog">
                <lin-def:unit operation="pattern match">^syslog\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_sssd:obj:1" version="1" comment="Retrieve the ActiveState property of sssd">
                <lin-def:unit operation="pattern match">^sssd\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_sshd:obj:1" version="1" comment="Retrieve the ActiveState property of sshd">
                <lin-def:unit operation="pattern match">^sshd\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_rsyncd:obj:1" version="1" comment="Retrieve the ActiveState property of rsyncd">
                <lin-def:unit operation="pattern match">^rsyncd\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_rpcsvcgssd:obj:1" version="1" comment="Retrieve the ActiveState property of rpcsvcgssd">
                <lin-def:unit operation="pattern match">^rpcsvcgssd\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_rpcidmapd:obj:1" version="1" comment="Retrieve the ActiveState property of rpcidmapd">
                <lin-def:unit operation="pattern match">^rpcidmapd\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_rpcgssd:obj:1" version="1" comment="Retrieve the ActiveState property of rpcgssd">
                <lin-def:unit operation="pattern match">^rpcgssd\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_nfslock:obj:1" version="1" comment="Retrieve the ActiveState property of nfslock">
                <lin-def:unit operation="pattern match">^nfslock\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_nfs-server:obj:1" version="1" comment="Retrieve the ActiveState property of nfs-server">
                <lin-def:unit operation="pattern match">^nfs-server\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_netfs:obj:1" version="1" comment="Retrieve the ActiveState property of netfs">
                <lin-def:unit operation="pattern match">^netfs\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_debug-shell:obj:1" version="1" comment="Retrieve the ActiveState property of debug-shell">
                <lin-def:unit operation="pattern match">^debug-shell\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_bluetooth:obj:1" version="1" comment="Retrieve the ActiveState property of bluetooth">
                <lin-def:unit operation="pattern match">^bluetooth\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_autofs:obj:1" version="1" comment="Retrieve the ActiveState property of autofs">
                <lin-def:unit operation="pattern match">^autofs\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_atd:obj:1" version="1" comment="Retrieve the ActiveState property of atd">
                <lin-def:unit operation="pattern match">^atd\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_systemd-coredump:obj:1" version="1" comment="Retrieve the LoadState property of systemd-coredump">
                <lin-def:unit operation="pattern match">^systemd-coredump\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_syslog:obj:1" version="1" comment="Retrieve the LoadState property of syslog">
                <lin-def:unit operation="pattern match">^syslog\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_sssd:obj:1" version="1" comment="Retrieve the LoadState property of sssd">
                <lin-def:unit operation="pattern match">^sssd\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_sshd:obj:1" version="1" comment="Retrieve the LoadState property of sshd">
                <lin-def:unit operation="pattern match">^sshd\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_rsyncd:obj:1" version="1" comment="Retrieve the LoadState property of rsyncd">
                <lin-def:unit operation="pattern match">^rsyncd\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_rpcsvcgssd:obj:1" version="1" comment="Retrieve the LoadState property of rpcsvcgssd">
                <lin-def:unit operation="pattern match">^rpcsvcgssd\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_rpcidmapd:obj:1" version="1" comment="Retrieve the LoadState property of rpcidmapd">
                <lin-def:unit operation="pattern match">^rpcidmapd\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_rpcgssd:obj:1" version="1" comment="Retrieve the LoadState property of rpcgssd">
                <lin-def:unit operation="pattern match">^rpcgssd\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_nfslock:obj:1" version="1" comment="Retrieve the LoadState property of nfslock">
                <lin-def:unit operation="pattern match">^nfslock\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_nfs-server:obj:1" version="1" comment="Retrieve the LoadState property of nfs-server">
                <lin-def:unit operation="pattern match">^nfs-server\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_netfs:obj:1" version="1" comment="Retrieve the LoadState property of netfs">
                <lin-def:unit operation="pattern match">^netfs\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_debug-shell:obj:1" version="1" comment="Retrieve the LoadState property of debug-shell">
                <lin-def:unit operation="pattern match">^debug-shell\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_bluetooth:obj:1" version="1" comment="Retrieve the LoadState property of bluetooth">
                <lin-def:unit operation="pattern match">^bluetooth\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_autofs:obj:1" version="1" comment="Retrieve the LoadState property of autofs">
                <lin-def:unit operation="pattern match">^autofs\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_atd:obj:1" version="1" comment="Retrieve the LoadState property of atd">
                <lin-def:unit operation="pattern match">^atd\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_selinux_policy:obj:1" version="1">
                <ind-def:filepath>/etc/selinux/config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^SELINUXTYPE=([\w]*)[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_screensaver_mode_blank:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?picture-uri=(string[\s])?\'\'$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_screensaver_lock_enabled:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?lock-enabled=true$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_screensaver_lock_delay_setting:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^lock-delay[\s=]*uint32[\s]([^=\s]*)</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_screensaver_lock_delay:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?lock-delay=uint32[\s][0-9]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_screensaver_idle_delay_setting:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^idle-delay[\s=]*uint32[\s]([^=\s]*)</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_screensaver_idle_delay:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/desktop/session]([^\n]*\n+)+?idle-delay=uint32[\s][0-9]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_screensaver_idle_activation_enabled:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?idle-activation-enabled=true$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_screensaver_disable_user_info:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?show-full-name-in-top-bar=false$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rsyslog_remote_tls_cacert:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*global\(DefaultNetstreamDriverCAFile="(.+?)"\)\s*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">0</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rsyslog_remote_tls:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*action\((?i)type(?-i)="omfwd"(.+?)\)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">0</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:obj:1" version="1" comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.d">
                <ind-def:path>/etc/rsyslog.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\$DefaultNetstreamDriver gtls$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:obj:1" version="1" comment="Check if  $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf">
                <ind-def:filepath>/etc/rsyslog.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\$DefaultNetstreamDriver gtls$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:obj:1" version="1" comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.d">
                <ind-def:path>/etc/rsyslog.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\$ActionSendStreamDriverMode 1$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:obj:1" version="1" comment="Check if  $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf">
                <ind-def:filepath>/etc/rsyslog.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\$ActionSendStreamDriverMode 1$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:obj:1" version="1" comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.d">
                <ind-def:path>/etc/rsyslog.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\$ActionSendStreamDriverAuthMode x509/name$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:obj:1" version="1" comment="Check if  $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf">
                <ind-def:filepath>/etc/rsyslog.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\$ActionSendStreamDriverAuthMode x509/name$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_root_mail_alias:obj:1" version="1">
                <ind-def:filepath>/etc/aliases</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?:[rR][oO][oO][tT]|"[rR][oO][oO][tT]")\s*:\s*(.+)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhvh4_version:obj:1" version="1">
                <lin-def:name>redhat-release-virtualization-host</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhevm4_version:obj:1" version="1">
                <lin-def:name>rhvm-appliance</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel9_version:obj:1" version="1">
                <ind-def:filepath>/etc/redhat-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel8_version:obj:1" version="1">
                <ind-def:filepath>/etc/redhat-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel7_version:obj:1" version="1">
                <ind-def:filepath>/etc/redhat-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:family_object id="oval:ssg-obj_rhel9_unix_family:obj:1" version="1"/>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel9:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:family_object id="oval:ssg-obj_rhel8_unix_family:obj:1" version="1"/>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_9:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_8:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_7:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_6:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_5:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_4:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_3:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_2:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_1:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_10:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_0:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel7_workstation:obj:1" version="1">
                <lin-def:name>redhat-release-workstation</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:family_object id="oval:ssg-obj_rhel7_unix_family:obj:1" version="1"/>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel7_server:obj:1" version="1">
                <lin-def:name>redhat-release-server</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel7_computenode:obj:1" version="1">
                <lin-def:name>redhat-release-computenode</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel7_client:obj:1" version="1">
                <lin-def:name>redhat-release-client</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rhcos:obj:1" version="1">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^ID="(\w+)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rhcos4:obj:1" version="1">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^VERSION_ID="(\d)\.\d+"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_require_rescue_service_runlevel1:obj:1" version="1">
                <ind-def:filepath>/usr/lib/systemd/system/runlevel1.target</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Requires=.*rescue.service</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_require_rescue_service:obj:1" version="1">
                <ind-def:filepath>/usr/lib/systemd/system/rescue.service</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^ExecStart=\-.*/usr/lib/systemd/systemd-sulogin-shell[ ]+rescue</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_require_emergency_service_emergency:obj:1" version="1">
                <ind-def:filepath>/usr/lib/systemd/system/emergency.target</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Requires=.*emergency.service</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_require_emergency_service:obj:1" version="1">
                <ind-def:filepath>/usr/lib/systemd/system/emergency.service</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^ExecStart=\-/usr/lib/systemd/systemd-sulogin-shell[\s]+emergency</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_remote_method_monitoring_daemon:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.*daemon\.\*.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_remote_method_monitoring_authpriv:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.*authpriv\.\*.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_remote_method_monitoring_auth:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.*auth\.\*.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_user-administration-disabled:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/lockdown/user-administration-disabled$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_sys_geolocation:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/system/location/enabled$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_screensaver_mode_change:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/screensaver/picture-uri$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_screensaver_lock_locked:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/screensaver/lock-enabled$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_screensaver_lock:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/screensaver/lock-enabled$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_removal-action:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/settings-daemon/peripherals/smartcard/removal-action$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_remote_access_encryption:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/Vino/require-encryption$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_remote_access_creds:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/Vino/authentication-methods$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_power_setting_change:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/settings-daemon/plugins/power/active$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_info_change:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/screensaver/show-full-name-in-top-bar$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_gnome_autorun:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/media-handling/autorun-never$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_gnome_automount_open:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/media-handling/automount-open$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_gnome_automount:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/media-handling/automount$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_enable_wifi_notification:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/nm-applet/suppress-wireless-networks-available$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_enable_wifi_creation:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/nm-applet/disable-wifi-create$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_enable_restart_buttons:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/distro.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/login-screen/disable-restart-buttons$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_enable_ctrlaltdel:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/settings-daemon/plugins/media-keys/logout$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_disable_user_list:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/distro.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/login-screen/disable-user-list$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_disable_smartcard:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/distro.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/login-screen/enable-smartcard-authentication$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_clock_geolocation:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/clocks/geolocation$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_change_idle_activation_locked:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/screensaver/idle-activation-enabled$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_change_idle_activation_enabled:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/screensaver/idle-activation-enabled$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_change_gnome_thumbnailers:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/thumbnailers/disable-all$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_banner_gui_enabled_change:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/distro.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/login-screen/banner-message-enable$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_banner_change:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/distro.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/login-screen/banner-message-text$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_allowed-failures_change:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/distro.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/login-screen/allowed-failures$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_ucredit:obj:1" version="3">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*ucredit[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_retry_system_auth:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*retry=([0-9]*).*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_retry_pwquality_conf:obj:1" version="1">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^retry[\s]*=[\s]*(\d+)(?:[\s]|$)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_ocredit:obj:1" version="3">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*ocredit[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_minlen:obj:1" version="3">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*minlen[\s]*=[\s]*(\d+)(?:[\s]|$)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_minclass:obj:1" version="3">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*minclass[\s]*=[\s]*(\d+)(?:[\s]|$)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_maxrepeat:obj:1" version="3">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*maxrepeat[\s]*=[\s]*(\d+)(?:[\s]|$)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_maxclassrepeat:obj:1" version="3">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*maxclassrepeat[\s]*=[\s]*(\d+)(?:[\s]|$)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_lcredit:obj:1" version="3">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*lcredit[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_difok:obj:1" version="3">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*difok[\s]*=[\s]*(\d+)(?:[\s]|$)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_dictcheck:obj:1" version="3">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*dictcheck[\s]*=[\s]*(\d+)(?:[\s]|$)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_dcredit:obj:1" version="3">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*dcredit[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality:obj:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-var_pam_pwquality_config_path:var:1" var_check="at least one"/>
                <ind-def:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_package_kernel-PAE_installed:obj:1" version="1">
                <lin-def:name>kernel-PAE</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_opensuse_leap42_installed:obj:1" version="1">
                <lin-def:name>openSUSE-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_opensuse_leap15_installed:obj:1" version="1">
                <lin-def:name>openSUSE-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_opensuse_installed:obj:1" version="1">
                <lin-def:name>openSUSE-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_openssh-server_version:obj:1" version="1">
                <lin-def:name>openssh-server</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_ol9_system:obj:1" version="1">
                <lin-def:name>oraclelinux-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_ol8_system:obj:1" version="1">
                <lin-def:name>oraclelinux-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_ol7_system:obj:1" version="1">
                <lin-def:name>oraclelinux-release</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ntpd_run_as_ntp_user_systemd:obj:1" version="1" comment="check /usr/lib/systemd/system/ntpd.service">
                <ind-def:filepath>/usr/lib/systemd/system/ntpd.service</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*ExecStart=.*-u ntp:ntp.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ntpd_run_as_ntp_user_etc_sysconfig_ntpd:obj:1" version="1" comment="check /etc/sysconfig/ntpd">
                <ind-def:filepath>/etc/sysconfig/ntpd</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*OPTIONS=.*-u ntp:ntp.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ntpd_multiple_servers:obj:1" version="1" comment="Ensure more than one ntpd NTP server is set">
                <ind-def:filepath>/etc/ntp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^([\s]*server[\s]+.+$){2,}$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ntpd_configure_restrictions_ipv6:obj:1" version="1" comment="ensure ipv6 restrictions">
                <ind-def:filepath>/etc/ntp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*restrict[\s]+-6[\s]+default(?=.*kod)(?=.*nomodify)(?=.*notrap)(?=.*nopeer)(?=.*noquery).*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ntpd_configure_restrictions_ipv4:obj:1" version="1" comment="ensure ipv4 restrictions">
                <ind-def:filepath>/etc/ntp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*restrict[\s]+(-4[\s]*)?default(?=.*kod)(?=.*nomodify)(?=.*notrap)(?=.*nopeer)(?=.*noquery).*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ntp_set_maxpoll:obj:1" version="1">
                <ind-def:filepath>/etc/ntp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^server[\s]+[\S]+.*maxpoll[\s]+(\d+)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ntp_remote_server:obj:1" version="1" comment="Ensure at least one ntpd NTP server is set">
                <ind-def:filepath>/etc/ntp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*server[\s]+.+$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ntp_no_server_nor_pool:obj:1" version="1">
                <ind-def:filepath>/etc/ntp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^server.*</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ntp_all_server_has_maxpoll:obj:1" version="1">
                <ind-def:filepath>/etc/ntp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^server[\s]+[\S]+[\s]+(.*)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_noexec_cmd_line:obj:1" version="1">
                <ind-def:filepath>/proc/cmdline</ind-def:filepath>
                <ind-def:pattern operation="pattern match">.+noexec[0-9]*=off.+</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_no_tmux_in_shells:obj:1" version="1">
                <ind-def:filepath>/etc/shells</ind-def:filepath>
                <ind-def:pattern operation="pattern match">tmux\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_no_insecure_locks_exports:obj:1" version="2">
                <ind-def:filepath>/etc/exports</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(.*?(\binsecure_locks\b)[^$]*)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_no_empty_passwords_etc_shadow:obj:1" version="1">
                <ind-def:filepath>/etc/shadow</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[^:]+::.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_network_ipv6_static_address:obj:1" version="1" comment="Set static IPv6 address on each interface">
                <ind-def:path>/etc/sysconfig/network-scripts</ind-def:path>
                <ind-def:filename operation="pattern match">ifcfg-.*</ind-def:filename>
                <ind-def:pattern operation="pattern match">^IPV6ADDR=.+$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_network_ipv6_privacy_extensions:obj:1" version="1" comment="Enable privacy extensions on each interface">
                <ind-def:path>/etc/sysconfig/network-scripts</ind-def:path>
                <ind-def:filename operation="pattern match">ifcfg-.*</ind-def:filename>
                <ind-def:pattern operation="pattern match">^IPV6_PRIVACY=rfc3041$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_network_ipv6_disable_rpc_udp6:obj:1" version="1" comment="Test for udp6 based rpc services">
                <ind-def:filepath>/etc/netconfig</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^udp6\s+tpi_clts\s+v\s+inet6\s+udp\s+-\s+-$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_network_ipv6_disable_rpc_tcp6:obj:1" version="1" comment="Test for tcp6 based rpc services">
                <ind-def:filepath>/etc/netconfig</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^tcp6\s+tpi_cots_ord\s+v\s+inet6\s+tcp\s+-\s+-$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_network_ipv6_default_gateway:obj:1" version="1" comment="Define default gateways">
                <ind-def:path>/etc/sysconfig/network-scripts</ind-def:path>
                <ind-def:filename operation="pattern match">ifcfg-.*</ind-def:filename>
                <ind-def:pattern operation="pattern match">^IPV6_DEFAULTGW=.+$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_name_wrlinux1019:obj:1" version="1" comment="Check WRLinux1019 produce name">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^NAME=.Wind[\s]+River[\s]+Linux.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_name_centos9:obj:1" version="1" comment="Check os-release ID">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^ID="(\w+)"$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_name_centos8:obj:1" version="1" comment="Check os-release ID">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^ID="(\w+)"$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_messages_nx_active:obj:1" version="1">
                <ind-def:filepath>/var/log/messages</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.+protection: disabled.+</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_mcafee_runtime_installed:obj:1" version="1">
                <lin-def:name>MFErt</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_mcafee_management_agent:obj:1" version="1">
                <lin-def:name>MFEcma</lin-def:name>
              </lin-def:rpminfo_object>
              <unix-def:file_object id="oval:ssg-obj_lsb:obj:1" version="1" comment="check /etc/lsb-release file">
                <unix-def:filepath>/etc/lsb-release</unix-def:filepath>
              </unix-def:file_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_linuxshield_install_antivirus:obj:1" version="1">
                <lin-def:name>McAfeeVSEForLinux</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_runmodules-load:obj:1" version="1" comment="kernel module vfat disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_runmodprobed:obj:1" version="1" comment="kernel module vfat disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of vfat">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_libmodules-load:obj:1" version="1" comment="kernel module vfat disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_libmodprobed:obj:1" version="1" comment="kernel module vfat disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_etcmodules-load:obj:1" version="1" comment="kernel module vfat disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_disabled:obj:1" version="1" comment="kernel module vfat disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_runmodules-load:obj:1" version="1" comment="kernel module usb-storage disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_runmodprobed:obj:1" version="1" comment="kernel module usb-storage disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of usb-storage">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_libmodules-load:obj:1" version="1" comment="kernel module usb-storage disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_libmodprobed:obj:1" version="1" comment="kernel module usb-storage disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_etcmodules-load:obj:1" version="1" comment="kernel module usb-storage disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_disabled:obj:1" version="1" comment="kernel module usb-storage disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_runmodules-load:obj:1" version="1" comment="kernel module udf disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_runmodprobed:obj:1" version="1" comment="kernel module udf disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of udf">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_libmodules-load:obj:1" version="1" comment="kernel module udf disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_libmodprobed:obj:1" version="1" comment="kernel module udf disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_etcmodules-load:obj:1" version="1" comment="kernel module udf disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_disabled:obj:1" version="1" comment="kernel module udf disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_runmodules-load:obj:1" version="1" comment="kernel module tipc disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_runmodprobed:obj:1" version="1" comment="kernel module tipc disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of tipc">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_libmodules-load:obj:1" version="1" comment="kernel module tipc disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_libmodprobed:obj:1" version="1" comment="kernel module tipc disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_etcmodules-load:obj:1" version="1" comment="kernel module tipc disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_disabled:obj:1" version="1" comment="kernel module tipc disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_runmodules-load:obj:1" version="1" comment="kernel module squashfs disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_runmodprobed:obj:1" version="1" comment="kernel module squashfs disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of squashfs">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_libmodules-load:obj:1" version="1" comment="kernel module squashfs disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_libmodprobed:obj:1" version="1" comment="kernel module squashfs disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_etcmodules-load:obj:1" version="1" comment="kernel module squashfs disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_disabled:obj:1" version="1" comment="kernel module squashfs disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_runmodules-load:obj:1" version="1" comment="kernel module rds disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_runmodprobed:obj:1" version="1" comment="kernel module rds disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of rds">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_libmodules-load:obj:1" version="1" comment="kernel module rds disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_libmodprobed:obj:1" version="1" comment="kernel module rds disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_etcmodules-load:obj:1" version="1" comment="kernel module rds disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_disabled:obj:1" version="1" comment="kernel module rds disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_mac80211_runmodules-load:obj:1" version="1" comment="kernel module mac80211 disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+mac80211\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_mac80211_runmodprobed:obj:1" version="1" comment="kernel module mac80211 disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+mac80211\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_mac80211_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of mac80211">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+mac80211\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_mac80211_libmodules-load:obj:1" version="1" comment="kernel module mac80211 disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+mac80211\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_mac80211_libmodprobed:obj:1" version="1" comment="kernel module mac80211 disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+mac80211\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_mac80211_etcmodules-load:obj:1" version="1" comment="kernel module mac80211 disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+mac80211\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_mac80211_disabled:obj:1" version="1" comment="kernel module mac80211 disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+mac80211\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_runmodules-load:obj:1" version="1" comment="kernel module jffs2 disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_runmodprobed:obj:1" version="1" comment="kernel module jffs2 disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of jffs2">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_libmodules-load:obj:1" version="1" comment="kernel module jffs2 disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_libmodprobed:obj:1" version="1" comment="kernel module jffs2 disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_etcmodules-load:obj:1" version="1" comment="kernel module jffs2 disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_disabled:obj:1" version="1" comment="kernel module jffs2 disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlwifi_runmodules-load:obj:1" version="1" comment="kernel module iwlwifi disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+iwlwifi\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlwifi_runmodprobed:obj:1" version="1" comment="kernel module iwlwifi disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+iwlwifi\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlwifi_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of iwlwifi">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+iwlwifi\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlwifi_libmodules-load:obj:1" version="1" comment="kernel module iwlwifi disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+iwlwifi\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlwifi_libmodprobed:obj:1" version="1" comment="kernel module iwlwifi disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+iwlwifi\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlwifi_etcmodules-load:obj:1" version="1" comment="kernel module iwlwifi disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+iwlwifi\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlwifi_disabled:obj:1" version="1" comment="kernel module iwlwifi disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+iwlwifi\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlmvm_runmodules-load:obj:1" version="1" comment="kernel module iwlmvm disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+iwlmvm\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlmvm_runmodprobed:obj:1" version="1" comment="kernel module iwlmvm disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+iwlmvm\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlmvm_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of iwlmvm">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+iwlmvm\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlmvm_libmodules-load:obj:1" version="1" comment="kernel module iwlmvm disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+iwlmvm\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlmvm_libmodprobed:obj:1" version="1" comment="kernel module iwlmvm disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+iwlmvm\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlmvm_etcmodules-load:obj:1" version="1" comment="kernel module iwlmvm disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+iwlmvm\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_iwlmvm_disabled:obj:1" version="1" comment="kernel module iwlmvm disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+iwlmvm\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_runmodules-load:obj:1" version="1" comment="kernel module hfsplus disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_runmodprobed:obj:1" version="1" comment="kernel module hfsplus disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of hfsplus">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_libmodules-load:obj:1" version="1" comment="kernel module hfsplus disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_libmodprobed:obj:1" version="1" comment="kernel module hfsplus disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_etcmodules-load:obj:1" version="1" comment="kernel module hfsplus disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_disabled:obj:1" version="1" comment="kernel module hfsplus disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_runmodules-load:obj:1" version="1" comment="kernel module hfs disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_runmodprobed:obj:1" version="1" comment="kernel module hfs disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of hfs">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_libmodules-load:obj:1" version="1" comment="kernel module hfs disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_libmodprobed:obj:1" version="1" comment="kernel module hfs disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_etcmodules-load:obj:1" version="1" comment="kernel module hfs disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_disabled:obj:1" version="1" comment="kernel module hfs disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_runmodules-load:obj:1" version="1" comment="kernel module freevxfs disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_runmodprobed:obj:1" version="1" comment="kernel module freevxfs disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of freevxfs">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_libmodules-load:obj:1" version="1" comment="kernel module freevxfs disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_libmodprobed:obj:1" version="1" comment="kernel module freevxfs disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_etcmodules-load:obj:1" version="1" comment="kernel module freevxfs disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_disabled:obj:1" version="1" comment="kernel module freevxfs disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_runmodules-load:obj:1" version="1" comment="kernel module firewire-core disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_runmodprobed:obj:1" version="1" comment="kernel module firewire-core disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of firewire-core">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_libmodules-load:obj:1" version="1" comment="kernel module firewire-core disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_libmodprobed:obj:1" version="1" comment="kernel module firewire-core disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_etcmodules-load:obj:1" version="1" comment="kernel module firewire-core disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_disabled:obj:1" version="1" comment="kernel module firewire-core disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_runmodules-load:obj:1" version="1" comment="kernel module dccp disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_runmodprobed:obj:1" version="1" comment="kernel module dccp disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of dccp">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_libmodules-load:obj:1" version="1" comment="kernel module dccp disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_libmodprobed:obj:1" version="1" comment="kernel module dccp disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_etcmodules-load:obj:1" version="1" comment="kernel module dccp disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_disabled:obj:1" version="1" comment="kernel module dccp disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_runmodules-load:obj:1" version="1" comment="kernel module cramfs disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_runmodprobed:obj:1" version="1" comment="kernel module cramfs disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of cramfs">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_libmodules-load:obj:1" version="1" comment="kernel module cramfs disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_libmodprobed:obj:1" version="1" comment="kernel module cramfs disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_etcmodules-load:obj:1" version="1" comment="kernel module cramfs disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_disabled:obj:1" version="1" comment="kernel module cramfs disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_cfg80211_runmodules-load:obj:1" version="1" comment="kernel module cfg80211 disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+cfg80211\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_cfg80211_runmodprobed:obj:1" version="1" comment="kernel module cfg80211 disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+cfg80211\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_cfg80211_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of cfg80211">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+cfg80211\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_cfg80211_libmodules-load:obj:1" version="1" comment="kernel module cfg80211 disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+cfg80211\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_cfg80211_libmodprobed:obj:1" version="1" comment="kernel module cfg80211 disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+cfg80211\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_cfg80211_etcmodules-load:obj:1" version="1" comment="kernel module cfg80211 disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+cfg80211\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_cfg80211_disabled:obj:1" version="1" comment="kernel module cfg80211 disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+cfg80211\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_can_runmodules-load:obj:1" version="1" comment="kernel module can disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_can_runmodprobed:obj:1" version="1" comment="kernel module can disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_can_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of can">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_can_libmodules-load:obj:1" version="1" comment="kernel module can disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_can_libmodprobed:obj:1" version="1" comment="kernel module can disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_can_etcmodules-load:obj:1" version="1" comment="kernel module can disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_can_disabled:obj:1" version="1" comment="kernel module can disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_runmodules-load:obj:1" version="1" comment="kernel module bluetooth disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_runmodprobed:obj:1" version="1" comment="kernel module bluetooth disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of bluetooth">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_libmodules-load:obj:1" version="1" comment="kernel module bluetooth disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_libmodprobed:obj:1" version="1" comment="kernel module bluetooth disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_etcmodules-load:obj:1" version="1" comment="kernel module bluetooth disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_disabled:obj:1" version="1" comment="kernel module bluetooth disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_runmodules-load:obj:1" version="1" comment="kernel module atm disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_runmodprobed:obj:1" version="1" comment="kernel module atm disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of atm">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_libmodules-load:obj:1" version="1" comment="kernel module atm disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_libmodprobed:obj:1" version="1" comment="kernel module atm disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_etcmodules-load:obj:1" version="1" comment="kernel module atm disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_disabled:obj:1" version="1" comment="kernel module atm disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_kerberos_disable_no_keytab:obj:1" version="1" comment="Default Kerberos keytab file">
                <unix-def:filepath operation="pattern match">^/etc/.+\.keytab$</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_harden_sshd_macs_openssh_conf_crypto_policy:obj:1" version="1">
                <ind-def:filepath>/etc/crypto-policies/back-ends/openssh.config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^MACs.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_harden_sshd_crypto_policy:obj:1" version="1">
                <ind-def:filepath>/etc/crypto-policies/back-ends/opensshserver.config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?:.*\n)*\s*CRYPTO_POLICY=(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_harden_sshd_ciphers_openssh_conf_crypto_policy:obj:1" version="1">
                <ind-def:filepath>/etc/crypto-policies/back-ends/openssh.config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Ciphers.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_RekeyLimit:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Match final all(?:.*
)*?\s*RekeyLimit[\s]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Match final all(?:.*
)*?\s*PubkeyAcceptedKeyTypes[\s]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_Match:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*Match[\s]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_MACs:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Match final all(?:.*
)*?\s*MACs[\s]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_KexAlgorithms:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Match final all(?:.*
)*?\s*KexAlgorithms[\s]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_GSSAPIAuthentication:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Match final all(?:.*
)*?\s*GSSAPIAuthentication[\s]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_Ciphers:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Match final all(?:.*
)*?\s*Ciphers[\s]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_grub2_nousb_argument:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*GRUB_CMDLINE_LINUX=([^#]*).*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_gnome_gdm_disable_xdmcp_config_file:obj:1" version="1" comment="The configuration file /etc/gdm/custom.conf for gnome_gdm_disable_xdmcp">
                <unix-def:filepath operation="pattern match">^/etc/gdm/custom.conf</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_gnome_gdm_disable_xdmcp:obj:1" version="1">
                <ind-def:filepath>/etc/gdm/custom.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*\[xdmcp\].*(?:\n\s*[^[\s].*)*\n^\s*Enable[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_gnome_disable_thumbnailers:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/desktop/thumbnailers]([^\n]*\n+)+?disable-all=true$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_gdm_login_banner_text_setting:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/distro.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^banner-message-text=[\s]*'*(.*?)'$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_firewalld_input_drop:obj:1" version="1">
                <ind-def:filepath>/etc/firewalld/firewalld.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^DefaultZone=drop$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_file_permissions_unauthorized_suid_unowned:obj:1" version="1" comment="files with suid set which are not owned by any RPM package">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_file_permissions_unauthorized_suid_suid_set:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_unauthorized_suid_filepaths:ste:1</filter>
              </unix-def:file_object>
              <lin-def:rpmverifyfile_object id="oval:ssg-obj_file_permissions_unauthorized_suid_rpms:obj:1" version="1" comment="all files with suid set that come from a RPM package">
                <lin-def:behaviors nolinkto="true" nomd5="true" nosize="true" nouser="true" nogroup="true" nomtime="true" nomode="true" nordev="true"/>
                <lin-def:name operation="pattern match">.*</lin-def:name>
                <lin-def:epoch operation="pattern match">.*</lin-def:epoch>
                <lin-def:version operation="pattern match">.*</lin-def:version>
                <lin-def:release operation="pattern match">.*</lin-def:release>
                <lin-def:arch operation="pattern match">.*</lin-def:arch>
                <lin-def:filepath var_ref="oval:ssg-var_file_permissions_unauthorized_suid_all:var:1" var_check="all"/>
              </lin-def:rpmverifyfile_object>
              <unix-def:file_object id="oval:ssg-obj_file_permissions_unauthorized_suid_files:obj:1" version="1" comment="all files with suid set">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_file_permissions_unauthorized_suid_suid_set:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-obj_file_permissions_unauthorized_sgid_unowned:obj:1" version="1" comment="files with sgid set which are not owned by any RPM package">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_file_permissions_unauthorized_sgid_sgid_set:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_unauthorized_sgid_filepaths:ste:1</filter>
              </unix-def:file_object>
              <lin-def:rpmverifyfile_object id="oval:ssg-obj_file_permissions_unauthorized_sgid_rpms:obj:1" version="1" comment="all files with sgid set that come from a RPM package">
                <lin-def:behaviors nolinkto="true" nomd5="true" nosize="true" nouser="true" nogroup="true" nomtime="true" nomode="true" nordev="true"/>
                <lin-def:name operation="pattern match">.*</lin-def:name>
                <lin-def:epoch operation="pattern match">.*</lin-def:epoch>
                <lin-def:version operation="pattern match">.*</lin-def:version>
                <lin-def:release operation="pattern match">.*</lin-def:release>
                <lin-def:arch operation="pattern match">.*</lin-def:arch>
                <lin-def:filepath var_ref="oval:ssg-var_file_permissions_unauthorized_sgid_all:var:1" var_check="all"/>
              </lin-def:rpmverifyfile_object>
              <unix-def:file_object id="oval:ssg-obj_file_permissions_unauthorized_sgid_files:obj:1" version="1" comment="all files with sgid set">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_file_permissions_unauthorized_sgid_sgid_set:ste:1</filter>
              </unix-def:file_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_zipl_installed:obj:1" version="1">
                <lin-def:name>s390utils-base</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_yum_installed:obj:1" version="1">
                <lin-def:name>yum</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_usbguard_installed:obj:1" version="1">
                <lin-def:name>usbguard</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_tftp_server_installed:obj:1" version="1">
                <lin-def:name>tftp-server</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_systemd_installed:obj:1" version="1">
                <lin-def:name>systemd</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_sudo_installed:obj:1" version="1">
                <lin-def:name>sudo</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_sssd-common_installed:obj:1" version="1">
                <lin-def:name>sssd-common</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_pam_installed:obj:1" version="1">
                <lin-def:name>pam</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_ovirt-host_installed:obj:1" version="1">
                <lin-def:name>ovirt-host</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_ovirt-engine_installed:obj:1" version="1">
                <lin-def:name>ovirt-engine</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_nss-pam-ldapd_installed:obj:1" version="1">
                <lin-def:name>nss-pam-ldapd</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_net-snmp_installed:obj:1" version="1">
                <lin-def:name>net-snmp</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_login_defs_installed:obj:1" version="1">
                <lin-def:name>shadow-utils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_libuser_installed:obj:1" version="1">
                <lin-def:name>libuser</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_grub2_installed:obj:1" version="1">
                <lin-def:name>grub2-common</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_gdm_installed:obj:1" version="1">
                <lin-def:name>gdm</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_audit_installed:obj:1" version="1">
                <lin-def:name>audit</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ensure_gpgcheck_never_disabled:obj:1" version="1">
                <ind-def:path>/etc/yum.repos.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*gpgcheck\s*=\s*0\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_enable_pam_namespace:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/login</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*session\s+required\s+pam_namespace\.so\s*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_enable_gnome_smartcard:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/distro.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?enable-smartcard-authentication=true$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_dnf-automatic_security_updates_only_config_file:obj:1" version="1" comment="The configuration file /etc/dnf/automatic.conf for dnf-automatic_security_updates_only">
                <unix-def:filepath operation="pattern match">^/etc/dnf/automatic.conf</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_dnf-automatic_security_updates_only:obj:1" version="1">
                <ind-def:filepath>/etc/dnf/automatic.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*\[commands\].*(?:\n\s*[^[\s].*)*\n^\s*upgrade_type[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_dnf-automatic_apply_updates_config_file:obj:1" version="1" comment="The configuration file /etc/dnf/automatic.conf for dnf-automatic_apply_updates">
                <unix-def:filepath operation="pattern match">^/etc/dnf/automatic.conf</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_dnf-automatic_apply_updates:obj:1" version="1">
                <ind-def:filepath>/etc/dnf/automatic.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*\[commands\].*(?:\n\s*[^[\s].*)*\n^\s*apply_updates[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_display_login_attempts_silent:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/postlogin</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*session\s+required\s+pam_lastlog\.so(?:\s+[\w=]+)*\s+silent(\s|$)</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_display_login_attempts:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/postlogin</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*session\s+required\s+pam_lastlog\.so(?:\s+[\w=]+)*\s+showfailed(\s|$)</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disallow_bypass_password_sudo:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/sudo</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.*pam_succeed_if.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_wifi_notification:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/nm-applet]([^\n]*\n+)+?suppress-wireless-networks-available=true$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_wifi_creation:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/nm-applet]([^\n]*\n+)+?disable-wifi-create=true$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_user_list:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/distro.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?disable-user-list=true$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_sys_geolocation:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/system/location]([^\n]*\n+)+?enabled=false$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_restart_buttons:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/distro.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?disable-restart-buttons=true$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_host_auth_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)HostbasedAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_host_auth:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)HostbasedAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_guest_login:obj:1" version="1">
                <ind-def:filepath>/etc/gdm/custom.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\[daemon]([^\n]*\n+)+?TimedLoginEnable=[Ff]alse$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_gnome_power_setting:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/settings-daemon/plugins/power]([^\n]*\n+)+?active=false$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_gnome_ctrlaltdel:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/settings-daemon/plugins/media-keys]([^\n]*\n+)+?logout[\s]*=[\s]*''$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_clock_geolocation:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/clocks]([^\n]*\n+)+?geolocation=false$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_automatic_login:obj:1" version="1">
                <ind-def:filepath>/etc/gdm/custom.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\[daemon]([^\n]*\n+)+?AutomaticLoginEnable=[Ff]alse$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_debian_9:obj:1" version="1" comment="Check Debian version">
                <ind-def:filepath>/etc/debian_version</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^9.[0-9]+$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_debian_11:obj:1" version="1" comment="Check Debian version">
                <ind-def:filepath>/etc/debian_version</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^11.[0-9]+$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_debian_10:obj:1" version="1" comment="Check Debian version">
                <ind-def:filepath>/etc/debian_version</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^10.[0-9]+$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_debian:obj:1" version="1" comment="check /etc/debian_version file">
                <unix-def:filepath>/etc/debian_version</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_dconf_user_profile:obj:1" version="2">
                <ind-def:filepath>/etc/dconf/profile/user</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^user-db:user\nsystem-db:local$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_dconf_local_db:obj:1" version="1" comment="The binary system-wide dconf database with 'local' settings">
                <unix-def:filepath>/etc/dconf/db/local</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-obj_dconf_local_config:obj:1" version="1" comment="The dconf keyfile with 'local' settings">
                <unix-def:filepath operation="pattern match">^/etc/dconf/db/local.d/.*</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_lock_screen_on_smartcard_removal:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*\[org/gnome/settings-daemon/peripherals/smartcard\].*(?:\n\s*[^[\s].*)*\n^\s*removal-action[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_disable_user_admin:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*\[org/gnome/desktop/lockdown\].*(?:\n\s*[^[\s].*)*\n^\s*user-administration-disabled[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_disable_autorun:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/desktop/media-handling\]([^\n]*\n+)+?autorun-never=true$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_disable_automount_open:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/desktop/media-handling\]([^\n]*\n+)+?automount-open=false$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_disable_automount:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/desktop/media-handling\]([^\n]*\n+)+?automount=false$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_dconf_distro_db:obj:1" version="1" comment="The binary system-wide dconf database with 'distro' settings">
                <unix-def:filepath>/etc/dconf/db/distro</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-obj_dconf_distro_config:obj:1" version="1" comment="The dconf keyfile with 'distro' settings">
                <unix-def:filepath operation="pattern match">^/etc/dconf/db/distro.d/.*</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_cron_logging_rsyslog_dir:obj:1" version="1">
                <ind-def:path>/etc/rsyslog.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*cron\.\*[\s]+/var/log/cron$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_cron_logging_rsyslog:obj:1" version="1">
                <ind-def:filepath>/etc/rsyslog.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*cron\.\*[\s]+/var/log/cron$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-obj_count_of_all_uids:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-variable_count_of_all_uids:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-obj_count_of_all_group_names:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-variable_count_of_all_group_names:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-obj_count_of_all_group_ids:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-variable_count_of_all_group_ids:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_coredump_disable_storage:obj:1" version="1">
                <ind-def:filepath>/etc/systemd/coredump.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*\[Coredump\].*(?:\n\s*[^[\s].*)*\n^[ \t]*(?i)Storage(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_coredump_disable_backtraces:obj:1" version="1">
                <ind-def:filepath>/etc/systemd/coredump.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*\[Coredump\].*(?:\n\s*[^[\s].*)*\n^[ \t]*(?i)ProcessSizeMax(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_configure_usbguard_auditbackend_config_file:obj:1" version="1" comment="The configuration file /etc/usbguard/usbguard-daemon.conf for configure_usbguard_auditbackend">
                <unix-def:filepath operation="pattern match">^/etc/usbguard/usbguard-daemon.conf</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_configure_usbguard_auditbackend:obj:1" version="1">
                <ind-def:filepath>/etc/usbguard/usbguard-daemon.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*AuditBackend=(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_configure_tmux_lock_command:obj:1" version="1">
                <ind-def:filepath>/etc/tmux.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*set\s+-g\s+lock-command\s+vlock\s*(?:#.*)?$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_configure_tmux_lock_after_time:obj:1" version="1">
                <ind-def:filepath>/etc/tmux.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*set\s+-g\s+lock-after-time\s+900\s*(?:#.*)?$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_configure_remote_access_encryption:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/Vino]([^\n]*\n+)+?require-encryption=true$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_configure_remote_access_creds:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/Vino]([^\n]*\n+)+?authentication-methods=\['vnc'\]$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_configure_gnutls_tls_crypto_policy:obj:1" version="1">
                <ind-def:filepath>/etc/crypto-policies/back-ends/gnutls.config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">\+VERS-ALL:-VERS-DTLS0\.9:-VERS-SSL3\.0:-VERS-TLS1\.0:-VERS-TLS1\.1:-VERS-DTLS1\.0</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_configure_bashrc_exec_tmux:obj:1" version="1">
                <ind-def:behaviors singleline="true" multiline="false"/>
                <ind-def:filepath operation="pattern match">^/etc/bashrc$|^/etc/profile\.d/.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">if \[ "\$PS1" \]; then\n\s+parent=\$\(ps -o ppid= -p \$\$\)\n\s+name=\$\(ps -o comm= -p \$parent\)\n\s+case "\$name" in sshd\|login\) exec tmux ;; esac\nfi</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_configure_allowed_failures:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/distro.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?allowed-failures=3$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_chronyd_run_as_chrony_user_config_file:obj:1" version="1" comment="The configuration file /etc/sysconfig/chronyd for chronyd_run_as_chrony_user">
                <unix-def:filepath operation="pattern match">^/etc/sysconfig/chronyd</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_chronyd_run_as_chrony_user:obj:1" version="1">
                <ind-def:filepath>/etc/sysconfig/chronyd</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*OPTIONS=(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_chronyd_port_value:obj:1" version="1">
                <ind-def:filepath>/etc/chrony.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*port[\s]+(\S+)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_chronyd_cmdport_value:obj:1" version="1">
                <ind-def:filepath>/etc/chrony.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*cmdport[\s]+(\S+)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_chrony_set_maxpoll:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?:server|pool|peer)[\s]+[\S]+.*maxpoll[\s]+(\d+)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_chrony_no_server_nor_pool:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?:server|pool).*</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_chrony_all_server_has_maxpoll:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?:server|pool|peer)[\s]+[\S]+[\s]+(.*)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_centos7:obj:1" version="1">
                <lin-def:name>centos-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_centos6:obj:1" version="1">
                <lin-def:name>centos-release</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_banner_gui_enabled:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/distro.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?banner-message-enable=true$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_auditd_write_logs_default_not_overriden:obj:1" version="1">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)write_logs(?-i)[ \t]*=[ \t]*</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_auditd_write_logs:obj:1" version="1">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)write_logs(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_auditd_overflow_action:obj:1" version="1">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)overflow_action(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_auditd_name_format:obj:1" version="1">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)name_format(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_auditd_log_format:obj:1" version="1">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)log_format(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_auditd_local_events_default_not_overriden:obj:1" version="1">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)local_events(?-i)[ \t]*=[ \t]*</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_auditd_local_events:obj:1" version="1">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)local_events(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_auditd_freq:obj:1" version="1">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)freq(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:password_object id="oval:ssg-obj_all_uids:obj:1" version="1">
                <unix-def:username operation="pattern match">.*</unix-def:username>
              </unix-def:password_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_all_group_names:obj:1" version="1" comment="Get all group names">
                <ind-def:filepath>/etc/group</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(.+):.+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_all_group_ids:obj:1" version="1" comment="Get all group ids">
                <ind-def:filepath>/etc/group</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.+:.+:(\d+):.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-obj_accounts_umask_etc_profile:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-var_etc_profile_umask_as_number:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-obj_accounts_umask_etc_login_defs:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-var_etc_login_defs_umask_as_number:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_accounts_password_pam_pwhistory_remember_system_auth:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-pwhistory_line_regex_system_auth:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_accounts_password_pam_pwhistory_remember_password_auth:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/password-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-pwhistory_line_regex_password_auth:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_accounts_password_pam_faillock:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_faillock\.so.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_accounts_password_pam_enforce_root:obj:1" version="1">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*enforce_for_root[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_accounts_password_pam_enforce_local:obj:1" version="1">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*local_users_only[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_accounts_have_homedir_login_defs:obj:1" version="2">
                <ind-def:filepath>/etc/login.defs</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*(?i)CREATE_HOME(?-i)[\s]+yes[\s]*(?:#.*)?$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_PAE_NX_cpu_support:obj:1" version="1">
                <ind-def:filepath>/proc/cpuinfo</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^flags[\s]+:.*[\s]+pae[\s]+.*[\s]+nx[\s]+.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_NX_cpu_support:obj:1" version="1">
                <ind-def:filepath>/proc/cpuinfo</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^flags[\s]+:.*[\s]+nx[\s]+.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:password_object id="oval:ssg-file_permissions_unowned_userid_list_object:obj:1" version="1">
                <unix-def:username operation="pattern match">.*</unix-def:username>
              </unix-def:password_object>
              <unix-def:file_object id="oval:ssg-file_permissions_unowned_object:obj:1" version="1" comment="all local files">
                <unix-def:behaviors recurse="directories" recurse_direction="down" recurse_file_system="local"/>
                <unix-def:path>/</unix-def:path>
                <unix-def:filename operation="pattern match">.*</unix-def:filename>
                <filter>oval:ssg-file_permissions_unowned_userid_list_match:ste:1</filter>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-etc_group_object:obj:1" version="1">
                <ind-def:filepath>/etc/group</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[^:]+:[^:]*:([\d]+):[^:]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-crypto_policies_current_file:obj:1" version="1" comment="crypto-policies current state">
                <unix-def:filepath>/etc/crypto-policies/state/current</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-crypto_policies_config_file:obj:1" version="1" comment="crypto-policies config state">
                <unix-def:filepath>/etc/crypto-policies/config</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-all_local_directories_uid_zero:obj:1" version="1" comment="all local directories">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_uid_is_not_root_and_world_writable:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-all_local_directories_uid:obj:1" version="1" comment="all local directories">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_uid_is_user_and_world_writable:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-all_local_directories_gid:obj:1" version="1" comment="all local directories">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_gid_is_user_and_world_writable:ste:1</filter>
              </unix-def:file_object>
            </objects>
            <states>
              <unix-def:file_state id="oval:ssg-symlink_file_ownership_library_dirs_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_ownership_audit_configuration_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_ownerdir_ownership_library_dirs_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_owner_var_log_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_owner_var_log_syslog_uid_104:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_owner_var_log_messages_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_owner_grub2_cfg_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_owner_etc_shadow_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_owner_etc_passwd_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_owner_etc_motd_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_owner_etc_issue_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_owner_etc_gshadow_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_owner_etc_group_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_owner_efi_grub2_cfg_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_owner_backup_etc_shadow_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_owner_backup_etc_passwd_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_owner_backup_etc_gshadow_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_owner_backup_etc_group_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_groupownership_audit_configuration_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_groupownerroot_permissions_syslibrary_files_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_groupownerdir_group_ownership_library_dirs_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_groupowner_var_log_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_groupowner_var_log_syslog_uid_4:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_groupowner_var_log_messages_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_groupowner_grub2_cfg_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_groupowner_etc_shadow_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_groupowner_etc_passwd_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_groupowner_etc_motd_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_groupowner_etc_issue_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_groupowner_etc_gshadow_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_groupowner_etc_group_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_groupowner_efi_grub2_cfg_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_groupowner_backup_etc_shadow_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_groupowner_backup_etc_passwd_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_groupowner_backup_etc_gshadow_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-symlink_file_groupowner_backup_etc_group_uid_0:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <ind-def:variable_state id="oval:ssg-ste_umask_for_daemons:ste:1" version="1">
                <ind-def:value operation="bitwise and" datatype="int" var_ref="oval:ssg-var_umask_for_daemons_umask_as_number:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-ste_system_crypto_policy_value:ste:1" version="2" comment="variable value is set to 'FIPS' or 'FIPS:modifier', where the modifier corresponds to a crypto policy module that further restricts the modified crypto policy.">
                <ind-def:value operation="pattern match">^FIPS(:(OSPP|NO-SHA1|NO-CAMELLIA))?$</ind-def:value>
              </ind-def:variable_state>
              <ind-def:textfilecontent54_state id="oval:ssg-ste_sshd_config_start_parameter_valid:ste:1" version="1">
                <ind-def:subexpression operation="less than or equal" datatype="int">10</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-ste_sshd_config_rate_parameter_valid:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int">30</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-ste_sshd_config_full_parameter_valid:ste:1" version="1">
                <ind-def:subexpression operation="less than or equal" datatype="int">100</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-ste_harden_sshd_macs_openssh_conf_crypto_policy:ste:1" version="1">
                <ind-def:text var_ref="oval:ssg-sshd_macs_crypto:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-ste_harden_sshd_ciphers_openssh_conf_crypto_policy:ste:1" version="1">
                <ind-def:text var_ref="oval:ssg-sshd_ciphers_crypto:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:variable_state id="oval:ssg-ste_accounts_umask_etc_profile:ste:1" version="1">
                <ind-def:value operation="bitwise and" datatype="int" var_ref="oval:ssg-var_accounts_user_umask_umask_as_number:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-ste_accounts_umask_etc_login_defs:ste:1" version="1">
                <ind-def:value operation="bitwise and" datatype="int" var_ref="oval:ssg-var_accounts_user_umask_umask_as_number:var:1" var_check="all"/>
              </ind-def:variable_state>
              <unix-def:file_state id="oval:ssg-state_world_writable_and_not_sticky:ste:1" version="1">
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:interface_state id="oval:ssg-state_wifi_up:ste:1" version="1">
                <unix-def:flag entity_check="at least one">UP</unix-def:flag>
              </unix-def:interface_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_vm_mmap_min_addr_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_vm_mmap_min_addr:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_version_centos9:ste:1" version="1">
                <ind-def:subexpression>9</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_version_centos8:ste:1" version="1">
                <ind-def:subexpression>8</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <unix-def:file_state id="oval:ssg-state_var_tmp_tmp_inst:ste:1" version="1">
                <unix-def:type>directory</unix-def:type>
                <unix-def:uread datatype="boolean">false</unix-def:uread>
                <unix-def:uwrite datatype="boolean">false</unix-def:uwrite>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gread datatype="boolean">false</unix-def:gread>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:oread datatype="boolean">false</unix-def:oread>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <ind-def:variable_state id="oval:ssg-state_var_removable_partition_is_cd_dvd_drive:ste:1" version="1">
                <ind-def:value>/dev/cdrom</ind-def:value>
              </ind-def:variable_state>
              <lin-def:partition_state id="oval:ssg-state_var_partition_nosuid_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nosuid</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_var_partition_noexec_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">noexec</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_var_partition_nodev_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nodev</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_var_log_partition_nosuid_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nosuid</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_var_log_partition_noexec_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">noexec</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_var_log_partition_nodev_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nodev</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_var_log_audit_partition_nosuid_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nosuid</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_var_log_audit_partition_noexec_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">noexec</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_var_log_audit_partition_nodev_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nodev</lin-def:mount_options>
              </lin-def:partition_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_x86_vsyscall_emulation:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_x86_vsyscall_emulation_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_vmap_stack:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_vmap_stack_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_unmap_kernel_at_el0:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_unmap_kernel_at_el0_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_syn_cookies:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_syn_cookies_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_strict_module_rwx:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_strict_module_rwx_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_strict_kernel_rwx:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_strict_kernel_rwx_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_stackprotector_strong:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_stackprotector_strong_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_stackprotector:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_stackprotector_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_slub_debug:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_slub_debug_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_slab_merge_default:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_slab_merge_default_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_slab_frelist_random:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_slab_frelist_random_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_slab_freelist_hardened:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_slab_freelist_hardened_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_security_yama:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_security_yama_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_security_writable_hooks:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_security_writable_hooks_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_security_dmesg_restrict:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_security_dmesg_restrict_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_security:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_security_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_seccomp_filter:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_seccomp_filter_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_seccomp:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_seccomp_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_sched_stack_end_check:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_sched_stack_end_check_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_retpoline:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_retpoline_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_refcount_full:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_refcount_full_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_randomize_memory:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_randomize_memory_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_randomize_base:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_randomize_base_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_proc_kcore:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_proc_kcore_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_panic_timeout:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_panic_timeout_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_panic_on_oops:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_panic_on_oops_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_page_table_isolation:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_page_table_isolation_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_page_poisoning_zero:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_page_poisoning_zero_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_page_poisoning_no_sanity:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_page_poisoning_no_sanity_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_page_poisoning:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_page_poisoning_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_module_sig_sha512:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_module_sig_sha512_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_module_sig_key:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_module_sig_key_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_module_sig_hash:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_module_sig_hash_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_module_sig_force:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_module_sig_force_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_module_sig_all:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_module_sig_all_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_module_sig:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_module_sig_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_modify_ldt_syscall:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_modify_ldt_syscall_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_legacy_vsyscall_xonly:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_legacy_vsyscall_xonly_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_legacy_vsyscall_none:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_legacy_vsyscall_none_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_legacy_vsyscall_emulate:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_legacy_vsyscall_emulate_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_legacy_ptys:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_legacy_ptys_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_kexec:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_kexec_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_ipv6:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_ipv6_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_ia32_emulation:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_ia32_emulation_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_hibernation:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_hibernation_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_hardened_usercopy_fallback:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_hardened_usercopy_fallback_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_hardened_usercopy:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_hardened_usercopy_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_gcc_plugin_structleak_byref_all:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_gcc_plugin_structleak_byref_all_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_gcc_plugin_structleak:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_gcc_plugin_structleak_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_gcc_plugin_stackleak:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_gcc_plugin_stackleak_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_gcc_plugin_randstruct:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_gcc_plugin_randstruct_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_gcc_plugin_latent_entropy:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_gcc_plugin_latent_entropy_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_fortify_source:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_fortify_source_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_devkmem:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_devkmem_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_default_mmap_min_addr:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_default_mmap_min_addr_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_debug_wx:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_debug_wx_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_debug_sg:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_debug_sg_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_debug_notifiers:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_debug_notifiers_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_debug_list:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_debug_list_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_debug_fs:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_debug_fs_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_debug_credentials:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_debug_credentials_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_compat_vdso:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_compat_vdso_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_compat_brk:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_compat_brk_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_bug_on_data_corruption:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_bug_on_data_corruption_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_bug:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_bug_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_binfmt_misc:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_binfmt_misc_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_arm64_sw_ttbr0_pan:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_arm64_sw_ttbr0_pan_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_var_kernel_config_acpi_custom_method:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-local_var_config_acpi_custom_method_count_compliant_configs:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_user_max_user_namespaces_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_user_max_user_namespaces:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:family_state id="oval:ssg-state_unix_wrlinux8:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <ind-def:family_state id="oval:ssg-state_unix_wrlinux1019:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <ind-def:family_state id="oval:ssg-state_unix_family:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_uid_less_than_zero:ste:1" version="1">
                <ind-def:subexpression operation="less than" datatype="int">0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_uid_less_than_sys_uid_min:ste:1" version="1">
                <ind-def:subexpression operation="less than" datatype="int" var_ref="oval:ssg-variable_sys_uid_min_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <unix-def:file_state id="oval:ssg-state_uid_is_user_and_world_writable:ste:1" version="1" comment="uid greater than or equal to 1000 and world writable">
                <unix-def:user_id operation="greater than or equal" datatype="int">1000</unix-def:user_id>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_uid_is_not_root_and_world_writable:ste:1" version="1" comment="uid greater than 0 and world writable">
                <unix-def:user_id operation="greater than" datatype="int">0</unix-def:user_id>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
              </unix-def:file_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_uid_greater_than_or_equal_uid_min:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-variable_uid_min_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_uid_greater_than_or_equal_sys_uid_min:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-variable_sys_uid_min_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_uid_greater_than_or_equal_sys_uid_max:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-variable_sys_uid_max_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <lin-def:partition_state id="oval:ssg-state_tmp_partition_nosuid_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nosuid</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_tmp_partition_noexec_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">noexec</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_tmp_partition_nodev_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nodev</lin-def:mount_options>
              </lin-def:partition_state>
              <unix-def:file_state id="oval:ssg-state_tmp_inst:ste:1" version="1">
                <unix-def:type>directory</unix-def:type>
                <unix-def:uread datatype="boolean">false</unix-def:uread>
                <unix-def:uwrite datatype="boolean">false</unix-def:uwrite>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gread datatype="boolean">false</unix-def:gread>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:oread datatype="boolean">false</unix-def:oread>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_timer_running_dnf-automatic:ste:1" version="1" comment="dnf-automatic is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_timeout_value_upper_bound:ste:1" version="1" comment="upper bound of ClientAliveInterval in seconds">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-sshd_idle_timeout_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_timeout_value_lower_bound:ste:1" version="1" comment="lower bound of ClientAliveInterval in seconds">
                <ind-def:subexpression operation="greater than" datatype="int">0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_time_service_set_maxpoll:ste:1" version="1">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_time_service_set_maxpoll:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_usbguard_socket_on:ste:1" version="1" comment="usbguard listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">usbguard.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_usbguard_on:ste:1" version="1" comment="usbguard listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">usbguard.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_syslog-ng_socket_on:ste:1" version="1" comment="syslog-ng listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">syslog-ng.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_syslog-ng_on:ste:1" version="1" comment="syslog-ng listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">syslog-ng.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_rsyslog_socket_on:ste:1" version="1" comment="rsyslog listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">rsyslog.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_rsyslog_on:ste:1" version="1" comment="rsyslog listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">rsyslog.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_rngd_socket_on:ste:1" version="1" comment="rngd listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">rngd.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_rngd_on:ste:1" version="1" comment="rngd listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">rngd.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_pcscd_socket_on:ste:1" version="1" comment="pcscd listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">pcscd.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_pcscd_on:ste:1" version="1" comment="pcscd listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">pcscd.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_ntpd_socket_on:ste:1" version="1" comment="ntpd listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">ntpd.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_ntpd_on:ste:1" version="1" comment="ntpd listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">ntpd.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_ntp_socket_on:ste:1" version="1" comment="ntp listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">ntp.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_ntp_on:ste:1" version="1" comment="ntp listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">ntp.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_iptables_socket_on:ste:1" version="1" comment="iptables listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">iptables.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_iptables_on:ste:1" version="1" comment="iptables listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">iptables.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_ip6tables_socket_on:ste:1" version="1" comment="ip6tables listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">ip6tables.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_ip6tables_on:ste:1" version="1" comment="ip6tables listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">ip6tables.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_firewalld_socket_on:ste:1" version="1" comment="firewalld listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">firewalld.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_firewalld_on:ste:1" version="1" comment="firewalld listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">firewalld.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_dnf-automatic_on:ste:1" version="1" comment="dnf-automatic listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">dnf-automatic.timer</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_crond_socket_on:ste:1" version="1" comment="crond listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">crond.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_crond_on:ste:1" version="1" comment="crond listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">crond.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_cron_socket_on:ste:1" version="1" comment="cron listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">cron.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_cron_on:ste:1" version="1" comment="cron listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">cron.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_chronyd_socket_on:ste:1" version="1" comment="chronyd listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">chronyd.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_chronyd_on:ste:1" version="1" comment="chronyd listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">chronyd.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_auditd_socket_on:ste:1" version="1" comment="auditd listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">auditd.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_auditd_on:ste:1" version="1" comment="auditd listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">auditd.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <unix-def:uname_state id="oval:ssg-state_system_info_architecture_x86_64:ste:1" version="1" comment="64 bit architecture">
                <unix-def:processor_type>x86_64</unix-def:processor_type>
              </unix-def:uname_state>
              <unix-def:uname_state id="oval:ssg-state_system_info_architecture_x86:ste:1" version="1" comment="32 bit architecture">
                <unix-def:processor_type>i686</unix-def:processor_type>
              </unix-def:uname_state>
              <unix-def:uname_state id="oval:ssg-state_system_info_architecture_s390_64:ste:1" version="1" comment="64 bit architecture">
                <unix-def:processor_type>s390x</unix-def:processor_type>
              </unix-def:uname_state>
              <unix-def:uname_state id="oval:ssg-state_system_info_architecture_ppcle_64:ste:1" version="1" comment="64 bit architecture">
                <unix-def:processor_type>ppc64le</unix-def:processor_type>
              </unix-def:uname_state>
              <unix-def:uname_state id="oval:ssg-state_system_info_architecture_ppc_64:ste:1" version="1" comment="64 bit architecture">
                <unix-def:processor_type>ppc64</unix-def:processor_type>
              </unix-def:uname_state>
              <unix-def:uname_state id="oval:ssg-state_system_info_architecture_aarch_64:ste:1" version="1" comment="64 bit architecture">
                <unix-def:processor_type>aarch64</unix-def:processor_type>
              </unix-def:uname_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_system_auth_pam_unix_rounds:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_unix_rounds:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:variable_state id="oval:ssg-state_system_auth_default_pam_unix_rounds_var:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-var_system_auth_default_hashing_rounds:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_vm_mmap_min_addr_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_user_max_user_namespaces_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_vm_mmap_min_addr:ste:1" version="1">
                <unix-def:value datatype="int">65536</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_user_max_user_namespaces:ste:1" version="1">
                <unix-def:value datatype="int">0</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_router_solicitations:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_max_addresses:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_autoconf:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_autoconf_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_redirects:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_router_solicitations:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_max_addresses:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_autoconf:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_autoconf_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_tcp_syncookies:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_ip_local_port_range:ste:1" version="1">
                <unix-def:value operation="pattern match">32768\s*65535</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_ip_forward:ste:1" version="1">
                <unix-def:value datatype="int">0</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_shared_media:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_shared_media_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_send_redirects:ste:1" version="1">
                <unix-def:value datatype="int">0</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_secure_redirects:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_rp_filter:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_log_martians:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_accept_source_route:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_accept_redirects:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_shared_media:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_shared_media_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_send_redirects:ste:1" version="1">
                <unix-def:value datatype="int">0</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_secure_redirects:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_rp_filter:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_route_localnet:ste:1" version="1">
                <unix-def:value datatype="int">0</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_log_martians:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_drop_gratuitous_arp:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_arp_ignore:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_arp_ignore_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_arp_filter:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_arp_filter_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_accept_source_route:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_accept_redirects:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_accept_local:ste:1" version="1">
                <unix-def:value datatype="int">0</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_core_bpf_jit_harden:ste:1" version="1">
                <unix-def:value datatype="int">2</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_yama_ptrace_scope:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_unprivileged_bpf_disabled:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_sysrq:ste:1" version="1">
                <unix-def:value datatype="int">0</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_randomize_va_space:ste:1" version="1">
                <unix-def:value datatype="int">2</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_pid_max:ste:1" version="1">
                <unix-def:value datatype="int">65536</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_perf_event_paranoid:ste:1" version="1">
                <unix-def:value datatype="int">2</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_perf_event_max_sample_rate:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_perf_cpu_time_max_percent:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_panic_on_oops:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_modules_disabled:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_kptr_restrict:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_kernel_kptr_restrict_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_kexec_load_disabled:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_dmesg_restrict:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_core_pattern:ste:1" version="1">
                <unix-def:value>|/bin/false</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_fs_suid_dumpable:ste:1" version="1">
                <unix-def:value datatype="int">0</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_fs_protected_symlinks:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_fs_protected_regular:ste:1" version="1">
                <unix-def:value datatype="int">2</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_fs_protected_hardlinks:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_fs_protected_fifos:ste:1" version="1">
                <unix-def:value datatype="int">2</unix-def:value>
              </unix-def:sysctl_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_router_solicitations_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_max_addresses_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_disable_ipv6_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_autoconf_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_redirects_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_pinfo_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_defrtr_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_router_solicitations_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_max_addresses_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_disable_ipv6_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_autoconf_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_ra_pinfo_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_ra_defrtr_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv4_tcp_syncookies_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv4_ip_local_port_range_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv4_ip_forward_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_shared_media_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_send_redirects_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_secure_redirects_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_rp_filter_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_log_martians_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_accept_source_route_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_accept_redirects_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_shared_media_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_send_redirects_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_secure_redirects_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_rp_filter_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_route_localnet_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_log_martians_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_arp_ignore_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_arp_filter_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_accept_source_route_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_accept_redirects_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_accept_local_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_net_core_bpf_jit_harden_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_kernel_yama_ptrace_scope_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_kernel_unprivileged_bpf_disabled_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_kernel_sysrq_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_kernel_randomize_va_space_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_kernel_pid_max_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_kernel_perf_event_paranoid_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_kernel_perf_event_max_sample_rate_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_kernel_perf_cpu_time_max_percent_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_kernel_panic_on_oops_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_kernel_modules_disabled_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_kernel_kptr_restrict_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_kernel_kexec_load_disabled_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_kernel_exec_shield:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_kernel_dmesg_restrict_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_kernel_core_pattern_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_fs_suid_dumpable_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_fs_protected_symlinks_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_fs_protected_regular_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_fs_protected_hardlinks_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sysctl_fs_protected_fifos_defined_in_one_file:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_crypto_fips_enabled:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_vm_mmap_min_addr:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_user_max_user_namespaces:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_router_solicitations:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_max_addresses:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_disable_ipv6:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_autoconf:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_accept_redirects:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_accept_ra_pinfo:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_accept_ra_defrtr:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_default_accept_ra:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_router_solicitations:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_max_addresses:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_disable_ipv6:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_autoconf:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_accept_ra_pinfo:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv6_conf_all_accept_ra_defrtr:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_tcp_syncookies:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_ip_local_port_range:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_ip_forward:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_icmp_ignore_bogus_error_responses:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_icmp_echo_ignore_broadcasts:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_shared_media:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_send_redirects:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_secure_redirects:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_rp_filter:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_log_martians:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_accept_source_route:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_default_accept_redirects:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_shared_media:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_send_redirects:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_secure_redirects:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_rp_filter:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_route_localnet:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_log_martians:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_drop_gratuitous_arp:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_arp_ignore:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_arp_filter:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_accept_source_route:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_accept_redirects:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_ipv4_conf_all_accept_local:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_net_core_bpf_jit_harden:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_yama_ptrace_scope:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_unprivileged_bpf_disabled:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_sysrq:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_randomize_va_space:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_pid_max:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_perf_event_paranoid:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_perf_event_max_sample_rate:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_perf_cpu_time_max_percent:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_panic_on_oops:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_modules_disabled:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_kptr_restrict:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_kexec_load_disabled:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_dmesg_restrict:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_kernel_core_pattern:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_fs_suid_dumpable:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_fs_protected_symlinks:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_fs_protected_regular:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_fs_protected_hardlinks:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <unix-def:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_fs_protected_fifos:ste:1" version="1" comment="State that matches symlinks referencing files not in the default dirs">
                <unix-def:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <ind-def:variable_state id="oval:ssg-state_symlink_kerberos_crypto_policy_backend:ste:1" version="1">
                <ind-def:value var_ref="oval:ssg-var_symlink_kerberos_crypto_policy_backend:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sudoers_passwd_n_files:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sudoers_default_includedir:ste:1" version="1">
                <ind-def:subexpression>/etc/sudoers.d</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_vm_mmap_min_addr:ste:1" version="1">
                <ind-def:subexpression datatype="int">65536</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_user_max_user_namespaces:ste:1" version="1">
                <ind-def:subexpression datatype="int">0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_router_solicitations:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_max_addresses:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_disable_ipv6:ste:1" version="1">
                <ind-def:subexpression datatype="int">1</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_autoconf:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_autoconf_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_pinfo:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_defrtr:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_router_solicitations:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_max_addresses:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_disable_ipv6:ste:1" version="1">
                <ind-def:subexpression datatype="int">1</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_autoconf:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_autoconf_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_pinfo:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_defrtr:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_ip_local_port_range:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">32768\s*65535</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_ip_forward:ste:1" version="1">
                <ind-def:subexpression datatype="int">0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_shared_media:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_shared_media_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_send_redirects:ste:1" version="1">
                <ind-def:subexpression datatype="int">0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_shared_media:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_shared_media_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_send_redirects:ste:1" version="1">
                <ind-def:subexpression datatype="int">0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_route_localnet:ste:1" version="1">
                <ind-def:subexpression datatype="int">0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:ste:1" version="1">
                <ind-def:subexpression datatype="int">1</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_arp_ignore:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_arp_ignore_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_arp_filter:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_arp_filter_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_local:ste:1" version="1">
                <ind-def:subexpression datatype="int">0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_core_bpf_jit_harden:ste:1" version="1">
                <ind-def:subexpression datatype="int">2</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_yama_ptrace_scope:ste:1" version="1">
                <ind-def:subexpression datatype="int">1</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_unprivileged_bpf_disabled:ste:1" version="1">
                <ind-def:subexpression datatype="int">1</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_sysrq:ste:1" version="1">
                <ind-def:subexpression datatype="int">0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_randomize_va_space:ste:1" version="1">
                <ind-def:subexpression datatype="int">2</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_pid_max:ste:1" version="1">
                <ind-def:subexpression datatype="int">65536</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_perf_event_paranoid:ste:1" version="1">
                <ind-def:subexpression datatype="int">2</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_perf_event_max_sample_rate:ste:1" version="1">
                <ind-def:subexpression datatype="int">1</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_perf_cpu_time_max_percent:ste:1" version="1">
                <ind-def:subexpression datatype="int">1</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_panic_on_oops:ste:1" version="1">
                <ind-def:subexpression datatype="int">1</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_modules_disabled:ste:1" version="1">
                <ind-def:subexpression datatype="int">1</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_kptr_restrict:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_kernel_kptr_restrict_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_kexec_load_disabled:ste:1" version="1">
                <ind-def:subexpression datatype="int">1</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_dmesg_restrict:ste:1" version="1">
                <ind-def:subexpression datatype="int">1</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_core_pattern:ste:1" version="1">
                <ind-def:subexpression>|/bin/false</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_fs_suid_dumpable:ste:1" version="1">
                <ind-def:subexpression datatype="int">0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_fs_protected_symlinks:ste:1" version="1">
                <ind-def:subexpression datatype="int">1</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_fs_protected_regular:ste:1" version="1">
                <ind-def:subexpression datatype="int">2</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_fs_protected_hardlinks:ste:1" version="1">
                <ind-def:subexpression datatype="int">1</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_fs_protected_fifos:ste:1" version="1">
                <ind-def:subexpression datatype="int">2</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sssd_user_value:ste:1" version="1" comment="value of user setting">
                <ind-def:subexpression>sssd</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sssd_ssh_known_hosts_timeout:ste:1" version="1" comment="value of ssh_known_hosts_timeout setting">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_sssd_ssh_known_hosts_timeout:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sssd_memcache_timeout:ste:1" version="1" comment="value of memcache_timeout setting">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_sssd_memcache_timeout:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sssd_certificate_verification:ste:1" version="1" comment="value of certificate_verification">
                <ind-def:subexpression var_ref="oval:ssg-var_sssd_certificate_verification_digest_function:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_x11_use_localhost_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_x11_use_localhost:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_use_priv_separation:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_sshd_priv_separation:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_set_loglevel_verbose_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^VERBOSE$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_set_loglevel_verbose:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^VERBOSE$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_set_loglevel_info_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^INFO$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_set_loglevel_info:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^INFO$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_set_keepalive_0_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^0$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_set_keepalive_0:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^0$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:variable_state id="oval:ssg-state_sshd_requirement_unset:ste:1" version="1">
                <ind-def:value datatype="int">0</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sshd_required:ste:1" version="1">
                <ind-def:value datatype="int">2</ind-def:value>
              </ind-def:variable_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_print_last_log_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_print_last_log:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:variable_state id="oval:ssg-state_sshd_not_required:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_enable_x11_forwarding_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_enable_x11_forwarding:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_enable_warning_banner_net_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^/etc/issue.net$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_enable_warning_banner_net:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^/etc/issue.net$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_enable_warning_banner_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^/etc/issue$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_enable_warning_banner:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^/etc/issue$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_enable_strictmodes_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_enable_strictmodes:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_enable_pubkey_auth_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_enable_pubkey_auth:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_enable_pam_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_enable_pam:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_enable_gssapi_auth_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_enable_gssapi_auth:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_do_not_permit_user_env_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_do_not_permit_user_env:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_x11_forwarding_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_x11_forwarding:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_user_known_hosts_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_user_known_hosts:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_tcp_forwarding_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_tcp_forwarding:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_root_password_login_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^prohibit-password$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_root_password_login:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^prohibit-password$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_root_login_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_root_login:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_rhosts_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_rhosts:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_pubkey_auth_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_pubkey_auth:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_kerb_auth_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_kerb_auth:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_gssapi_auth_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_gssapi_auth:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_empty_passwords_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_empty_passwords:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_compression:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_sshd_disable_compression:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_clientalivecountmax:ste:1" version="1">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_sshd_set_keepalive:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <lin-def:partition_state id="oval:ssg-state_srv_partition_nosuid_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nosuid</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sles_15_for_sap:ste:1" version="1">
                <lin-def:version operation="pattern match">^15.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sles_12_for_sap:ste:1" version="1">
                <lin-def:version operation="pattern match">^12.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:family_state id="oval:ssg-state_sle15_unix_family:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sle15_server:ste:1" version="1">
                <lin-def:version operation="pattern match">^15.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sle15_desktop:ste:1" version="1">
                <lin-def:version operation="pattern match">^15.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:family_state id="oval:ssg-state_sle12_unix_family:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sle12_server:ste:1" version="1">
                <lin-def:version operation="pattern match">^12.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sle12_desktop:ste:1" version="1">
                <lin-def:version operation="pattern match">^12.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sl7:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sl6:ste:1" version="1">
                <lin-def:version operation="pattern match">^6.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <unix-def:file_state id="oval:ssg-state_setuid_or_setgid_set:ste:1" version="1" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
              </unix-def:file_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_usbguard:ste:1" version="1" comment="usbguard is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_syslog-ng:ste:1" version="1" comment="syslog-ng is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_rsyslog:ste:1" version="1" comment="rsyslog is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_rngd:ste:1" version="1" comment="rngd is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_pcscd:ste:1" version="1" comment="pcscd is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_ntpd:ste:1" version="1" comment="ntpd is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_ntp:ste:1" version="1" comment="ntp is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_iptables:ste:1" version="1" comment="iptables is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_ip6tables:ste:1" version="1" comment="ip6tables is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_firewalld:ste:1" version="1" comment="firewalld is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_crond:ste:1" version="1" comment="crond is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_cron:ste:1" version="1" comment="cron is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_chronyd:ste:1" version="1" comment="chronyd is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_auditd:ste:1" version="1" comment="auditd is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_systemd-coredump:ste:1" version="1" comment="systemd-coredump is not running">
                <lin-def:value operation="pattern match">inactive|failed</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_syslog:ste:1" version="1" comment="syslog is not running">
                <lin-def:value operation="pattern match">inactive|failed</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_sssd:ste:1" version="1" comment="sssd is not running">
                <lin-def:value operation="pattern match">inactive|failed</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_sshd:ste:1" version="1" comment="sshd is not running">
                <lin-def:value operation="pattern match">inactive|failed</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_rsyncd:ste:1" version="1" comment="rsyncd is not running">
                <lin-def:value operation="pattern match">inactive|failed</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_rpcsvcgssd:ste:1" version="1" comment="rpcsvcgssd is not running">
                <lin-def:value operation="pattern match">inactive|failed</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_rpcidmapd:ste:1" version="1" comment="rpcidmapd is not running">
                <lin-def:value operation="pattern match">inactive|failed</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_rpcgssd:ste:1" version="1" comment="rpcgssd is not running">
                <lin-def:value operation="pattern match">inactive|failed</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_nfslock:ste:1" version="1" comment="nfslock is not running">
                <lin-def:value operation="pattern match">inactive|failed</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_nfs-server:ste:1" version="1" comment="nfs-server is not running">
                <lin-def:value operation="pattern match">inactive|failed</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_netfs:ste:1" version="1" comment="netfs is not running">
                <lin-def:value operation="pattern match">inactive|failed</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_debug-shell:ste:1" version="1" comment="debug-shell is not running">
                <lin-def:value operation="pattern match">inactive|failed</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_bluetooth:ste:1" version="1" comment="bluetooth is not running">
                <lin-def:value operation="pattern match">inactive|failed</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_autofs:ste:1" version="1" comment="autofs is not running">
                <lin-def:value operation="pattern match">inactive|failed</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_atd:ste:1" version="1" comment="atd is not running">
                <lin-def:value operation="pattern match">inactive|failed</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_systemd-coredump:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_syslog:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_sssd:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_sshd:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_rsyncd:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_rpcsvcgssd:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_rpcidmapd:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_rpcgssd:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_nfslock:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_nfs-server:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_netfs:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_debug-shell:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_bluetooth:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_autofs:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_atd:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_server_has_maxpoll:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">maxpoll \d+</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_selinux_policy:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_selinux_policy_name:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <lin-def:selinuxsecuritycontext_state id="oval:ssg-state_selinux_dev_unlabeled_t:ste:1" version="1" comment="unlabeled_t label">
                <lin-def:type>unlabeled_t</lin-def:type>
              </lin-def:selinuxsecuritycontext_state>
              <lin-def:selinuxsecuritycontext_state id="oval:ssg-state_selinux_dev_device_t:ste:1" version="1" comment="device_t label">
                <lin-def:type>device_t</lin-def:type>
              </lin-def:selinuxsecuritycontext_state>
              <lin-def:selinuxsecuritycontext_state id="oval:ssg-state_selinux_confinement_of_daemons:ste:1" version="1" comment="state unconfined_service_t">
                <lin-def:type>unconfined_service_t</lin-def:type>
              </lin-def:selinuxsecuritycontext_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_screensaver_lock_delay_setting:ste:1" version="1">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_screensaver_lock_delay:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_screensaver_idle_delay_setting:ste:1" version="1">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-inactivity_timeout_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_rsyslog_remote_tls:ste:1" version="1" comment="value of omfwd action">
                <ind-def:subexpression operation="pattern match">(?=[\S\s]*\s(?i)protocol(?-i)="tcp")(?=[\S\s]*\s(?i)Target(?-i)="[^"]+?")(?=[\S\s]*\s(?i)port(?-i)="6514")(?=[\S\s]*\s(?i)StreamDriver(?-i)="gtls")(?=[\S\s]*\s(?i)StreamDriverMode(?-i)="1")(?=[\S\s]*\s(?i)StreamDriverAuthMode(?-i)="x509/name")(?=[\S\s]*\s(?i)StreamDriver\.CheckExtendedKeyPurpose(?-i)="on")</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <unix-def:file_state id="oval:ssg-state_rsyslog_files_permissions:ste:1" version="1">
                <unix-def:type>regular</unix-def:type>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gread datatype="boolean">false</unix-def:gread>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:oread datatype="boolean">false</unix-def:oread>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_rsyslog_files_ownership:ste:1" version="1">
                <unix-def:type>regular</unix-def:type>
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_rsyslog_files_groupownership:ste:1" version="1">
                <unix-def:type>regular</unix-def:type>
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_root_mail_alias:ste:1" version="1" comment="root email alias">
                <ind-def:subexpression var_ref="oval:ssg-var_postfix_root_mail_alias:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhvh4_version:ste:1" version="1">
                <lin-def:evr operation="greater than or equal" datatype="evr_string">0:4.4</lin-def:evr>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhevm4_version:ste:1" version="1">
                <lin-def:version operation="pattern match">^4.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_rhevh_rhel9_version:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">9</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_rhevh_rhel8_version:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">8</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_rhevh_rhel7_version:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">7</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:family_state id="oval:ssg-state_rhel9_unix_family:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel9:ste:1" version="1">
                <lin-def:version operation="pattern match">^9.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:family_state id="oval:ssg-state_rhel8_unix_family:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_9:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.9*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_8:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.8*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_7:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.7*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_6:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.6*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_5:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.5*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_4:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.4*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_3:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.3*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_2:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.2*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_1:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.1*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_10:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.10*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_0:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.0*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel7_workstation:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:family_state id="oval:ssg-state_rhel7_unix_family:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel7_server:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel7_computenode:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel7_client:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_rhcos:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">rhcos</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_rhcos4:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">4</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_proper_audit_rule_but_for_unprivileged_command:ste:1" version="1">
                <ind-def:subexpression operation="not equal" var_ref="oval:ssg-variable_all_privileged_commands:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <unix-def:interface_state id="oval:ssg-state_promisc:ste:1" version="1">
                <unix-def:flag entity_check="at least one">PROMISC</unix-def:flag>
              </unix-def:interface_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_proc_sys_kernel_osrelease_arch_s390x:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^s390x$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_proc_sys_kernel_osrelease_arch_aarch64:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^aarch64$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_proc_sys_kernel_osrelease_64_bit:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(x86_64|aarch64|ppc64le|s390x)$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <lin-def:partition_state id="oval:ssg-state_proc_partition_hidepid_optional_no:ste:1" version="1">
                <lin-def:mount_options var_ref="oval:ssg-local_var_mountoption_hidepid_with_value:var:1" var_check="all" entity_check="at least one"/>
              </lin-def:partition_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_proc_cpuinfo_64_bit:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">\blm\b</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <unix-def:file_state id="oval:ssg-state_perms_binary_files_symlink:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_perms_binary_files_nogroupwrite_noworldwrite:ste:1" version="1" operator="OR">
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
              </unix-def:file_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_permissions_ignore_include_paths:ste:1" version="1" comment="ignore">
                <ind-def:text operation="pattern match">(?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*)</ind-def:text>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_ucredit:ste:1" version="3">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_ucredit:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_retry_upper_bound:ste:1" version="1" comment="upper bound of password_pam_retry">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_retry:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_retry_lower_bound:ste:1" version="1" comment="lower bound of password_pam_retry">
                <ind-def:subexpression operation="greater than" datatype="int">0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_ocredit:ste:1" version="3">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_ocredit:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_minlen:ste:1" version="3">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_minlen:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_minclass:ste:1" version="3">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_minclass:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_maxrepeat:ste:1" version="3">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_maxrepeat:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_maxclassrepeat_zero_comparison:ste:1" version="1">
                <ind-def:subexpression operation="greater than" datatype="int">0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_maxclassrepeat:ste:1" version="3">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_maxclassrepeat:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_lcredit:ste:1" version="3">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_lcredit:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_difok:ste:1" version="3">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_difok:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_dictcheck:ste:1" version="3">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-var_password_pam_dictcheck:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_dcredit:ste:1" version="3">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_dcredit:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_auth_pam_unix_rounds:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_unix_rounds:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:variable_state id="oval:ssg-state_password_auth_default_pam_unix_rounds_var:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-var_password_auth_default_hashing_rounds:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_pam_pkcs11_cert_policy_ocsp_on:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^.*ocsp_on.*$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <lin-def:rpminfo_state id="oval:ssg-state_package_gpg-pubkey-9867c58f-601c49ca:ste:1" version="1">
                <lin-def:release>601c49ca</lin-def:release>
                <lin-def:version>9867c58f</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_package_gpg-pubkey-5323552a-6112bcdc:ste:1" version="1">
                <lin-def:release>6112bcdc</lin-def:release>
                <lin-def:version>5323552a</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_package_gpg-pubkey-45719a39-5f2c0192:ste:1" version="1">
                <lin-def:release>5f2c0192</lin-def:release>
                <lin-def:version>45719a39</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_package_gpg-pubkey-38ab71f4-60242b08:ste:1" version="1">
                <lin-def:release>60242b08</lin-def:release>
                <lin-def:version>38ab71f4</lin-def:version>
              </lin-def:rpminfo_state>
              <unix-def:file_state id="oval:ssg-state_owner_systemmap:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1" version="1" operator="OR">
                <unix-def:group_id operation="not equal" datatype="int">0</unix-def:group_id>
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_owner_not_root_root_var_log_audit:ste:1" version="1" operator="OR">
                <unix-def:group_id operation="not equal" datatype="int">0</unix-def:group_id>
                <unix-def:user_id operation="not equal" datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_owner_ignore_include_paths:ste:1" version="1" comment="ignore">
                <ind-def:text operation="pattern match">(?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*)</ind-def:text>
              </ind-def:textfilecontent54_state>
              <unix-def:file_state id="oval:ssg-state_owner_binaries_not_root:ste:1" version="1" operator="OR">
                <unix-def:user_id operation="not equal" datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <lin-def:partition_state id="oval:ssg-state_opt_partition_nosuid_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nosuid</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:rpminfo_state id="oval:ssg-state_opensuse_leap42_installed:ste:1" version="1">
                <lin-def:version operation="pattern match">^42.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_opensuse_leap15_installed:ste:1" version="1">
                <lin-def:version operation="pattern match">^15.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_opensuse_installed:ste:1" version="1">
                <lin-def:name operation="pattern match">openSUSE-release</lin-def:name>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_openssh-server_version:ste:1" version="1">
                <lin-def:evr operation="greater than or equal" datatype="evr_string">0:7.4</lin-def:evr>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_ol9_system:ste:1" version="1">
                <lin-def:version operation="pattern match">^9.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_ol8_system:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_ol7_system:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <unix-def:file_state id="oval:ssg-state_not_mode_0750:ste:1" version="1" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:oread datatype="boolean">true</unix-def:oread>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_not_mode_0700:ste:1" version="1" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:gread datatype="boolean">true</unix-def:gread>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">true</unix-def:gexec>
                <unix-def:oread datatype="boolean">true</unix-def:oread>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_not_mode_0640:ste:1" version="1" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:uexec datatype="boolean">true</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">true</unix-def:gexec>
                <unix-def:oread datatype="boolean">true</unix-def:oread>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_not_mode_0600:ste:1" version="1" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:uexec datatype="boolean">true</unix-def:uexec>
                <unix-def:gread datatype="boolean">true</unix-def:gread>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">true</unix-def:gexec>
                <unix-def:oread datatype="boolean">true</unix-def:oread>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_nosuid_etc_fstab_not_cd_dvd_drive:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^.*,?nosuid,?.*</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_nosuid_etc_fstab_cd_dvd_drive:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^.*,?nosuid,?.*$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_noexec_etc_fstab_not_cd_dvd_drive:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^.*,?noexec,?.*</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_noexec_etc_fstab_cd_dvd_drive:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^.*,?noexec,?.*$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_nodev_etc_fstab_not_cd_dvd_drive:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^.*,?nodev,?.*</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_nodev_etc_fstab_cd_dvd_drive:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^.*,?nodev,?.*$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:variable_state id="oval:ssg-state_no_duplicate_uids:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-variable_count_of_unique_uids:var:1" var_check="at least one"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_no_duplicate_group_names:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-variable_count_of_unique_group_names:var:1" var_check="at least one"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_no_duplicate_group_ids:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-variable_count_of_unique_group_ids:var:1" var_check="at least one"/>
              </ind-def:variable_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_network_nmcli_permissions:ste:1" version="1">
                <ind-def:subexpression>ResultActive=auth_admin</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_default_router_solicitations_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_router_solicitations:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_default_max_addresses_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_max_addresses:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_default_disable_ipv6_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_disable_ipv6:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_default_autoconf_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_autoconf:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_default_accept_redirects_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_accept_redirects:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_default_accept_ra_rtr_pref_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_accept_ra_rtr_pref:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_default_accept_ra_pinfo_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_accept_ra_pinfo:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_default_accept_ra_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_accept_ra:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_default_accept_ra_defrtr_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_accept_ra_defrtr:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_all_router_solicitations_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_router_solicitations:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_all_max_addresses_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_max_addresses:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_all_disable_ipv6_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_disable_ipv6:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_all_autoconf_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_autoconf:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_all_accept_ra_rtr_pref_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_accept_ra_rtr_pref:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_all_accept_ra_pinfo_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_accept_ra_pinfo:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv6_conf_all_accept_ra_defrtr_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_accept_ra_defrtr:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv4_tcp_syncookies_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_tcp_syncookies:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv4_ip_local_port_range_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_ip_local_port_range:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv4_ip_forward_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_ip_forward:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv4_icmp_ignore_bogus_error_responses_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_icmp_ignore_bogus_error_responses:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv4_icmp_echo_ignore_broadcasts_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_icmp_echo_ignore_broadcasts:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_default_shared_media_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_shared_media:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_default_send_redirects_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_send_redirects:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_default_secure_redirects_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_secure_redirects:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_default_rp_filter_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_rp_filter:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_default_log_martians_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_log_martians:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_default_accept_source_route_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_accept_source_route:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_default_accept_redirects_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_accept_redirects:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_all_shared_media_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_shared_media:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_all_send_redirects_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_send_redirects:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_all_secure_redirects_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_secure_redirects:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_all_rp_filter_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_rp_filter:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_all_route_localnet_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_route_localnet:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_all_log_martians_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_log_martians:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_all_drop_gratuitous_arp_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_drop_gratuitous_arp:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_all_arp_ignore_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_arp_ignore:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_all_arp_filter_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_arp_filter:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_all_accept_source_route_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_accept_source_route:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_all_accept_redirects_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_accept_redirects:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_ipv4_conf_all_accept_local_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_accept_local:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_net_core_bpf_jit_harden_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_net_core_bpf_jit_harden:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_name_centos9:ste:1" version="1">
                <ind-def:subexpression>centos</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_name_centos8:ste:1" version="1">
                <ind-def:subexpression>centos</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <lin-def:partition_state id="oval:ssg-state_mount_option_var_tmp_bind_compare_source:ste:1" version="1">
                <lin-def:device var_ref="oval:ssg-var_mount_option_var_tmp_bind_var_tmp_source_device:var:1" var_check="all" entity_check="at least one"/>
              </lin-def:partition_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_maxsessions_value_upper_bound:ste:1" version="1" comment="upper bound of MaxSessions in number of sessions">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_sshd_max_sessions:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_maxsessions_value_lower_bound:ste:1" version="1" comment="lower bound of MaxSessions in number of sessions">
                <ind-def:subexpression operation="greater than or equal" datatype="int">0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_maxlogins:ste:1" version="1">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_accounts_max_concurrent_login_sessions:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_maxauthtries_value_upper_bound:ste:1" version="1" comment="upper bound of MaxAuthTries">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-sshd_max_auth_tries_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_maxauthtries_value_lower_bound:ste:1" version="1" comment="lower bound of MaxAuthTries">
                <ind-def:subexpression operation="greater than" datatype="int">0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_logingracetime_value_upper_bound:ste:1" version="1" comment="upper bound of LoginGraceTime in number of sessions">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_sshd_set_login_grace_time:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_logingracetime_value_lower_bound:ste:1" version="1" comment="lower bound of LoginGraceTime in number of sessions">
                <ind-def:subexpression operation="greater than" datatype="int">0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_logfile_sudoers:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_sudo_logfile:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:variable_state id="oval:ssg-state_location_of_kerberos_crypto_policy_backend:ste:1" version="1">
                <ind-def:value>/etc/crypto-policies/back-ends/krb5.config</ind-def:value>
              </ind-def:variable_state>
              <lin-def:partition_state id="oval:ssg-state_local_nodev:ste:1" version="1">
                <lin-def:device operation="pattern match">^/dev/.*$</lin-def:device>
                <lin-def:mount_options operation="not equal">nodev</lin-def:mount_options>
              </lin-def:partition_state>
              <ind-def:variable_state id="oval:ssg-state_local_db_is_up_to_date:ste:1" version="1">
                <ind-def:value operation="less than or equal" datatype="int" var_ref="oval:ssg-var_dconf_local_keyfiles_modified_time:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_last_pass_warn_age_instance_value:ste:1" version="1">
                <ind-def:value operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" var_check="at least one"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_last_pass_min_len_instance_value:ste:1" version="1">
                <ind-def:value operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_accounts_password_minlen_login_defs:var:1" var_check="at least one"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_last_pass_min_days_instance_value:ste:1" version="1">
                <ind-def:value operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_accounts_minimum_age_login_defs:var:1" var_check="at least one"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_last_pass_max_days_instance_value:ste:1" version="1">
                <ind-def:value operation="less than or equal" datatype="int" var_ref="oval:ssg-var_accounts_maximum_age_login_defs:var:1" var_check="at least one"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_last_encrypt_method_instance_value:ste:1" version="1">
                <ind-def:value var_ref="oval:ssg-var_password_hashing_algorithm:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_yama_ptrace_scope_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_kernel_yama_ptrace_scope:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_unprivileged_bpf_disabled_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_kernel_unprivileged_bpf_disabled:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_sysrq_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_kernel_sysrq:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_randomize_va_space_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_kernel_randomize_va_space:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_pid_max_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_kernel_pid_max:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_perf_event_paranoid_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_kernel_perf_event_paranoid:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_perf_event_max_sample_rate_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_kernel_perf_event_max_sample_rate:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_perf_cpu_time_max_percent_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_kernel_perf_cpu_time_max_percent:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_panic_on_oops_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_kernel_panic_on_oops:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_modules_disabled_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_kernel_modules_disabled:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_kptr_restrict_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_kernel_kptr_restrict:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_kexec_load_disabled_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_kernel_kexec_load_disabled:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_dmesg_restrict_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_kernel_dmesg_restrict:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_core_pattern_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_kernel_core_pattern:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_x86_vsyscall_emulation:ste:1" version="1">
                <ind-def:subexpression>n</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_vmap_stack:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_unmap_kernel_at_el0:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_syn_cookies:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_strict_module_rwx:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_strict_kernel_rwx:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_stackprotector_strong:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_stackprotector:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_slub_debug:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_slab_merge_default:ste:1" version="1">
                <ind-def:subexpression>n</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_slab_frelist_random:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_slab_freelist_hardened:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_security_yama:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_security_writable_hooks:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_security_dmesg_restrict:ste:1" version="1">
                <ind-def:subexpression>n</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_security:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_seccomp_filter:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_seccomp:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_sched_stack_end_check:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_retpoline:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_refcount_full:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_randomize_memory:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_randomize_base:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_proc_kcore:ste:1" version="1">
                <ind-def:subexpression>n</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_panic_timeout:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_kernel_config_panic_timeout:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_panic_on_oops:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_page_table_isolation:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_page_poisoning_zero:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_page_poisoning_no_sanity:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_page_poisoning:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_module_sig_sha512:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_module_sig_key:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_kernel_config_module_sig_key:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_module_sig_hash:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_kernel_config_module_sig_hash:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_module_sig_force:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_module_sig_all:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_module_sig:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_modify_ldt_syscall:ste:1" version="1">
                <ind-def:subexpression>n</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_legacy_vsyscall_xonly:ste:1" version="1">
                <ind-def:subexpression>n</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_legacy_vsyscall_none:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_legacy_vsyscall_emulate:ste:1" version="1">
                <ind-def:subexpression>n</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_legacy_ptys:ste:1" version="1">
                <ind-def:subexpression>n</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_kexec:ste:1" version="1">
                <ind-def:subexpression>n</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_ipv6:ste:1" version="1">
                <ind-def:subexpression>n</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_ia32_emulation:ste:1" version="1">
                <ind-def:subexpression>n</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_hibernation:ste:1" version="1">
                <ind-def:subexpression>n</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_hardened_usercopy_fallback:ste:1" version="1">
                <ind-def:subexpression>n</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_hardened_usercopy:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_gcc_plugin_structleak_byref_all:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_gcc_plugin_structleak:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_gcc_plugin_stackleak:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_gcc_plugin_randstruct:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_gcc_plugin_latent_entropy:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_fortify_source:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_devkmem:ste:1" version="1">
                <ind-def:subexpression>n</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_default_mmap_min_addr:ste:1" version="1">
                <ind-def:subexpression>65536</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_debug_wx:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_debug_sg:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_debug_notifiers:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_debug_list:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_debug_fs:ste:1" version="1">
                <ind-def:subexpression>n</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_debug_credentials:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_compat_vdso:ste:1" version="1">
                <ind-def:subexpression>n</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_compat_brk:ste:1" version="1">
                <ind-def:subexpression>n</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_bug_on_data_corruption:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_bug:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_binfmt_misc:ste:1" version="1">
                <ind-def:subexpression>n</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_arm64_sw_ttbr0_pan:ste:1" version="1">
                <ind-def:subexpression>y</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_kernel_config_acpi_custom_method:ste:1" version="1">
                <ind-def:subexpression>n</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <lin-def:partition_state id="oval:ssg-state_home_partition_noexec_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">noexec</lin-def:mount_options>
              </lin-def:partition_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_harden_sshd_crypto_policy:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^'-oCiphers=aes256-ctr,aes128-ctr,aes256-cbc,aes128-cbc -oMACs=hmac-sha2-512,hmac-sha2-256 -oGSSAPIKeyExchange=no -oKexAlgorithms=ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256 -oPubkeyAcceptedKeyTypes=rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256'$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_RekeyLimit:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^512M 1h$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_Match:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^final all$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_MACs:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^hmac-sha2-512,hmac-sha2-256$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_KexAlgorithms:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_GSSAPIAuthentication:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_Ciphers:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^aes256-ctr,aes256-cbc,aes128-ctr,aes128-cbc$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_vsyscall_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?:.*\s)?vsyscall=none(?:\s.*)?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_spectre_v2_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?:.*\s)?spectre_v2=on(?:\s.*)?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_spec_store_bypass_disable_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match" var_ref="oval:ssg-local_var_regex_spec_store_bypass_disable_var_spec_store_bypass_disable_options:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_slub_debug_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match" var_ref="oval:ssg-local_var_regex_slub_debug_var_slub_debug_options:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_slab_nomerge_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?:.*\s)?slab_nomerge=yes(?:\s.*)?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_rng_core_default_quality_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match" var_ref="oval:ssg-local_var_regex_rng_core_default_quality_var_rng_core_default_quality:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_pti_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?:.*\s)?pti=on(?:\s.*)?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_page_poison_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?:.*\s)?page_poison=1(?:\s.*)?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_nousb_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^.*\bnousb\b.*$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_mds_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match" var_ref="oval:ssg-local_var_regex_mds_var_mds_options:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_mce_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?:.*\s)?mce=0(?:\s.*)?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_l1tf_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match" var_ref="oval:ssg-local_var_regex_l1tf_var_l1tf_options:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_ipv6_disable_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?:.*\s)?ipv6\.disable=1(?:\s.*)?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_iommu_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?:.*\s)?iommu=force(?:\s.*)?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_audit_backlog_limit_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?:.*\s)?audit_backlog_limit=8192(?:\s.*)?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_audit_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?:.*\s)?audit=1(?:\s.*)?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_groupownership_ignore_include_paths:ste:1" version="1" comment="ignore">
                <ind-def:text operation="pattern match">(?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*)</ind-def:text>
              </ind-def:textfilecontent54_state>
              <unix-def:file_state id="oval:ssg-state_groupowner_system_commands_dirs_not_root:ste:1" version="1">
                <unix-def:group_id operation="not equal" datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_gnome_gdm_disable_xdmcp:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^false$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_gid_passwd_group_same:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_gid_passwd_group_same:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <unix-def:file_state id="oval:ssg-state_gid_is_user_and_world_writable:ste:1" version="1" comment="gid greater than or equal to 1000 and world writable">
                <unix-def:group_id operation="greater than or equal" datatype="int">1000</unix-def:group_id>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
              </unix-def:file_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_gdm_login_banner_text_setting:ste:1" version="1">
                <ind-def:subexpression operation="pattern match" var_ref="oval:ssg-login_banner_text:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_fs_suid_dumpable_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_fs_suid_dumpable:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_fs_protected_symlinks_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_fs_protected_symlinks:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_fs_protected_regular_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_fs_protected_regular:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_fs_protected_hardlinks_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_fs_protected_hardlinks:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_fs_protected_fifos_filepath_is_symlink:ste:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-local_var_safe_symlinks_fs_protected_fifos:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_force_opensc_card_drivers:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_smartcard_drivers:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <lin-def:rpmverifyfile_state id="oval:ssg-state_files_fail_mode:ste:1" version="1">
                <lin-def:mode_differs>fail</lin-def:mode_differs>
              </lin-def:rpmverifyfile_state>
              <lin-def:rpmverifyfile_state id="oval:ssg-state_files_fail_md5_hash:ste:1" version="1">
                <lin-def:md5_differs>fail</lin-def:md5_differs>
                <lin-def:configuration_file datatype="boolean">false</lin-def:configuration_file>
                <lin-def:ghost_file datatype="boolean">false</lin-def:ghost_file>
              </lin-def:rpmverifyfile_state>
              <unix-def:file_state id="oval:ssg-state_file_permissionsdir_permissions_library_dirs_3_mode_0755or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissionsdir_permissions_library_dirs_2_mode_0755or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissionsdir_permissions_library_dirs_1_mode_0755or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissionsdir_permissions_library_dirs_0_mode_0755or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissionsdir_permissions_binary_dirs_5_mode_0755or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissionsdir_permissions_binary_dirs_4_mode_0755or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissionsdir_permissions_binary_dirs_3_mode_0755or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissionsdir_permissions_binary_dirs_2_mode_0755or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissionsdir_permissions_binary_dirs_1_mode_0755or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissionsdir_permissions_binary_dirs_0_mode_0755or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_var_log_syslog_0_mode_0640or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:oread datatype="boolean">false</unix-def:oread>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_var_log_messages_0_mode_0640or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:oread datatype="boolean">false</unix-def:oread>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_var_log_0_mode_0755or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_ungroupowned:ste:1" version="1" comment="Files that are owned by a group.">
                <unix-def:group_id datatype="int" var_ref="oval:ssg-variable_file_permissions_ungroupowned:var:1" var_check="at least one"/>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write_exclude_sys:ste:1" version="1">
                <unix-def:filepath operation="pattern match">^/sys/.*$</unix-def:filepath>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write_exclude_special_selinux_files:ste:1" version="1">
                <unix-def:filepath operation="pattern match">^/selinux/(?:(?:member)|(?:user)|(?:relabel)|(?:create)|(?:access)|(?:context))$</unix-def:filepath>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write_exclude_proc:ste:1" version="1">
                <unix-def:filepath operation="pattern match">^/proc/.*$</unix-def:filepath>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write:ste:1" version="1">
                <unix-def:type>regular</unix-def:type>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_unauthorized_suid_suid_set:ste:1" version="1">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_unauthorized_suid_filepaths:ste:1" version="1">
                <unix-def:filepath var_ref="oval:ssg-var_file_permissions_unauthorized_suid_rpms:var:1" var_check="at least one"/>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_unauthorized_sgid_sgid_set:ste:1" version="1">
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_unauthorized_sgid_filepaths:ste:1" version="1">
                <unix-def:filepath var_ref="oval:ssg-var_file_permissions_unauthorized_sgid_rpms:var:1" var_check="at least one"/>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_systemmap:ste:1" version="1">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gread datatype="boolean">false</unix-def:gread>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:oread datatype="boolean">false</unix-def:oread>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_sshd_pub_key_0_mode_0644or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_sshd_private_key_0_mode_0600or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gread datatype="boolean">false</unix-def:gread>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:oread datatype="boolean">false</unix-def:oread>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_library_dirs_3_mode_7755or_stricter_:ste:1" version="3">
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_library_dirs_2_mode_7755or_stricter_:ste:1" version="3">
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_library_dirs_1_mode_7755or_stricter_:ste:1" version="3">
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_library_dirs_0_mode_7755or_stricter_:ste:1" version="3">
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:password_state id="oval:ssg-state_file_permissions_home_dirs_interactive_uids:ste:1" version="1">
                <unix-def:user_id operation="greater than or equal" datatype="int">1000</unix-def:user_id>
              </unix-def:password_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_home_dirs_dirs:ste:1" version="1">
                <unix-def:type>directory</unix-def:type>
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:oread datatype="boolean">false</unix-def:oread>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_grub2_cfg_0_mode_0600or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gread datatype="boolean">false</unix-def:gread>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:oread datatype="boolean">false</unix-def:oread>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_etc_shadow_0_mode_0000or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:uread datatype="boolean">false</unix-def:uread>
                <unix-def:uwrite datatype="boolean">false</unix-def:uwrite>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gread datatype="boolean">false</unix-def:gread>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:oread datatype="boolean">false</unix-def:oread>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_etc_passwd_0_mode_0644or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_etc_motd_0_mode_0644or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_etc_issue_0_mode_0644or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_etc_gshadow_0_mode_0000or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:uread datatype="boolean">false</unix-def:uread>
                <unix-def:uwrite datatype="boolean">false</unix-def:uwrite>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gread datatype="boolean">false</unix-def:gread>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:oread datatype="boolean">false</unix-def:oread>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_etc_group_0_mode_0644or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_etc_audit_rulesd_0_mode_0640or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:oread datatype="boolean">false</unix-def:oread>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_etc_audit_auditd_0_mode_0640or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:oread datatype="boolean">false</unix-def:oread>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_efi_grub2_cfg_0_mode_0700or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:gread datatype="boolean">false</unix-def:gread>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:oread datatype="boolean">false</unix-def:oread>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_backup_etc_shadow_0_mode_0000or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:uread datatype="boolean">false</unix-def:uread>
                <unix-def:uwrite datatype="boolean">false</unix-def:uwrite>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gread datatype="boolean">false</unix-def:gread>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:oread datatype="boolean">false</unix-def:oread>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_backup_etc_passwd_0_mode_0644or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_backup_etc_gshadow_0_mode_0000or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:uread datatype="boolean">false</unix-def:uread>
                <unix-def:uwrite datatype="boolean">false</unix-def:uwrite>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gread datatype="boolean">false</unix-def:gread>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:oread datatype="boolean">false</unix-def:oread>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_backup_etc_group_0_mode_0644or_stricter_:ste:1" version="3">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_ownership_library_dirs_uid_0_3:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_ownership_library_dirs_uid_0_2:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_ownership_library_dirs_uid_0_1:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_ownership_library_dirs_uid_0_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_ownership_audit_configuration_uid_0_1:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_ownership_audit_configuration_uid_0_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_3:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_2:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_1:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_5:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_4:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_3:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_2:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_1:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_var_log_uid_0_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_var_log_syslog_uid_104_0:ste:1" version="1">
                <unix-def:user_id datatype="int">104</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_var_log_messages_uid_0_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_grub2_cfg_uid_0_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_etc_shadow_uid_0_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_etc_passwd_uid_0_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_etc_motd_uid_0_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_etc_issue_uid_0_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_etc_gshadow_uid_0_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_etc_group_uid_0_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_efi_grub2_cfg_uid_0_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_backup_etc_shadow_uid_0_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_backup_etc_passwd_uid_0_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_backup_etc_gshadow_uid_0_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_backup_etc_group_uid_0_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupownership_audit_configuration_gid_0_1:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupownership_audit_configuration_gid_0_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_gid_0_3:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_gid_0_2:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_gid_0_1:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_gid_0_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_gid_0_3:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_gid_0_2:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_gid_0_1:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_gid_0_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_var_log_syslog_gid_4_0:ste:1" version="1">
                <unix-def:group_id datatype="int">4</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_var_log_messages_gid_0_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_var_log_gid_0_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_grub2_cfg_gid_0_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_etc_shadow_gid_0_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_etc_passwd_gid_0_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_etc_motd_gid_0_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_etc_issue_gid_0_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_etc_gshadow_gid_0_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_etc_group_gid_0_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_efi_grub2_cfg_gid_0_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_backup_etc_shadow_gid_0_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_backup_etc_passwd_gid_0_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_backup_etc_gshadow_gid_0_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_backup_etc_group_gid_0_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_etc_selinux_config:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_selinux_state:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_etc_profile_tmout:ste:1" version="2">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_accounts_tmout:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:variable_state id="oval:ssg-state_etc_passwd_no_duplicate_user_names:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-variable_count_of_unique_usernames_from_etc_passwd:var:1" var_check="at least one"/>
              </ind-def:variable_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_etc_default_useradd_inactive_nonnegative:ste:1" version="1">
                <ind-def:subexpression operation="greater than" datatype="int">-1</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_etc_default_useradd_inactive:ste:1" version="1">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_account_disable_post_pw_expiration:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:environmentvariable58_state id="oval:ssg-state_ends_colon_period:ste:1" version="1" comment="ends with colon or period">
                <ind-def:value operation="pattern match">[:\.]$</ind-def:value>
              </ind-def:environmentvariable58_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_enable_dracut_fips_module:ste:1" version="1">
                <ind-def:subexpression>fips</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_dnf-automatic_security_updates_only:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^security$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_dnf-automatic_apply_updates:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:variable_state id="oval:ssg-state_distro_db_is_up_to_date:ste:1" version="1">
                <ind-def:value operation="less than or equal" datatype="int" var_ref="oval:ssg-var_dconf_distro_keyfiles_modified_time:var:1" var_check="all"/>
              </ind-def:variable_state>
              <unix-def:symlink_state id="oval:ssg-state_disable_xwindows_runlevel_target:ste:1" version="1" comment="default.target is linked to multi-user.target">
                <unix-def:filepath>/etc/systemd/system/default.target</unix-def:filepath>
                <unix-def:canonical_path operation="pattern match">^(/usr)?/lib/systemd/system/multi-user.target$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_disable_host_auth_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_disable_host_auth:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <unix-def:symlink_state id="oval:ssg-state_disable_ctrlaltdel_exists:ste:1" version="1" comment="Disable Ctrl-Alt-Del key sequence override exists">
                <unix-def:filepath>/etc/systemd/system/ctrl-alt-del.target</unix-def:filepath>
                <unix-def:canonical_path>/dev/null</unix-def:canonical_path>
              </unix-def:symlink_state>
              <lin-def:partition_state id="oval:ssg-state_dev_shm_partition_nosuid_optional_no:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nosuid</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_dev_shm_partition_noexec_optional_no:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">noexec</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_dev_shm_partition_nodev_optional_no:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nodev</lin-def:mount_options>
              </lin-def:partition_state>
              <unix-def:file_state id="oval:ssg-state_dev_proc_sys_dirs:ste:1" version="1">
                <unix-def:filepath operation="pattern match">^\/(dev|proc|sys)\/.*$</unix-def:filepath>
              </unix-def:file_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_default_os_user:ste:1" version="1" comment="The user root is always allowed as default opering system user">
                <ind-def:subexpression operation="pattern match">^root$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_dconf_gnome_lock_screen_on_smartcard_removal:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^'lock-screen'$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_dconf_gnome_disable_user_admin:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^true$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:variable_state id="oval:ssg-state_crypto_current_file_newer_than_config_file:ste:1" version="1">
                <ind-def:value operation="less than or equal" datatype="int" var_ref="oval:ssg-variable_crypto_policies_current_file_timestamp:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_count_of_privileged_commands_having_audit_definition_augenrules:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-variable_count_of_privileged_commands_having_audit_definition_augenrules:var:1" var_check="at least one"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_count_of_privileged_commands_having_audit_definition_auditctl:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-variable_count_of_privileged_commands_having_audit_definition_auditctl:var:1" var_check="at least one"/>
              </ind-def:variable_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?:.*\s)?selinux=0(?:\s.*)?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?:.*\s)?selinux=0(?:\s.*)?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?:.*\s)?selinux=0(?:\s.*)?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_coredump_disable_storage:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?i)none(?-i)$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_coredump_disable_backtraces:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?i)0(?-i)$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_core_dumps_limitsconf:ste:1" version="1">
                <ind-def:subexpression>0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_core_dumps_limits_d:ste:1" version="1">
                <ind-def:subexpression>0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:environmentvariable58_state id="oval:ssg-state_contains_relative_path:ste:1" version="1" comment="elements begin with a slash">
                <ind-def:value operation="pattern match">[^\\]:[^/]</ind-def:value>
              </ind-def:environmentvariable58_state>
              <ind-def:environmentvariable58_state id="oval:ssg-state_contains_double_period:ste:1" version="1" comment="period twice in a row">
                <ind-def:value operation="pattern match">\.\.</ind-def:value>
              </ind-def:environmentvariable58_state>
              <ind-def:environmentvariable58_state id="oval:ssg-state_contains_double_colon:ste:1" version="1" comment="colon twice in a row">
                <ind-def:value operation="pattern match">::</ind-def:value>
              </ind-def:environmentvariable58_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_configure_usbguard_auditbackend:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^LinuxAudit$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_configure_opensc_card_drivers:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_smartcard_drivers:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_configure_crypto_policy_current:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_system_crypto_policy:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_configure_crypto_policy:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_system_crypto_policy:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_chronyd_run_as_chrony_user:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^["]?.*-u chrony.*["]?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_chronyd_port_value_0:ste:1" version="1">
                <ind-def:subexpression>0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_chronyd_cmdport_value_0:ste:1" version="1">
                <ind-def:subexpression>0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <lin-def:rpminfo_state id="oval:ssg-state_centos7:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_centos6:ste:1" version="1">
                <lin-def:version operation="pattern match">^6.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_bootloader_uefi_superuser_differ_from_other_users:ste:1" version="1">
                <ind-def:subexpression operation="not equal" var_ref="oval:ssg-var_uefi_user_accounts:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_bootloader_superuser_differ_from_other_users:ste:1" version="1">
                <ind-def:subexpression operation="not equal" var_ref="oval:ssg-var_user_accounts:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_bootloader_disable_recovery_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^true|"true"$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <lin-def:partition_state id="oval:ssg-state_boot_partition_nosuid_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nosuid</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_boot_partition_noexec_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">noexec</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_boot_partition_nodev_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nodev</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_boot_partition_noauto_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">noauto</lin-def:mount_options>
              </lin-def:partition_state>
              <unix-def:file_state id="oval:ssg-state_block_or_char_device_file:ste:1" version="1" comment="device files">
                <unix-def:type operation="pattern match">^(block|character) special$</unix-def:type>
              </unix-def:file_state>
              <ind-def:environmentvariable58_state id="oval:ssg-state_begins_slash:ste:1" version="1" comment="begins with a slash">
                <ind-def:value operation="pattern match">^[^/]</ind-def:value>
              </ind-def:environmentvariable58_state>
              <ind-def:environmentvariable58_state id="oval:ssg-state_begins_colon_period:ste:1" version="1" comment="starts with colon or period">
                <ind-def:value operation="pattern match">^[:\.]</ind-def:value>
              </ind-def:environmentvariable58_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_banner_etc_motd:ste:1" version="1">
                <ind-def:subexpression operation="pattern match" var_ref="oval:ssg-login_banner_text:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_banner_etc_issue:ste:1" version="1">
                <ind-def:subexpression operation="pattern match" var_ref="oval:ssg-login_banner_text:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_write_logs:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?i)yes(?-i)$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_overflow_action:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?i)(syslog|single|halt)(?-i)$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_name_format:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?i)hostname(?-i)$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_log_format:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?i)ENRICHED(?-i)$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_local_events:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?i)yes(?-i)$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_freq:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?i)50(?-i)$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_space_left_percentage:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_auditd_space_left_percentage:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_space_left_action:ste:1" version="2">
                <ind-def:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_space_left_action:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_num_logs:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_auditd_num_logs:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_max_log_file_action:ste:1" version="1">
                <ind-def:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_max_log_file_action:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_max_log_file:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_auditd_max_log_file:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_flush:ste:1" version="1">
                <ind-def:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_flush:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_admin_space_left_action:ste:1" version="1">
                <ind-def:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_admin_space_left_action:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_action_mail_acct:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_auditd_action_mail_acct:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_data_disk_full_action:ste:1" version="1">
                <ind-def:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_disk_full_action:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_data_disk_error_action:ste:1" version="1">
                <ind-def:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_disk_error_action:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_audispd_configure_remote_server:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_audispd_remote_server:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_audit_rules_privileged_commands:ste:1" version="1">
                <ind-def:subexpression operation="pattern match" var_ref="oval:ssg-variable_all_privileged_commands:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_aide_check_attributes:ste:1" version="1">
                <ind-def:subexpression>p+i+n+u+g+s+b+acl+selinux+xattrs+sha512</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <unix-def:file_state id="oval:ssg-state_accounts_root_path_dirs_wrong_perms:ste:1" version="1" operator="OR" comment="group or other has write privilege">
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_accounts_root_path_dirs_symlink:ste:1" version="1" comment="symbolic link">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_accounts_root_gid_zero:ste:1" version="1" comment="root account's gid is equal to 0">
                <ind-def:subexpression datatype="int">0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_accounts_passwords_pam_faillock_unlock_time_parameter_lower_bound:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_accounts_passwords_pam_faillock_interval_parameter_lower_bound:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_accounts_passwords_pam_faillock_deny_parameter_upper_bound:ste:1" version="1">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_accounts_passwords_pam_faillock_deny_parameter_lower_bound:ste:1" version="1">
                <ind-def:subexpression operation="greater than" datatype="int">0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_accounts_password_pam_unix_remember:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_unix_remember:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_accounts_password_pam_pwhistory_remember_system_auth:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_remember:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_accounts_password_pam_pwhistory_remember_password_auth:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_remember:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <unix-def:shadow_state id="oval:ssg-state_accounts_password_all_shadowed_sha512:ste:1" version="1">
                <unix-def:encrypt_method>SHA-512</unix-def:encrypt_method>
              </unix-def:shadow_state>
              <unix-def:shadow_state id="oval:ssg-state_accounts_password_all_shadowed_has_no_password:ste:1" version="1">
                <unix-def:password operation="pattern match">^(!|!!|\*)$</unix-def:password>
              </unix-def:shadow_state>
              <unix-def:password_state id="oval:ssg-state_accounts_password_all_shadowed:ste:1" version="1">
                <unix-def:password operation="pattern match">^[x*]$</unix-def:password>
              </unix-def:password_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_accounts_logon_fail_delay:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_accounts_fail_delay:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_accounts_authorized_local_users:ste:1" version="1" comment="authorized usernames required by the installed software groups and applications">
                <ind-def:subexpression operation="pattern match" var_ref="oval:ssg-var_accounts_authorized_local_users_regex:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <unix-def:file_state id="oval:ssg-file_permissions_unowned_userid_list_match:ste:1" version="1">
                <unix-def:user_id datatype="int" var_ref="oval:ssg-file_permissions_unowned_userid_list:var:1" var_check="at least one"/>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-exclude_symlinks_dir_permissions_library_dirs:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-exclude_symlinks__var_log_syslog:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-exclude_symlinks__var_log_messages:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-exclude_symlinks__var_log:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-exclude_symlinks__sshd_pub_key:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-exclude_symlinks__sshd_private_key:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-exclude_symlinks__library_dirs:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-exclude_symlinks__grub2_cfg:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-exclude_symlinks__etc_shadow:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-exclude_symlinks__etc_passwd:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-exclude_symlinks__etc_motd:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-exclude_symlinks__etc_issue:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-exclude_symlinks__etc_gshadow:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-exclude_symlinks__etc_group:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-exclude_symlinks__etc_audit_rulesd:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-exclude_symlinks__etc_audit_auditd:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-exclude_symlinks__efi_grub2_cfg:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-exclude_symlinks__backup_etc_shadow:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-exclude_symlinks__backup_etc_passwd:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-exclude_symlinks__backup_etc_gshadow:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-exclude_symlinks__backup_etc_group:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
            </states>
            <variables>
              <local_variable id="oval:ssg-variable_uid_min_value:var:1" version="1" datatype="int" comment="Value of last UID_MIN from /etc/login.defs">
                <regex_capture pattern="UID_MIN[\s]+(\d+)">
                  <object_component object_ref="oval:ssg-object_last_uid_min_from_etc_login_defs:obj:1" item_field="subexpression"/>
                </regex_capture>
              </local_variable>
              <local_variable id="oval:ssg-variable_sys_uid_min_value:var:1" version="1" datatype="int" comment="Value of last SYS_UID_MIN from /etc/login.defs">
                <regex_capture pattern="SYS_UID_MIN[\s]+(\d+)">
                  <object_component object_ref="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1" item_field="subexpression"/>
                </regex_capture>
              </local_variable>
              <local_variable id="oval:ssg-variable_sys_uid_max_value:var:1" version="1" datatype="int" comment="Value of last SYS_UID_MAX from /etc/login.defs">
                <regex_capture pattern="SYS_UID_MAX[\s]+(\d+)">
                  <object_component object_ref="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1" item_field="subexpression"/>
                </regex_capture>
              </local_variable>
              <local_variable id="oval:ssg-variable_smart_card_required_system_auth:var:1" version="1" datatype="string" comment="Regular expressiion to check if smartcard authentication is required in /etc/pam.d/system-auth">
                <concat>
                  <literal_component>\nauth[\s]+required[\s]+pam_env.so</literal_component>
                  <literal_component>\nauth[\s]+\[success=1[\s]default=ignore\][\s]pam_succeed_if.so[\s]service[\s]notin[\s]</literal_component>
                  <literal_component>login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kscreensaver[\s]quiet[\s]use_uid</literal_component>
                  <literal_component>\nauth[\s]+\[success=done[\s]ignore=ignore[\s]default=die\][\s]</literal_component>
                  <literal_component>pam_pkcs11.so[\s]nodebug[\s]wait_for_card\n</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-variable_smart_card_required_smartcard_auth:var:1" version="1" datatype="string" comment="Regular expression to check if smartcard authentication is required in /etc/pam.d/smartcard-auth">
                <concat>
                  <literal_component>\nauth[\s]+required[\s]+pam_env.so.*</literal_component>
                  <literal_component>\nauth[\s]+\[success=done[\s]ignore=ignore[\s]default=die\][\s]</literal_component>
                  <literal_component>pam_pkcs11.so[\s]nodebug[\s]wait_for_card\n.*</literal_component>
                  <literal_component>\npassword[\s]+required[\s]+pam_pkcs11.so\n</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-variable_smart_card_enabled_system_auth:var:1" version="1" datatype="string" comment="Regular expression to check if smartcard authentication is enabled in /etc/pam.d/system-auth">
                <concat>
                  <literal_component>\nauth[\s]+required[\s]+pam_env.so</literal_component>
                  <literal_component>\nauth[\s]+\[success=1[\s]default=ignore\][\s]pam_succeed_if.so[\s]service[\s]notin[\s]</literal_component>
                  <literal_component>login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kscreensaver[\s]quiet[\s]use_uid</literal_component>
                  <literal_component>\nauth[\s]+\[success=done[\s]authinfo_unavail=ignore[\s]ignore=ignore[\s]default=die\][\s]</literal_component>
                  <literal_component>pam_pkcs11.so[\s]nodebug\n</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_nosuid:var:1" version="1" datatype="string" comment="Regular expression pattern for removable block special device other than CD / DVD drive">
                <concat>
                  <literal_component>^[\s]*</literal_component>
                  <variable_component var_ref="oval:ssg-var_removable_partition:var:1"/>
                  <literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_noexec:var:1" version="1" datatype="string" comment="Regular expression pattern for removable block special device other than CD / DVD drive">
                <concat>
                  <literal_component>^[\s]*</literal_component>
                  <variable_component var_ref="oval:ssg-var_removable_partition:var:1"/>
                  <literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_nodev:var:1" version="1" datatype="string" comment="Regular expression pattern for removable block special device other than CD / DVD drive">
                <concat>
                  <literal_component>^[\s]*</literal_component>
                  <variable_component var_ref="oval:ssg-var_removable_partition:var:1"/>
                  <literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-variable_last_pass_warn_age_instance_value:var:1" version="1" datatype="int" comment="The value of last PASS_WARN_AGE directive in /etc/login.defs">
                <regex_capture pattern="PASS_WARN_AGE\s+(\d+)">
                  <object_component object_ref="oval:ssg-object_last_pass_warn_age_from_etc_login_defs:obj:1" item_field="subexpression"/>
                </regex_capture>
              </local_variable>
              <local_variable id="oval:ssg-variable_last_pass_min_len_instance_value:var:1" version="1" datatype="int" comment="The value of last PASS_MIN_LEN directive in /etc/login.defs">
                <regex_capture pattern="PASS_MIN_LEN\s+(\d+)">
                  <object_component object_ref="oval:ssg-object_last_pass_min_len_from_etc_login_defs:obj:1" item_field="subexpression"/>
                </regex_capture>
              </local_variable>
              <local_variable id="oval:ssg-variable_last_pass_min_days_instance_value:var:1" version="1" datatype="int" comment="The value of last PASS_MIN_DAYS directive in /etc/login.defs">
                <regex_capture pattern="PASS_MIN_DAYS\s+(\d+)">
                  <object_component object_ref="oval:ssg-object_last_pass_min_days_from_etc_login_defs:obj:1" item_field="subexpression"/>
                </regex_capture>
              </local_variable>
              <local_variable id="oval:ssg-variable_last_pass_max_days_instance_value:var:1" version="1" datatype="int" comment="The value of last PASS_MAX_DAYS directive in /etc/login.defs">
                <regex_capture pattern="PASS_MAX_DAYS\s+(\d+)">
                  <object_component object_ref="oval:ssg-object_last_pass_max_days_from_etc_login_defs:obj:1" item_field="subexpression"/>
                </regex_capture>
              </local_variable>
              <local_variable id="oval:ssg-variable_last_encrypt_method_instance_value:var:1" version="1" datatype="string" comment="The value of last ENCRYPT_METHOD directive in /etc/login.defs">
                <regex_capture pattern="ENCRYPT_METHOD\s+(\w+)">
                  <object_component object_ref="oval:ssg-object_last_encrypt_method_from_etc_login_defs:obj:1" item_field="subexpression"/>
                </regex_capture>
              </local_variable>
              <local_variable id="oval:ssg-variable_file_permissions_ungroupowned:var:1" version="1" datatype="int" comment="all GIDs on the target system">
                <object_component object_ref="oval:ssg-etc_group_object:obj:1" item_field="subexpression"/>
              </local_variable>
              <local_variable id="oval:ssg-variable_dev_device_files:var:1" version="1" datatype="string" comment="all device files within /dev directory">
                <object_component object_ref="oval:ssg-object_dev_device_files:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-variable_crypto_policies_current_file_timestamp:var:1" version="1" datatype="int" comment="Age of /etc/crypto-policies/state/current">
                <object_component object_ref="oval:ssg-crypto_policies_current_file:obj:1" item_field="m_time"/>
              </local_variable>
              <local_variable id="oval:ssg-variable_crypto_policies_config_file_timestamp:var:1" version="1" datatype="int" comment="Age of /etc/crypto-policies/config">
                <object_component object_ref="oval:ssg-crypto_policies_config_file:obj:1" item_field="m_time"/>
              </local_variable>
              <local_variable id="oval:ssg-variable_count_of_unique_usernames_from_etc_passwd:var:1" version="1" datatype="int" comment="Count of unique username rows retrieved from /etc/passwd">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_etc_passwd_content:obj:1" item_field="subexpression"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-variable_count_of_unique_uids:var:1" version="1" datatype="int" comment="Count of unique uids">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-obj_all_uids:obj:1" item_field="user_id"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-variable_count_of_unique_group_names:var:1" version="1" datatype="int" comment="Count of unique group names">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-obj_all_group_names:obj:1" item_field="subexpression"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-variable_count_of_unique_group_ids:var:1" version="1" datatype="int" comment="Count of unique group ids">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-obj_all_group_ids:obj:1" item_field="subexpression"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-variable_count_of_suid_sgid_binaries_on_system:var:1" version="1" datatype="int" comment="count of suid / sgid binaries actually present on the system">
                <count>
                  <object_component object_ref="oval:ssg-object_system_privileged_commands:obj:1" item_field="filepath"/>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-variable_count_of_privileged_commands_having_audit_definition_augenrules:var:1" version="1" datatype="int" comment="count of suid / sgid binaries having full audit rule definition in some of /etc/audit/rules.d/*.rules files">
                <count>
                  <object_component object_ref="oval:ssg-object_arpc_suid_sgid_augenrules:obj:1" item_field="subexpression"/>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-variable_count_of_privileged_commands_having_audit_definition_auditctl:var:1" version="1" datatype="int" comment="count of suid / sgid binaries having full audit rule definition in /etc/audit/audit.rules file">
                <count>
                  <object_component object_ref="oval:ssg-object_arpc_suid_sgid_auditctl:obj:1" item_field="subexpression"/>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1" version="1" datatype="int" comment="Count of all username rows retrieved from /etc/passwd (including duplicates if any)">
                <count>
                  <object_component object_ref="oval:ssg-object_etc_passwd_content:obj:1" item_field="subexpression"/>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-variable_count_of_all_uids:var:1" version="1" datatype="int" comment="Count of all uids (including duplicates if any)">
                <count>
                  <object_component object_ref="oval:ssg-obj_all_uids:obj:1" item_field="user_id"/>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-variable_count_of_all_group_names:var:1" version="1" datatype="int" comment="Count of all group names (including duplicates if any)">
                <count>
                  <object_component object_ref="oval:ssg-obj_all_group_names:obj:1" item_field="subexpression"/>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-variable_count_of_all_group_ids:var:1" version="1" datatype="int" comment="Count of all group ids (including duplicates if any)">
                <count>
                  <object_component object_ref="oval:ssg-obj_all_group_ids:obj:1" item_field="subexpression"/>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-variable_cd_dvd_drive_regex_pattern_nosuid:var:1" version="1" datatype="string" comment="Regular expression pattern for CD / DVD drive alternative names">
                <concat>
                  <literal_component>^[\s]*</literal_component>
                  <variable_component var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names_nosuid:var:1"/>
                  <literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-variable_cd_dvd_drive_regex_pattern_noexec:var:1" version="1" datatype="string" comment="Regular expression pattern for CD / DVD drive alternative names">
                <concat>
                  <literal_component>^[\s]*</literal_component>
                  <variable_component var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names_noexec:var:1"/>
                  <literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-variable_cd_dvd_drive_regex_pattern_nodev:var:1" version="1" datatype="string" comment="Regular expression pattern for CD / DVD drive alternative names">
                <concat>
                  <literal_component>^[\s]*</literal_component>
                  <variable_component var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names_nodev:var:1"/>
                  <literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</literal_component>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-variable_cd_dvd_drive_alternative_names_nosuid:var:1" version="1" datatype="string" comment="CD/DVD drive alternative names whitelist">
                <value>/dev/cdrom</value>
                <value>/dev/dvd</value>
                <value>/dev/scd0</value>
                <value>/dev/sr0</value>
              </constant_variable>
              <constant_variable id="oval:ssg-variable_cd_dvd_drive_alternative_names_noexec:var:1" version="1" datatype="string" comment="CD/DVD drive alternative names whitelist">
                <value>/dev/cdrom</value>
                <value>/dev/dvd</value>
                <value>/dev/scd0</value>
                <value>/dev/sr0</value>
              </constant_variable>
              <constant_variable id="oval:ssg-variable_cd_dvd_drive_alternative_names_nodev:var:1" version="1" datatype="string" comment="CD/DVD drive alternative names whitelist">
                <value>/dev/cdrom</value>
                <value>/dev/dvd</value>
                <value>/dev/scd0</value>
                <value>/dev/sr0</value>
              </constant_variable>
              <constant_variable id="oval:ssg-variable_cd_dvd_drive_alternative_names:var:1" version="1" datatype="string" comment="CD/DVD drive alternative names whitelist">
                <value>/dev/cdrom</value>
                <value>/dev/dvd</value>
                <value>/dev/scd0</value>
                <value>/dev/sr0</value>
              </constant_variable>
              <local_variable id="oval:ssg-variable_all_privileged_commands:var:1" version="1" datatype="string" comment="All privileged commands">
                <object_component object_ref="oval:ssg-object_system_privileged_commands:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-variable_aide_operational_database_absolute_path:var:1" version="1" datatype="string" comment="Absolute path of Aide build database file">
                <concat>
                  <object_component object_ref="oval:ssg-object_aide_build_database_dirpath:obj:1" item_field="subexpression"/>
                  <literal_component>/</literal_component>
                  <object_component object_ref="oval:ssg-object_aide_operational_database_filename:obj:1" item_field="subexpression"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-variable_aide_build_new_database_absolute_path:var:1" version="1" datatype="string" comment="Absolute path of Aide build database file">
                <concat>
                  <object_component object_ref="oval:ssg-object_aide_build_database_dirpath:obj:1" item_field="subexpression"/>
                  <literal_component>/</literal_component>
                  <object_component object_ref="oval:ssg-object_aide_build_new_database_filename:obj:1" item_field="subexpression"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_user_accounts:var:1" version="1" datatype="string" comment="Variable           including all system usernames">
                <object_component object_ref="oval:ssg-object_user_accounts:obj:1" item_field="username"/>
              </local_variable>
              <local_variable id="oval:ssg-var_umask_for_daemons_umask_as_number:var:1" version="1" datatype="int" comment="var_umask_for_daemons umask converted from string to a number">
                <arithmetic arithmetic_operation="add">
                  <arithmetic arithmetic_operation="multiply">
                    <literal_component datatype="int">64</literal_component>
                    <variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_var_umask_for_daemons:var:1"/>
                  </arithmetic>
                  <arithmetic arithmetic_operation="multiply">
                    <literal_component datatype="int">8</literal_component>
                    <variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_var_umask_for_daemons:var:1"/>
                  </arithmetic>
                  <variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_var_umask_for_daemons:var:1"/>
                </arithmetic>
              </local_variable>
              <external_variable id="oval:ssg-var_umask_for_daemons:var:1" version="1" datatype="string" comment="Value of var_umask_for_daemons (the required umask) as string"/>
              <local_variable id="oval:ssg-var_uefi_user_accounts:var:1" version="1" datatype="string" comment="Variable           including all system usernames">
                <object_component object_ref="oval:ssg-object_uefi_user_accounts:obj:1" item_field="username"/>
              </local_variable>
              <external_variable id="oval:ssg-var_time_service_set_maxpoll:var:1" version="1" datatype="int" comment="maxpoll value"/>
              <local_variable id="oval:ssg-var_third_digit_of_umask_from_var_umask_for_daemons:var:1" version="1" datatype="int" comment="Third octal digit of umask from var_umask_for_daemons">
                <substring substring_start="3" substring_length="1">
                  <variable_component var_ref="oval:ssg-var_umask_for_daemons:var:1"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_third_digit_of_umask_from_var_accounts_user_umask:var:1" version="1" datatype="int" comment="Third octal digit of umask from var_accounts_user_umask">
                <substring substring_start="3" substring_length="1">
                  <variable_component var_ref="oval:ssg-var_accounts_user_umask:var:1"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_profile:var:1" version="1" datatype="int" comment="Third octal digit of umask from /etc/profile">
                <substring substring_start="3" substring_length="1">
                  <object_component object_ref="oval:ssg-obj_umask_from_etc_profile:obj:1" item_field="subexpression"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_login_defs:var:1" version="1" datatype="int" comment="Third octal digit of umask from /etc/login.defs">
                <substring substring_start="3" substring_length="1">
                  <object_component object_ref="oval:ssg-obj_umask_from_etc_login_defs:obj:1" item_field="subexpression"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_init_d_functions:var:1" version="1" datatype="int" comment="Third octal digit of umask from /etc/init.d/functions">
                <substring substring_start="3" substring_length="1">
                  <object_component object_ref="oval:ssg-obj_umask_from_etc_init_d_functions:obj:1" item_field="subexpression"/>
                </substring>
              </local_variable>
              <external_variable id="oval:ssg-var_system_crypto_policy:var:1" version="1" datatype="string" comment="defined crypto policy"/>
              <local_variable id="oval:ssg-var_system_auth_default_hashing_rounds:var:1" version="1" datatype="int" comment="Default number of password hashing rounds">
                <literal_component>5000</literal_component>
              </local_variable>
              <local_variable id="oval:ssg-var_symlink_kerberos_crypto_policy_configuration:var:1" version="1" datatype="string" comment="regex variable for canonical path to targeted kerberos policy">
                <object_component object_ref="oval:ssg-object_kerberos_crypto_policy_configuration:obj:1" item_field="canonical_path"/>
              </local_variable>
              <local_variable id="oval:ssg-var_symlink_kerberos_crypto_policy_backend:var:1" version="1" datatype="string" comment="regex variable for canonical path to targeted kerberos policy">
                <object_component object_ref="oval:ssg-object_kerberos_crypto_policy_backend:obj:1" item_field="canonical_path"/>
              </local_variable>
              <external_variable id="oval:ssg-var_sudo_logfile:var:1" version="1" datatype="string" comment="Variable value for sudo logfile "/>
              <external_variable id="oval:ssg-var_sssd_ssh_known_hosts_timeout:var:1" version="1" datatype="int" comment="var_sssd_ssh_known_hosts_timeout value"/>
              <external_variable id="oval:ssg-var_sssd_memcache_timeout:var:1" version="1" datatype="int" comment="memcache_timeout value"/>
              <external_variable id="oval:ssg-var_sssd_certificate_verification_digest_function:var:1" version="1" datatype="string" comment="certificate_verification value"/>
              <external_variable id="oval:ssg-var_sshd_set_login_grace_time:var:1" version="1" datatype="int" comment="logingracetime value"/>
              <external_variable id="oval:ssg-var_sshd_set_keepalive:var:1" version="1" datatype="int" comment="ClientAliveCountMax value"/>
              <external_variable id="oval:ssg-var_sshd_priv_separation:var:1" version="1" datatype="string" comment="external variable for the desired value of UsePrivilegeSeparation"/>
              <external_variable id="oval:ssg-var_sshd_max_sessions:var:1" version="1" datatype="int" comment="maxsessions value"/>
              <external_variable id="oval:ssg-var_sshd_disable_compression:var:1" version="1" datatype="string" comment="external variable for the desired value of Compression"/>
              <external_variable id="oval:ssg-var_spec_store_bypass_disable_options:var:1" version="1" datatype="string" comment="Variable defining the value the argument should have"/>
              <external_variable id="oval:ssg-var_smartcard_drivers:var:1" version="1" datatype="string" comment="external variable for opensc smartcard drivers"/>
              <external_variable id="oval:ssg-var_slub_debug_options:var:1" version="1" datatype="string" comment="Variable defining the value the argument should have"/>
              <external_variable id="oval:ssg-var_selinux_state:var:1" version="1" datatype="string" comment="external variable for selinux state"/>
              <external_variable id="oval:ssg-var_selinux_policy_name:var:1" version="1" datatype="string" comment="External variable: name of selinux policy in /etc/selinux/config"/>
              <local_variable id="oval:ssg-var_second_digit_of_umask_from_var_umask_for_daemons:var:1" version="1" datatype="int" comment="Second octal digit of umask from var_umask_for_daemons">
                <substring substring_start="2" substring_length="1">
                  <variable_component var_ref="oval:ssg-var_umask_for_daemons:var:1"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_second_digit_of_umask_from_var_accounts_user_umask:var:1" version="1" datatype="int" comment="Second octal digit of umask from var_accounts_user_umask">
                <substring substring_start="2" substring_length="1">
                  <variable_component var_ref="oval:ssg-var_accounts_user_umask:var:1"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_profile:var:1" version="1" datatype="int" comment="Second octal digit of umask from /etc/profile">
                <substring substring_start="2" substring_length="1">
                  <object_component object_ref="oval:ssg-obj_umask_from_etc_profile:obj:1" item_field="subexpression"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_login_defs:var:1" version="1" datatype="int" comment="Second octal digit of umask from /etc/login.defs">
                <substring substring_start="2" substring_length="1">
                  <object_component object_ref="oval:ssg-obj_umask_from_etc_login_defs:obj:1" item_field="subexpression"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_init_d_functions:var:1" version="1" datatype="int" comment="Second octal digit of umask from /etc/init.d/functions">
                <substring substring_start="2" substring_length="1">
                  <object_component object_ref="oval:ssg-obj_umask_from_etc_init_d_functions:obj:1" item_field="subexpression"/>
                </substring>
              </local_variable>
              <external_variable id="oval:ssg-var_screensaver_lock_delay:var:1" version="1" datatype="int" comment="screensaver lock delay variable"/>
              <external_variable id="oval:ssg-var_rng_core_default_quality:var:1" version="1" datatype="string" comment="Variable defining the value the argument should have"/>
              <local_variable id="oval:ssg-var_rfp_syslog_config:var:1" version="1" datatype="string" comment="Locations of all rsyslog configuration files as collection">
                <literal_component>^/etc/rsyslog.conf$</literal_component>
              </local_variable>
              <local_variable id="oval:ssg-var_rfp_log_files_paths:var:1" version="1" datatype="string" comment="File paths of all rsyslog configuration files">
                <object_component object_ref="oval:ssg-object_rfp_log_files_paths:obj:1" item_field="subexpression"/>
              </local_variable>
              <local_variable id="oval:ssg-var_rfp_include_config_regex:var:1" version="1" datatype="string" comment="$IncludeConfig value converted to regex">
                <unique>
                  <glob_to_regex glob_noescape="false">
                    <object_component object_ref="oval:ssg-object_rfp_rsyslog_include_config_value:obj:1" item_field="subexpression"/>
                  </glob_to_regex>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-var_rfp_all_log_files:var:1" version="1" datatype="string" comment="Locations of all rsyslog configuration files as collection">
                <object_component object_ref="oval:ssg-object_var_rfp_all_log_files:obj:1" item_field="value"/>
              </local_variable>
              <local_variable id="oval:ssg-var_rfo_syslog_config:var:1" version="1" datatype="string" comment="Locations of all rsyslog configuration files as collection">
                <literal_component>^/etc/rsyslog.conf$</literal_component>
              </local_variable>
              <local_variable id="oval:ssg-var_rfo_log_files_paths:var:1" version="1" datatype="string" comment="File paths of all rsyslog configuration files">
                <object_component object_ref="oval:ssg-object_rfo_log_files_paths:obj:1" item_field="subexpression"/>
              </local_variable>
              <local_variable id="oval:ssg-var_rfo_include_config_regex:var:1" version="1" datatype="string" comment="$IncludeConfig value converted to regex">
                <unique>
                  <glob_to_regex glob_noescape="false">
                    <object_component object_ref="oval:ssg-object_rfo_rsyslog_include_config_value:obj:1" item_field="subexpression"/>
                  </glob_to_regex>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-var_rfo_all_log_files:var:1" version="1" datatype="string" comment="Locations of all rsyslog configuration files as collection">
                <object_component object_ref="oval:ssg-object_var_rfo_all_log_files:obj:1" item_field="value"/>
              </local_variable>
              <local_variable id="oval:ssg-var_rfg_syslog_config:var:1" version="1" datatype="string" comment="Locations of all rsyslog configuration files as collection">
                <literal_component>^/etc/rsyslog.conf$</literal_component>
              </local_variable>
              <local_variable id="oval:ssg-var_rfg_log_files_paths:var:1" version="1" datatype="string" comment="File paths of all rsyslog configuration files">
                <object_component object_ref="oval:ssg-object_rfg_log_files_paths:obj:1" item_field="subexpression"/>
              </local_variable>
              <local_variable id="oval:ssg-var_rfg_include_config_regex:var:1" version="1" datatype="string" comment="$IncludeConfig value converted to regex">
                <unique>
                  <glob_to_regex glob_noescape="false">
                    <object_component object_ref="oval:ssg-object_rfg_rsyslog_include_config_value:obj:1" item_field="subexpression"/>
                  </glob_to_regex>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-var_rfg_all_log_files:var:1" version="1" datatype="string" comment="Locations of all rsyslog configuration files as collection">
                <object_component object_ref="oval:ssg-object_var_rfg_all_log_files:obj:1" item_field="value"/>
              </local_variable>
              <external_variable id="oval:ssg-var_removable_partition:var:1" version="1" datatype="string" comment="removable partition"/>
              <external_variable id="oval:ssg-var_rekey_limit_time:var:1" version="1" datatype="string" comment="Time component of the rekey limit"/>
              <external_variable id="oval:ssg-var_rekey_limit_size:var:1" version="1" datatype="string" comment="Size component of the rekey limit"/>
              <external_variable id="oval:ssg-var_postfix_root_mail_alias:var:1" version="1" datatype="string" comment="expected email alias"/>
              <external_variable id="oval:ssg-var_password_pam_unix_rounds:var:1" version="1" datatype="int" comment="number of passwords hashing rounds"/>
              <external_variable id="oval:ssg-var_password_pam_unix_remember:var:1" version="1" datatype="int" comment="number of passwords that should be remembered"/>
              <external_variable id="oval:ssg-var_password_pam_ucredit:var:1" version="3" datatype="int" comment="External variable for pam_ucredit"/>
              <external_variable id="oval:ssg-var_password_pam_retry:var:1" version="1" datatype="int" comment="External variable for pam_pwquality retry"/>
              <external_variable id="oval:ssg-var_password_pam_remember_control_flag:var:1" version="1" datatype="string" comment="control flag for pwhistory module"/>
              <external_variable id="oval:ssg-var_password_pam_remember:var:1" version="1" datatype="int" comment="number of passwords that should be remembered"/>
              <external_variable id="oval:ssg-var_password_pam_ocredit:var:1" version="3" datatype="int" comment="External variable for pam_ocredit"/>
              <external_variable id="oval:ssg-var_password_pam_minlen:var:1" version="3" datatype="int" comment="External variable for pam_minlen"/>
              <external_variable id="oval:ssg-var_password_pam_minclass:var:1" version="3" datatype="int" comment="External variable for pam_minclass"/>
              <external_variable id="oval:ssg-var_password_pam_maxrepeat:var:1" version="3" datatype="int" comment="External variable for pam_maxrepeat"/>
              <external_variable id="oval:ssg-var_password_pam_maxclassrepeat:var:1" version="3" datatype="int" comment="External variable for pam_maxclassrepeat"/>
              <external_variable id="oval:ssg-var_password_pam_lcredit:var:1" version="3" datatype="int" comment="External variable for pam_lcredit"/>
              <external_variable id="oval:ssg-var_password_pam_difok:var:1" version="3" datatype="int" comment="External variable for pam_difok"/>
              <external_variable id="oval:ssg-var_password_pam_dictcheck:var:1" version="3" datatype="int" comment="External variable for pam_dictcheck"/>
              <external_variable id="oval:ssg-var_password_pam_dcredit:var:1" version="3" datatype="int" comment="External variable for pam_dcredit"/>
              <external_variable id="oval:ssg-var_password_hashing_algorithm:var:1" version="1" datatype="string" comment="defined hashing algorithm"/>
              <local_variable id="oval:ssg-var_password_auth_default_hashing_rounds:var:1" version="1" datatype="int" comment="Default number of password hashing rounds">
                <literal_component>5000</literal_component>
              </local_variable>
              <constant_variable id="oval:ssg-var_pam_pwquality_config_path:var:1" version="1" datatype="string" comment="correct path for pam_pwquality.so check">
                <value>/etc/pam.d/system-auth</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_mount_option_var_tmp_bind_var_tmp_source_device:var:1" version="1" datatype="string" comment="Source device of /var/tmp">
                <object_component object_ref="oval:ssg-object_mount_option_var_tmp:obj:1" item_field="device"/>
              </local_variable>
              <external_variable id="oval:ssg-var_mount_option_proc_hidepid:var:1" version="1" datatype="string" comment="Variable defining the value the argument should have"/>
              <external_variable id="oval:ssg-var_mds_options:var:1" version="1" datatype="string" comment="Variable defining the value the argument should have"/>
              <external_variable id="oval:ssg-var_l1tf_options:var:1" version="1" datatype="string" comment="Variable defining the value the argument should have"/>
              <external_variable id="oval:ssg-var_kernel_config_panic_timeout:var:1" version="1" datatype="string" comment="Value for kernel CONFIG_PANIC_TIMEOUT setting"/>
              <external_variable id="oval:ssg-var_kernel_config_module_sig_key:var:1" version="1" datatype="string" comment="Value for kernel CONFIG_MODULE_SIG_KEY setting"/>
              <external_variable id="oval:ssg-var_kernel_config_module_sig_hash:var:1" version="1" datatype="string" comment="Value for kernel CONFIG_MODULE_SIG_HASH setting"/>
              <local_variable id="oval:ssg-var_gid_passwd_group_same:var:1" version="1" datatype="string" comment="GIDs from /etc/group">
                <object_component object_ref="oval:ssg-object_gid_passwd_group_same_var:obj:1" item_field="subexpression"/>
              </local_variable>
              <local_variable id="oval:ssg-var_first_digit_of_umask_from_var_umask_for_daemons:var:1" version="1" datatype="int" comment="First octal digit of umask from var_umask_for_daemons">
                <substring substring_start="1" substring_length="1">
                  <variable_component var_ref="oval:ssg-var_umask_for_daemons:var:1"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_first_digit_of_umask_from_var_accounts_user_umask:var:1" version="1" datatype="int" comment="First octal digit of umask from var_accounts_user_umask">
                <substring substring_start="1" substring_length="1">
                  <variable_component var_ref="oval:ssg-var_accounts_user_umask:var:1"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_profile:var:1" version="1" datatype="int" comment="First octal digit of umask from /etc/profile">
                <substring substring_start="1" substring_length="1">
                  <object_component object_ref="oval:ssg-obj_umask_from_etc_profile:obj:1" item_field="subexpression"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_login_defs:var:1" version="1" datatype="int" comment="First octal digit of umask from /etc/login.defs">
                <substring substring_start="1" substring_length="1">
                  <object_component object_ref="oval:ssg-obj_umask_from_etc_login_defs:obj:1" item_field="subexpression"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_init_d_functions:var:1" version="1" datatype="int" comment="First octal digit of umask from /etc/init.d/functions">
                <substring substring_start="1" substring_length="1">
                  <object_component object_ref="oval:ssg-obj_umask_from_etc_init_d_functions:obj:1" item_field="subexpression"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_file_permissions_unauthorized_suid_rpms:var:1" version="1" datatype="string" comment="all files with suid set that come from a RPM package">
                <object_component object_ref="oval:ssg-obj_file_permissions_unauthorized_suid_rpms:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-var_file_permissions_unauthorized_suid_all:var:1" version="1" datatype="string" comment="all files with suid set">
                <object_component object_ref="oval:ssg-obj_file_permissions_unauthorized_suid_files:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-var_file_permissions_unauthorized_sgid_rpms:var:1" version="1" datatype="string" comment="all files with sgid set that come from a RPM package">
                <object_component object_ref="oval:ssg-obj_file_permissions_unauthorized_sgid_rpms:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-var_file_permissions_unauthorized_sgid_all:var:1" version="1" datatype="string" comment="all files with sgid set">
                <object_component object_ref="oval:ssg-obj_file_permissions_unauthorized_sgid_files:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-var_file_permissions_home_dirs_dirs:var:1" version="1" datatype="string" comment="Variable including all home dirs from interactive users">
                <object_component object_ref="oval:ssg-object_file_permissions_home_dirs_objects:obj:1" item_field="home_dir"/>
              </local_variable>
              <local_variable id="oval:ssg-var_etc_profile_umask_as_number:var:1" version="1" datatype="int" comment="/etc/profile umask converted from string to a number">
                <arithmetic arithmetic_operation="add">
                  <arithmetic arithmetic_operation="multiply">
                    <literal_component datatype="int">64</literal_component>
                    <variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_profile:var:1"/>
                  </arithmetic>
                  <arithmetic arithmetic_operation="multiply">
                    <literal_component datatype="int">8</literal_component>
                    <variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_profile:var:1"/>
                  </arithmetic>
                  <variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_profile:var:1"/>
                </arithmetic>
              </local_variable>
              <local_variable id="oval:ssg-var_etc_login_defs_umask_as_number:var:1" version="1" datatype="int" comment="/etc/login.defs umask converted from string to a number">
                <arithmetic arithmetic_operation="add">
                  <arithmetic arithmetic_operation="multiply">
                    <literal_component datatype="int">64</literal_component>
                    <variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_login_defs:var:1"/>
                  </arithmetic>
                  <arithmetic arithmetic_operation="multiply">
                    <literal_component datatype="int">8</literal_component>
                    <variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_login_defs:var:1"/>
                  </arithmetic>
                  <variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_login_defs:var:1"/>
                </arithmetic>
              </local_variable>
              <local_variable id="oval:ssg-var_etc_init_d_functions_umask_as_number:var:1" version="1" datatype="int" comment="/etc/init.d/functions umask converted from string to a number">
                <arithmetic arithmetic_operation="add">
                  <arithmetic arithmetic_operation="multiply">
                    <literal_component datatype="int">64</literal_component>
                    <variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_init_d_functions:var:1"/>
                  </arithmetic>
                  <arithmetic arithmetic_operation="multiply">
                    <literal_component datatype="int">8</literal_component>
                    <variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_init_d_functions:var:1"/>
                  </arithmetic>
                  <variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_init_d_functions:var:1"/>
                </arithmetic>
              </local_variable>
              <local_variable id="oval:ssg-var_dconf_local_keyfiles_modified_time:var:1" version="1" datatype="int" comment="When dconf keyfiles in the 'local' tree have been modified">
                <time_difference format_2="seconds_since_epoch">
                  <object_component object_ref="oval:ssg-obj_dconf_local_config:obj:1" item_field="m_time"/>
                </time_difference>
              </local_variable>
              <local_variable id="oval:ssg-var_dconf_local_db_modified_time:var:1" version="1" datatype="string" comment="When the 'local' dconf DB has been modified">
                <time_difference format_2="seconds_since_epoch">
                  <object_component object_ref="oval:ssg-obj_dconf_local_db:obj:1" item_field="m_time"/>
                </time_difference>
              </local_variable>
              <local_variable id="oval:ssg-var_dconf_distro_keyfiles_modified_time:var:1" version="1" datatype="int" comment="When dconf keyfiles in the 'distro' tree have been modified">
                <time_difference format_2="seconds_since_epoch">
                  <object_component object_ref="oval:ssg-obj_dconf_distro_config:obj:1" item_field="m_time"/>
                </time_difference>
              </local_variable>
              <local_variable id="oval:ssg-var_dconf_distro_db_modified_time:var:1" version="1" datatype="string" comment="When the 'distro' dconf DB has been modified">
                <time_difference format_2="seconds_since_epoch">
                  <object_component object_ref="oval:ssg-obj_dconf_distro_db:obj:1" item_field="m_time"/>
                </time_difference>
              </local_variable>
              <external_variable id="oval:ssg-var_auditd_space_left_percentage:var:1" version="1" datatype="int" comment="audit space_left setting"/>
              <external_variable id="oval:ssg-var_auditd_space_left_action:var:1" version="2" datatype="string" comment="audit space_left_action setting"/>
              <external_variable id="oval:ssg-var_auditd_num_logs:var:1" version="1" datatype="int" comment="audit num_logs setting"/>
              <external_variable id="oval:ssg-var_auditd_max_log_file_action:var:1" version="1" datatype="string" comment="audit max_log_file_action setting"/>
              <external_variable id="oval:ssg-var_auditd_max_log_file:var:1" version="1" datatype="int" comment="audit max_log_file setting"/>
              <external_variable id="oval:ssg-var_auditd_flush:var:1" version="1" datatype="string" comment="audit flush setting"/>
              <external_variable id="oval:ssg-var_auditd_disk_full_action:var:1" version="1" datatype="string" comment="audit disk_full_action setting"/>
              <external_variable id="oval:ssg-var_auditd_disk_error_action:var:1" version="1" datatype="string" comment="audit disk_error_action setting"/>
              <external_variable id="oval:ssg-var_auditd_admin_space_left_action:var:1" version="1" datatype="string" comment="audit admin_space_left_action setting"/>
              <external_variable id="oval:ssg-var_auditd_action_mail_acct:var:1" version="1" datatype="string" comment="audit action_mail_acct setting"/>
              <constant_variable id="oval:ssg-var_audit_rule_openat_order_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_order_64bit_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_order_64bit_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_order_32bit_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_order_32bit_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_openat_o_trunc_separator_regex:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>(?:[^.]|\.\s)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit openat O_TRUNC EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit openat O_TRUNC EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat O_TRUNC EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat O_TRUNC EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_openat_o_creat_separator_regex:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>(?:[^.]|\.\s)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_openat_o_creat_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat O_CREAT EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit openat O_CREAT EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_openat_o_creat_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat O_CREAT EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat O_CREAT EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_order_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_order_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_order_64bit_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_order_64bit_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_order_64bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_order_64bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_order_64bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_order_64bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_order_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_order_32bit_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_order_32bit_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_order_32bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_order_32bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_order_32bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_order_32bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_o_trunc_separator_regex:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>(?:[^.]|\.\s)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_o_trunc_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open O_TRUNC EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open O_TRUNC EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_o_trunc_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open O_TRUNC EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open O_TRUNC EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_o_creat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_o_creat_separator_regex:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>(?:[^.]|\.\s)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_o_creat_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open O_CREAT EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open O_CREAT EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_o_creat_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open O_CREAT EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open O_CREAT EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_separator_regex:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>(?:[^.]|\.\s)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open_by_handle_at O_TRUNC EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open_by_handle_at O_TRUNC EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at O_TRUNC EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at O_TRUNC EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_separator_regex:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>(?:[^.]|\.\s)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at O_CREAT EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open_by_handle_at O_CREAT EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at O_CREAT EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at O_CREAT EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_access_var_log_audit_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+dir=/var/log/audit/)[\s]+(?:-F[\s]+perm=r)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_64bit_openat_write_tc_shadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_64bit_openat_write_tc_passwd_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_64bit_openat_write_tc_gshadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_64bit_openat_write_tc_group_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_64bit_open_write_tc_shadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_64bit_open_write_tc_passwd_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_64bit_open_write_tc_gshadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_64bit_open_write_tc_group_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_shadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_passwd_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_gshadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_group_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_32bit_openat_write_tc_shadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_32bit_openat_write_tc_passwd_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_32bit_openat_write_tc_gshadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_32bit_openat_write_tc_group_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_32bit_open_write_tc_shadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_32bit_open_write_tc_passwd_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_32bit_open_write_tc_gshadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_32bit_open_write_tc_group_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_shadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_passwd_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_gshadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_group_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <external_variable id="oval:ssg-var_audispd_remote_server:var:1" version="1" datatype="string" comment="audispd remote_server setting"/>
              <constant_variable id="oval:ssg-var_arufm_unlinkat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_unlink_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_truncate_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_setxattr_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_64bit_openat_eperm_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_64bit_openat_eacces_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_64bit_openat_auditctl_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_64bit_open_eperm_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_64bit_open_eacces_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_eperm_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_eacces_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_auditctl_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_64bit_open_auditctl_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_32bit_openat_eperm_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_32bit_openat_eacces_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_32bit_openat_auditctl_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_32bit_openat_auditctl_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_eperm_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_eacces_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_eperm_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_eacces_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_auditctl_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_auditctl_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_auditctl_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_auditctl_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_arufm_renameat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_rename_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_removexattr_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_openat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_arufm_openat_order_64bit_auditctl_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_arufm_open_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_arufm_open_order_64bit_auditctl_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_arufm_open_by_handle_at_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_arufm_open_by_handle_at_order_64bit_auditctl_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_arufm_lsetxattr_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_lremovexattr_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_lchown_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_ftruncate_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_fsetxattr_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_fremovexattr_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_fchownat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_fchown_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_fchmodat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_fchmod_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_creat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_chown_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_chmod_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_accounts_user_umask_umask_as_number:var:1" version="1" datatype="int" comment="var_accounts_user_umask umask converted from string to a number">
                <arithmetic arithmetic_operation="add">
                  <arithmetic arithmetic_operation="multiply">
                    <literal_component datatype="int">64</literal_component>
                    <variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_var_accounts_user_umask:var:1"/>
                  </arithmetic>
                  <arithmetic arithmetic_operation="multiply">
                    <literal_component datatype="int">8</literal_component>
                    <variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_var_accounts_user_umask:var:1"/>
                  </arithmetic>
                  <variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_var_accounts_user_umask:var:1"/>
                </arithmetic>
              </local_variable>
              <external_variable id="oval:ssg-var_accounts_user_umask:var:1" version="1" datatype="string" comment="Value of var_accounts_user_umask (the required umask) as string"/>
              <external_variable id="oval:ssg-var_accounts_tmout:var:1" version="1" datatype="int" comment="external variable for TMOUT"/>
              <local_variable id="oval:ssg-var_accounts_root_path_dirs_no_write:var:1" version="1" datatype="string" comment="Split the PATH on the : delimiter">
                <split delimiter=":">
                  <object_component object_ref="oval:ssg-object_accounts_root_path_dirs_no_write_pathenv:obj:1" item_field="value"/>
                </split>
              </local_variable>
              <constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_unix_regex:var:1" version="1" datatype="string" comment="regex to identify pam_unix.so in auth section of pam files">
                <value>^[\s]*auth\N+pam_unix\.so</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_unlock_time_parameter_regex:var:1" version="1" datatype="string" comment="regex to identify pam_faillock.so unlock_time entry in auth section of pam files">
                <value>^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*unlock_time=([0-9]+)</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_auth_regex:var:1" version="1" datatype="string" comment="regex to identify pam_faillock.so entries in auth section of pam files">
                <value>^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_account_regex:var:1" version="1" datatype="string" comment="regex to identify pam_faillock.so entry in account section of pam files">
                <value>^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_faillock_conf_unlock_time_parameter_regex:var:1" version="1" datatype="string" comment="regex to identify unlock_time entry in /etc/security/faillock.conf">
                <value>^[\s]*unlock_time[\s]*=[\s]*([0-9]+)</value>
              </constant_variable>
              <external_variable id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1" version="1" datatype="int" comment="number of failed login attempts allowed"/>
              <constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_unix_regex:var:1" version="1" datatype="string" comment="regex to identify pam_unix.so in auth section of pam files">
                <value>^[\s]*auth\N+pam_unix\.so</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_fail_interval_parameter_regex:var:1" version="1" datatype="string" comment="regex to identify pam_faillock.so fail_interval entry in auth section of pam files">
                <value>^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*fail_interval=([0-9]+)</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_auth_regex:var:1" version="1" datatype="string" comment="regex to identify pam_faillock.so entries in auth section of pam files">
                <value>^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_account_regex:var:1" version="1" datatype="string" comment="regex to identify pam_faillock.so entry in account section of pam files">
                <value>^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_interval_faillock_conf_fail_interval_parameter_regex:var:1" version="1" datatype="string" comment="regex to identify fail_interval entry in /etc/security/faillock.conf">
                <value>^[\s]*fail_interval[\s]*=[\s]*([0-9]+)</value>
              </constant_variable>
              <external_variable id="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1" version="1" datatype="int" comment="number of failed login attempts allowed"/>
              <constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_enforce_local_pam_unix_regex:var:1" version="1" datatype="string" comment="regex to identify pam_unix.so in auth section of pam files">
                <value>^[\s]*auth\N+pam_unix\.so</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_enforce_local_pam_faillock_auth_regex:var:1" version="1" datatype="string" comment="regex to identify pam_faillock.so entries in auth section of pam files">
                <value>^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_enforce_local_pam_faillock_account_regex:var:1" version="1" datatype="string" comment="regex to identify pam_faillock.so entry in account section of pam files">
                <value>^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_enforce_local_faillock_conf_parameter_regex:var:1" version="1" datatype="string" comment="regex to identify deny entry in /etc/security/faillock.conf">
                <value>^[\s]*local_users_only</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_unix_regex:var:1" version="1" datatype="string" comment="regex to identify pam_unix.so in auth section of pam files">
                <value>^[\s]*auth\N+pam_unix\.so</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_parameter_regex:var:1" version="1" datatype="string" comment="regex to identify pam_faillock.so deny entry in auth section of pam files">
                <value>^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*even_deny_root</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_auth_regex:var:1" version="1" datatype="string" comment="regex to identify pam_faillock.so entries in auth section of pam files">
                <value>^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_account_regex:var:1" version="1" datatype="string" comment="regex to identify pam_faillock.so entry in account section of pam files">
                <value>^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_faillock_conf_parameter_regex:var:1" version="1" datatype="string" comment="regex to identify deny entry in /etc/security/faillock.conf">
                <value>^[\s]*even_deny_root</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_unix_regex:var:1" version="1" datatype="string" comment="regex to identify pam_unix.so in auth section of pam files">
                <value>^[\s]*auth\N+pam_unix\.so</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_deny_parameter_regex:var:1" version="1" datatype="string" comment="regex to identify pam_faillock.so deny entry in auth section of pam files">
                <value>^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*deny=([0-9]+)</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_auth_regex:var:1" version="1" datatype="string" comment="regex to identify pam_faillock.so entries in auth section of pam files">
                <value>^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_account_regex:var:1" version="1" datatype="string" comment="regex to identify pam_faillock.so entry in account section of pam files">
                <value>^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_faillock_conf_deny_parameter_regex:var:1" version="1" datatype="string" comment="regex to identify deny entry in /etc/security/faillock.conf">
                <value>^[\s]*deny[\s]*=[\s]*([0-9]+)</value>
              </constant_variable>
              <external_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1" version="1" datatype="int" comment="number of failed login attempts allowed"/>
              <external_variable id="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" version="1" datatype="int" comment="password expiration warning age in days"/>
              <external_variable id="oval:ssg-var_accounts_password_minlen_login_defs:var:1" version="1" datatype="int" comment="Password minimum length"/>
              <external_variable id="oval:ssg-var_accounts_minimum_age_login_defs:var:1" version="1" datatype="int" comment="Minimum password age in days"/>
              <external_variable id="oval:ssg-var_accounts_maximum_age_login_defs:var:1" version="1" datatype="int" comment="Maximum password age"/>
              <external_variable id="oval:ssg-var_accounts_max_concurrent_login_sessions:var:1" version="1" datatype="int" comment="maximum number of concurrent logins per user"/>
              <external_variable id="oval:ssg-var_accounts_fail_delay:var:1" version="1" datatype="int" comment="Expected fail_delay"/>
              <external_variable id="oval:ssg-var_accounts_authorized_local_users_regex:var:1" version="1" datatype="string" comment="accounts authorized local users on operating system"/>
              <external_variable id="oval:ssg-var_account_disable_post_pw_expiration:var:1" version="1" datatype="int" comment="inactive days expiration"/>
              <constant_variable id="oval:ssg-var_64bit_arufm_unlinkat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_unlink_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_truncate_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_setxattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_renameat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_rename_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_removexattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_openat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_open_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_open_by_handle_at_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_lsetxattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_lremovexattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_lchown_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_ftruncate_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_fsetxattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_fremovexattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_fchownat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_fchown_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_fchmodat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_fchmod_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_unlinkat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit unlinkat EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_unlinkat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_unlinkat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_unlink_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit unlink EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_unlink_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_unlink_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_truncate_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit truncate EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_truncate_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_truncate_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_setxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit setxattr EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_setxattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_setxattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_renameat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit renameat EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_renameat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_renameat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_rename_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit rename EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_rename_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_rename_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_removexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit removexattr EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_removexattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_removexattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_openat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit openat EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_openat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_openat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_open_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_open_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_open_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_open_by_handle_at_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open_by_handle_at EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_open_by_handle_at_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_open_by_handle_at_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_lsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit lsetxattr EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_lsetxattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_lsetxattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_lremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit lremovexattr EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_lremovexattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_lremovexattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_lchown_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit lchown EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_lchown_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_lchown_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_ftruncate_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit ftruncate EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_ftruncate_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_ftruncate_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_fsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fsetxattr EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_fsetxattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fsetxattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_fremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fremovexattr EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_fremovexattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fremovexattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_fchownat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchownat EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_fchownat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchownat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_fchown_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchown EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_fchown_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchown_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_fchmodat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchmodat EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_fchmodat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchmodat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_fchmod_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchmod EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_fchmod_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchmod_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_creat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit creat EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_creat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_chown_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit chown EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_chown_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_chown_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_chmod_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit chmod EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_chmod_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_chmod_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_unlinkat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit unlinkat EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_unlinkat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_unlinkat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_unlink_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit unlink EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_unlink_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_unlink_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_truncate_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit truncate EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_truncate_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_truncate_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_setxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit setxattr EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_setxattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_setxattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_renameat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit renameat EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_renameat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_renameat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_rename_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit rename EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_rename_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_rename_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_removexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit removexattr EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_removexattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_removexattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_openat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit openat EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_openat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_openat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_open_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_open_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_open_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_open_by_handle_at_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open_by_handle_at EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_open_by_handle_at_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_open_by_handle_at_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_lsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit lsetxattr EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_lsetxattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_lsetxattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_lremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit lremovexattr EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_lremovexattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_lremovexattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_lchown_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit lchown EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_lchown_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_lchown_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_ftruncate_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit ftruncate EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_ftruncate_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_ftruncate_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_fsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fsetxattr EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_fsetxattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fsetxattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_fremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fremovexattr EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_fremovexattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fremovexattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_fchownat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchownat EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_fchownat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchownat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_fchown_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchown EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_fchown_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchown_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_fchmodat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchmodat EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_fchmodat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchmodat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_fchmod_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchmod EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_fchmod_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchmod_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_creat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit creat EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_creat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_chown_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit chown EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_chown_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_chown_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_chmod_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit chmod EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_chmod_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_chmod_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_creat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_chown_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_chmod_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_unlinkat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_unlink_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_truncate_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_setxattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_renameat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_rename_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_removexattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_openat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_open_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_open_by_handle_at_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_lsetxattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_lremovexattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_lchown_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_ftruncate_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_fsetxattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_fremovexattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_fchownat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_fchown_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_fchmodat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_fchmod_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_unlinkat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit unlinkat EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_unlinkat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_unlinkat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_unlink_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit unlink EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_unlink_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_unlink_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_truncate_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit truncate EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_truncate_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_truncate_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_setxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit setxattr EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_setxattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_setxattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_renameat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit renameat EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_renameat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_renameat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_rename_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit rename EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_rename_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_rename_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_removexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit removexattr EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_removexattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_removexattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_openat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_openat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_openat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_open_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_open_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_open_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_open_by_handle_at_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_open_by_handle_at_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_open_by_handle_at_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_lsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit lsetxattr EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_lsetxattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_lsetxattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_lremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit lremovexattr EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_lremovexattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_lremovexattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_lchown_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit lchown EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_lchown_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_lchown_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_ftruncate_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit ftruncate EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_ftruncate_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_ftruncate_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_fsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fsetxattr EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_fsetxattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fsetxattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_fremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fremovexattr EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_fremovexattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fremovexattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_fchownat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchownat EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_fchownat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchownat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_fchown_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchown EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_fchown_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchown_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_fchmodat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchmodat EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_fchmodat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchmodat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_fchmod_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchmod EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_fchmod_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchmod_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_creat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit creat EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_creat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_chown_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit chown EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_chown_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_chown_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_chmod_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit chmod EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_chmod_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_chmod_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_unlinkat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit unlinkat EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_unlinkat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_unlinkat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_unlink_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit unlink EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_unlink_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_unlink_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_truncate_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit truncate EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_truncate_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_truncate_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_setxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit setxattr EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_setxattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_setxattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_renameat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit renameat EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_renameat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_renameat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_rename_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit rename EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_rename_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_rename_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_removexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit removexattr EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_removexattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_removexattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_openat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_openat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_openat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_open_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_open_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_open_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_open_by_handle_at_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_open_by_handle_at_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_open_by_handle_at_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_lsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit lsetxattr EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_lsetxattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_lsetxattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_lremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit lremovexattr EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_lremovexattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_lremovexattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_lchown_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit lchown EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_lchown_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_lchown_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_ftruncate_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit ftruncate EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_ftruncate_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_ftruncate_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_fsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fsetxattr EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_fsetxattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fsetxattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_fremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fremovexattr EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_fremovexattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fremovexattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_fchownat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchownat EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_fchownat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchownat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_fchown_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchown EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_fchown_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchown_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_fchmodat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchmodat EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_fchmodat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchmodat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_fchmod_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchmod EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_fchmod_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchmod_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_creat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit creat EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_creat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_chown_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit chown EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_chown_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_chown_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_chmod_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit chmod EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_chmod_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_chmod_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_creat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_chown_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_chmod_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.router_solicitations"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.max_addresses"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_autoconf_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.autoconf"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.accept_redirects"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.accept_ra"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.accept_ra_rtr_pref"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.accept_ra_pinfo"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.accept_ra_defrtr"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.all.router_solicitations"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.all.max_addresses"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_autoconf_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.all.autoconf"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.all.accept_ra_rtr_pref"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.all.accept_ra_pinfo"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.all.accept_ra_defrtr"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.tcp_syncookies"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.icmp_ignore_bogus_error_responses"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.icmp_echo_ignore_broadcasts"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_conf_default_shared_media_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.default.shared_media"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.default.secure_redirects"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.default.rp_filter"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.default.log_martians"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.default.accept_source_route"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.default.accept_redirects"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_shared_media_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.all.shared_media"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.all.secure_redirects"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.all.rp_filter"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.all.log_martians"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_arp_ignore_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.all.arp_ignore"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_arp_filter_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.all.arp_filter"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.all.accept_source_route"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.all.accept_redirects"/>
              <external_variable id="oval:ssg-sysctl_kernel_kptr_restrict_value:var:1" version="1" datatype="int" comment="External variable for kernel.kptr_restrict"/>
              <external_variable id="oval:ssg-sshd_required:var:1" version="1" datatype="int" comment="May be defined by Profiles to explicitly say if sshd is required or not"/>
              <external_variable id="oval:ssg-sshd_max_auth_tries_value:var:1" version="1" datatype="int" comment="maxauthtries value"/>
              <local_variable id="oval:ssg-sshd_macs_crypto:var:1" version="1" datatype="string" comment="The regex of the directive">
                <concat>
                  <literal_component>MACs </literal_component>
                  <variable_component var_ref="oval:ssg-sshd_approved_macs:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-sshd_line_regex:var:1" version="1" datatype="string" comment="The regex of the directive">
                <concat>
                  <literal_component>^[\s]*RekeyLimit[\s]+</literal_component>
                  <variable_component var_ref="oval:ssg-var_rekey_limit_size:var:1"/>
                  <literal_component>[\s]+</literal_component>
                  <variable_component var_ref="oval:ssg-var_rekey_limit_time:var:1"/>
                  <literal_component>[\s]*$</literal_component>
                </concat>
              </local_variable>
              <external_variable id="oval:ssg-sshd_idle_timeout_value:var:1" version="1" datatype="int" comment="timeout value"/>
              <local_variable id="oval:ssg-sshd_ciphers_crypto:var:1" version="1" datatype="string" comment="The regex of the directive">
                <concat>
                  <literal_component>Ciphers </literal_component>
                  <variable_component var_ref="oval:ssg-sshd_approved_ciphers:var:1"/>
                </concat>
              </local_variable>
              <external_variable id="oval:ssg-sshd_approved_macs:var:1" version="1" datatype="string" comment="SSH Approved MACs by FIPS"/>
              <external_variable id="oval:ssg-sshd_approved_ciphers:var:1" version="1" datatype="string" comment="SSH Approved Ciphers by FIPS"/>
              <external_variable id="oval:ssg-rsyslog_remote_loghost_address:var:1" version="1" datatype="string" comment="used for remediation only"/>
              <local_variable id="oval:ssg-pwhistory_line_regex_system_auth:var:1" version="1" datatype="string" comment="The regex of the directive">
                <concat>
                  <literal_component>^\s*password\s+(?:</literal_component>
                  <variable_component var_ref="oval:ssg-var_password_pam_remember_control_flag:var:1"/>
                  <literal_component>)\s+pam_pwhistory\.so.*remember=([0-9]*).*$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-pwhistory_line_regex_password_auth:var:1" version="1" datatype="string" comment="The regex of the directive">
                <concat>
                  <literal_component>^\s*password\s+(?:</literal_component>
                  <variable_component var_ref="oval:ssg-var_password_pam_remember_control_flag:var:1"/>
                  <literal_component>)\s+pam_pwhistory\.so.*remember=([0-9]*).*$</literal_component>
                </concat>
              </local_variable>
              <external_variable id="oval:ssg-login_banner_text:var:1" version="1" datatype="string" comment="warning banner text variable"/>
              <local_variable id="oval:ssg-local_variable_counter_sudoers_passwd_n_files:var:1" version="1" datatype="int" comment="Items counter">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_test_sudoers_targetpw_config:obj:1" item_field="filepath"/>
                    <object_component object_ref="oval:ssg-object_test_sudoers_rootpw_config:obj:1" item_field="filepath"/>
                    <object_component object_ref="oval:ssg-object_test_sudoers_runaspw_config:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_vm_mmap_min_addr_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_vm_mmap_min_addr:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_user_max_user_namespaces_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_user_max_user_namespaces:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_router_solicitations_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_router_solicitations:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_max_addresses_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_max_addresses:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_disable_ipv6_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_disable_ipv6:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_autoconf_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_autoconf:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_accept_redirects_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_accept_redirects:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_accept_ra_pinfo_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_accept_ra_pinfo:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_accept_ra_defrtr_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_accept_ra_defrtr:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_default_accept_ra_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_default_accept_ra:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_router_solicitations_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_router_solicitations:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_max_addresses_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_max_addresses:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_disable_ipv6_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_disable_ipv6:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_autoconf_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_autoconf:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_accept_ra_pinfo_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_accept_ra_pinfo:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv6_conf_all_accept_ra_defrtr_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv6_conf_all_accept_ra_defrtr:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv4_tcp_syncookies_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_tcp_syncookies:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv4_ip_local_port_range_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_ip_local_port_range:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv4_ip_forward_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_ip_forward:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_shared_media_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_shared_media:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_send_redirects_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_send_redirects:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_secure_redirects_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_secure_redirects:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_rp_filter_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_rp_filter:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_log_martians_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_log_martians:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_accept_source_route_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_accept_source_route:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_default_accept_redirects_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_default_accept_redirects:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_shared_media_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_shared_media:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_send_redirects_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_send_redirects:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_secure_redirects_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_secure_redirects:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_rp_filter_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_rp_filter:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_route_localnet_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_route_localnet:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_log_martians_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_log_martians:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_arp_ignore_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_arp_ignore:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_arp_filter_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_arp_filter:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_accept_source_route_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_accept_source_route:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_accept_redirects_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_accept_redirects:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_ipv4_conf_all_accept_local_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_ipv4_conf_all_accept_local:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_net_core_bpf_jit_harden_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_net_core_bpf_jit_harden:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_kernel_yama_ptrace_scope_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_yama_ptrace_scope:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_kernel_unprivileged_bpf_disabled_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_unprivileged_bpf_disabled:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_kernel_sysrq_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_sysrq:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_kernel_randomize_va_space_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_randomize_va_space:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_kernel_pid_max_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_pid_max:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_kernel_perf_event_paranoid_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_perf_event_paranoid:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_kernel_perf_event_max_sample_rate_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_perf_event_max_sample_rate:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_kernel_perf_cpu_time_max_percent_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_perf_cpu_time_max_percent:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_kernel_panic_on_oops_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_panic_on_oops:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_kernel_modules_disabled_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_modules_disabled:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_kernel_kptr_restrict_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_kptr_restrict:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_kernel_kexec_load_disabled_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_kexec_load_disabled:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_kernel_dmesg_restrict_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_dmesg_restrict:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_kernel_core_pattern_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_kernel_core_pattern:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_fs_suid_dumpable_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_fs_suid_dumpable:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_fs_protected_symlinks_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_fs_protected_symlinks:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_fs_protected_regular_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_fs_protected_regular:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_fs_protected_hardlinks_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_fs_protected_hardlinks:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_unique_sysctl_fs_protected_fifos_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_static_set_sysctls_fs_protected_fifos:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_vm_mmap_min_addr:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_vm_mmap_min_addr_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_user_max_user_namespaces:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_user_max_user_namespaces_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv6_conf_default_router_solicitations:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv6_conf_default_router_solicitations_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv6_conf_default_max_addresses:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv6_conf_default_max_addresses_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv6_conf_default_disable_ipv6:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv6_conf_default_disable_ipv6_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv6_conf_default_autoconf:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv6_conf_default_autoconf_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv6_conf_default_accept_redirects:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv6_conf_default_accept_redirects_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv6_conf_default_accept_ra_rtr_pref:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv6_conf_default_accept_ra_rtr_pref_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv6_conf_default_accept_ra_pinfo:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv6_conf_default_accept_ra_pinfo_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv6_conf_default_accept_ra_defrtr:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv6_conf_default_accept_ra_defrtr_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv6_conf_default_accept_ra:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv6_conf_default_accept_ra_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv6_conf_all_router_solicitations:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv6_conf_all_router_solicitations_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv6_conf_all_max_addresses:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv6_conf_all_max_addresses_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv6_conf_all_disable_ipv6:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv6_conf_all_disable_ipv6_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv6_conf_all_autoconf:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv6_conf_all_autoconf_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv6_conf_all_accept_ra_rtr_pref:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv6_conf_all_accept_ra_rtr_pref_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv6_conf_all_accept_ra_pinfo:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv6_conf_all_accept_ra_pinfo_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv6_conf_all_accept_ra_defrtr:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv6_conf_all_accept_ra_defrtr_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv4_tcp_syncookies:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv4_tcp_syncookies_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv4_ip_local_port_range:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv4_ip_local_port_range_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv4_ip_forward:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv4_ip_forward_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv4_icmp_ignore_bogus_error_responses:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv4_icmp_ignore_bogus_error_responses_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv4_icmp_echo_ignore_broadcasts:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv4_icmp_echo_ignore_broadcasts_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv4_conf_default_shared_media:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv4_conf_default_shared_media_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv4_conf_default_send_redirects:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv4_conf_default_send_redirects_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv4_conf_default_secure_redirects:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv4_conf_default_secure_redirects_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv4_conf_default_rp_filter:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv4_conf_default_rp_filter_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv4_conf_default_log_martians:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv4_conf_default_log_martians_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv4_conf_default_accept_source_route:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv4_conf_default_accept_source_route_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv4_conf_default_accept_redirects:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv4_conf_default_accept_redirects_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv4_conf_all_shared_media:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv4_conf_all_shared_media_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv4_conf_all_send_redirects:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv4_conf_all_send_redirects_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv4_conf_all_secure_redirects:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv4_conf_all_secure_redirects_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv4_conf_all_rp_filter:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv4_conf_all_rp_filter_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv4_conf_all_route_localnet:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv4_conf_all_route_localnet_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv4_conf_all_log_martians:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv4_conf_all_log_martians_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv4_conf_all_drop_gratuitous_arp:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv4_conf_all_drop_gratuitous_arp_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv4_conf_all_arp_ignore:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv4_conf_all_arp_ignore_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv4_conf_all_arp_filter:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv4_conf_all_arp_filter_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv4_conf_all_accept_source_route:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv4_conf_all_accept_source_route_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv4_conf_all_accept_redirects:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv4_conf_all_accept_redirects_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_ipv4_conf_all_accept_local:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_ipv4_conf_all_accept_local_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_net_core_bpf_jit_harden:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_net_core_bpf_jit_harden_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_kernel_yama_ptrace_scope:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_kernel_yama_ptrace_scope_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_kernel_unprivileged_bpf_disabled:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_kernel_unprivileged_bpf_disabled_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_kernel_sysrq:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_kernel_sysrq_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_kernel_randomize_va_space:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_kernel_randomize_va_space_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_kernel_pid_max:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_kernel_pid_max_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_kernel_perf_event_paranoid:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_kernel_perf_event_paranoid_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_kernel_perf_event_max_sample_rate:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_kernel_perf_event_max_sample_rate_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_kernel_perf_cpu_time_max_percent:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_kernel_perf_cpu_time_max_percent_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_kernel_panic_on_oops:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_kernel_panic_on_oops_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_kernel_modules_disabled:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_kernel_modules_disabled_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_kernel_kptr_restrict:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_kernel_kptr_restrict_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_kernel_kexec_load_disabled:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_kernel_kexec_load_disabled_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_kernel_dmesg_restrict:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_kernel_dmesg_restrict_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_kernel_core_pattern:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_kernel_core_pattern_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_fs_suid_dumpable:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_fs_suid_dumpable_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_fs_protected_symlinks:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_fs_protected_symlinks_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_fs_protected_regular:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_fs_protected_regular_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_fs_protected_hardlinks:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_fs_protected_hardlinks_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_symlinks_fs_protected_fifos:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-object_fs_protected_fifos_symlinks:obj:1" item_field="filepath"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_vm_mmap_min_addr:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_vm_mmap_min_addr:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_user_max_user_namespaces:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_user_max_user_namespaces:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_router_solicitations:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_default_router_solicitations:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_max_addresses:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_default_max_addresses:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_disable_ipv6:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_default_disable_ipv6:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_autoconf:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_default_autoconf:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_accept_redirects:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_default_accept_redirects:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_accept_ra_rtr_pref:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_accept_ra_pinfo:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_default_accept_ra_pinfo:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_accept_ra_defrtr:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_default_accept_ra_defrtr:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_default_accept_ra:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_default_accept_ra:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_router_solicitations:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_all_router_solicitations:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_max_addresses:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_all_max_addresses:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_disable_ipv6:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_all_disable_ipv6:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_autoconf:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_all_autoconf:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_accept_ra_rtr_pref:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_accept_ra_pinfo:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_all_accept_ra_pinfo:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv6_conf_all_accept_ra_defrtr:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv6_conf_all_accept_ra_defrtr:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv4_tcp_syncookies:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_tcp_syncookies:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv4_ip_local_port_range:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_ip_local_port_range:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv4_ip_forward:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_ip_forward:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv4_icmp_ignore_bogus_error_responses:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv4_icmp_echo_ignore_broadcasts:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_shared_media:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_default_shared_media:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_send_redirects:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_default_send_redirects:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_secure_redirects:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_default_secure_redirects:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_rp_filter:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_default_rp_filter:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_log_martians:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_default_log_martians:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_accept_source_route:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_default_accept_source_route:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_default_accept_redirects:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_default_accept_redirects:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_shared_media:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_all_shared_media:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_send_redirects:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_all_send_redirects:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_secure_redirects:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_all_secure_redirects:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_rp_filter:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_all_rp_filter:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_route_localnet:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_all_route_localnet:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_log_martians:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_all_log_martians:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_drop_gratuitous_arp:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_arp_ignore:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_all_arp_ignore:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_arp_filter:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_all_arp_filter:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_accept_source_route:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_all_accept_source_route:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_accept_redirects:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_all_accept_redirects:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_ipv4_conf_all_accept_local:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_ipv4_conf_all_accept_local:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_net_core_bpf_jit_harden:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_net_core_bpf_jit_harden:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_kernel_yama_ptrace_scope:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_kernel_yama_ptrace_scope:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_kernel_unprivileged_bpf_disabled:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_kernel_unprivileged_bpf_disabled:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_kernel_sysrq:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_kernel_sysrq:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_kernel_randomize_va_space:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_kernel_randomize_va_space:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_kernel_pid_max:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_kernel_pid_max:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_kernel_perf_event_paranoid:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_kernel_perf_event_paranoid:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_kernel_perf_event_max_sample_rate:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_kernel_perf_event_max_sample_rate:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_kernel_perf_cpu_time_max_percent:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_kernel_perf_cpu_time_max_percent:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_kernel_panic_on_oops:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_kernel_panic_on_oops:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_kernel_modules_disabled:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_kernel_modules_disabled:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_kernel_kptr_restrict:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_kernel_kptr_restrict:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_kernel_kexec_load_disabled:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_kernel_kexec_load_disabled:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_kernel_dmesg_restrict:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_kernel_dmesg_restrict:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_kernel_core_pattern:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_kernel_core_pattern:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_fs_suid_dumpable:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_fs_suid_dumpable:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_fs_protected_symlinks:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_fs_protected_symlinks:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_fs_protected_regular:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_fs_protected_regular:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_fs_protected_hardlinks:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_fs_protected_hardlinks:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_safe_symlinks_fs_protected_fifos:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
                <unique>
                  <object_component object_ref="oval:ssg-var_object_symlink_fs_protected_fifos:obj:1" item_field="value"/>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-local_var_regex_spec_store_bypass_disable_var_spec_store_bypass_disable_options:var:1" version="1" datatype="string" comment="Regex that matches spec_store_bypass_disable with value var_spec_store_bypass_disable_options">
                <concat>
                  <literal_component>^(?:.*\s)?spec_store_bypass_disable=</literal_component>
                  <variable_component var_ref="oval:ssg-var_spec_store_bypass_disable_options:var:1"/>
                  <literal_component>(?:\s.*)?$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-local_var_regex_slub_debug_var_slub_debug_options:var:1" version="1" datatype="string" comment="Regex that matches slub_debug with value var_slub_debug_options">
                <concat>
                  <literal_component>^(?:.*\s)?slub_debug=</literal_component>
                  <variable_component var_ref="oval:ssg-var_slub_debug_options:var:1"/>
                  <literal_component>(?:\s.*)?$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-local_var_regex_rng_core_default_quality_var_rng_core_default_quality:var:1" version="1" datatype="string" comment="Regex that matches rng_core.default_quality with value var_rng_core_default_quality">
                <concat>
                  <literal_component>^(?:.*\s)?rng_core.default_quality=</literal_component>
                  <variable_component var_ref="oval:ssg-var_rng_core_default_quality:var:1"/>
                  <literal_component>(?:\s.*)?$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-local_var_regex_mds_var_mds_options:var:1" version="1" datatype="string" comment="Regex that matches mds with value var_mds_options">
                <concat>
                  <literal_component>^(?:.*\s)?mds=</literal_component>
                  <variable_component var_ref="oval:ssg-var_mds_options:var:1"/>
                  <literal_component>(?:\s.*)?$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-local_var_regex_l1tf_var_l1tf_options:var:1" version="1" datatype="string" comment="Regex that matches l1tf with value var_l1tf_options">
                <concat>
                  <literal_component>^(?:.*\s)?l1tf=</literal_component>
                  <variable_component var_ref="oval:ssg-var_l1tf_options:var:1"/>
                  <literal_component>(?:\s.*)?$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-local_var_mountoption_hidepid_with_value:var:1" version="1" datatype="string" comment="Value used in hidepid option as defined in var_mount_option_proc_hidepid variable">
                <concat>
                  <literal_component>hidepid=</literal_component>
                  <variable_component var_ref="oval:ssg-var_mount_option_proc_hidepid:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_x86_vsyscall_emulation_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_x86_vsyscall_emulation_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_x86_vsyscall_emulation_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_x86_vsyscall_emulation:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_vmap_stack_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_vmap_stack_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_vmap_stack_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_vmap_stack:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_unmap_kernel_at_el0_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_unmap_kernel_at_el0_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_unmap_kernel_at_el0_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_unmap_kernel_at_el0:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_syn_cookies_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_syn_cookies_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_syn_cookies_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_syn_cookies:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_strict_module_rwx_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_strict_module_rwx_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_strict_module_rwx_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_strict_module_rwx:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_strict_kernel_rwx_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_strict_kernel_rwx_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_strict_kernel_rwx_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_strict_kernel_rwx:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_stackprotector_strong_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_stackprotector_strong_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_stackprotector_strong_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_stackprotector_strong:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_stackprotector_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_stackprotector_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_stackprotector_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_stackprotector:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_slub_debug_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_slub_debug_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_slub_debug_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_slub_debug:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_slab_merge_default_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_slab_merge_default_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_slab_merge_default_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_slab_merge_default:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_slab_frelist_random_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_slab_frelist_random_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_slab_frelist_random_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_slab_frelist_random:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_slab_freelist_hardened_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_slab_freelist_hardened_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_slab_freelist_hardened_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_slab_freelist_hardened:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_security_yama_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_security_yama_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_security_yama_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_security_yama:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_security_writable_hooks_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_security_writable_hooks_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_security_writable_hooks_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_security_writable_hooks:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_security_dmesg_restrict_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_security_dmesg_restrict_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_security_dmesg_restrict_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_security_dmesg_restrict:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_security_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_security_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_security_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_security:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_seccomp_filter_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_seccomp_filter_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_seccomp_filter_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_seccomp_filter:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_seccomp_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_seccomp_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_seccomp_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_seccomp:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_sched_stack_end_check_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_sched_stack_end_check_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_sched_stack_end_check_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_sched_stack_end_check:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_retpoline_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_retpoline_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_retpoline_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_retpoline:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_refcount_full_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_refcount_full_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_refcount_full_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_refcount_full:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_randomize_memory_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_randomize_memory_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_randomize_memory_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_randomize_memory:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_randomize_base_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_randomize_base_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_randomize_base_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_randomize_base:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_proc_kcore_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_proc_kcore_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_proc_kcore_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_proc_kcore:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_panic_timeout_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_panic_timeout_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_panic_timeout_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_panic_timeout:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_panic_on_oops_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_panic_on_oops_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_panic_on_oops_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_panic_on_oops:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_page_table_isolation_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_page_table_isolation_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_page_table_isolation_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_page_table_isolation:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_page_poisoning_zero_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_page_poisoning_zero_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_page_poisoning_zero_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_page_poisoning_zero:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_page_poisoning_no_sanity_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_page_poisoning_no_sanity_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_page_poisoning_no_sanity_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_page_poisoning_no_sanity:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_page_poisoning_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_page_poisoning_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_page_poisoning_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_page_poisoning:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_module_sig_sha512_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_module_sig_sha512_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_module_sig_sha512_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_module_sig_sha512:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_module_sig_key_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_module_sig_key_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_module_sig_key_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_module_sig_key:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_module_sig_hash_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_module_sig_hash_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_module_sig_hash_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_module_sig_hash:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_module_sig_force_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_module_sig_force_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_module_sig_force_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_module_sig_force:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_module_sig_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_module_sig_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_module_sig_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_module_sig:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_module_sig_all_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_module_sig_all_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_module_sig_all_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_module_sig_all:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_modify_ldt_syscall_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_modify_ldt_syscall_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_modify_ldt_syscall_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_modify_ldt_syscall:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_legacy_vsyscall_xonly_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_xonly_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_legacy_vsyscall_xonly_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_xonly:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_legacy_vsyscall_none_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_none_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_legacy_vsyscall_none_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_none:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_legacy_vsyscall_emulate_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_emulate_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_legacy_vsyscall_emulate_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_emulate:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_legacy_ptys_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_legacy_ptys_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_legacy_ptys_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_legacy_ptys:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_kexec_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_kexec_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_kexec_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_kexec:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_ipv6_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_ipv6_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_ipv6_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_ipv6:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_ia32_emulation_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_ia32_emulation_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_ia32_emulation_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_ia32_emulation:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_hibernation_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_hibernation_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_hibernation_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_hibernation:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_hardened_usercopy_fallback_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_hardened_usercopy_fallback_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_hardened_usercopy_fallback_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_hardened_usercopy_fallback:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_hardened_usercopy_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_hardened_usercopy_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_hardened_usercopy_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_hardened_usercopy:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_gcc_plugin_structleak_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_structleak_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_gcc_plugin_structleak_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_structleak:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_gcc_plugin_structleak_byref_all_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_structleak_byref_all_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_gcc_plugin_structleak_byref_all_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_structleak_byref_all:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_gcc_plugin_stackleak_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_stackleak_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_gcc_plugin_stackleak_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_stackleak:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_gcc_plugin_randstruct_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_randstruct_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_gcc_plugin_randstruct_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_randstruct:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_gcc_plugin_latent_entropy_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_latent_entropy_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_gcc_plugin_latent_entropy_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_latent_entropy:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_fortify_source_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_fortify_source_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_fortify_source_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_fortify_source:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_devkmem_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_devkmem_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_devkmem_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_devkmem:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_default_mmap_min_addr_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_default_mmap_min_addr_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_default_mmap_min_addr_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_default_mmap_min_addr:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_debug_wx_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_debug_wx_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_debug_wx_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_debug_wx:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_debug_sg_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_debug_sg_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_debug_sg_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_debug_sg:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_debug_notifiers_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_debug_notifiers_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_debug_notifiers_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_debug_notifiers:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_debug_list_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_debug_list_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_debug_list_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_debug_list:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_debug_fs_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_debug_fs_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_debug_fs_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_debug_fs:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_debug_credentials_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_debug_credentials_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_debug_credentials_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_debug_credentials:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_compat_vdso_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_compat_vdso_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_compat_vdso_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_compat_vdso:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_compat_brk_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_compat_brk_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_compat_brk_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_compat_brk:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_bug_on_data_corruption_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_bug_on_data_corruption_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_bug_on_data_corruption_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_bug_on_data_corruption:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_bug_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_bug_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_bug_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_bug:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_binfmt_misc_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_binfmt_misc_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_binfmt_misc_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_binfmt_misc:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_arm64_sw_ttbr0_pan_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_arm64_sw_ttbr0_pan_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_arm64_sw_ttbr0_pan_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_arm64_sw_ttbr0_pan:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_acpi_custom_method_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_acpi_custom_method_files:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_config_acpi_custom_method_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_kernel_config_acpi_custom_method:obj:1" item_field="filepath"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_vm_mmap_min_addr:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_vm_mmap_min_addr:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_user_max_user_namespaces:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_user_max_user_namespaces:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv6_conf_default_router_solicitations:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_router_solicitations:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv6_conf_default_max_addresses:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_max_addresses:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv6_conf_default_disable_ipv6:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_disable_ipv6:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv6_conf_default_autoconf:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_autoconf:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv6_conf_default_accept_redirects:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_redirects:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv6_conf_default_accept_ra_rtr_pref:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv6_conf_default_accept_ra_pinfo:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_ra_pinfo:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv6_conf_default_accept_ra_defrtr:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_ra_defrtr:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv6_conf_default_accept_ra:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_default_accept_ra:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv6_conf_all_router_solicitations:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_router_solicitations:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv6_conf_all_max_addresses:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_max_addresses:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv6_conf_all_disable_ipv6:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_disable_ipv6:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv6_conf_all_autoconf:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_autoconf:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv6_conf_all_accept_ra_rtr_pref:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv6_conf_all_accept_ra_pinfo:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_accept_ra_pinfo:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv6_conf_all_accept_ra_defrtr:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv6_conf_all_accept_ra_defrtr:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv4_tcp_syncookies:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_tcp_syncookies:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv4_ip_local_port_range:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_ip_local_port_range:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv4_ip_forward:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_ip_forward:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv4_icmp_ignore_bogus_error_responses:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv4_icmp_echo_ignore_broadcasts:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv4_conf_default_shared_media:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_shared_media:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv4_conf_default_send_redirects:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_send_redirects:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv4_conf_default_secure_redirects:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_secure_redirects:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv4_conf_default_rp_filter:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_rp_filter:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv4_conf_default_log_martians:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_log_martians:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv4_conf_default_accept_source_route:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_accept_source_route:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv4_conf_default_accept_redirects:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_default_accept_redirects:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv4_conf_all_shared_media:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_shared_media:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv4_conf_all_send_redirects:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_send_redirects:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv4_conf_all_secure_redirects:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_secure_redirects:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv4_conf_all_rp_filter:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_rp_filter:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv4_conf_all_route_localnet:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_route_localnet:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv4_conf_all_log_martians:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_log_martians:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv4_conf_all_drop_gratuitous_arp:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv4_conf_all_arp_ignore:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_arp_ignore:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv4_conf_all_arp_filter:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_arp_filter:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv4_conf_all_accept_source_route:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_accept_source_route:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv4_conf_all_accept_redirects:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_accept_redirects:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_ipv4_conf_all_accept_local:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_ipv4_conf_all_accept_local:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_net_core_bpf_jit_harden:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_net_core_bpf_jit_harden:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_kernel_yama_ptrace_scope:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_yama_ptrace_scope:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_kernel_unprivileged_bpf_disabled:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_unprivileged_bpf_disabled:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_kernel_sysrq:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_sysrq:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_kernel_randomize_va_space:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_randomize_va_space:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_kernel_pid_max:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_pid_max:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_kernel_perf_event_paranoid:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_perf_event_paranoid:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_kernel_perf_event_max_sample_rate:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_perf_event_max_sample_rate:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_kernel_perf_cpu_time_max_percent:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_perf_cpu_time_max_percent:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_kernel_panic_on_oops:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_panic_on_oops:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_kernel_modules_disabled:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_modules_disabled:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_kernel_kptr_restrict:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_kptr_restrict:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_kernel_kexec_load_disabled:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_kexec_load_disabled:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_kernel_dmesg_restrict:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_dmesg_restrict:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_kernel_core_pattern:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_kernel_core_pattern:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_fs_suid_dumpable:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_fs_suid_dumpable:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_fs_protected_symlinks:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_fs_protected_symlinks:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_fs_protected_regular:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_fs_protected_regular:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_fs_protected_hardlinks:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_fs_protected_hardlinks:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_conf_files_fs_protected_fifos:var:1" version="1" datatype="string" comment="List of conf files">
                <object_component object_ref="oval:ssg-object_static_set_unfiltered_sysctls_fs_protected_fifos:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_vm_mmap_min_addr:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_user_max_user_namespaces:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv6_conf_default_router_solicitations:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv6_conf_default_max_addresses:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv6_conf_default_disable_ipv6:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv6_conf_default_autoconf:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv6_conf_default_accept_redirects:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv6_conf_default_accept_ra_rtr_pref:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv6_conf_default_accept_ra_pinfo:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv6_conf_default_accept_ra_defrtr:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv6_conf_default_accept_ra:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv6_conf_all_router_solicitations:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv6_conf_all_max_addresses:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv6_conf_all_disable_ipv6:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv6_conf_all_autoconf:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv6_conf_all_accept_ra_rtr_pref:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv6_conf_all_accept_ra_pinfo:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv6_conf_all_accept_ra_defrtr:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv4_tcp_syncookies:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv4_ip_local_port_range:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv4_ip_forward:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv4_icmp_ignore_bogus_error_responses:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv4_icmp_echo_ignore_broadcasts:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv4_conf_default_shared_media:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv4_conf_default_send_redirects:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv4_conf_default_secure_redirects:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv4_conf_default_rp_filter:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv4_conf_default_log_martians:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv4_conf_default_accept_source_route:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv4_conf_default_accept_redirects:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv4_conf_all_shared_media:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv4_conf_all_send_redirects:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv4_conf_all_secure_redirects:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv4_conf_all_rp_filter:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv4_conf_all_route_localnet:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv4_conf_all_log_martians:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv4_conf_all_drop_gratuitous_arp:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv4_conf_all_arp_ignore:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv4_conf_all_arp_filter:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv4_conf_all_accept_source_route:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv4_conf_all_accept_redirects:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_ipv4_conf_all_accept_local:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_net_core_bpf_jit_harden:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_kernel_yama_ptrace_scope:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_kernel_unprivileged_bpf_disabled:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_kernel_sysrq:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_kernel_randomize_va_space:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_kernel_pid_max:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_kernel_perf_event_paranoid:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_kernel_perf_event_max_sample_rate:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_kernel_perf_cpu_time_max_percent:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_kernel_panic_on_oops:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_kernel_modules_disabled:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_kernel_kptr_restrict:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_kernel_kexec_load_disabled:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_kernel_dmesg_restrict:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_kernel_core_pattern:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_fs_suid_dumpable:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_fs_protected_symlinks:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_fs_protected_regular:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_fs_protected_hardlinks:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <local_variable id="oval:ssg-local_var_blank_path_fs_protected_fifos:var:1" version="1" datatype="string" comment="Blank string">
                <literal_component></literal_component>
              </local_variable>
              <external_variable id="oval:ssg-inactivity_timeout_value:var:1" version="1" datatype="int" comment="inactivity timeout variable"/>
              <local_variable id="oval:ssg-file_permissions_unowned_userid_list:var:1" version="1" datatype="int" comment="List of valid user ids">
                <object_component object_ref="oval:ssg-file_permissions_unowned_userid_list_object:obj:1" item_field="user_id"/>
              </local_variable>
              <local_variable id="oval:ssg-audit_log_file_path:var:1" version="1" datatype="string" comment="path to audit log files">
                <regex_capture pattern="^log_file\s*=\s*(.*)">
                  <object_component object_ref="oval:ssg-object_auditd_conf_log_file:obj:1" item_field="subexpression"/>
                </regex_capture>
              </local_variable>
              <local_variable id="oval:ssg-audit_log_dir:var:1" version="1" datatype="string" comment="path to audit log directory">
                <regex_capture pattern="^(.*)\/([^\/]+$)">
                  <variable_component var_ref="oval:ssg-audit_log_file_path:var:1"/>
                </regex_capture>
              </local_variable>
            </variables>
          </oval_definitions>
          <results>
            <system>
              <definitions>
                <definition definition_id="oval:ssg-xwindows_runlevel_target:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_disable_xwindows_runlevel_target:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-wireless_disable_interfaces:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_wireless_disable_interfaces:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-var_umask_for_daemons_as_number:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_existence_of_var_umask_for_daemons_as_number_variable:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_var_removable_partition_is_cd_dvd_drive:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-var_accounts_user_umask_as_number:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-use_pam_wheel_for_su:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_use_pam_wheel_for_su:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-usbguard_rules_not_empty_not_missing:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_usbguard_rules_nonempty:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-usbguard_allow_hub:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-usbguard_rules_not_empty_not_missing:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-usbguard_allow_hid_and_hub:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-usbguard_rules_not_empty_not_missing:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-usbguard_allow_hid:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-usbguard_rules_not_empty_not_missing:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-umask_for_daemons:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-var_umask_for_daemons_as_number:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-tst_umask_for_daemons:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-timer_dnf-automatic_enabled:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-package_dnf-automatic_installed:def:1" version="1" result="false"/>
                    <criteria operator="AND" result="false">
                      <criterion test_ref="oval:ssg-test_timer_running_dnf-automatic:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_dnf-automatic:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-system_info_architecture_x86_64:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_system_info_architecture_x86_64:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-system_info_architecture_x86:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_system_info_architecture_x86:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-system_info_architecture_s390_64:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_system_info_architecture_s390_64:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-system_info_architecture_ppc_64:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criterion test_ref="oval:ssg-test_system_info_architecture_ppc_64:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-system_info_architecture_aarch_64:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_system_info_architecture_aarch_64:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-system_info_architecture_64bit:def:1" result="true" version="1">
                  <criteria operator="OR" result="true">
                    <extend_definition definition_ref="oval:ssg-system_info_architecture_x86_64:def:1" version="1" result="true"/>
                    <extend_definition definition_ref="oval:ssg-system_info_architecture_ppc_64:def:1" version="1" result="false"/>
                    <extend_definition definition_ref="oval:ssg-system_info_architecture_aarch_64:def:1" version="1" result="false"/>
                    <extend_definition definition_ref="oval:ssg-system_info_architecture_s390_64:def:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-system_boot_mode_is_uefi:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_efi_dir_existence:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-system_boot_mode_is_non_uefi:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-system_boot_mode_is_uefi:def:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_vm_mmap_min_addr:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_vm_mmap_min_addr:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_vm_mmap_min_addr:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_user_max_user_namespaces:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_user_max_user_namespaces:def:1" version="3" result="false"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_user_max_user_namespaces:def:1" version="3" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_vm_mmap_min_addr:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_vm_mmap_min_addr:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_vm_mmap_min_addr:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_vm_mmap_min_addr:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_vm_mmap_min_addr:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_vm_mmap_min_addr_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_user_max_user_namespaces:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_static_sysctl_user_max_user_namespaces:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_user_max_user_namespaces:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_user_max_user_namespaces:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_user_max_user_namespaces:tst:1" version="1" result="false"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_user_max_user_namespaces_defined_in_one_file:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_default_router_solicitations:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_router_solicitations:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_router_solicitations_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_default_max_addresses:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_max_addresses:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_max_addresses:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_max_addresses:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_max_addresses:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_max_addresses_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_default_disable_ipv6:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_disable_ipv6_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_default_autoconf:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_autoconf:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_autoconf:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_autoconf:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_autoconf:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_autoconf_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_redirects:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_pinfo:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_pinfo_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_defrtr:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_defrtr_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_all_router_solicitations:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_router_solicitations:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_router_solicitations_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_all_max_addresses:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_max_addresses:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_max_addresses:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_max_addresses:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_max_addresses:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_max_addresses_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_all_disable_ipv6:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_all_autoconf:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_autoconf:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_autoconf:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_autoconf:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_autoconf:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_autoconf_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_pinfo:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_pinfo_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_defrtr:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_defrtr_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_tcp_syncookies:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_tcp_syncookies:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_ip_local_port_range:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_ip_local_port_range:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_local_port_range:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_ip_local_port_range:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_local_port_range:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_ip_local_port_range_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_ip_forward:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_ip_forward:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_forward:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_ip_forward:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_forward:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_ip_forward_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_icmp_ignore_bogus_error_responses:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_icmp_echo_ignore_broadcasts:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_default_shared_media:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_shared_media:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_shared_media:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_shared_media:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_shared_media:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_shared_media_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_default_send_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_send_redirects:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_default_secure_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_secure_redirects:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_default_rp_filter:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_rp_filter:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_default_log_martians:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_log_martians:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_source_route:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_source_route:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_redirects:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_all_shared_media:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_shared_media:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_shared_media:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_shared_media:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_shared_media:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_shared_media_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_all_send_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_send_redirects:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_all_secure_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_secure_redirects:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_all_rp_filter:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_rp_filter:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_all_route_localnet:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_route_localnet:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_route_localnet:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_route_localnet:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_route_localnet:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_route_localnet_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_all_log_martians:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_log_martians:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_all_drop_gratuitous_arp:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_all_arp_ignore:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_arp_ignore:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_arp_ignore:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_arp_ignore:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_arp_ignore:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_ignore_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_all_arp_filter:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_arp_filter:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_arp_filter:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_arp_filter:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_arp_filter:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_filter_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_source_route:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_source_route:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_redirects:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_local:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_local:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_local:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_local:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_local:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_local_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_core_bpf_jit_harden:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_static_sysctl_net_core_bpf_jit_harden:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_core_bpf_jit_harden:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_net_core_bpf_jit_harden:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_core_bpf_jit_harden:tst:1" version="1" result="false"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_net_core_bpf_jit_harden_defined_in_one_file:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_yama_ptrace_scope:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_static_sysctl_kernel_yama_ptrace_scope:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_yama_ptrace_scope:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_yama_ptrace_scope:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_yama_ptrace_scope:tst:1" version="1" result="false"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_kernel_yama_ptrace_scope_defined_in_one_file:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_unprivileged_bpf_disabled:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_static_sysctl_kernel_unprivileged_bpf_disabled:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_unprivileged_bpf_disabled:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_unprivileged_bpf_disabled:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:tst:1" version="1" result="false"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_kernel_unprivileged_bpf_disabled_defined_in_one_file:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_sysrq:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_kernel_sysrq:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_sysrq:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_sysrq:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_sysrq:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_kernel_sysrq_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_randomize_va_space:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_kernel_randomize_va_space:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_randomize_va_space:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_randomize_va_space:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_randomize_va_space:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_kernel_randomize_va_space_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_pid_max:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_kernel_pid_max:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_pid_max:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_pid_max:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_pid_max:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_kernel_pid_max_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_perf_event_paranoid:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_static_sysctl_kernel_perf_event_paranoid:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_event_paranoid:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_event_paranoid:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_paranoid:tst:1" version="1" result="false"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_kernel_perf_event_paranoid_defined_in_one_file:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_perf_event_max_sample_rate:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_kernel_perf_event_max_sample_rate:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_kernel_perf_event_max_sample_rate_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_perf_cpu_time_max_percent:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_kernel_perf_cpu_time_max_percent:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_kernel_perf_cpu_time_max_percent_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_panic_on_oops:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_kernel_panic_on_oops:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_panic_on_oops:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_panic_on_oops:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_panic_on_oops:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_kernel_panic_on_oops_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_modules_disabled:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_kernel_modules_disabled:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_modules_disabled:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_modules_disabled:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_modules_disabled:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_kernel_modules_disabled_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_kptr_restrict:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_static_sysctl_kernel_kptr_restrict:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_kptr_restrict:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_kptr_restrict:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_kptr_restrict:tst:1" version="1" result="false"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_kernel_kptr_restrict_defined_in_one_file:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_kexec_load_disabled:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_static_sysctl_kernel_kexec_load_disabled:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_kexec_load_disabled:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_kexec_load_disabled:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_kexec_load_disabled:tst:1" version="1" result="false"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_kernel_kexec_load_disabled_defined_in_one_file:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_dmesg_restrict:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_static_sysctl_kernel_dmesg_restrict:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_dmesg_restrict:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_dmesg_restrict:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_dmesg_restrict:tst:1" version="1" result="false"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_kernel_dmesg_restrict_defined_in_one_file:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_core_pattern:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_static_sysctl_kernel_core_pattern:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_core_pattern:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_core_pattern:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_core_pattern:tst:1" version="1" result="false"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_kernel_core_pattern_defined_in_one_file:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_fs_suid_dumpable:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_fs_suid_dumpable:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_fs_suid_dumpable:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_fs_suid_dumpable:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_suid_dumpable:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_fs_suid_dumpable_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_fs_protected_symlinks:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_fs_protected_symlinks:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_symlinks:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_fs_protected_symlinks:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_symlinks:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_fs_protected_symlinks_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_fs_protected_regular:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_fs_protected_regular:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_regular:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_fs_protected_regular:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_regular:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_fs_protected_regular_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_fs_protected_hardlinks:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_fs_protected_hardlinks:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_hardlinks:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_fs_protected_hardlinks:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_hardlinks:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_fs_protected_hardlinks_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_fs_protected_fifos:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_static_sysctl_fs_protected_fifos:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_fifos:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_run_sysctld_fs_protected_fifos:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_fifos:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sysctl_fs_protected_fifos_defined_in_one_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_vm_mmap_min_addr:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_vm_mmap_min_addr:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_user_max_user_namespaces:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_user_max_user_namespaces:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_router_solicitations:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_router_solicitations:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_max_addresses:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_max_addresses:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_disable_ipv6:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_autoconf:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_autoconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_redirects:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_router_solicitations:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_router_solicitations:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_max_addresses:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_max_addresses:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_disable_ipv6:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_autoconf:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_autoconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_tcp_syncookies:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_tcp_syncookies:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_ip_local_port_range:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_ip_local_port_range:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_ip_forward:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_ip_forward:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_shared_media:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_shared_media:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_send_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_send_redirects:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_secure_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_secure_redirects:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_rp_filter:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_rp_filter:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_log_martians:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_log_martians:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_source_route:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_source_route:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_redirects:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_shared_media:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_shared_media:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_send_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_send_redirects:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_secure_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_secure_redirects:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_rp_filter:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_rp_filter:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_route_localnet:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_route_localnet:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_log_martians:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_log_martians:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_drop_gratuitous_arp:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_arp_ignore:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_arp_ignore:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_arp_filter:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_arp_filter:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_source_route:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_source_route:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_redirects:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_local:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_local:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_core_bpf_jit_harden:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_core_bpf_jit_harden:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_yama_ptrace_scope:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_yama_ptrace_scope:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_unprivileged_bpf_disabled:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_unprivileged_bpf_disabled:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_sysrq:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_sysrq:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_randomize_va_space:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_randomize_va_space:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_pid_max:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_pid_max:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_perf_event_paranoid:def:1" result="true" version="3">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_perf_event_paranoid:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_perf_event_max_sample_rate:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_perf_event_max_sample_rate:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_perf_cpu_time_max_percent:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_perf_cpu_time_max_percent:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_panic_on_oops:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_panic_on_oops:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_modules_disabled:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_modules_disabled:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_kptr_restrict:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_kptr_restrict:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_kexec_load_disabled:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_kexec_load_disabled:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_dmesg_restrict:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_dmesg_restrict:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_core_pattern:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_core_pattern:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_fs_suid_dumpable:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_fs_suid_dumpable:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_fs_protected_symlinks:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_fs_protected_symlinks:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_fs_protected_regular:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_fs_protected_regular:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_fs_protected_hardlinks:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_fs_protected_hardlinks:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_fs_protected_fifos:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_fs_protected_fifos:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_router_solicitations:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_router_solicitations:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_max_addresses:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_max_addresses:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_default_disable_ipv6:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_disable_ipv6:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_disable_ipv6:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_default_autoconf:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_autoconf:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_autoconf:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_redirects:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_redirects:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_pinfo:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_defrtr:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_router_solicitations:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_router_solicitations:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_max_addresses:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_max_addresses:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_all_disable_ipv6:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_disable_ipv6:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_disable_ipv6:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_all_autoconf:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_autoconf:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_autoconf:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_pinfo:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_defrtr:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_tcp_syncookies:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_tcp_syncookies:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_tcp_syncookies:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_ip_local_port_range:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_ip_local_port_range:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_ip_local_port_range:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_ip_forward:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_ip_forward:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_ip_forward:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_icmp_ignore_bogus_error_responses:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_icmp_echo_ignore_broadcasts:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_default_shared_media:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_shared_media:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_shared_media:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_default_send_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_send_redirects:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_send_redirects:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_secure_redirects:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_secure_redirects:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_rp_filter:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_rp_filter:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_default_log_martians:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_log_martians:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_log_martians:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_source_route:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_source_route:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_redirects:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_redirects:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_all_shared_media:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_shared_media:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_shared_media:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_all_send_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_send_redirects:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_send_redirects:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_secure_redirects:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_secure_redirects:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_rp_filter:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_rp_filter:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_all_route_localnet:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_route_localnet:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_route_localnet:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_all_log_martians:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_log_martians:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_log_martians:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_all_drop_gratuitous_arp:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_drop_gratuitous_arp:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_drop_gratuitous_arp:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_all_arp_ignore:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_arp_ignore:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_arp_ignore:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_all_arp_filter:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_arp_filter:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_arp_filter:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_source_route:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_source_route:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_redirects:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_redirects:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_all_accept_local:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_local:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_local:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_core_bpf_jit_harden:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_core_bpf_jit_harden:def:1" version="3" result="false"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_core_bpf_jit_harden:def:1" version="3" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_yama_ptrace_scope:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_yama_ptrace_scope:def:1" version="3" result="false"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_yama_ptrace_scope:def:1" version="3" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_unprivileged_bpf_disabled:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_unprivileged_bpf_disabled:def:1" version="3" result="false"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_unprivileged_bpf_disabled:def:1" version="3" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_sysrq:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_sysrq:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_sysrq:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_randomize_va_space:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_randomize_va_space:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_randomize_va_space:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_pid_max:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_pid_max:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_pid_max:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_perf_event_paranoid:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_perf_event_paranoid:def:1" version="3" result="false"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_perf_event_paranoid:def:1" version="3" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_perf_event_max_sample_rate:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_perf_event_max_sample_rate:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_perf_event_max_sample_rate:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_perf_cpu_time_max_percent:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_perf_cpu_time_max_percent:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_perf_cpu_time_max_percent:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_panic_on_oops:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_panic_on_oops:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_panic_on_oops:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_modules_disabled:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_modules_disabled:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_modules_disabled:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_kptr_restrict:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_kptr_restrict:def:1" version="3" result="false"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_kptr_restrict:def:1" version="3" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_kexec_load_disabled:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_kexec_load_disabled:def:1" version="3" result="false"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_kexec_load_disabled:def:1" version="3" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_ipv6_disable:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_disable_ipv6:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_disable_ipv6:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_exec_shield:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_nx_disabled_grub:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_dmesg_restrict:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_dmesg_restrict:def:1" version="3" result="false"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_dmesg_restrict:def:1" version="3" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_core_pattern:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_core_pattern:def:1" version="3" result="false"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_core_pattern:def:1" version="3" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_fs_suid_dumpable:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_fs_suid_dumpable:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_fs_suid_dumpable:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_fs_protected_symlinks:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_fs_protected_symlinks:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_fs_protected_symlinks:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_fs_protected_regular:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_fs_protected_regular:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_fs_protected_regular:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_fs_protected_hardlinks:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_fs_protected_hardlinks:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_fs_protected_hardlinks:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_fs_protected_fifos:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_fs_protected_fifos:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_fs_protected_fifos:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_crypto_fips_enabled:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_sysctl_crypto_fips_enabled:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudoers_validate_passwd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sudoers_targetpw_config:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_sudoers_rootpw_config:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_sudoers_runaspw_config:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_sudoers_passwd_n_files:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudoers_no_root_target:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_no_root_or_ALL_in_runas_spec:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_no_user_spec_rules:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudoers_no_command_negation:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sudoers_no_command_negation:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudoers_explicit_command_args:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sudoers_explicit_command_args:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudoers_default_includedir:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sudoers_default_includedir:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_sudoers_without_include:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_sudoersd_without_includes:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudo_vdsm_nopasswd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_vdsm_nopasswd_etc_sudoers:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_vdsm_nopasswd_etc_sudoers_d:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudo_require_authentication:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sudo_remove_no_authenticate:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sudo_remove_nopasswd:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudo_remove_nopasswd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_nopasswd_etc_sudoers:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_nopasswd_etc_sudoers_d:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudo_remove_no_authenticate:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_no_authenticate_etc_sudoers:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_no_authenticate_etc_sudoers_d:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudo_custom_logfile:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_logfile_sudoers:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudo_add_use_pty:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_use_pty_sudoers:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudo_add_requiretty:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_requiretty_sudoers:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudo_add_noexec:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_noexec_sudoers:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sssd_ssh_known_hosts_timeout:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-service_sssd_disabled:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sssd_conf_exists:def:1" version="1" result="not evaluated" negate="true"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sssd_ssh_known_hosts_timeout:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sssd_run_as_sssd_user:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_sssd_run_as_sssd_user:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sssd_offline_cred_expiration:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-service_sssd_disabled:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sssd_conf_exists:def:1" version="1" result="not evaluated" negate="true"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sssd_offline_cred_expiration:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sssd_memcache_timeout:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-service_sssd_disabled:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sssd_conf_exists:def:1" version="1" result="not evaluated" negate="true"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sssd_memcache_timeout:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sssd_enable_smartcards:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-service_sssd_disabled:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sssd_conf_exists:def:1" version="1" result="not evaluated" negate="true"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sssd_enable_smartcards:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sssd_enable_certmap:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sssd_enable_certmap:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sssd_conf_uses_ldap:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_id_provider_is_set_to_ad:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sssd_conf_exists:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sssd_conf_exists:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sssd_certificate_verification:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sssd_certificate_verification:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_x11_use_localhost:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_x11_use_localhost:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_x11_use_localhost_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_version_equal_or_higher_than_74:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_openssh-server_version:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_use_priv_separation:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sshd_use_priv_separation:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_use_directory_configuration:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="AND" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-sshd_includes_config_files:def:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_use_directory_configuration_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_set_maxstartups:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-tst_maxstartups_start_parameter:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-tst_maxstartups_rate_parameter:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-tst_maxstartups_full_parameter:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_set_max_sessions:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_sshd_max_sessions:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_set_max_auth_tries:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-service_sshd_disabled:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_sshd_max_auth_tries:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_set_loglevel_verbose:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_set_loglevel_verbose:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_set_loglevel_verbose_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_set_loglevel_info:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_set_loglevel_info:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_set_loglevel_info_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_set_login_grace_time:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_sshd_login_grace_time:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_set_keepalive_0:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_set_keepalive_0:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_set_keepalive_0_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_set_keepalive:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_clientalivecountmax:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_clientalivecountmax_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_set_idle_timeout:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_idle_timeout:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_idle_timeout_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                      <extend_definition definition_ref="oval:ssg-sshd_set_keepalive:def:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_requirement_unset:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_sshd_requirement_unset:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_required_or_unset:def:1" result="true" version="1">
                  <criteria operator="OR" result="true">
                    <criterion test_ref="oval:ssg-test_sshd_required:tst:1" version="1" result="false"/>
                    <extend_definition definition_ref="oval:ssg-sshd_requirement_unset:def:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_rekey_limit:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="true"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="true"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="true"/>
                      <criteria operator="OR" result="false">
                        <criterion test_ref="oval:ssg-test_sshd_rekey_limit:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_sshd_rekey_limit_config_dir:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_print_last_log:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_print_last_log:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_print_last_log_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_not_required_or_unset:def:1" result="true" version="1">
                  <criteria operator="OR" result="true">
                    <criterion test_ref="oval:ssg-test_sshd_not_required:tst:1" version="1" result="false"/>
                    <extend_definition definition_ref="oval:ssg-sshd_requirement_unset:def:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_includes_config_files:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sshd_includes_config_files:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_enable_x11_forwarding:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_enable_x11_forwarding:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_enable_x11_forwarding_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_enable_warning_banner_net:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_enable_warning_banner_net:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_enable_warning_banner_net_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_enable_warning_banner:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="true"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="true"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="true"/>
                      <criteria operator="OR" result="false">
                        <criterion test_ref="oval:ssg-test_sshd_enable_warning_banner:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_sshd_enable_warning_banner_config_dir:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_enable_strictmodes:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_enable_strictmodes:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_enable_strictmodes_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_enable_pubkey_auth:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_enable_pubkey_auth:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_enable_pubkey_auth_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_enable_pam:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_enable_pam:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_enable_pam_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_enable_gssapi_auth:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_enable_gssapi_auth:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_enable_gssapi_auth_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_do_not_permit_user_env:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_do_not_permit_user_env:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_do_not_permit_user_env_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_disable_x11_forwarding:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_disable_x11_forwarding:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_disable_x11_forwarding_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_disable_user_known_hosts:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_disable_user_known_hosts:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_disable_user_known_hosts_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_disable_tcp_forwarding:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_disable_tcp_forwarding:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_disable_tcp_forwarding_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_disable_root_password_login:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_disable_root_password_login:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_disable_root_password_login_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_disable_root_login:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="true"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="true"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="true"/>
                      <criteria operator="OR" result="false">
                        <criterion test_ref="oval:ssg-test_sshd_disable_root_login:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_sshd_disable_root_login_config_dir:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_disable_rhosts_rsa:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-sshd_version_equal_or_higher_than_74:def:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_disable_rhosts_rsa:tst:1" version="1" result="not evaluated" negate="true"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_disable_rhosts:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_disable_rhosts:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_disable_rhosts_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_disable_pubkey_auth:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_disable_pubkey_auth:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_disable_pubkey_auth_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_disable_kerb_auth:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="true"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="true"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="true"/>
                      <criteria operator="OR" result="false">
                        <criterion test_ref="oval:ssg-test_sshd_disable_kerb_auth:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_sshd_disable_kerb_auth_config_dir:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_disable_gssapi_auth:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="true"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="true"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="true"/>
                      <criteria operator="OR" result="false">
                        <criterion test_ref="oval:ssg-test_sshd_disable_gssapi_auth:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_sshd_disable_gssapi_auth_config_dir:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_disable_empty_passwords:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="true"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="true"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="true"/>
                      <criteria operator="OR" result="false">
                        <criterion test_ref="oval:ssg-test_sshd_disable_empty_passwords:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_sshd_disable_empty_passwords_config_dir:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_disable_compression:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_sshd_disable_compression:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <extend_definition definition_ref="oval:ssg-sshd_version_equal_or_higher_than_74:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_allow_only_protocol2:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-sshd_version_equal_or_higher_than_74:def:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_allow_only_protocol2:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-snmpd_use_newer_protocol:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_net-snmp_removed:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_snmp_versions:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-snmpd_not_default_password:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_snmp_default_communities:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-smartcard_auth:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-install_smartcard_packages:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-service_pcscd_enabled:def:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-package_esc_installed:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_pam_pkcs11_cert_policy_ocsp_on:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_smart_card_enabled_system_auth:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_smart_card_required_system_auth:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_smart_card_required_smartcard_auth:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-set_password_hashing_algorithm_systemauth:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_pam_unix_sha512:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-set_password_hashing_algorithm_passwordauth:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_pam_unix_passwordauth_sha512:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-set_password_hashing_algorithm_logindefs:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_etc_login_defs_encrypt_method:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-set_password_hashing_algorithm_libuserconf:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_etc_libuser_conf_cryptstyle:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-set_firewalld_default_zone:def:1" result="false" version="2">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_firewalld_input_drop:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_usbguard_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_usbguard_package_usbguard_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_usbguard:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_usbguard:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_usbguard_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_systemd-coredump_disabled:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criterion test_ref="oval:ssg-test_service_systemd-coredump_package_systemd_removed:tst:1" version="1" result="false"/>
                    <criteria operator="AND" result="false">
                      <criterion test_ref="oval:ssg-test_service_not_running_systemd-coredump:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_systemd-coredump:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_syslogng_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_syslog-ng_package_syslog-ng_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_syslog-ng:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_syslog-ng:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_syslog-ng_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_syslog_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_syslog_package_rsyslog_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_syslog:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_syslog:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_sssd_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_sssd_package_sssd-common_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_sssd:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_sssd:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_sshd_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_sshd_package_openssh-server_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_sshd:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_sshd:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_rsyslog_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_rsyslog_package_rsyslog_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_rsyslog:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_rsyslog:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_rsyslog_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_rsyncd_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_rsyncd_package_rsync-daemon_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_rsyncd:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_rsyncd:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_rpcsvcgssd_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_rpcsvcgssd_package_nfs-utils_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_rpcsvcgssd:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_rpcsvcgssd:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_rpcidmapd_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_rpcidmapd_package_nfs-utils_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_rpcidmapd:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_rpcidmapd:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_rpcgssd_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_rpcgssd_package_nfs-utils_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_rpcgssd:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_rpcgssd:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_rngd_enabled:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_service_rngd_package_rng-tools_installed:tst:1" version="1" result="false"/>
                    <criteria operator="AND" result="false">
                      <criterion test_ref="oval:ssg-test_service_running_rngd:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_rngd:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_rngd_socket:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_pcscd_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_pcscd_package_pcsc-lite_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_pcscd:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_pcscd:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_pcscd_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_ntpd_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_ntpd_package_ntp_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_ntpd:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_ntpd:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_ntpd_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_ntp_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_ntp_package_ntp_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_ntp:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_ntp:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_ntp_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_nfslock_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_nfslock_package_nfs-utils_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_nfslock:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_nfslock:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_nfs_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_nfs-server_package_nfs-utils_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_nfs-server:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_nfs-server:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_netfs_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_netfs_package_netfs_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_netfs:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_netfs:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_iptables_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_iptables_package_iptables_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_iptables:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_iptables:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_iptables_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_ip6tables_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_ip6tables_package_iptables-ipv6_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_ip6tables:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_ip6tables:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_ip6tables_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_firewalld_enabled:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_service_firewalld_package_firewalld_installed:tst:1" version="1" result="true"/>
                    <criteria operator="AND" result="true">
                      <criterion test_ref="oval:ssg-test_service_running_firewalld:tst:1" version="1" result="true"/>
                      <criteria operator="OR" result="true">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_firewalld:tst:1" version="1" result="true"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_firewalld_socket:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_debug-shell_disabled:def:1" result="true" version="1">
                  <criteria operator="OR" result="true">
                    <criterion test_ref="oval:ssg-test_service_debug-shell_package_systemd_removed:tst:1" version="1" result="false"/>
                    <criteria operator="AND" result="true">
                      <criterion test_ref="oval:ssg-test_service_not_running_debug-shell:tst:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_debug-shell:tst:1" version="1" result="true"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_crond_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_crond_package_cronie_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_crond:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_crond:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_crond_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_cron_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_cron_package_cron_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_cron:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_cron:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_cron_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_chronyd_or_ntpd_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-service_chronyd_enabled:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-service_ntpd_enabled:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_chronyd_enabled:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_service_chronyd_package_chrony_installed:tst:1" version="1" result="true"/>
                    <criteria operator="AND" result="true">
                      <criterion test_ref="oval:ssg-test_service_running_chronyd:tst:1" version="1" result="true"/>
                      <criteria operator="OR" result="true">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_chronyd:tst:1" version="1" result="true"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_chronyd_socket:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_bluetooth_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_bluetooth_package_bluez_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_bluetooth:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_bluetooth:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_autofs_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_autofs_package_autofs_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_autofs:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_autofs:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_auditd_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_auditd_package_audit_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_auditd:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_auditd:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_auditd_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_atd_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_atd_package_at_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_atd:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_atd:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-selinux_state:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_etc_selinux_config:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-selinux_policytype:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_selinux_policy:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-selinux_confinement_of_daemons:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_selinux_confinement_of_daemons:tst:1" version="2" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-selinux_all_devicefiles_labeled:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_selinux_dev_device_t:tst:1" version="2" result="true"/>
                    <criterion test_ref="oval:ssg-test_selinux_dev_unlabeled_t:tst:1" version="2" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-securetty_root_login_console_only:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_virtual_consoles_etc_securetty:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rsyslog_remote_tls_cacert:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rsyslog_remote_tls_cacert:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rsyslog_remote_tls:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rsyslog_remote_tls:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rsyslog_remote_loghost:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criterion test_ref="oval:ssg-test_remote_rsyslog_conf:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_remote_rsyslog_d:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rsyslog_remote_access_monitoring:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_remote_method_monitoring_auth:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_remote_method_monitoring_authpriv:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_remote_method_monitoring_daemon:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rsyslog_nolisten:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rsyslog_nolisten:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rsyslog_files_permissions:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rsyslog_files_permissions:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rsyslog_files_ownership:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rsyslog_files_ownership:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rsyslog_files_groupownership:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rsyslog_files_groupownership:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rsyslog_cron_logging:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criterion test_ref="oval:ssg-test_cron_logging_rsyslog:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_cron_logging_rsyslog_dir:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rpm_verify_permissions:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_verify_all_rpms_mode:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rpm_verify_hashes:def:1" result="true" version="3">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_files_fail_md5_hash:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-root_permissions_syslibrary_files:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_0:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_1:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_2:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_3:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-root_path_no_dot:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_var_begins:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_env_var_contains_doublecolon:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_env_var_contains_doubleperiod:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_env_var_ends:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_env_var_begins_slash:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_env_var_contains_relative_path:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-restrict_serial_port_logins:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_serial_ports_etc_securetty:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-require_singleuser_auth:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_require_rescue_service:tst:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_require_rescue_service_runlevel1:tst:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_no_custom_runlevel1_target:tst:1" version="1" result="true" negate="true"/>
                    <criterion test_ref="oval:ssg-test_no_custom_rescue_service:tst:1" version="1" result="true" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-require_emergency_target_auth:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_require_emergency_service:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_require_emergency_service_emergency_target:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_no_custom_emergency_target:tst:1" version="1" result="not evaluated" negate="true"/>
                    <criterion test_ref="oval:ssg-test_no_custom_emergency_service:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-removable_partition_doesnt_exist:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_removable_partition_doesnt_exist:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-proc_sys_kernel_osrelease_arch_not_s390x:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-proc_sys_kernel_osrelease_arch_not_aarch64:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-proc_sys_kernel_osrelease_arch_aarch64:def:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-proc_sys_kernel_osrelease_arch_aarch64:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_proc_sys_kernel_osrelease_arch_aarch64:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-prefer_64bit_os:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_proc_sys_kernel_osrelease_64_bit:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_proc_cpuinfo_64_bit:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-postfix_client_configure_mail_alias:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_postfix_client_configure_mail_alias:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-partition_for_var_log_audit:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-testvar_log_audit_partition:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-partition_for_var_log:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-testvar_log_partition:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-partition_for_var:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-testvar_partition:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-partition_for_usr:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-testusr_partition:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-partition_for_tmp:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-testtmp_partition:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-partition_for_srv:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-testsrv_partition:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-partition_for_opt:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-testopt_partition:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-partition_for_home:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-testhome_partition:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-partition_for_boot:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-testboot_partition:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_xorg-x11-server-common_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_xorg-x11-server-common_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_vsftpd_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_vsftpd_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_vsftpd_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_vsftpd_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_vim_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_vim-enhanced_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_usbguard_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_usbguard_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_tuned_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_tuned_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_tmux_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_tmux_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_telnetd_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_telnetd_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_telnetd-ssl_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_telnetd-ssl_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_tar_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_tar_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_syslogng_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_syslog-ng_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_sudo_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_sudo_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_sssd-ipa_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_sssd-ipa_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_setroubleshoot_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_setroubleshoot_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_setroubleshoot-server_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_setroubleshoot-server_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_setroubleshoot-plugins_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_setroubleshoot-plugins_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_sendmail_removed:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_package_sendmail_removed:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_screen_installed:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_package_screen_installed:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_scap-security-guide_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_scap-security-guide_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_samba-common_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_samba-common_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_rsyslog_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_rsyslog_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_rsyslog-gnutls_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_rsyslog-gnutls_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_rng-tools_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_rng-tools_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_rear_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_rear_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_python3-abrt-addon_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_python3-abrt-addon_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_prelink_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_prelink_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_policycoreutils_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_policycoreutils_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_pcsc-lite_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_pcsc-lite_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_pam_ldap_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_pam_ldap_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_openssh-server_removed:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_package_openssh-server_removed:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_openssh-server_installed:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_package_openssh-server_installed:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_openscap-scanner_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_openscap-scanner_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_opensc_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_opensc_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_openldap-clients_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_openldap-clients_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_ntpdate_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_ntpdate_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_ntp_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_ntp_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_nss-tools_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_nss-tools_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_nis_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_nis_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_nfs-utils_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_nfs-utils_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_net-snmp_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_net-snmp_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_mcstrans_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_mcstrans_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_libselinux_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_libselinux_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_libreswan_installed:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_package_libreswan_installed:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_libreport-plugin-rhtsupport_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_libreport-plugin-rhtsupport_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_libreport-plugin-logger_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_libreport-plugin-logger_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_libcap-ng-utils_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_libcap-ng-utils_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_krb5-workstation_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_krb5-workstation_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_iptables_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_iptables_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_iprutils_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_iprutils_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_inetutils-telnetd_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_inetutils-telnetd_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_gssproxy_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_gssproxy_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_gnutls-utils_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_gnutls-utils_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_geolite2-country_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_geolite2-country_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_geolite2-city_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_geolite2-city_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_gdm_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_gdm_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_gdm_installed:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_package_gdm_installed:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_fapolicyd_installed:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_package_fapolicyd_installed:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_esc_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_esc_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_dnf-automatic_installed:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_package_dnf-automatic_installed:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_dconf_installed:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_package_dconf_installed:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_cryptsetup-luks_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_cryptsetup-luks_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_cron_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_cron_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_chrony_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_chrony_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_binutils_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_binutils_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_bind_removed:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_package_bind_removed:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_avahi_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_avahi_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_audit_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_audit_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_audit-audispd-plugins_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_audit-audispd-plugins_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_audispd-plugins_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_audispd-plugins_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_aide_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_aide_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_abrt_removed:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_package_abrt_removed:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_abrt-plugin-sosreport_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_abrt-plugin-sosreport_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_abrt-plugin-rhtsupport_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_abrt-plugin-rhtsupport_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_abrt-plugin-logger_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_abrt-plugin-logger_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_abrt-cli_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_abrt-cli_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_abrt-addon-kerneloops_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_abrt-addon-kerneloops_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_abrt-addon-ccpp_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_abrt-addon-ccpp_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_MFEhiplsm_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_MFEhiplsm_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_GConf2_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_GConf2_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-ntpd_specify_remote_server:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_ntp_remote_server:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-ntpd_specify_multiple_servers:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_ntpd_multiple_servers:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-ntpd_run_as_ntp_user:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_ntpd_run_as_ntp_user_etc_sysconfig_ntpd:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ntpd_run_as_ntp_user_systemd:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-ntpd_configure_restrictions:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_ntpd_configure_restrictions_ipv6:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ntpd_configure_restrictions_ipv4:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_tmux_in_shells:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_no_tmux_in_shells:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_shelllogin_for_systemaccounts:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_sys_uid_min_not_defined:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_sys_uid_max_not_defined:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_shell_defined_default_uid_range:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_sys_uid_min_not_defined:tst:1" version="1" result="not evaluated" negate="true"/>
                      <criterion test_ref="oval:ssg-test_sys_uid_max_not_defined:tst:1" version="1" result="not evaluated" negate="true"/>
                      <criterion test_ref="oval:ssg-test_shell_defined_reserved_uid_range:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_rsh_trust_files:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_no_rsh_trust_files_root:tst:1" version="1" result="not evaluated" negate="true"/>
                    <criterion test_ref="oval:ssg-test_no_rsh_trust_files_home:tst:1" version="1" result="not evaluated" negate="true"/>
                    <criterion test_ref="oval:ssg-test_no_rsh_trust_files_etc:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_netrc_files:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_no_netrc_files_home:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_legacy_plus_entries_etc_shadow:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_no_legacy_plus_entries_etc_shadow:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_legacy_plus_entries_etc_passwd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_no_legacy_plus_entries_etc_passwd:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_legacy_plus_entries_etc_group:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_no_legacy_plus_entries_etc_group:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_insecure_locks_exports:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_no_insecure_locks_exports:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_files_unowned_by_user:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-no_files_unowned_by_user_test:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_empty_passwords_etc_shadow:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_no_empty_passwords_etc_shadow:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_empty_passwords:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_no_empty_passwords:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_direct_root_logins:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_no_direct_root_logins:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_etc_securetty_exists:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_no_cd_dvd_drive_in_etc_fstab:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-network_sniffer_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_promisc_interfaces:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-network_nmcli_permissions:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_network_nmcli_permissions:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-network_ipv6_static_address:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_network_ipv6_static_address:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-network_ipv6_privacy_extensions:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_network_ipv6_privacy_extensions:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-network_ipv6_disable_rpc:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_network_ipv6_disable_rpc_udp6:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_network_ipv6_disable_rpc_tcp6:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-network_ipv6_default_gateway:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_network_ipv6_default_gateway:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-network_disable_zeroconf:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysconfig_nozeroconf_yes:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_var_tmp_bind:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_configure_mount_option_var_tmp_bind_tmp:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_mount_option_var_tmp:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_mount_option_var_tmp_bind:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_mount_option_var_tmp_bind_compare_source:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_var_nosuid:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_var_partition_nosuid_optional_yes:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_var_noexec:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_var_partition_noexec_optional_yes:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_var_nodev:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_var_partition_nodev_optional_yes:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_var_log_nosuid:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_var_log_partition_nosuid_optional_yes:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_var_log_noexec:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_var_log_partition_noexec_optional_yes:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_var_log_nodev:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_var_log_partition_nodev_optional_yes:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_var_log_audit_nosuid:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_var_log_audit_partition_nosuid_optional_yes:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_var_log_audit_noexec:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_var_log_audit_partition_noexec_optional_yes:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_var_log_audit_nodev:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_var_log_audit_partition_nodev_optional_yes:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_tmp_nosuid:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_tmp_partition_nosuid_optional_yes:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_tmp_noexec:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_tmp_partition_noexec_optional_yes:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_tmp_nodev:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_tmp_partition_nodev_optional_yes:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_srv_nosuid:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_srv_partition_nosuid_optional_yes:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_proc_hidepid:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_proc_partition_hidepid_optional_no:tst:1" version="2" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_proc_no_partition_hidepid_optional_no:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_opt_nosuid:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_opt_partition_nosuid_optional_yes:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_nosuid_removable_partitions:def:1" result="not evaluated" version="5">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_nosuid_etc_fstab_cd_dvd_drive:tst:1" version="1" result="not evaluated"/>
                        <extend_definition definition_ref="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_nosuid_etc_fstab_not_cd_dvd_drive:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_noexec_removable_partitions:def:1" result="not evaluated" version="5">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_noexec_etc_fstab_cd_dvd_drive:tst:1" version="1" result="not evaluated"/>
                        <extend_definition definition_ref="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_noexec_etc_fstab_not_cd_dvd_drive:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_nodev_removable_partitions:def:1" result="not evaluated" version="5">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_nodev_etc_fstab_cd_dvd_drive:tst:1" version="1" result="not evaluated"/>
                        <extend_definition definition_ref="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_nodev_etc_fstab_not_cd_dvd_drive:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_nodev_nonroot_local_partitions:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_nodev_nonroot_local_partitions:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_home_noexec:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_home_partition_noexec_optional_yes:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_dev_shm_nosuid:def:1" result="true" version="2">
                  <criteria operator="OR" result="true">
                    <criterion test_ref="oval:ssg-test_dev_shm_partition_nosuid_optional_no:tst:1" version="2" result="true"/>
                    <criterion test_ref="oval:ssg-test_dev_shm_no_partition_nosuid_optional_no:tst:1" version="1" result="false" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_dev_shm_noexec:def:1" result="false" version="2">
                  <criteria operator="OR" result="false">
                    <criterion test_ref="oval:ssg-test_dev_shm_partition_noexec_optional_no:tst:1" version="2" result="false"/>
                    <criterion test_ref="oval:ssg-test_dev_shm_no_partition_noexec_optional_no:tst:1" version="1" result="false" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_dev_shm_nodev:def:1" result="true" version="2">
                  <criteria operator="OR" result="true">
                    <criterion test_ref="oval:ssg-test_dev_shm_partition_nodev_optional_no:tst:1" version="2" result="true"/>
                    <criterion test_ref="oval:ssg-test_dev_shm_no_partition_nodev_optional_no:tst:1" version="1" result="false" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_boot_nosuid:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_boot_partition_nosuid_optional_yes:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_boot_noexec:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_boot_partition_noexec_optional_yes:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_boot_nodev:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_boot_partition_nodev_optional_yes:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_boot_noauto:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_boot_partition_noauto_optional_yes:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-logwatch_configured_splithosts:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_logwatch_configured_splithosts:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-logwatch_configured_hostlimit:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_logwatch_configured_hostlimit:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_vfat_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_vfat_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_vfat_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_vfat_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_vfat_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_vfat_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_vfat_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_vfat_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_usb-storage_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_usb-storage_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_usb-storage_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_usb-storage_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_usb-storage_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_usb-storage_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_usb-storage_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_usb-storage_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_udf_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_udf_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_udf_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_udf_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_udf_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_udf_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_udf_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_udf_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_tipc_disabled:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criterion test_ref="oval:ssg-test_kernmod_tipc_disabled:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_kernmod_tipc_etcmodules-load:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_kernmod_tipc_runmodules-load:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_kernmod_tipc_libmodules-load:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_kernmod_tipc_runmodprobed:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_kernmod_tipc_libmodprobed:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_kernmod_tipc_modprobeconf:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_squashfs_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_squashfs_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_squashfs_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_squashfs_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_squashfs_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_squashfs_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_squashfs_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_squashfs_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_rds_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_rds_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_rds_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_rds_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_rds_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_rds_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_rds_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_rds_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_mac80211_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_mac80211_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_mac80211_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_mac80211_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_mac80211_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_mac80211_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_mac80211_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_mac80211_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_jffs2_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_jffs2_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_jffs2_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_jffs2_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_jffs2_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_jffs2_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_jffs2_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_jffs2_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_iwlwifi_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_iwlwifi_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_iwlwifi_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_iwlwifi_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_iwlwifi_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_iwlwifi_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_iwlwifi_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_iwlwifi_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_iwlmvm_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_iwlmvm_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_iwlmvm_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_iwlmvm_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_iwlmvm_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_iwlmvm_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_iwlmvm_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_iwlmvm_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_ipv6_option_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernel_module_ipv6_option_disabled:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_hfsplus_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_hfsplus_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_hfsplus_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_hfsplus_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_hfsplus_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_hfsplus_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_hfsplus_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_hfsplus_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_hfs_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_hfs_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_hfs_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_hfs_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_hfs_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_hfs_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_hfs_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_hfs_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_freevxfs_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_freevxfs_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_freevxfs_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_freevxfs_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_freevxfs_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_freevxfs_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_freevxfs_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_freevxfs_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_firewire-core_disabled:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criterion test_ref="oval:ssg-test_kernmod_firewire-core_disabled:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_kernmod_firewire-core_etcmodules-load:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_kernmod_firewire-core_runmodules-load:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_kernmod_firewire-core_libmodules-load:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_kernmod_firewire-core_runmodprobed:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_kernmod_firewire-core_libmodprobed:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_kernmod_firewire-core_modprobeconf:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_dccp_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_dccp_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_dccp_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_dccp_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_dccp_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_dccp_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_dccp_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_dccp_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_cramfs_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_cramfs_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_cramfs_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_cramfs_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_cramfs_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_cramfs_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_cramfs_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_cramfs_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_cfg80211_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_cfg80211_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_cfg80211_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_cfg80211_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_cfg80211_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_cfg80211_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_cfg80211_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_cfg80211_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_can_disabled:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criterion test_ref="oval:ssg-test_kernmod_can_disabled:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_kernmod_can_etcmodules-load:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_kernmod_can_runmodules-load:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_kernmod_can_libmodules-load:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_kernmod_can_runmodprobed:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_kernmod_can_libmodprobed:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_kernmod_can_modprobeconf:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_bluetooth_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_bluetooth_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_bluetooth_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_bluetooth_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_bluetooth_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_bluetooth_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_bluetooth_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_bluetooth_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_atm_disabled:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criterion test_ref="oval:ssg-test_kernmod_atm_disabled:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_kernmod_atm_etcmodules-load:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_kernmod_atm_runmodules-load:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_kernmod_atm_libmodules-load:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_kernmod_atm_runmodprobed:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_kernmod_atm_libmodprobed:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_kernmod_atm_modprobeconf:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_x86_vsyscall_emulation:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_x86_vsyscall_emulation:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_x86_vsyscall_emulation_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_x86_vsyscall_emulation_absence:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_vmap_stack:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_vmap_stack:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_vmap_stack_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_unmap_kernel_at_el0:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_unmap_kernel_at_el0:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_unmap_kernel_at_el0_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_syn_cookies:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_syn_cookies:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_syn_cookies_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_strict_module_rwx:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_strict_module_rwx:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_strict_module_rwx_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_strict_kernel_rwx:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_strict_kernel_rwx:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_strict_kernel_rwx_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_stackprotector_strong:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_stackprotector_strong:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_stackprotector_strong_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_stackprotector:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_stackprotector:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_stackprotector_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_slub_debug:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_slub_debug:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_slub_debug_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_slab_merge_default:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_slab_merge_default:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_slab_merge_default_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_slab_merge_default_absence:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_slab_freelist_random:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_slab_frelist_random:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_slab_frelist_random_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_slab_freelist_hardened:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_slab_freelist_hardened:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_slab_freelist_hardened_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_security_yama:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_security_yama:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_security_yama_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_security_writable_hooks:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_security_writable_hooks:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_security_writable_hooks_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_security_dmesg_restrict:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_security_dmesg_restrict:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_security_dmesg_restrict_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_security_dmesg_restrict_absence:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_security:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_security:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_security_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_seccomp_filter:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_seccomp_filter:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_seccomp_filter_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_seccomp:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_seccomp:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_seccomp_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_sched_stack_end_check:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_sched_stack_end_check:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_sched_stack_end_check_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_retpoline:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_retpoline:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_retpoline_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_refcount_full:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_refcount_full:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_refcount_full_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_randomize_memory:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_randomize_memory:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_randomize_memory_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_randomize_base:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_randomize_base:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_randomize_base_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_proc_kcore:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_proc_kcore:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_proc_kcore_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_proc_kcore_absence:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_panic_timeout:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_panic_timeout:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_panic_timeout_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_panic_on_oops:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_panic_on_oops:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_panic_on_oops_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_page_table_isolation:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_page_table_isolation:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_page_table_isolation_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_page_poisoning_zero:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_page_poisoning_zero:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_page_poisoning_zero_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_page_poisoning_no_sanity:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_page_poisoning_no_sanity:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_page_poisoning_no_sanity_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_page_poisoning:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_page_poisoning:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_page_poisoning_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_module_sig_sha512:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_module_sig_sha512:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_module_sig_sha512_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_module_sig_key:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_module_sig_key:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_module_sig_key_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_module_sig_hash:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_module_sig_hash:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_module_sig_hash_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_module_sig_force:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_module_sig_force:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_module_sig_force_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_module_sig_all:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_module_sig_all:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_module_sig_all_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_module_sig:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_module_sig:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_module_sig_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_modify_ldt_syscall:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_modify_ldt_syscall:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_modify_ldt_syscall_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_modify_ldt_syscall_absence:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_legacy_vsyscall_xonly:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_legacy_vsyscall_xonly:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_legacy_vsyscall_xonly_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_legacy_vsyscall_xonly_absence:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_legacy_vsyscall_none:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_legacy_vsyscall_none:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_legacy_vsyscall_none_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_legacy_vsyscall_emulate:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_legacy_vsyscall_emulate:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_legacy_vsyscall_emulate_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_legacy_vsyscall_emulate_absence:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_legacy_ptys:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_legacy_ptys:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_legacy_ptys_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_legacy_ptys_absence:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_kexec:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_kexec:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_kexec_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_kexec_absence:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_ipv6:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_ipv6:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_ipv6_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_ipv6_absence:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_ia32_emulation:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_ia32_emulation:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_ia32_emulation_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_ia32_emulation_absence:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_hibernation:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_hibernation:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_hibernation_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_hibernation_absence:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_hardened_usercopy_fallback:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_hardened_usercopy_fallback:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_hardened_usercopy_fallback_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_hardened_usercopy_fallback_absence:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_hardened_usercopy:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_hardened_usercopy:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_hardened_usercopy_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_gcc_plugin_structleak_byref_all:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_gcc_plugin_structleak_byref_all:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_gcc_plugin_structleak_byref_all_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_gcc_plugin_structleak:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_gcc_plugin_structleak:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_gcc_plugin_structleak_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_gcc_plugin_stackleak:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_gcc_plugin_stackleak:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_gcc_plugin_stackleak_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_gcc_plugin_randstruct:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_gcc_plugin_randstruct:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_gcc_plugin_randstruct_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_gcc_plugin_latent_entropy:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_gcc_plugin_latent_entropy:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_gcc_plugin_latent_entropy_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_fortify_source:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_fortify_source:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_fortify_source_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_devkmem:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_devkmem:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_devkmem_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_devkmem_absence:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_default_mmap_min_addr:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_default_mmap_min_addr:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_default_mmap_min_addr_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_debug_wx:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_debug_wx:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_debug_wx_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_debug_sg:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_debug_sg:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_debug_sg_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_debug_notifiers:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_debug_notifiers:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_debug_notifiers_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_debug_list:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_debug_list:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_debug_list_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_debug_fs:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_debug_fs:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_debug_fs_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_debug_fs_absence:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_debug_credentials:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_debug_credentials:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_debug_credentials_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_compat_vdso:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_compat_vdso:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_compat_vdso_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_compat_vdso_absence:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_compat_brk:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_compat_brk:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_compat_brk_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_compat_brk_absence:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_bug_on_data_corruption:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_bug_on_data_corruption:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_bug_on_data_corruption_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_bug:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_bug:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_bug_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_binfmt_misc:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_binfmt_misc:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_binfmt_misc_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_binfmt_misc_absence:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_arm64_sw_ttbr0_pan:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_arm64_sw_ttbr0_pan:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_arm64_sw_ttbr0_pan_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_config_acpi_custom_method:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_kernel_config_acpi_custom_method:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_all_kernels_config_acpi_custom_method_compliant:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_kernel_config_acpi_custom_method_absence:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kerberos_disable_no_keytab:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kerberos_disable_no_keytab:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_is_a_machine:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_env_is_a_container:def:1" version="2" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_is_a_container:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_installed_env_is_a_docker_container:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_installed_env_is_a_podman_container:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_zipl_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_zipl_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_yum_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_yum_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_wifi_interface:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_proc_net_wireless_exists:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_usbguard_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_usbguard_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_tftp_server_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_tftp_server_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_systemd_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_systemd_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_sudo_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_sudo_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_sssd-common_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_sssd-common_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_postfix_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_postfix_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_polkit_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_polkit_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_pam_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_pam_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_ovirt:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_ovirt-host_installed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_env_has_ovirt-engine_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_ntp_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_ntp_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_nss-pam-ldapd_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_nss-pam-ldapd_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_no_ovirt:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_env_has_ovirt:def:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_net-snmp_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_net-snmp_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_login_defs:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_login_defs_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_libuser_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_libuser_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_grub2_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_grub2_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" version="1" result="not evaluated" negate="true"/>
                      <criterion test_ref="oval:ssg-test_system_using_opal:tst:1" version="1" result="not evaluated" negate="true"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_gdm_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_gdm_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_chrony_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_chrony_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_audit_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_audit_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_app_is_rhv4:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel7:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_rhevm4_version:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_wrlinux8:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_unix_wrlinux8:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_wrlinux8_version:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_wrlinux1019:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_unix_wrlinux1019:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_wrlinux1019_name:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_wrlinux1019_version:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_vendor_supported:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel7:def:1" version="1" result="false"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel8:def:1" version="1" result="false"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel9:def:1" version="1" result="false"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_ol7_family:def:1" version="1" result="false"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_ol8_family:def:1" version="1" result="false"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_sle12:def:1" version="1" result="false"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_sle15:def:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ubuntu:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_lsb:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ubuntu:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ubuntu2004:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ubuntu_focal:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ubuntu1804:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ubuntu_bionic:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ubuntu1604:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ubuntu_xenial:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_sle15:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_sle15_unix_family:tst:1" version="1" result="true"/>
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_sle15_desktop:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_sle15_server:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_sles_15_for_sap:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_sle12:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_sle12_unix_family:tst:1" version="1" result="true"/>
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_sle12_desktop:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_sle12_server:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_sles_12_for_sap:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_sl7:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_sl7:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_sl6:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_sl6:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhv4:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel8:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel9:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_rhel9_unix_family:tst:1" version="1" result="true"/>
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_rhel9:tst:1" version="1" result="false"/>
                      <criteria operator="AND" result="false">
                        <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_rhevh_rhel9_version:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_9:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_9:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_8:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_8:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_7:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_7:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_6:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_6:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_5:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_5:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_4:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_4:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_3:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_3:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_2:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_2:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_1:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_1:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_10:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_10:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_0:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_rhel8_unix_family:tst:1" version="1" result="true"/>
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_rhel8:tst:1" version="1" result="false"/>
                      <criteria operator="AND" result="false">
                        <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_rhevh_rhel8_version:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel7:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_rhel7_unix_family:tst:1" version="1" result="true"/>
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_rhel7_client:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_rhel7_workstation:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_rhel7_server:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_rhel7_computenode:tst:1" version="1" result="false"/>
                      <criteria operator="AND" result="false">
                        <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_rhevh_rhel7_version:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhcos4:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_rhcos:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_rhcos4:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_unix_family:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_opensuse_leap42:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_opensuse:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_opensuse_leap42_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_opensuse_leap15:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_opensuse:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_opensuse_leap15_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_opensuse:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_opensuse_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ol9_family:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_ol9_system:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ol8_family:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="true"/>
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_ol8_system:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ol7_family:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="true"/>
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_ol7_system:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_fedora:def:1" result="true" version="3">
                  <criteria operator="AND" result="true">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_fedora_release_rpm:tst:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_fedora_vendor_product:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_debian:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_debian:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_debian9:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_debian:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_debian_9:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_debian11:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_debian:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_debian_11:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_debian10:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_debian:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_debian_10:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_centos9:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_centos9_name:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_centos9_version:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_centos8:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_centos8_name:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_centos8_version:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_centos7:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_centos7:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_centos6:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_centos6:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_FIPS_certified:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel7:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel8:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_rhcos4:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_ol7_family:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_sle12:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_sle15:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu1604:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu1804:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu2004:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-install_smartcard_packages:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_openssl-pkcs11_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-install_mcafee_hbss_pa:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_mcafee_auditengine_exists:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-install_mcafee_hbss_accm:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_mcafee_accm_exists:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-install_mcafee_hbss:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-install_mcafee_cma_rt:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-install_mcafee_hbss_accm:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-package_MFEhiplsm_installed:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-install_mcafee_hbss_pa:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-install_mcafee_cma_rt:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_mcafee_runtime_installed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_mcafee_management_agent:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-install_mcafee_antivirus:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-install_mcafee_cma_rt:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_linuxshield_install_antivirus:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-install_hids:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-install_mcafee_hbss:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_selinux_enforcing:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-install_antivirus:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-install_mcafee_antivirus:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-install_PAE_kernel_on_x86-32:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-system_info_architecture_x86:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_PAE_NX_cpu_support:tst:1" version="1" result="not evaluated" negate="true"/>
                      <criteria operator="AND" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_x86:def:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_package_kernel-PAE_installed:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_defaultkernel_sysconfig_kernel:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-harden_sshd_macs_openssh_conf_crypto_policy:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_harden_sshd_macs_openssh_conf_crypto_policy:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-harden_sshd_crypto_policy:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_harden_sshd_crypto_policy:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_harden_sshd_ciphers_openssh_conf_crypto_policy:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-harden_ssh_client_crypto_policy:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_Match:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_RekeyLimit:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_GSSAPIAuthentication:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_Ciphers:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_MACs:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_KexAlgorithms:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_vsyscall_argument:def:1" result="false" version="2">
                  <criteria operator="AND" result="false">
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_grub2_vsyscall_argument:tst:1" version="1" result="false"/>
                      <criteria operator="AND" result="false">
                        <criterion test_ref="oval:ssg-test_grub2_vsyscall_argument_default:tst:1" version="1" result="false"/>
                        <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1" result="true"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_uefi_password:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_grub2_uefi_password_usercfg:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_uefi_admin_username:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_bootloader_uefi_superuser_differ_from_other_users:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_spectre_v2_argument:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_grub2_spectre_v2_argument:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_grub2_spectre_v2_argument_default:tst:1" version="1" result="not evaluated"/>
                        <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_spec_store_bypass_disable_argument:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_grub2_spec_store_bypass_disable_argument:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_grub2_spec_store_bypass_disable_argument_default:tst:1" version="1" result="not evaluated"/>
                        <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_slub_debug_argument:def:1" result="false" version="2">
                  <criteria operator="AND" result="false">
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_grub2_slub_debug_argument:tst:1" version="1" result="false"/>
                      <criteria operator="AND" result="false">
                        <criterion test_ref="oval:ssg-test_grub2_slub_debug_argument_default:tst:1" version="1" result="false"/>
                        <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1" result="true"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_slab_nomerge_argument:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_grub2_slab_nomerge_argument:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_grub2_slab_nomerge_argument_default:tst:1" version="1" result="not evaluated"/>
                        <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_rng_core_default_quality_argument:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_grub2_rng_core_default_quality_argument:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_grub2_rng_core_default_quality_argument_default:tst:1" version="1" result="not evaluated"/>
                        <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_pti_argument:def:1" result="false" version="2">
                  <criteria operator="AND" result="false">
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_grub2_pti_argument:tst:1" version="1" result="false"/>
                      <criteria operator="AND" result="false">
                        <criterion test_ref="oval:ssg-test_grub2_pti_argument_default:tst:1" version="1" result="false"/>
                        <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1" result="true"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_password:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <criteria operator="OR" result="false">
                        <criterion test_ref="oval:ssg-test_grub2_password_usercfg:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_grub2_password_grubcfg:tst:1" version="1" result="false"/>
                      </criteria>
                      <criterion test_ref="oval:ssg-test_bootloader_superuser:tst:1" version="2" result="true"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_page_poison_argument:def:1" result="false" version="2">
                  <criteria operator="AND" result="false">
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_grub2_page_poison_argument:tst:1" version="1" result="false"/>
                      <criteria operator="AND" result="false">
                        <criterion test_ref="oval:ssg-test_grub2_page_poison_argument_default:tst:1" version="1" result="false"/>
                        <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1" result="true"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_nousb_argument:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_grub2_nousb_argument:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_nosmep_argument_absent:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_grub2_nosmep_argument_absent:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_grub2_nosmep_argument_absent_default:tst:1" version="1" result="not evaluated"/>
                        <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_nosmap_argument_absent:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_grub2_nosmap_argument_absent:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_grub2_nosmap_argument_absent_default:tst:1" version="1" result="not evaluated"/>
                        <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_mds_argument:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_grub2_mds_argument:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_grub2_mds_argument_default:tst:1" version="1" result="not evaluated"/>
                        <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_mce_argument:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_grub2_mce_argument:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_grub2_mce_argument_default:tst:1" version="1" result="not evaluated"/>
                        <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_l1tf_argument:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_grub2_l1tf_argument:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_grub2_l1tf_argument_default:tst:1" version="1" result="not evaluated"/>
                        <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_ipv6_disable_argument:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_grub2_ipv6_disable_argument:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_grub2_ipv6_disable_argument_default:tst:1" version="1" result="not evaluated"/>
                        <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_entries_reference_kernelopts:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_grub2_entries_reference_kernelopts:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_enable_selinux:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_selinux_default_grub:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_selinux_grub2_cfg:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_selinux_grub_dir:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_enable_iommu_force:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_grub2_iommu_argument:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_grub2_iommu_argument_default:tst:1" version="1" result="not evaluated"/>
                        <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_disable_interactive_boot:def:1" result="true" version="4">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux:tst:1" version="1" result="true"/>
                    <criteria operator="AND" result="true">
                      <criterion test_ref="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux_default:tst:1" version="1" result="true"/>
                      <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1" result="true"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_default_exists:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_grub2_default_exists:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_audit_backlog_limit_argument:def:1" result="false" version="2">
                  <criteria operator="AND" result="false">
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_grub2_audit_backlog_limit_argument:tst:1" version="1" result="false"/>
                      <criteria operator="AND" result="false">
                        <criterion test_ref="oval:ssg-test_grub2_audit_backlog_limit_argument_default:tst:1" version="1" result="false"/>
                        <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1" result="true"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_audit_argument:def:1" result="false" version="2">
                  <criteria operator="AND" result="false">
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_grub2_audit_argument:tst:1" version="1" result="false"/>
                      <criteria operator="AND" result="false">
                        <criterion test_ref="oval:ssg-test_grub2_audit_argument_default:tst:1" version="1" result="false"/>
                        <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1" result="true"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_admin_username:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_bootloader_superuser_differ_from_other_users:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-group_unique_name:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_etc_group_no_duplicate_group_names:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-group_unique_id:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_etc_group_no_duplicate_group_ids:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-gnome_gdm_disable_xdmcp:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_gnome_gdm_disable_xdmcp:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_gnome_gdm_disable_xdmcp_config_file_exists:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-gnome_gdm_disable_guest_login:def:1" result="false" version="2">
                  <criteria operator="OR" result="false">
                    <extend_definition definition_ref="oval:ssg-package_gdm_installed:def:1" version="1" result="false" negate="true"/>
                    <criterion test_ref="oval:ssg-test_disable_guest_login:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-gnome_gdm_disable_automatic_login:def:1" result="false" version="2">
                  <criteria operator="OR" result="false">
                    <extend_definition definition_ref="oval:ssg-package_gdm_installed:def:1" version="1" result="false" negate="true"/>
                    <criterion test_ref="oval:ssg-test_disable_automatic_login:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-gid_passwd_group_same:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_gid_passwd_group_same:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-ftp_present_banner:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_vsftpd_removed:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ftp_present_banner:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-ftp_log_transactions:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_vsftpd_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_ftp_log_transactions_enable:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_ftp_log_transactions_format:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_ftp_log_transactions_protocol:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-force_opensc_card_drivers:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_force_opensc_card_drivers:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_var_log_syslog:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_var_log_syslog_0:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_var_log_messages:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_var_log_messages_0:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_var_log_audit:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-auditd_conf_log_file_not_set:def:1" version="1" result="not evaluated" negate="true"/>
                      <criteria operator="AND" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_file_permissions_audit_log-non_root:tst:1" version="1" result="not evaluated" negate="true"/>
                      </criteria>
                      <criterion test_ref="oval:ssg-test_file_permissions_audit_log:tst:1" version="1" result="not evaluated" negate="true"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_file_permissions_var_log_audit-non_root:tst:1" version="1" result="not evaluated" negate="true"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_file_permissions_var_log_audit:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_var_log:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_var_log_0:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_ungroupowned:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_ungroupowned:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_unauthorized_world_writable:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_unauthorized_world_write:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_unauthorized_suid:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_unauthorized_suid:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_unauthorized_sgid:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_unauthorized_sgid:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_systemmap:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_permissions_systemmap_files:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_sshd_pub_key:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_sshd_pub_key_0:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_sshd_private_key:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_sshd_private_key_0:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_library_dirs:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_library_dirs_0:tst:1" version="3" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_permissions_library_dirs_1:tst:1" version="3" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_permissions_library_dirs_2:tst:1" version="3" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_permissions_library_dirs_3:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_home_dirs:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_home_dirs:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_grub2_cfg:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_grub2_cfg_0:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_etc_shadow:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_etc_shadow_0:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_etc_passwd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_etc_passwd_0:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_etc_motd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_etc_motd_0:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_etc_issue:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_etc_issue_0:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_etc_gshadow:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_etc_gshadow_0:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_etc_group:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_etc_group_0:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_etc_audit_rulesd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_etc_audit_rulesd_0:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_etc_audit_auditd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_etc_audit_auditd_0:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_efi_grub2_cfg:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_efi_grub2_cfg_0:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_binary_dirs:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_perms_binary_files:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_backup_etc_shadow:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_backup_etc_shadow_0:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_backup_etc_passwd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_backup_etc_passwd_0:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_backup_etc_gshadow:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_backup_etc_gshadow_0:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_backup_etc_group:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_backup_etc_group_0:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_ownership_var_log_audit:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_ownership_var_log_audit_files:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_ownership_var_log_audit_directories:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_ownership_var_log_audit_files-non_root:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_ownership_var_log_audit_directories-non_root:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_ownership_library_dirs:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_ownership_library_dirs_0:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_ownership_library_dirs_1:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_ownership_library_dirs_2:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_ownership_library_dirs_3:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_ownership_binary_dirs:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_ownership_binary_directories:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ownership_binary_files:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_ownership_audit_configuration:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_ownership_audit_configuration_0:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_ownership_audit_configuration_1:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_var_log_syslog:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_var_log_syslog_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_var_log_messages:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_var_log_messages_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_var_log:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_var_log_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_grub2_cfg:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_grub2_cfg_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_etc_shadow:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_etc_shadow_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_etc_passwd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_etc_passwd_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_etc_motd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_etc_motd_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_etc_issue:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_etc_issue_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_etc_gshadow:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_etc_gshadow_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_etc_group:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_etc_group_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_efi_grub2_cfg:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_efi_grub2_cfg_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_backup_etc_shadow:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_backup_etc_shadow_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_backup_etc_passwd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_backup_etc_passwd_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_backup_etc_gshadow:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_backup_etc_gshadow_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_backup_etc_group:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_backup_etc_group_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupownership_system_commands_dirs:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_groupownership_system_commands_dirs:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupownership_audit_configuration:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupownership_audit_configuration_0:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_groupownership_audit_configuration_1:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_var_log_syslog:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_var_log_syslog_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_var_log_messages:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_var_log_messages_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_var_log:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_var_log_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_grub2_cfg:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_grub2_cfg_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_etc_shadow:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_etc_shadow_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_etc_passwd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_etc_passwd_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_etc_motd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_etc_motd_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_etc_issue:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_etc_issue_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_etc_gshadow:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_etc_gshadow_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_etc_group:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_etc_group_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_efi_grub2_cfg:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_efi_grub2_cfg_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_backup_etc_shadow:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_backup_etc_shadow_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_backup_etc_passwd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_backup_etc_passwd_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_backup_etc_gshadow:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_backup_etc_gshadow_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_backup_etc_group:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_backup_etc_group_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_cron_deny_not_exist:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_cron_deny_not_exist:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_at_deny_not_exist:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_at_deny_not_exist:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-etc_system_fips_exists:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_etc_system_fips:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-ensure_logrotate_activated:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_logrotate_conf_daily_setting:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_logrotate_conf_no_other_keyword:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_cron_daily_logrotate_existence:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-ensure_gpgcheck_repo_metadata:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_yum_ensure_gpgcheck_repo_metadata:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-ensure_gpgcheck_never_disabled:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_ensure_gpgcheck_never_disabled:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-ensure_gpgcheck_local_packages:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_yum_ensure_gpgcheck_local_packages:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-ensure_gpgcheck_globally_activated:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_ensure_gpgcheck_globally_activated:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-ensure_fedora_gpgkey_installed:def:1" result="true" version="2">
                  <criteria operator="AND" result="true">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_fedora:def:1" version="3" result="true"/>
                    <criteria operator="OR" result="true">
                      <criterion test_ref="oval:ssg-test_package_gpgkey-5323552a-6112bcdc_installed:tst:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_package_gpgkey-38ab71f4-60242b08_installed:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_package_gpgkey-9867c58f-601c49ca_installed:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_package_gpgkey-45719a39-5f2c0192_installed:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-enable_pam_namespace:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_enable_pam_namespace:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-enable_fips_mode:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-etc_system_fips_exists:def:1" version="1" result="false"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_crypto_fips_enabled:def:1" version="1" result="false"/>
                    <extend_definition definition_ref="oval:ssg-enable_dracut_fips_module:def:1" version="1" result="false"/>
                    <extend_definition definition_ref="oval:ssg-configure_crypto_policy:def:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_system_crypto_policy_value:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-enable_dracut_fips_module:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_enable_dracut_fips_module:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-enable_dconf_user_profile:def:1" result="true" version="1">
                  <criteria operator="OR" result="true">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="false" negate="true"/>
                    <criterion test_ref="oval:ssg-test_dconf_user_profile:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dnf-automatic_security_updates_only:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_dnf-automatic_security_updates_only:tst:1" version="1" result="false"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_dnf-automatic_security_updates_only_config_file_exists:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dnf-automatic_apply_updates:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_dnf-automatic_apply_updates:tst:1" version="1" result="false"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_dnf-automatic_apply_updates_config_file_exists:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-display_login_attempts:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_display_login_attempts:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_display_login_attempts_silent:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-disallow_bypass_password_sudo:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_disallow_bypass_password_sudo:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-disable_users_coredumps:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_core_dumps_limits_d:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_core_dumps_limits_d_exists:tst:1" version="1" result="not evaluated" negate="true"/>
                      <criterion test_ref="oval:ssg-test_core_dumps_limitsconf:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-disable_host_auth:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="true"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="true"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="true"/>
                      <criteria operator="OR" result="false">
                        <criterion test_ref="oval:ssg-test_disable_host_auth:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_disable_host_auth_config_dir:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-disable_ctrlaltdel_reboot:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_disable_ctrlaltdel_exists:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-directory_permissions_var_log_audit:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-auditd_conf_log_file_not_set:def:1" version="1" result="not evaluated" negate="true"/>
                      <criteria operator="AND" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_dir_permissions_audit_log-non_root:tst:1" version="1" result="not evaluated" negate="true"/>
                      </criteria>
                      <criterion test_ref="oval:ssg-test_dir_permissions_audit_log:tst:1" version="1" result="not evaluated" negate="true"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_dir_permissions_var_log_audit:tst:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_dir_permissions_var_log_audit-non_root:tst:1" version="1" result="not evaluated" negate="true"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-directory_access_var_log_audit:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_directory_acccess_var_log_audit_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_directory_acccess_var_log_audit_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dir_perms_world_writable_system_owned_group:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated" negate="true">
                    <criterion test_ref="oval:ssg-test_dir_world_writable_gid_gt_value:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dir_perms_world_writable_system_owned:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated" negate="true">
                    <criterion test_ref="oval:ssg-test_dir_world_writable_uid_gt_value:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dir_perms_world_writable_sticky_bits:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_dir_perms_world_writable_sticky_bits:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dir_perms_world_writable_root_owned:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated" negate="true">
                    <criterion test_ref="oval:ssg-test_dir_world_writable_uid_gt_zero:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dir_permissions_library_dirs:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissionsdir_permissions_library_dirs_0:tst:1" version="3" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_permissionsdir_permissions_library_dirs_1:tst:1" version="3" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_permissionsdir_permissions_library_dirs_2:tst:1" version="3" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_permissionsdir_permissions_library_dirs_3:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dir_permissions_binary_dirs:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_0:tst:1" version="3" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_1:tst:1" version="3" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_2:tst:1" version="3" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_3:tst:1" version="3" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_4:tst:1" version="3" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_5:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dir_ownership_library_dirs:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_ownerdir_ownership_library_dirs_0:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_ownerdir_ownership_library_dirs_1:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_ownerdir_ownership_library_dirs_2:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_ownerdir_ownership_library_dirs_3:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dir_ownership_binary_dirs:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_ownerdir_ownership_binary_dirs_0:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_ownerdir_ownership_binary_dirs_1:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_ownerdir_ownership_binary_dirs_2:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_ownerdir_ownership_binary_dirs_3:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_ownerdir_ownership_binary_dirs_4:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_ownerdir_ownership_binary_dirs_5:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dir_group_ownership_library_dirs:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_0:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_1:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_2:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_3:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_session_idle_user_locks:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="false" negate="true"/>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_user_change_idle_delay_lock:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_screensaver_user_locks:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="false" negate="true"/>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_user_change_lock_delay_lock:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_screensaver_user_info:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="false" negate="true"/>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_screensaver_disable_user_info:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_info_change:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_screensaver_mode_blank:def:1" result="false" version="2">
                  <criteria operator="OR" result="false">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="false" negate="true"/>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_screensaver_mode_blank:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_screensaver_mode_change:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_screensaver_lock_locked:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_screensaver_lock_locked:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_screensaver_lock_enabled:def:1" result="false" version="2">
                  <criteria operator="OR" result="false">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="false" negate="true"/>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_screensaver_lock_enabled:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_screensaver_lock:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_screensaver_lock_delay:def:1" result="false" version="2">
                  <criteria operator="OR" result="false">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="false" negate="true"/>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_screensaver_lock_delay:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_screensaver_lock_delay_setting:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_screensaver_idle_delay:def:1" result="false" version="2">
                  <criteria operator="OR" result="false">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="false" negate="true"/>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_screensaver_idle_delay:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_screensaver_idle_delay_setting:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_screensaver_idle_activation_locked:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_change_idle_activation_locked:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_screensaver_idle_activation_enabled:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="false" negate="true"/>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_screensaver_idle_activation_enabled:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_change_idle_activation_enabled:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_remote_access_encryption:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_configure_remote_access_encryption:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_remote_access_encryption:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_remote_access_credential_prompt:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_configure_remote_access_creds:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_remote_access_creds:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_login_retries:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="false" negate="true"/>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_configure_allowed_failures:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_allowed-failures_change:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_login_banner_text:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="false" negate="true"/>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_banner_change:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_gdm_login_banner_text_setting:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_lock_screen_on_smartcard_removal:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_dconf_gnome_lock_screen_on_smartcard_removal:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_removal-action:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_enable_smartcard_auth:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_enable_gnome_smartcard:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_disable_smartcard:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_disable_wifi_notification:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_disable_wifi_notification:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_enable_wifi_notification:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_disable_wifi_create:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_disable_wifi_creation:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_enable_wifi_creation:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_disable_user_list:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_disable_user_list:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_disable_user_list:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_disable_user_admin:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_dconf_gnome_disable_user_admin:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_user-administration-disabled:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_disable_thumbnailers:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_gnome_disable_thumbnailers:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_change_gnome_thumbnailers:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_disable_restart_shutdown:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_disable_restart_buttons:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_enable_restart_buttons:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_disable_power_settings:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_disable_gnome_power_setting:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_power_setting_change:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_disable_geolocation:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_disable_sys_geolocation:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_sys_geolocation:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_disable_clock_geolocation:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_clock_geolocation:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_disable_ctrlaltdel_reboot:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_disable_gnome_ctrlaltdel:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_enable_ctrlaltdel:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_disable_autorun:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_dconf_gnome_disable_autorun:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_gnome_autorun:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_disable_automount_open:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_dconf_gnome_disable_automount_open:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_gnome_automount_open:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_disable_automount:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_dconf_gnome_disable_automount:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_gnome_automount:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_banner_enabled:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="false" negate="true"/>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_banner_gui_enabled:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_banner_gui_enabled_change:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_db_up_to_date:def:1" result="true" version="2">
                  <criteria operator="OR" result="true">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="false" negate="true"/>
                    <criteria operator="AND" result="true">
                      <criteria operator="OR" result="true">
                        <criterion test_ref="oval:ssg-test_dconf_distro_up_to_date:tst:1" version="1" result="true"/>
                        <criterion test_ref="oval:ssg-test_dconf_distro_no_keyfiles:tst:1" version="1" result="false"/>
                      </criteria>
                      <criteria operator="OR" result="true">
                        <criterion test_ref="oval:ssg-test_dconf_local_up_to_date:tst:1" version="1" result="error"/>
                        <criterion test_ref="oval:ssg-test_dconf_local_no_keyfiles:tst:1" version="1" result="true"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-coreos_enable_selinux_kernel_argument:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_coreos_enable_selinux_kernel_argument_file_boot_loader_entries_ostree_2_conf_absent:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:tst:1" version="1" result="not evaluated" negate="true"/>
                      </criteria>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:tst:1" version="1" result="not evaluated" negate="true"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:tst:1" version="1" result="not evaluated" negate="true"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-coredump_disable_storage:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criterion test_ref="oval:ssg-test_coredump_disable_storage:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-coredump_disable_backtraces:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criterion test_ref="oval:ssg-test_coredump_disable_backtraces:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_usbguard_auditbackend:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_configure_usbguard_auditbackend:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_configure_usbguard_auditbackend_config_file_exists:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_tmux_lock_command:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_configure_tmux_lock_command:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_tmux_lock_after_time:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_configure_tmux_lock_after_time:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_ssh_crypto_policy:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_configure_ssh_crypto_policy:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_openssl_crypto_policy:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_configure_openssl_crypto_policy:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_opensc_nss_db:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_configure_opensc_nss_db:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_opensc_card_drivers:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_configure_opensc_card_drivers:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_libreswan_crypto_policy:def:1" result="true" version="1">
                  <criteria operator="OR" result="true">
                    <extend_definition definition_ref="oval:ssg-package_libreswan_installed:def:1" version="1" result="true" negate="true"/>
                    <criterion test_ref="oval:ssg-test_configure_libreswan_crypto_policy:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_kerberos_crypto_policy:def:1" result="true" version="2">
                  <criteria operator="OR" result="true">
                    <criterion test_ref="oval:ssg-test_configure_kerberos_crypto_policy_symlink:tst:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_configure_kerberos_crypto_policy_nosymlink:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_gnutls_tls_crypto_policy:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_configure_gnutls_tls_crypto_policy:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_crypto_policy:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_configure_crypto_policy:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_configure_crypto_policy_current:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_crypto_policies_updated:tst:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_crypto_policy_nss_config:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_bind_crypto_policy:def:1" result="true" version="1">
                  <criteria operator="OR" result="true">
                    <extend_definition definition_ref="oval:ssg-package_bind_removed:def:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_configure_bind_crypto_policy:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_bashrc_exec_tmux:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_configure_bashrc_exec_tmux:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-clean_components_post_updating:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_yum_clean_components_post_updating:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-chronyd_specify_remote_server:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_chronyd_remote_server:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-chronyd_specify_multiple_servers:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_chronyd_multiple_servers:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-chronyd_server_directive:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_chronyd_server_directive_with_server:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_chronyd_server_directive_no_pool:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-chronyd_run_as_chrony_user:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_chronyd_run_as_chrony_user:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_chronyd_run_as_chrony_user_config_file_exists:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-chronyd_or_ntpd_specify_remote_server:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-service_chronyd_enabled:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-chronyd_specify_remote_server:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-service_ntpd_enabled:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-ntpd_specify_remote_server:def:1" version="2" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-chronyd_or_ntpd_specify_multiple_servers:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-service_chronyd_enabled:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-chronyd_specify_multiple_servers:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-service_ntpd_enabled:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-ntpd_specify_multiple_servers:def:1" version="2" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-chronyd_or_ntpd_set_maxpoll:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_ntp_no_server:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_ntp_set_maxpoll:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_ntp_all_server_has_maxpoll:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_chrony_no_server_nor_pool:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_chrony_set_maxpoll:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_chrony_all_server_has_maxpoll:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-chronyd_no_chronyc_network:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-service_chronyd_enabled:def:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_chronyd_no_chronyc_network:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-chronyd_client_only:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-service_chronyd_enabled:def:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_chronyd_client_only:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_bootloader_disable_recovery_set_to_true:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-bios_enable_execution_restrictions:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_NX_cpu_support:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_messages_nx_active:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_noexec_cmd_line:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-banner_etc_motd:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_banner_etc_motd:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-banner_etc_issue:def:1" result="false" version="2">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_banner_etc_issue:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_write_logs:def:1" result="true" version="1">
                  <criteria operator="OR" result="true">
                    <criterion test_ref="oval:ssg-test_auditd_write_logs:tst:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_auditd_write_logs_default_not_overriden:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_overflow_action:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_overflow_action:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_name_format:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criterion test_ref="oval:ssg-test_auditd_name_format:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_log_format:def:1" result="true" version="1">
                  <criteria operator="OR" result="true">
                    <criterion test_ref="oval:ssg-test_auditd_log_format:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_local_events:def:1" result="true" version="1">
                  <criteria operator="OR" result="true">
                    <criterion test_ref="oval:ssg-test_auditd_local_events:tst:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_auditd_local_events_default_not_overriden:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_freq:def:1" result="true" version="1">
                  <criteria operator="OR" result="true">
                    <criterion test_ref="oval:ssg-test_auditd_freq:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_data_retention_space_left_percentage:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_data_retention_space_left_percentage:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_data_retention_space_left_action:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_data_retention_space_left_action:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_data_retention_num_logs:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_data_retention_num_logs:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_data_retention_max_log_file_action:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_data_retention_max_log_file_action:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_data_retention_max_log_file:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_data_retention_max_log_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_data_retention_flush:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_data_retention_flush:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_data_retention_admin_space_left_action:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_data_retention_admin_space_left_action:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_data_retention_action_mail_acct:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_data_retention_action_mail_acct:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_data_disk_full_action:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_data_disk_full_action:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_data_disk_error_action:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_data_disk_error_action:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_conf_log_group_not_root:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_conf_log_group_not_root:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_auditd_conf_log_group_is_set:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_conf_log_file_not_set:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_conf_log_file_not_set:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_audispd_syslog_plugin_activated:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_auditd_audispd_syslog_plugin_activated:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_audispd_encrypt_sent_records:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_auditd_audispd_encrypt_sent_records:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_audispd_configure_remote_server:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_auditd_audispd_configure_remote_server:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_usergroup_modification_shadow:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_shadow_augen:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_shadow_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_usergroup_modification_passwd:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_passwd_augen:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_passwd_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_usergroup_modification_opasswd:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_opasswd_augen:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_opasswd_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_usergroup_modification_gshadow:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_gshadow_augen:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_gshadow_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_usergroup_modification_group:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_group_augen:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_group_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_usergroup_modification:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_group_augen:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_augen:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_augen:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_augen:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_augen:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_group_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_unlinkat:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_unlinkat_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_unlinkat_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_unlinkat_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_unlinkat_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_unlinkat_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_unlinkat_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_unlinkat_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_unlinkat_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_unlink:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_unlink_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_unlink_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_unlink_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_unlink_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_unlink_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_unlink_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_unlink_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_unlink_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_truncate:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_truncate_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_truncate_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_truncate_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_truncate_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_truncate_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_truncate_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_truncate_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_truncate_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_setxattr:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_setxattr_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_setxattr_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_setxattr_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_setxattr_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_setxattr_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_setxattr_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_setxattr_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_setxattr_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_renameat:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_renameat_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_renameat_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_renameat_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_renameat_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_renameat_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_renameat_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_renameat_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_renameat_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_rename:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_rename_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_rename_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_rename_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_rename_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_rename_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_rename_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_rename_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_rename_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_removexattr:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_removexattr_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_removexattr_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_removexattr_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_removexattr_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_removexattr_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_removexattr_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_removexattr_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_removexattr_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_openat_rule_order:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_arufm_openat_order_32bit_eacces_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_openat_order_32bit_eperm_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_arufm_openat_order_64bit_eacces_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_arufm_openat_order_64bit_eperm_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_openat_order_32bit_eacces_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_openat_order_32bit_eperm_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_arufm_openat_order_64bit_eacces_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_arufm_openat_order_64bit_eperm_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eacces_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eperm_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eacces_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eperm_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eacces_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eperm_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eacces_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eperm_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eacces_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eperm_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eacces_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eperm_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eacces_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eperm_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eacces_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eperm_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_openat:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_openat_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_openat_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_openat_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_openat_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_openat_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_openat_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_openat_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_openat_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_open_rule_order:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_order_32bit_eacces_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_order_32bit_eperm_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_arufm_open_order_64bit_eacces_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_arufm_open_order_64bit_eperm_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_order_32bit_eacces_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_order_32bit_eperm_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_arufm_open_order_64bit_eacces_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_arufm_open_order_64bit_eperm_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eacces_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eperm_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eacces_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eperm_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eacces_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eperm_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eacces_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eperm_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_open_o_creat:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eacces_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eperm_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eacces_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eperm_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eacces_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eperm_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eacces_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eperm_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eacces_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eperm_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eacces_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eperm_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eacces_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eperm_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eacces_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eperm_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_open:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_open_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_open_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_open_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_open_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_open_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_open_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_open_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_open_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_lsetxattr:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_lsetxattr_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_lsetxattr_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_lsetxattr_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_lsetxattr_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_lsetxattr_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_lsetxattr_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_lsetxattr_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_lsetxattr_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_lremovexattr:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_lremovexattr_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_lremovexattr_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_lremovexattr_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_lremovexattr_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_lremovexattr_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_lremovexattr_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_lremovexattr_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_lremovexattr_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_lchown:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_lchown_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_lchown_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_lchown_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_lchown_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_lchown_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_lchown_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_lchown_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_lchown_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_ftruncate:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_ftruncate_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_ftruncate_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_ftruncate_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_ftruncate_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_ftruncate_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_ftruncate_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_ftruncate_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_ftruncate_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_fsetxattr:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fsetxattr_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fsetxattr_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fsetxattr_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fsetxattr_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fsetxattr_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fsetxattr_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fsetxattr_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fsetxattr_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_fremovexattr:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fremovexattr_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fremovexattr_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fremovexattr_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fremovexattr_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fremovexattr_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fremovexattr_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fremovexattr_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fremovexattr_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_fchownat:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchownat_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchownat_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchownat_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchownat_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchownat_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchownat_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchownat_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchownat_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_fchown:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchown_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchown_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchown_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchown_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchown_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchown_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchown_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchown_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_fchmodat:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchmodat_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchmodat_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchmodat_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchmodat_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchmodat_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchmodat_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchmodat_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchmodat_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_fchmod:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchmod_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchmod_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchmod_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchmod_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchmod_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchmod_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchmod_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchmod_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_creat:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_creat_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_creat_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_creat_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_creat_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_creat_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_creat_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_creat_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_creat_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_chown:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_chown_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_chown_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_chown_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_chown_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_chown_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_chown_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_chown_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_chown_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_chmod:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_chmod_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_chmod_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_chmod_augenrules:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_chmod_augenrules:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_chmod_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_chmod_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criteria operator="AND" result="false">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_chmod_auditctl:tst:1" version="1" result="false"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_chmod_auditctl:tst:1" version="1" result="false"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_creat:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_ftruncate:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_openat:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_open:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_truncate:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_time_watch_localtime:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_artw_etc_localtime_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_artw_etc_localtime_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_time_stime:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_x86:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="OR" result="not evaluated">
                      <criteria operator="AND" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_32bit_art_stime_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                      <criteria operator="AND" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_32bit_art_stime_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_time_settimeofday:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_art_settimeofday_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_art_settimeofday_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_art_settimeofday_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_art_settimeofday_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_time_clock_settime:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_art_clock_settime_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_art_clock_settime_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_art_clock_settime_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_art_clock_settime_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_time_adjtimex:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_art_adjtimex_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_art_adjtimex_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_art_adjtimex_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_art_adjtimex_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_sysadmin_actions:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_session_events:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_arse_utmp_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arse_btmp_augenrules:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arse_wtmp_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arse_utmp_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arse_btmp_auditctl:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arse_wtmp_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_usernetctl:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_usernetctl_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_usernetctl_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_userhelper:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_userhelper_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_userhelper_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_unix_chkpwd:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_umount:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_umount_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_umount_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_sudoedit:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_sudoedit_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_sudoedit_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_sudo:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_sudo_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_sudo_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_su:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_su_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_su_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_ssh_keysign:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_pt_chown:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_pt_chown_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_pt_chown_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_passwd:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_passwd_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_passwd_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_newuidmap:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_newuidmap_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_newuidmap_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_newgrp:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_newgrp_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_newgrp_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_newgidmap:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_newgidmap_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_newgidmap_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_mount:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_mount_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_mount_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_gpasswd:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_gpasswd_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_gpasswd_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_crontab:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_crontab_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_crontab_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_chsh:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_chsh_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_chsh_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_chage:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_chage_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_chage_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_at:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_at_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_at_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arpc_suid_sgid_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arpc_bin_count_equals_rules_count_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arpc_suid_sgid_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arpc_bin_count_equals_rules_count_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_networkconfig_modification_hostname:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_sethostname_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_sethostname_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_sethostname_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_sethostname_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_networkconfig_modification_domainname:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_setdomainname_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_setdomainname_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_setdomainname_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_setdomainname_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_networkconfig_modification:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arnm_etc_issue_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arnm_etc_issue_net_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arnm_etc_hosts_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arnm_etc_sysconfig_network_augenrules:tst:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-audit_rules_networkconfig_modification_hostname:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-audit_rules_networkconfig_modification_domainname:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arnm_etc_issue_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arnm_etc_issue_net_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arnm_etc_hosts_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arnm_etc_sysconfig_network_auditctl:tst:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-audit_rules_networkconfig_modification_hostname:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-audit_rules_networkconfig_modification_domainname:def:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_media_export:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_mount_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_mount_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_mount_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_mount_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_mac_modification:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_armm_selinux_watch_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_armm_selinux_watch_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_login_events_tallylog:def:1" result="false" version="2">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_arle_tallylog_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arle_tallylog_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_login_events_lastlog:def:1" result="false" version="2">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_arle_lastlog_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arle_lastlog_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_login_events_faillock:def:1" result="false" version="2">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_arle_faillock_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_arle_faillock_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_login_events:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-audit_rules_login_events_tallylog:def:1" version="2" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_login_events_faillock:def:1" version="2" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_login_events_lastlog:def:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_kernel_module_loading_init:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_init_module_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_init_module_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_init_module_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_init_module_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_kernel_module_loading_finit:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_finit_module_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_finit_module_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_finit_module_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_finit_module_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_kernel_module_loading_delete:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_delete_module_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_delete_module_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_delete_module_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_delete_module_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_kernel_module_loading:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-audit_rules_kernel_module_loading_init:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_kernel_module_loading_delete:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_kernel_module_loading_finit:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_immutable:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_ari_locked_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_ari_locked_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_file_deletion_events_unlinkat:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_unlinkat_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_unlinkat_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_unlinkat_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_unlinkat_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_file_deletion_events_unlink:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_unlink_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_unlink_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_unlink_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_unlink_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_file_deletion_events_rmdir:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_rmdir_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_rmdir_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_rmdir_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_rmdir_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_file_deletion_events_renameat:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_renameat_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_renameat_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_renameat_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_renameat_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_file_deletion_events_rename:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_rename_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_rename_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_rename_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_rename_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_file_deletion_events:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-audit_rules_file_deletion_events_rmdir:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_file_deletion_events_unlink:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_file_deletion_events_unlinkat:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_file_deletion_events_rename:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_file_deletion_events_renameat:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_execution_seunshare:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_execution_seunshare_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_execution_seunshare_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_execution_setsebool:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_execution_setsebool_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_execution_setsebool_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_execution_semanage:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_execution_semanage_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_execution_semanage_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_execution_restorecon:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_execution_restorecon_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_execution_restorecon_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_execution_chcon:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_execution_chcon_augenrules:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_execution_chcon_auditctl:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_etc_shadow_openat:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_openat_32bit_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_openat_64bit_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_openat_32bit_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_openat_64bit_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_etc_shadow_open_by_handle_at:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_32bit_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_64bit_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_32bit_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_64bit_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_etc_shadow_open:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_32bit_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_64bit_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_32bit_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_64bit_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_etc_passwd_openat:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_openat_32bit_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_openat_64bit_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_openat_32bit_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_openat_64bit_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_etc_passwd_open_by_handle_at:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_32bit_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_64bit_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_32bit_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_64bit_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_etc_passwd_open:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_32bit_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_64bit_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_32bit_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_64bit_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_etc_gshadow_openat:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_openat_32bit_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_openat_64bit_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_openat_32bit_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_openat_64bit_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_etc_gshadow_open_by_handle_at:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_32bit_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_64bit_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_32bit_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_64bit_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_etc_gshadow_open:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_32bit_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_64bit_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_32bit_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_64bit_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_etc_group_openat:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_group_openat_32bit_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_group_openat_64bit_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_group_openat_32bit_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_group_openat_64bit_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_etc_group_open_by_handle_at:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_32bit_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_64bit_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_32bit_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_64bit_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_etc_group_open:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_32bit_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_64bit_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_32bit_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_64bit_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_enable_syscall_auditing:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_enable_syscall_audit_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_enable_syscall_audit_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_umount:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_umount_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_umount_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_umount2:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_umount2_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_umount2_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_umount2_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_umount2_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_setxattr:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_setxattr_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_setxattr_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_setxattr_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_setxattr_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_removexattr:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_removexattr_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_removexattr_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_removexattr_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_removexattr_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_lsetxattr:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_lsetxattr_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_lsetxattr_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_lsetxattr_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_lsetxattr_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_lremovexattr:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_lremovexattr_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_lremovexattr_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_lremovexattr_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_lremovexattr_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_lchown:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_lchown_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_lchown_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_lchown_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_lchown_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_fsetxattr:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_fsetxattr_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_fsetxattr_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_fsetxattr_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_fsetxattr_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_fremovexattr:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_fremovexattr_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_fremovexattr_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_fremovexattr_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_fremovexattr_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_fchownat:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_fchownat_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_fchownat_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_fchownat_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_fchownat_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_fchown:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_fchown_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_fchown_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_fchown_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_fchown_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_fchmodat:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_fchmodat_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_fchmodat_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_fchmodat_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_fchmodat_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_fchmod:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_fchmod_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_fchmod_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_fchmod_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_fchmod_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_chown:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_chown_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_chown_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_chown_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_chown_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_chmod:def:1" result="false" version="1">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_chmod_augenrules:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_chmod_augenrules:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_chmod_auditctl:tst:1" version="1" result="false"/>
                      <criteria operator="OR" result="false">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="false" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_chmod_auditctl:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_augenrules:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_audit_rules_augenrules:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_auditctl:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_audit_rules_auditctl:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-aide_periodic_cron_checking:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_aide_installed:def:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_aide_periodic_cron_checking:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_aide_crond_checking:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_aide_var_cron_checking:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_aide_crontabs_checking:tst:1" version="2" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-aide_check_audit_tools:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_aide_installed:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_aide_verify_auditctl:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_aide_verify_auditd:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_aide_verify_ausearch:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_aide_verify_aureport:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_aide_verify_autrace:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_aide_verify_audispd:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_aide_verify_augenrules:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-aide_build_database:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_aide_installed:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_aide_build_new_database_absolute_path:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_aide_operational_database_absolute_path:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_umask_etc_profile:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-var_accounts_user_umask_as_number:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-tst_accounts_umask_etc_profile:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_umask_etc_login_defs:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-var_accounts_user_umask_as_number:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-tst_accounts_umask_etc_login_defs:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_tmout:def:1" result="false" version="3">
                  <criteria operator="OR" result="false">
                    <criterion test_ref="oval:ssg-test_etc_profile_tmout:tst:1" version="2" result="false"/>
                    <criterion test_ref="oval:ssg-test_etc_profiled_tmout:tst:1" version="2" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_root_path_dirs_no_write:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_root_gid_zero:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_root_gid_zero:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_polyinstantiated_var_tmp:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_var_tmp_tmp_inst:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_var_tmp_in_namespace_conf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_polyinstantiated_tmp:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_tmp_inst:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_tmp_in_namespace_conf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_passwords_pam_faillock_unlock_time:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <criteria operator="AND" result="false">
                      <criteria operator="AND" result="true">
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_unix_auth:tst:1" version="1" result="true"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_unix_auth:tst:1" version="1" result="true"/>
                      </criteria>
                      <criteria operator="AND" result="false">
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_auth:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_account:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_auth:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_account:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="OR" result="false">
                      <criteria operator="AND" result="false">
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_system:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_password:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_faillock_conf:tst:1" version="1" result="true"/>
                      </criteria>
                      <criteria operator="AND" result="false">
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_pamd_system:tst:1" version="1" result="true"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_pamd_password:tst:1" version="1" result="true"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_faillock_conf:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_passwords_pam_faillock_interval:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <criteria operator="AND" result="false">
                      <criteria operator="AND" result="true">
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_unix_auth:tst:1" version="1" result="true"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_unix_auth:tst:1" version="1" result="true"/>
                      </criteria>
                      <criteria operator="AND" result="false">
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_faillock_auth:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_faillock_account:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_faillock_auth:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_faillock_account:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="OR" result="false">
                      <criteria operator="AND" result="false">
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_pamd_system:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_pamd_password:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_faillock_conf:tst:1" version="1" result="true"/>
                      </criteria>
                      <criteria operator="AND" result="false">
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_pamd_system:tst:1" version="1" result="true"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_pamd_password:tst:1" version="1" result="true"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_faillock_conf:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_passwords_pam_faillock_enforce_local:def:1" result="not evaluated" version="5">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_system_pam_unix_auth:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_password_pam_unix_auth:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_system_pam_faillock_auth:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_system_pam_faillock_account:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_password_pam_faillock_auth:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_password_pam_faillock_account:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_parameter_faillock_conf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_passwords_pam_faillock_deny_root:def:1" result="false" version="5">
                  <criteria operator="AND" result="false">
                    <criteria operator="AND" result="false">
                      <criteria operator="AND" result="true">
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_system_pam_unix_auth:tst:1" version="1" result="true"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_password_pam_unix_auth:tst:1" version="1" result="true"/>
                      </criteria>
                      <criteria operator="AND" result="false">
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_auth:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_account:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_auth:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_account:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="OR" result="false">
                      <criteria operator="AND" result="false">
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_pamd_system:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_pamd_password:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_no_faillock_conf:tst:1" version="1" result="true"/>
                      </criteria>
                      <criteria operator="AND" result="false">
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_no_pamd_system:tst:1" version="1" result="true"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_no_pamd_password:tst:1" version="1" result="true"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_faillock_conf:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_passwords_pam_faillock_deny:def:1" result="false" version="5">
                  <criteria operator="AND" result="false">
                    <criteria operator="AND" result="false">
                      <criteria operator="AND" result="true">
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_unix_auth:tst:1" version="1" result="true"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_unix_auth:tst:1" version="1" result="true"/>
                      </criteria>
                      <criteria operator="AND" result="false">
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_faillock_auth:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_faillock_account:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_faillock_auth:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_faillock_account:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                    <criteria operator="OR" result="false">
                      <criteria operator="AND" result="false">
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_pamd_system:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_pamd_password:tst:1" version="1" result="false"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_faillock_conf:tst:1" version="1" result="true"/>
                      </criteria>
                      <criteria operator="AND" result="false">
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_pamd_system:tst:1" version="1" result="true"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_pamd_password:tst:1" version="1" result="true"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_faillock_conf:tst:1" version="1" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_warn_age_login_defs:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_pass_warn_age:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_unix_rounds_system_auth:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_system_auth_pam_unix_rounds_is_set:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_system_auth_pam_unix_rounds_is_default:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_system_auth_default_pam_unix_rounds_var:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_unix_rounds_password_auth:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_password_auth_pam_unix_rounds_is_set:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_password_auth_pam_unix_rounds_is_default:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_password_auth_default_pam_unix_rounds_var:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_unix_remember:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_password_pam_unix_remember:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_ucredit:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="true"/>
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_password_pam_pwquality_ucredit:tst:1" version="3" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_retry:def:1" result="false" version="2">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <criterion test_ref="oval:ssg-test_password_pam_pwquality_retry_system_auth:tst:1" version="1" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_password_pam_pwquality_retry_pwquality_conf:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_pwquality_system_auth:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_password_pam_pwquality_system_auth:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_pwquality_password_auth:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_password_pam_pwquality_password_auth:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_pwquality:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_pwhistory_remember_system_auth:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_pwhistory_remember_password_auth:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_ocredit:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="true"/>
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_password_pam_pwquality_ocredit:tst:1" version="3" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_minlen:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="true"/>
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_password_pam_pwquality_minlen:tst:1" version="3" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_minclass:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_password_pam_pwquality_minclass:tst:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_maxrepeat:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_password_pam_pwquality_maxrepeat:tst:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_maxclassrepeat:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_password_pam_pwquality_maxclassrepeat:tst:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_lcredit:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="true"/>
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_password_pam_pwquality_lcredit:tst:1" version="3" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_faillock:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_password_pam_faillock:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_enforce_root:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_accounts_password_pam_enforce_root:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_enforce_local:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_accounts_password_pam_enforce_local:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_difok:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_password_pam_pwquality_difok:tst:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_dictcheck:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_password_pam_pwquality_dictcheck:tst:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_dcredit:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="true"/>
                    <criteria operator="OR" result="false">
                      <criterion test_ref="oval:ssg-test_password_pam_pwquality_dcredit:tst:1" version="3" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_minlen_login_defs:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_pass_min_len:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_all_shadowed_sha512:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_password_all_shadowed_sha512:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_all_shadowed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_password_all_shadowed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_no_uid_except_zero:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_no_uid_except_root:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_minimum_age_login_defs:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_pass_min_days:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_maximum_age_login_defs:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_pass_max_days:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_max_concurrent_login_sessions:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_limitsd_maxlogins:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_limitsd_maxlogins_exists:tst:1" version="1" result="not evaluated" negate="true"/>
                      <criterion test_ref="oval:ssg-test_maxlogins:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_logon_fail_delay:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_logon_fail_delay:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_have_homedir_login_defs:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_have_homedir_login_defs:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_authorized_local_users:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_authorized_local_users:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-account_unique_name:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-account_unique_id:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_etc_passwd_no_duplicate_user_ids:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-account_disable_post_pw_expiration:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_etc_default_useradd_inactive:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
              </definitions>
              <tests>
                <test test_id="oval:ssg-no_files_unowned_by_user_test:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_chmod_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_chmod_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_chown_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_chown_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_delete_module_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_delete_module_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_fchmod_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_fchmod_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_fchmodat_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_fchmodat_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_fchown_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_fchown_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_fchownat_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_fchownat_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_finit_module_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_finit_module_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_fremovexattr_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_fremovexattr_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_fsetxattr_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_fsetxattr_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_init_module_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_init_module_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_lchown_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_lchown_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_lremovexattr_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_lremovexattr_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_lsetxattr_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_lsetxattr_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_mount_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_mount_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_removexattr_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_removexattr_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_rename_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_rename_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_renameat_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_renameat_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_rmdir_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_rmdir_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_setdomainname_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_setdomainname_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_sethostname_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_sethostname_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_setxattr_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_setxattr_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_umount2_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_umount2_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_umount_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_umount_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_unlink_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_unlink_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_unlinkat_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_ardm_unlinkat_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_32bit_art_adjtimex_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_art_adjtimex_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_art_clock_settime_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_art_clock_settime_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_art_settimeofday_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_art_settimeofday_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_art_stime_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_art_stime_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_chmod_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_chmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_chmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_chmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_chmod_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_chmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_chmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_chmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_chown_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_chown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_chown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_chown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_chown_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_chown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_chown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_chown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_creat_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_creat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_creat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_creat_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_creat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_creat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_fchmod_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_fchmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_fchmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_fchmod_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_fchmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_fchmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_fchmodat_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchmodat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_fchmodat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_fchmodat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_fchmodat_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchmodat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_fchmodat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_fchmodat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_fchown_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_fchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_fchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_fchown_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_fchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_fchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_fchownat_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchownat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_fchownat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_fchownat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_fchownat_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchownat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_fchownat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_fchownat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_fremovexattr_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_fremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_fremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_fremovexattr_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_fremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_fremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_fsetxattr_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_fsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_fsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_fsetxattr_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_fsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_fsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_ftruncate_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_ftruncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_ftruncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_ftruncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_ftruncate_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_ftruncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_ftruncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_ftruncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_lchown_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_lchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_lchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_lchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_lchown_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_lchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_lchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_lchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_lremovexattr_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_lremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_lremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_lremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_lremovexattr_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_lremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_lremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_lremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_lsetxattr_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_lsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_lsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_lsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_lsetxattr_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_lsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_lsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_lsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_open_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_open_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_open_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_open_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_open_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_open_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_open_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_open_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_open_by_handle_at_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_open_by_handle_at_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_open_by_handle_at_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_open_by_handle_at_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_open_by_handle_at_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_open_by_handle_at_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_openat_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_openat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_openat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_openat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_openat_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_openat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_openat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_openat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_removexattr_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_removexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_removexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_removexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_removexattr_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_removexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_removexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_removexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_rename_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_rename_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_rename_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_rename_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_rename_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_rename_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_rename_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_rename_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_renameat_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_renameat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_renameat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_renameat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_renameat_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_renameat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_renameat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_renameat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_setxattr_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_setxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_setxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_setxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_setxattr_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_setxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_setxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_setxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_truncate_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_truncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_truncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_truncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_truncate_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_truncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_truncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_truncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_unlink_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_unlink_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_unlink_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_unlink_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_unlink_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_unlink_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_unlink_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_unlink_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_unlinkat_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_unlinkat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_unlinkat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_unlinkat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_unlinkat_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_unlinkat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_unlinkat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eacces_unlinkat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_chmod_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_chmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_chmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_chmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_chmod_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_chmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_chmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_chmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_chown_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_chown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_chown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_chown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_chown_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_chown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_chown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_chown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_creat_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_creat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_creat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_creat_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_creat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_creat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_fchmod_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_fchmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_fchmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_fchmod_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_fchmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_fchmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_fchmodat_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchmodat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_fchmodat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_fchmodat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_fchmodat_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchmodat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_fchmodat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_fchmodat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_fchown_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_fchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_fchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_fchown_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_fchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_fchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_fchownat_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchownat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_fchownat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_fchownat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_fchownat_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchownat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_fchownat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_fchownat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_fremovexattr_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_fremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_fremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_fremovexattr_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_fremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_fremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_fsetxattr_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_fsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_fsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_fsetxattr_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_fsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_fsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_ftruncate_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_ftruncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_ftruncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_ftruncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_ftruncate_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_ftruncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_ftruncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_ftruncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_lchown_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_lchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_lchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_lchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_lchown_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_lchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_lchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_lchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_lremovexattr_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_lremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_lremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_lremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_lremovexattr_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_lremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_lremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_lremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_lsetxattr_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_lsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_lsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_lsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_lsetxattr_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_lsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_lsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_lsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_open_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_open_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_open_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_open_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_open_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_open_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_open_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_open_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_open_by_handle_at_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_open_by_handle_at_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_open_by_handle_at_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_open_by_handle_at_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_open_by_handle_at_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_open_by_handle_at_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_openat_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_openat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_openat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_openat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_openat_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_openat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_openat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_openat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_removexattr_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_removexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_removexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_removexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_removexattr_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_removexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_removexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_removexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_rename_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_rename_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_rename_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_rename_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_rename_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_rename_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_rename_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_rename_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_renameat_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_renameat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_renameat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_renameat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_renameat_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_renameat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_renameat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_renameat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_setxattr_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_setxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_setxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_setxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_setxattr_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_setxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_setxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_setxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_truncate_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_truncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_truncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_truncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_truncate_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_truncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_truncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_truncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_unlink_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_unlink_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_unlink_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_unlink_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_unlink_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_unlink_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_unlink_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_unlink_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_unlinkat_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_unlinkat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_unlinkat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_unlinkat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_unlinkat_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_unlinkat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_unlinkat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_32bit_arufm_eperm_unlinkat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_ardm_chmod_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_chmod_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_chown_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_chown_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_delete_module_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_delete_module_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_fchmod_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_fchmod_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_fchmodat_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_fchmodat_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_fchown_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_fchown_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_fchownat_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_fchownat_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_finit_module_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_finit_module_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_fremovexattr_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_fremovexattr_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_fsetxattr_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_fsetxattr_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_init_module_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_init_module_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_lchown_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_lchown_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_lremovexattr_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_lremovexattr_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_lsetxattr_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_lsetxattr_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_mount_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_mount_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_removexattr_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_removexattr_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_rename_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_rename_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_renameat_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_renameat_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_rmdir_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_rmdir_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_setdomainname_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_setdomainname_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_sethostname_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_sethostname_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_setxattr_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_setxattr_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_umount2_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_umount2_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_unlink_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_unlink_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_unlinkat_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_ardm_unlinkat_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_64bit_art_adjtimex_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_art_adjtimex_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_art_clock_settime_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_art_clock_settime_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_art_settimeofday_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_art_settimeofday_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_chmod_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_chmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_chmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_chmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_chmod_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_chmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_chmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_chmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_chown_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_chown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_chown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_chown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_chown_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_chown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_chown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_chown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_creat_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_creat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_creat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_creat_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_creat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_creat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_fchmod_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_fchmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_fchmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_fchmod_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_fchmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_fchmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_fchmodat_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchmodat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_fchmodat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_fchmodat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_fchmodat_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchmodat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_fchmodat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_fchmodat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_fchown_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_fchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_fchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_fchown_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_fchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_fchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_fchownat_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchownat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_fchownat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_fchownat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_fchownat_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchownat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_fchownat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_fchownat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_fremovexattr_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_fremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_fremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_fremovexattr_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_fremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_fremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_fsetxattr_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_fsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_fsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_fsetxattr_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_fsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_fsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_ftruncate_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_ftruncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_ftruncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_ftruncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_ftruncate_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_ftruncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_ftruncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_ftruncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_lchown_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_lchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_lchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_lchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_lchown_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_lchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_lchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_lchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_lremovexattr_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_lremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_lremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_lremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_lremovexattr_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_lremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_lremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_lremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_lsetxattr_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_lsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_lsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_lsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_lsetxattr_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_lsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_lsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_lsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_open_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_open_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_open_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_open_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_open_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_open_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_open_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_open_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_open_by_handle_at_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_open_by_handle_at_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_open_by_handle_at_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_open_by_handle_at_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_open_by_handle_at_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_open_by_handle_at_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_openat_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_openat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_openat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_openat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_openat_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_openat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_openat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_openat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_removexattr_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_removexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_removexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_removexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_removexattr_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_removexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_removexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_removexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_rename_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_rename_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_rename_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_rename_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_rename_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_rename_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_rename_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_rename_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_renameat_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_renameat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_renameat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_renameat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_renameat_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_renameat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_renameat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_renameat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_setxattr_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_setxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_setxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_setxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_setxattr_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_setxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_setxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_setxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_truncate_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_truncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_truncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_truncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_truncate_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_truncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_truncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_truncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_unlink_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_unlink_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_unlink_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_unlink_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_unlink_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_unlink_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_unlink_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_unlink_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_unlinkat_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_unlinkat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_unlinkat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_unlinkat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_unlinkat_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_unlinkat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_unlinkat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eacces_unlinkat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_chmod_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_chmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_chmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_chmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_chmod_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_chmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_chmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_chmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_chown_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_chown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_chown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_chown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_chown_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_chown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_chown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_chown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_creat_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_creat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_creat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_creat_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_creat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_creat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_fchmod_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_fchmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_fchmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_fchmod_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_fchmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_fchmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_fchmodat_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchmodat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_fchmodat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_fchmodat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_fchmodat_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchmodat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_fchmodat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_fchmodat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_fchown_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_fchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_fchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_fchown_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_fchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_fchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_fchownat_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchownat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_fchownat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_fchownat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_fchownat_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fchownat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_fchownat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_fchownat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_fremovexattr_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_fremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_fremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_fremovexattr_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_fremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_fremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_fsetxattr_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_fsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_fsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_fsetxattr_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_fsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_fsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_fsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_ftruncate_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_ftruncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_ftruncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_ftruncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_ftruncate_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_ftruncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_ftruncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_ftruncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_lchown_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_lchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_lchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_lchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_lchown_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_lchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_lchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_lchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_lremovexattr_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_lremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_lremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_lremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_lremovexattr_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_lremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_lremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_lremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_lsetxattr_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_lsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_lsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_lsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_lsetxattr_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_lsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_lsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_lsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_open_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_open_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_open_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_open_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_open_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_open_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_open_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_open_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_open_by_handle_at_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_open_by_handle_at_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_open_by_handle_at_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_open_by_handle_at_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_open_by_handle_at_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_open_by_handle_at_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_openat_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_openat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_openat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_openat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_openat_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_openat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_openat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_openat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_removexattr_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_removexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_removexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_removexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_removexattr_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_removexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_removexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_removexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_rename_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_rename_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_rename_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_rename_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_rename_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_rename_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_rename_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_rename_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_renameat_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_renameat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_renameat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_renameat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_renameat_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_renameat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_renameat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_renameat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_setxattr_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_setxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_setxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_setxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_setxattr_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_setxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_setxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_setxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_truncate_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_truncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_truncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_truncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_truncate_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_truncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_truncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_truncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_unlink_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_unlink_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_unlink_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_unlink_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_unlink_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_unlink_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_unlink_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_unlink_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_unlinkat_auditctl:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_unlinkat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_unlinkat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_unlinkat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_unlinkat_augenrules:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_arufm_unlinkat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_unlinkat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_64bit_arufm_eperm_unlinkat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_NX_cpu_support:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_PAE_NX_cpu_support:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_authorized_local_users:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_have_homedir_login_defs:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_logon_fail_delay:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_no_uid_except_root:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_password_all_shadowed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_password_all_shadowed_sha512:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_password_pam_enforce_local:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_password_pam_enforce_root:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_password_pam_faillock:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_password_pam_pwhistory_remember:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_password_pam_pwquality_password_auth:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_password_pam_pwquality_system_auth:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_password_pam_unix_remember:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_faillock_conf:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1">3</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_faillock_conf_deny_parameter_regex:var:1">^[\s]*deny[\s]*=[\s]*([0-9]+)</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_faillock_conf:tst:1" version="1" check_existence="none_exist" check="all" result="true">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_faillock_conf_deny_parameter_regex:var:1">^[\s]*deny[\s]*=[\s]*([0-9]+)</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_pamd_password:tst:1" version="1" check_existence="none_exist" check="all" result="true">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_deny_parameter_regex:var:1">^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*deny=([0-9]+)</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_pamd_system:tst:1" version="1" check_existence="none_exist" check="all" result="true">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_deny_parameter_regex:var:1">^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*deny=([0-9]+)</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_pamd_password:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1">3</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_deny_parameter_regex:var:1">^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*deny=([0-9]+)</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_pamd_system:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1">3</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_deny_parameter_regex:var:1">^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*deny=([0-9]+)</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_faillock_account:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_account_regex:var:1">^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_faillock_auth:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_auth_regex:var:1">^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_unix_auth:tst:1" version="1" check_existence="none_exist" check="all" result="true">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_unix_regex:var:1">^[\s]*auth\N+pam_unix\.so</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_faillock_conf:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_faillock_conf_parameter_regex:var:1">^[\s]*even_deny_root</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_no_faillock_conf:tst:1" version="1" check_existence="none_exist" check="all" result="true">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_faillock_conf_parameter_regex:var:1">^[\s]*even_deny_root</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_no_pamd_password:tst:1" version="1" check_existence="none_exist" check="all" result="true">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_parameter_regex:var:1">^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*even_deny_root</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_no_pamd_system:tst:1" version="1" check_existence="none_exist" check="all" result="true">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_parameter_regex:var:1">^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*even_deny_root</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_pamd_password:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_parameter_regex:var:1">^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*even_deny_root</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_pamd_system:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_parameter_regex:var:1">^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*even_deny_root</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_account:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_account_regex:var:1">^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_auth:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_auth_regex:var:1">^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_password_pam_unix_auth:tst:1" version="1" check_existence="none_exist" check="all" result="true">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_unix_regex:var:1">^[\s]*auth\N+pam_unix\.so</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_account:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_account_regex:var:1">^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_auth:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_auth_regex:var:1">^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_system_pam_unix_auth:tst:1" version="1" check_existence="none_exist" check="all" result="true">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_unix_regex:var:1">^[\s]*auth\N+pam_unix\.so</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_faillock_account:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_account_regex:var:1">^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_faillock_auth:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_auth_regex:var:1">^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_unix_auth:tst:1" version="1" check_existence="none_exist" check="all" result="true">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_unix_regex:var:1">^[\s]*auth\N+pam_unix\.so</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_parameter_faillock_conf:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_password_pam_faillock_account:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_password_pam_faillock_auth:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_password_pam_unix_auth:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_system_pam_faillock_account:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_system_pam_faillock_auth:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local_system_pam_unix_auth:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_faillock_conf:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1">900</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_interval_faillock_conf_fail_interval_parameter_regex:var:1">^[\s]*fail_interval[\s]*=[\s]*([0-9]+)</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_faillock_conf:tst:1" version="1" check_existence="none_exist" check="all" result="true">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_interval_faillock_conf_fail_interval_parameter_regex:var:1">^[\s]*fail_interval[\s]*=[\s]*([0-9]+)</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_pamd_password:tst:1" version="1" check_existence="none_exist" check="all" result="true">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_fail_interval_parameter_regex:var:1">^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*fail_interval=([0-9]+)</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_pamd_system:tst:1" version="1" check_existence="none_exist" check="all" result="true">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_fail_interval_parameter_regex:var:1">^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*fail_interval=([0-9]+)</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_pamd_password:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1">900</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_fail_interval_parameter_regex:var:1">^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*fail_interval=([0-9]+)</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_pamd_system:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1">900</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_fail_interval_parameter_regex:var:1">^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*fail_interval=([0-9]+)</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_faillock_account:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_account_regex:var:1">^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_faillock_auth:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_auth_regex:var:1">^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_unix_auth:tst:1" version="1" check_existence="none_exist" check="all" result="true">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_unix_regex:var:1">^[\s]*auth\N+pam_unix\.so</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_faillock_account:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_account_regex:var:1">^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_faillock_auth:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_auth_regex:var:1">^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_unix_auth:tst:1" version="1" check_existence="none_exist" check="all" result="true">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_unix_regex:var:1">^[\s]*auth\N+pam_unix\.so</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_faillock_conf:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1">0</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_faillock_conf_unlock_time_parameter_regex:var:1">^[\s]*unlock_time[\s]*=[\s]*([0-9]+)</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_faillock_conf:tst:1" version="1" check_existence="none_exist" check="all" result="true">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_faillock_conf_unlock_time_parameter_regex:var:1">^[\s]*unlock_time[\s]*=[\s]*([0-9]+)</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_pamd_password:tst:1" version="1" check_existence="none_exist" check="all" result="true">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_unlock_time_parameter_regex:var:1">^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*unlock_time=([0-9]+)</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_pamd_system:tst:1" version="1" check_existence="none_exist" check="all" result="true">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_unlock_time_parameter_regex:var:1">^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*unlock_time=([0-9]+)</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_password:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1">0</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_unlock_time_parameter_regex:var:1">^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*unlock_time=([0-9]+)</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_system:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1">0</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_unlock_time_parameter_regex:var:1">^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*unlock_time=([0-9]+)</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_account:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_account_regex:var:1">^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_auth:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_auth_regex:var:1">^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_unix_auth:tst:1" version="1" check_existence="none_exist" check="all" result="true">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_unix_regex:var:1">^[\s]*auth\N+pam_unix\.so</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_account:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_account_regex:var:1">^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_auth:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_auth_regex:var:1">^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_unix_auth:tst:1" version="1" check_existence="none_exist" check="all" result="true">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_unix_regex:var:1">^[\s]*auth\N+pam_unix\.so</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_root_gid_zero:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_build_new_database_absolute_path:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_crond_checking:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_crontabs_checking:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_operational_database_absolute_path:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_periodic_cron_checking:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_var_cron_checking:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_verify_audispd:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_verify_auditctl:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_verify_auditd:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_verify_augenrules:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_verify_aureport:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_verify_ausearch:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_verify_autrace:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_acpi_custom_method_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_arm64_sw_ttbr0_pan_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_binfmt_misc_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_bug_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_bug_on_data_corruption_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_compat_brk_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_compat_vdso_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_debug_credentials_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_debug_fs_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_debug_list_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_debug_notifiers_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_debug_sg_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_debug_wx_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_default_mmap_min_addr_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_devkmem_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_fortify_source_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_gcc_plugin_latent_entropy_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_gcc_plugin_randstruct_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_gcc_plugin_stackleak_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_gcc_plugin_structleak_byref_all_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_gcc_plugin_structleak_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_hardened_usercopy_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_hardened_usercopy_fallback_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_hibernation_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_ia32_emulation_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_ipv6_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_kexec_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_legacy_ptys_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_legacy_vsyscall_emulate_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_legacy_vsyscall_none_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_legacy_vsyscall_xonly_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_modify_ldt_syscall_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_module_sig_all_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_module_sig_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_module_sig_force_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_module_sig_hash_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_module_sig_key_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_module_sig_sha512_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_page_poisoning_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_page_poisoning_no_sanity_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_page_poisoning_zero_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_page_table_isolation_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_panic_on_oops_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_panic_timeout_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_proc_kcore_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_randomize_base_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_randomize_memory_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_refcount_full_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_retpoline_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_sched_stack_end_check_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_seccomp_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_seccomp_filter_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_security_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_security_dmesg_restrict_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_security_writable_hooks_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_security_yama_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_slab_freelist_hardened_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_slab_frelist_random_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_slab_merge_default_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_slub_debug_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_stackprotector_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_stackprotector_strong_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_strict_kernel_rwx_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_strict_module_rwx_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_syn_cookies_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_unmap_kernel_at_el0_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_vmap_stack_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_all_kernels_config_x86_vsyscall_emulation_compliant:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ari_locked_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_ari_locked_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_arle_faillock_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_arle_faillock_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_arle_lastlog_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_arle_lastlog_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_arle_tallylog_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_arle_tallylog_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_armm_selinux_watch_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_armm_selinux_watch_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_arnm_etc_hosts_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arnm_etc_hosts_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arnm_etc_issue_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arnm_etc_issue_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arnm_etc_issue_net_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arnm_etc_issue_net_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arnm_etc_sysconfig_network_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arnm_etc_sysconfig_network_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arpc_bin_count_equals_rules_count_auditctl:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arpc_bin_count_equals_rules_count_augenrules:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arpc_suid_sgid_auditctl:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arpc_suid_sgid_augenrules:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arse_btmp_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_arse_btmp_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_arse_utmp_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_arse_utmp_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_arse_wtmp_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_arse_wtmp_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_artw_etc_localtime_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_artw_etc_localtime_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_creat_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_creat_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_creat_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_creat_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_creat_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_creat_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_creat_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_creat_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_trunc_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_trunc_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_trunc_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_trunc_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_trunc_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_trunc_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_trunc_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_trunc_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_order_32bit_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_32bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_order_32bit_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_32bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_order_32bit_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_32bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_order_32bit_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_32bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_order_64bit_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_64bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_order_64bit_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_64bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_order_64bit_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_64bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_open_order_64bit_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_64bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_open_order_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_creat_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_creat_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_creat_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_creat_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_creat_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_creat_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_creat_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_creat_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_openat_order_32bit_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_32bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_openat_order_32bit_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_32bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_openat_order_32bit_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_32bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_openat_order_32bit_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_32bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_openat_order_64bit_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_64bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_openat_order_64bit_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_64bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_openat_order_64bit_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_64bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_arufm_openat_order_64bit_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_64bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_augenrules:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10425255" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_audit_rules_execution_chcon_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_execution_chcon_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_execution_restorecon_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_execution_restorecon_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_execution_semanage_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_execution_semanage_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_execution_setsebool_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_execution_setsebool_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_execution_seunshare_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_execution_seunshare_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_at_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_at_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_chage_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_chage_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_chsh_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_chsh_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_crontab_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_crontab_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_gpasswd_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_gpasswd_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_mount_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_mount_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_newgidmap_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_newgidmap_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_newgrp_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_newgrp_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_newuidmap_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_newuidmap_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_passwd_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_passwd_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_pt_chown_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_pt_chown_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_su_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_su_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_sudo_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_sudo_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_sudoedit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_sudoedit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_umount_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_umount_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_userhelper_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_userhelper_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_usernetctl_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_usernetctl_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_augenrules:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_tc_group_open_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_32bit_open_write_tc_group_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_group_open_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_32bit_open_write_tc_group_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_group_open_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_64bit_open_write_tc_group_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_group_open_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_64bit_open_write_tc_group_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_group_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_group_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_group_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_group_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_group_openat_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_32bit_openat_write_tc_group_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_group_openat_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_32bit_openat_write_tc_group_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_group_openat_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_64bit_openat_write_tc_group_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_group_openat_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_64bit_openat_write_tc_group_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_gshadow_open_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_32bit_open_write_tc_gshadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_gshadow_open_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_32bit_open_write_tc_gshadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_gshadow_open_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_64bit_open_write_tc_gshadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_gshadow_open_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_64bit_open_write_tc_gshadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_gshadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_gshadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_gshadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_gshadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_gshadow_openat_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_32bit_openat_write_tc_gshadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_gshadow_openat_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_32bit_openat_write_tc_gshadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_gshadow_openat_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_64bit_openat_write_tc_gshadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_gshadow_openat_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_64bit_openat_write_tc_gshadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_passwd_open_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_32bit_open_write_tc_passwd_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_passwd_open_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_32bit_open_write_tc_passwd_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_passwd_open_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_64bit_open_write_tc_passwd_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_passwd_open_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_64bit_open_write_tc_passwd_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_passwd_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_passwd_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_passwd_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_passwd_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_passwd_openat_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_32bit_openat_write_tc_passwd_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_passwd_openat_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_32bit_openat_write_tc_passwd_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_passwd_openat_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_64bit_openat_write_tc_passwd_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_passwd_openat_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_64bit_openat_write_tc_passwd_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_shadow_open_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_32bit_open_write_tc_shadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_shadow_open_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_32bit_open_write_tc_shadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_shadow_open_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_64bit_open_write_tc_shadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_shadow_open_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_64bit_open_write_tc_shadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_shadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_shadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_shadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_shadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_shadow_openat_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_32bit_openat_write_tc_shadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_shadow_openat_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_32bit_openat_write_tc_shadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_shadow_openat_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_64bit_openat_write_tc_shadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_tc_shadow_openat_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_64bit_openat_write_tc_shadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_etc_group_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_etc_group_augen:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_augen:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_augen:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_augen:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_augen:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_group_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_group_augen:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_gshadow_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_gshadow_augen:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_opasswd_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_opasswd_augen:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_passwd_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_passwd_augen:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_shadow_auditctl:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_shadow_augen:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_auditd_audispd_configure_remote_server:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audispd_remote_server:var:1">logcollector</tested_variable>
                </test>
                <test test_id="oval:ssg-test_auditd_audispd_encrypt_sent_records:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_auditd_audispd_syslog_plugin_activated:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_auditd_conf_log_file_not_set:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_conf_log_group_is_set:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_conf_log_group_not_root:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_data_disk_error_action:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_data_disk_full_action:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_data_retention_action_mail_acct:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_data_retention_admin_space_left_action:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_data_retention_flush:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_data_retention_max_log_file:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_data_retention_max_log_file_action:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_data_retention_num_logs:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_data_retention_space_left_action:tst:1" version="2" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_data_retention_space_left_percentage:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_freq:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425257" result="true"/>
                </test>
                <test test_id="oval:ssg-test_auditd_local_events:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425258" result="true"/>
                </test>
                <test test_id="oval:ssg-test_auditd_local_events_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="false">
                  <tested_item item_id="10425259" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_auditd_log_format:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425260" result="true"/>
                </test>
                <test test_id="oval:ssg-test_auditd_name_format:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_item item_id="10425261" result="false"/>
                </test>
                <test test_id="oval:ssg-test_auditd_overflow_action:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_write_logs:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425262" result="true"/>
                </test>
                <test test_id="oval:ssg-test_auditd_write_logs_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="false">
                  <tested_item item_id="10425263" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_banner_etc_issue:tst:1" version="1" check="at least one" result="false">
                  <tested_item item_id="10425242" result="false"/>
                  <tested_variable variable_id="oval:ssg-login_banner_text:var:1">^\-\-[\s\n]+WARNING[\s\n]+\-\-[\s\n]+This[\s\n]+system[\s\n]+is[\s\n]+for[\s\n]+the[\s\n]+use[\s\n]+of[\s\n]+authorized[\s\n]+users[\s\n]+only\.[\s\n]+Individuals[\s\n]+using[\s\n]+this[\s\n]+computer[\s\n]+system[\s\n]+without[\s\n]+authority[\s\n]+or[\s\n]+in[\s\n]+excess[\s\n]+of[\s\n]+their[\s\n]+authority[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+having[\s\n]+all[\s\n]+their[\s\n]+activities[\s\n]+on[\s\n]+this[\s\n]+system[\s\n]+monitored[\s\n]+and[\s\n]+recorded[\s\n]+by[\s\n]+system[\s\n]+personnel\.[\s\n]+Anyone[\s\n]+using[\s\n]+this[\s\n]+system[\s\n]+expressly[\s\n]+consents[\s\n]+to[\s\n]+such[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+advised[\s\n]+that[\s\n]+if[\s\n]+such[\s\n]+monitoring[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+criminal[\s\n]+activity[\s\n]+system[\s\n]+personal[\s\n]+may[\s\n]+provide[\s\n]+the[\s\n]+evidence[\s\n]+of[\s\n]+such[\s\n]+monitoring[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_banner_etc_motd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_banner_gui_enabled:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_boot_partition_noauto_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_boot_partition_nodev_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_boot_partition_noexec_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_boot_partition_nosuid_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_bootloader_disable_recovery_set_to_true:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425248" result="true"/>
                </test>
                <test test_id="oval:ssg-test_bootloader_superuser:tst:1" version="2" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425264" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_bootloader_superuser_differ_from_other_users:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_bootloader_uefi_superuser_differ_from_other_users:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_centos6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_centos7:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_centos8_name:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_centos8_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_centos9_name:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_centos9_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_chrony_all_server_has_maxpoll:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_chrony_no_server_nor_pool:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_chrony_set_maxpoll:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_chronyd_client_only:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_chronyd_multiple_servers:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_chronyd_no_chronyc_network:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_chronyd_remote_server:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_chronyd_run_as_chrony_user:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_chronyd_run_as_chrony_user_config_file_exists:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_chronyd_server_directive_no_pool:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_chronyd_server_directive_with_server:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_configure_allowed_failures:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_configure_bashrc_exec_tmux:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_configure_bind_crypto_policy:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_configure_crypto_policy:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_item item_id="10425213" result="false"/>
                  <tested_variable variable_id="oval:ssg-var_system_crypto_policy:var:1">FIPS</tested_variable>
                </test>
                <test test_id="oval:ssg-test_configure_crypto_policy_current:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_item item_id="10425214" result="false"/>
                  <tested_variable variable_id="oval:ssg-var_system_crypto_policy:var:1">FIPS</tested_variable>
                </test>
                <test test_id="oval:ssg-test_configure_gnutls_tls_crypto_policy:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_configure_kerberos_crypto_policy_nosymlink:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_item item_id="10425221" result="false"/>
                  <tested_variable variable_id="oval:ssg-var_symlink_kerberos_crypto_policy_configuration:var:1">/usr/share/crypto-policies/DEFAULT/krb5.txt</tested_variable>
                </test>
                <test test_id="oval:ssg-test_configure_kerberos_crypto_policy_symlink:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425221" result="true"/>
                  <tested_variable variable_id="oval:ssg-var_symlink_kerberos_crypto_policy_backend:var:1">/usr/share/crypto-policies/DEFAULT/krb5.txt</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_symlink_kerberos_crypto_policy_configuration:var:1">/usr/share/crypto-policies/DEFAULT/krb5.txt</tested_variable>
                </test>
                <test test_id="oval:ssg-test_configure_libreswan_crypto_policy:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_configure_mount_option_var_tmp_bind_tmp:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_configure_opensc_card_drivers:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_configure_opensc_nss_db:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_configure_openssl_crypto_policy:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425223" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_configure_remote_access_creds:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_configure_remote_access_encryption:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_configure_ssh_crypto_policy:tst:1" version="1" check_existence="none_exist" check="all" result="true"/>
                <test test_id="oval:ssg-test_configure_tmux_lock_after_time:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_configure_tmux_lock_command:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_configure_usbguard_auditbackend:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_configure_usbguard_auditbackend_config_file_exists:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_core_dumps_limits_d:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_core_dumps_limits_d_exists:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_core_dumps_limitsconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_coredump_disable_backtraces:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_coredump_disable_storage:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_coreos_enable_selinux_kernel_argument_file_boot_loader_entries_ostree_2_conf_absent:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_cron_daily_logrotate_existence:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_cron_logging_rsyslog:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_cron_logging_rsyslog_dir:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_crypto_policies_updated:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425216" result="true"/>
                  <tested_variable variable_id="oval:ssg-variable_crypto_policies_current_file_timestamp:var:1">1656317194</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_crypto_policies_config_file_timestamp:var:1">1656317058</tested_variable>
                </test>
                <test test_id="oval:ssg-test_crypto_policy_nss_config:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425218" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_dconf_distro_no_keyfiles:tst:1" version="1" check_existence="none_exist" check="all" result="false">
                  <tested_item item_id="10425229" result="not evaluated"/>
                  <tested_item item_id="10425230" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_dconf_distro_up_to_date:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425228" result="true"/>
                  <tested_variable variable_id="oval:ssg-var_dconf_distro_keyfiles_modified_time:var:1">1751</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_dconf_distro_keyfiles_modified_time:var:1">1751</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_dconf_distro_db_modified_time:var:1">1751</tested_variable>
                </test>
                <test test_id="oval:ssg-test_dconf_gnome_disable_automount:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dconf_gnome_disable_automount_open:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dconf_gnome_disable_autorun:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dconf_gnome_disable_user_admin:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dconf_gnome_lock_screen_on_smartcard_removal:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dconf_local_no_keyfiles:tst:1" version="1" check_existence="none_exist" check="all" result="true"/>
                <test test_id="oval:ssg-test_dconf_local_up_to_date:tst:1" version="1" check_existence="all_exist" check="all" result="error">
                  <tested_item item_id="10425232" result="error"/>
                  <tested_variable variable_id="oval:ssg-var_dconf_local_db_modified_time:var:1">1751</tested_variable>
                </test>
                <test test_id="oval:ssg-test_dconf_user_profile:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425233" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_debian:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_debian_10:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_debian_11:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_debian_9:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_defaultkernel_sysconfig_kernel:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dev_shm_no_partition_nodev_optional_no:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425267" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_dev_shm_no_partition_noexec_optional_no:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425267" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_dev_shm_no_partition_nosuid_optional_no:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425267" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_dev_shm_partition_nodev_optional_no:tst:1" version="2" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425267" result="true"/>
                </test>
                <test test_id="oval:ssg-test_dev_shm_partition_noexec_optional_no:tst:1" version="2" check_existence="all_exist" check="all" result="false">
                  <tested_item item_id="10425267" result="false"/>
                </test>
                <test test_id="oval:ssg-test_dev_shm_partition_nosuid_optional_no:tst:1" version="2" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425267" result="true"/>
                </test>
                <test test_id="oval:ssg-test_dir_permissions_audit_log-non_root:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dir_permissions_audit_log:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dir_permissions_var_log_audit-non_root:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dir_permissions_var_log_audit:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dir_perms_world_writable_sticky_bits:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dir_world_writable_gid_gt_value:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dir_world_writable_uid_gt_value:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dir_world_writable_uid_gt_zero:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_directory_acccess_var_log_audit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_access_var_log_audit_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+dir=/var/log/audit/)[\s]+(?:-F[\s]+perm=r)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_directory_acccess_var_log_audit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_audit_rule_access_var_log_audit_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+dir=/var/log/audit/)[\s]+(?:-F[\s]+perm=r)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_disable_automatic_login:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_disable_clock_geolocation:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_ctrlaltdel_exists:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_gnome_ctrlaltdel:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_gnome_power_setting:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_guest_login:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_disable_host_auth:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_disable_host_auth_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_disable_restart_buttons:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_sys_geolocation:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_user_list:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_wifi_creation:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_wifi_notification:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_xwindows_runlevel_target:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disallow_bypass_password_sudo:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_display_login_attempts:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_display_login_attempts_silent:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dnf-automatic_apply_updates:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_dnf-automatic_apply_updates_config_file_exists:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_dnf-automatic_security_updates_only:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_dnf-automatic_security_updates_only_config_file_exists:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_efi_dir_existence:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_enable_dracut_fips_module:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_enable_gnome_smartcard:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_enable_pam_namespace:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_enable_syscall_audit_auditctl:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_enable_syscall_audit_augenrules:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ensure_gpgcheck_globally_activated:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_ensure_gpgcheck_never_disabled:tst:1" version="1" check_existence="none_exist" check="all" result="true"/>
                <test test_id="oval:ssg-test_env_has_audit_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_chrony_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_gdm_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_grub2_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_libuser_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_login_defs_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_net-snmp_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_nss-pam-ldapd_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_ntp_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_ovirt-engine_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_ovirt-host_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_pam_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_polkit_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_postfix_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_sssd-common_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_sudo_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_systemd_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_tftp_server_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_usbguard_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_yum_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_zipl_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_var_begins:tst:1" version="1" check="none satisfy" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_var_begins_slash:tst:1" version="1" check="none satisfy" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_var_contains_doublecolon:tst:1" version="1" check="none satisfy" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_var_contains_doubleperiod:tst:1" version="1" check="none satisfy" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_var_contains_relative_path:tst:1" version="1" check="none satisfy" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_var_ends:tst:1" version="1" check="none satisfy" result="not evaluated"/>
                <test test_id="oval:ssg-test_etc_default_useradd_inactive:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_etc_group_no_duplicate_group_ids:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_etc_group_no_duplicate_group_names:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_etc_libuser_conf_cryptstyle:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_etc_login_defs_encrypt_method:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_etc_passwd_no_duplicate_user_ids:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_etc_profile_tmout:tst:1" version="2" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_tmout:var:1">600</tested_variable>
                </test>
                <test test_id="oval:ssg-test_etc_profiled_tmout:tst:1" version="2" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_tmout:var:1">600</tested_variable>
                </test>
                <test test_id="oval:ssg-test_etc_securetty_exists:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_etc_selinux_config:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="104252502" result="true"/>
                  <tested_variable variable_id="oval:ssg-var_selinux_state:var:1">enforcing</tested_variable>
                </test>
                <test test_id="oval:ssg-test_etc_system_fips:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_existence_of_var_umask_for_daemons_as_number_variable:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_fedora_release_rpm:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10425235" result="not evaluated"/>
                  <tested_item item_id="10425237" result="not evaluated"/>
                  <tested_item item_id="10425236" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_fedora_vendor_product:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10425238" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_file_at_deny_not_exist:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_cron_deny_not_exist:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_backup_etc_group_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_backup_etc_gshadow_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_backup_etc_passwd_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_backup_etc_shadow_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_efi_grub2_cfg_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_etc_group_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_etc_gshadow_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_etc_issue_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_etc_motd_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_etc_passwd_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_etc_shadow_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_grub2_cfg_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_var_log_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_var_log_messages_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_var_log_syslog_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_1:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_2:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_3:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_1:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_2:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_3:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupownership_audit_configuration_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupownership_audit_configuration_1:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_backup_etc_group_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_backup_etc_gshadow_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_backup_etc_passwd_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_backup_etc_shadow_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_efi_grub2_cfg_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_etc_group_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_etc_gshadow_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_etc_issue_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_etc_motd_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_etc_passwd_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_etc_shadow_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_grub2_cfg_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_var_log_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_var_log_messages_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_var_log_syslog_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_ownerdir_ownership_binary_dirs_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_ownerdir_ownership_binary_dirs_1:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_ownerdir_ownership_binary_dirs_2:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_ownerdir_ownership_binary_dirs_3:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_ownerdir_ownership_binary_dirs_4:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_ownerdir_ownership_binary_dirs_5:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_ownerdir_ownership_library_dirs_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_ownerdir_ownership_library_dirs_1:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_ownerdir_ownership_library_dirs_2:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_ownerdir_ownership_library_dirs_3:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_ownership_audit_configuration_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_ownership_audit_configuration_1:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_ownership_library_dirs_0:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_ownership_library_dirs_1:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_ownership_library_dirs_2:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_ownership_library_dirs_3:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_audit_log-non_root:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_audit_log:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_backup_etc_group_0:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_backup_etc_gshadow_0:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_backup_etc_passwd_0:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_backup_etc_shadow_0:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_efi_grub2_cfg_0:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_etc_audit_auditd_0:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_etc_audit_rulesd_0:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_etc_group_0:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_etc_gshadow_0:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_etc_issue_0:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_etc_motd_0:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_etc_passwd_0:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_etc_shadow_0:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_grub2_cfg_0:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_home_dirs:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_library_dirs_0:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_library_dirs_1:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_library_dirs_2:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_library_dirs_3:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_sshd_private_key_0:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_sshd_pub_key_0:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_unauthorized_sgid:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_unauthorized_suid:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_unauthorized_world_write:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_ungroupowned:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_var_log_0:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_var_log_audit-non_root:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_var_log_audit:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_var_log_messages_0:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_var_log_syslog_0:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_0:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_1:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_2:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_3:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_4:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_5:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissionsdir_permissions_library_dirs_0:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissionsdir_permissions_library_dirs_1:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissionsdir_permissions_library_dirs_2:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissionsdir_permissions_library_dirs_3:tst:1" version="3" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_files_fail_md5_hash:tst:1" version="1" check_existence="none_exist" check="all" result="true"/>
                <test test_id="oval:ssg-test_firewalld_input_drop:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_force_opensc_card_drivers:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ftp_log_transactions_enable:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ftp_log_transactions_format:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ftp_log_transactions_protocol:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ftp_present_banner:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_gdm_login_banner_text_setting:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-login_banner_text:var:1">^\-\-[\s\n]+WARNING[\s\n]+\-\-[\s\n]+This[\s\n]+system[\s\n]+is[\s\n]+for[\s\n]+the[\s\n]+use[\s\n]+of[\s\n]+authorized[\s\n]+users[\s\n]+only\.[\s\n]+Individuals[\s\n]+using[\s\n]+this[\s\n]+computer[\s\n]+system[\s\n]+without[\s\n]+authority[\s\n]+or[\s\n]+in[\s\n]+excess[\s\n]+of[\s\n]+their[\s\n]+authority[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+having[\s\n]+all[\s\n]+their[\s\n]+activities[\s\n]+on[\s\n]+this[\s\n]+system[\s\n]+monitored[\s\n]+and[\s\n]+recorded[\s\n]+by[\s\n]+system[\s\n]+personnel\.[\s\n]+Anyone[\s\n]+using[\s\n]+this[\s\n]+system[\s\n]+expressly[\s\n]+consents[\s\n]+to[\s\n]+such[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+advised[\s\n]+that[\s\n]+if[\s\n]+such[\s\n]+monitoring[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+criminal[\s\n]+activity[\s\n]+system[\s\n]+personal[\s\n]+may[\s\n]+provide[\s\n]+the[\s\n]+evidence[\s\n]+of[\s\n]+such[\s\n]+monitoring[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_gid_passwd_group_same:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_gnome_disable_thumbnailers:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_gnome_gdm_disable_xdmcp:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_gnome_gdm_disable_xdmcp_config_file_exists:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_groupownership_system_commands_dirs:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_audit_argument:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_item item_id="10425253" result="false"/>
                </test>
                <test test_id="oval:ssg-test_grub2_audit_argument_default:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_grub2_audit_backlog_limit_argument:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_item item_id="10425253" result="false"/>
                </test>
                <test test_id="oval:ssg-test_grub2_audit_backlog_limit_argument_default:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_grub2_default_exists:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux:tst:1" version="1" check_existence="none_exist" check="all" result="true"/>
                <test test_id="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux_default:tst:1" version="1" check_existence="none_exist" check="all" result="true"/>
                <test test_id="oval:ssg-test_grub2_entries_reference_kernelopts:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_iommu_argument:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_iommu_argument_default:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_ipv6_disable_argument:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_ipv6_disable_argument_default:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_l1tf_argument:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_l1tf_argument_default:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_mce_argument:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_mce_argument_default:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_mds_argument:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_mds_argument_default:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_nosmap_argument_absent:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_nosmap_argument_absent_default:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_nosmep_argument_absent:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_nosmep_argument_absent_default:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_nousb_argument:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_page_poison_argument:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_item item_id="10425253" result="false"/>
                </test>
                <test test_id="oval:ssg-test_grub2_page_poison_argument_default:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_grub2_password_grubcfg:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_grub2_password_usercfg:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_grub2_pti_argument:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_item item_id="10425253" result="false"/>
                </test>
                <test test_id="oval:ssg-test_grub2_pti_argument_default:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_grub2_rng_core_default_quality_argument:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_rng_core_default_quality_argument_default:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_slab_nomerge_argument:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_slab_nomerge_argument_default:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_slub_debug_argument:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_item item_id="10425253" result="false"/>
                  <tested_variable variable_id="oval:ssg-var_slub_debug_options:var:1">P</tested_variable>
                  <tested_variable variable_id="oval:ssg-local_var_regex_slub_debug_var_slub_debug_options:var:1">^(?:.*\s)?slub_debug=P(?:\s.*)?$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_grub2_slub_debug_argument_default:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_slub_debug_options:var:1">P</tested_variable>
                  <tested_variable variable_id="oval:ssg-local_var_regex_slub_debug_var_slub_debug_options:var:1">^(?:.*\s)?slub_debug=P(?:\s.*)?$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_grub2_spec_store_bypass_disable_argument:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_spec_store_bypass_disable_argument_default:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_spectre_v2_argument:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_spectre_v2_argument_default:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_uefi_password_usercfg:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_vsyscall_argument:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_item item_id="10425253" result="false"/>
                </test>
                <test test_id="oval:ssg-test_grub2_vsyscall_argument_default:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_harden_ssh_client_crypto_policy_Ciphers:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_harden_ssh_client_crypto_policy_GSSAPIAuthentication:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_harden_ssh_client_crypto_policy_KexAlgorithms:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_harden_ssh_client_crypto_policy_MACs:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_harden_ssh_client_crypto_policy_Match:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_harden_ssh_client_crypto_policy_RekeyLimit:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_harden_sshd_ciphers_openssh_conf_crypto_policy:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_harden_sshd_crypto_policy:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_harden_sshd_macs_openssh_conf_crypto_policy:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_home_partition_noexec_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_id_provider_is_set_to_ad:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_installed_env_is_a_docker_container:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_installed_env_is_a_podman_container:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kerberos_disable_no_keytab:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_acpi_custom_method:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_acpi_custom_method_absence:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_arm64_sw_ttbr0_pan:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_binfmt_misc:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_binfmt_misc_absence:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_bug:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_bug_on_data_corruption:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_compat_brk:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_compat_brk_absence:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_compat_vdso:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_compat_vdso_absence:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_debug_credentials:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_debug_fs:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_debug_fs_absence:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_debug_list:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_debug_notifiers:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_debug_sg:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_debug_wx:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_default_mmap_min_addr:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_devkmem:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_devkmem_absence:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_fortify_source:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_gcc_plugin_latent_entropy:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_gcc_plugin_randstruct:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_gcc_plugin_stackleak:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_gcc_plugin_structleak:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_gcc_plugin_structleak_byref_all:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_hardened_usercopy:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_hardened_usercopy_fallback:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_hardened_usercopy_fallback_absence:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_hibernation:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_hibernation_absence:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_ia32_emulation:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_ia32_emulation_absence:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_ipv6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_ipv6_absence:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_kexec:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_kexec_absence:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_legacy_ptys:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_legacy_ptys_absence:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_legacy_vsyscall_emulate:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_legacy_vsyscall_emulate_absence:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_legacy_vsyscall_none:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_legacy_vsyscall_xonly:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_legacy_vsyscall_xonly_absence:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_modify_ldt_syscall:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_modify_ldt_syscall_absence:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_module_sig:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_module_sig_all:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_module_sig_force:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_module_sig_hash:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_module_sig_key:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_module_sig_sha512:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_page_poisoning:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_page_poisoning_no_sanity:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_page_poisoning_zero:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_page_table_isolation:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_panic_on_oops:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_panic_timeout:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_proc_kcore:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_proc_kcore_absence:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_randomize_base:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_randomize_memory:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_refcount_full:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_retpoline:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_sched_stack_end_check:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_seccomp:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_seccomp_filter:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_security:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_security_dmesg_restrict:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_security_dmesg_restrict_absence:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_security_writable_hooks:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_security_yama:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_slab_freelist_hardened:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_slab_frelist_random:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_slab_merge_default:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_slab_merge_default_absence:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_slub_debug:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_stackprotector:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_stackprotector_strong:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_strict_kernel_rwx:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_strict_module_rwx:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_syn_cookies:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_unmap_kernel_at_el0:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_vmap_stack:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_x86_vsyscall_emulation:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_config_x86_vsyscall_emulation_absence:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_module_ipv6_option_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_atm_disabled:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_atm_etcmodules-load:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_atm_libmodprobed:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_atm_libmodules-load:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_atm_modprobeconf:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_atm_runmodprobed:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_atm_runmodules-load:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_bluetooth_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_bluetooth_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_bluetooth_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_bluetooth_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_bluetooth_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_bluetooth_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_bluetooth_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_can_disabled:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_can_etcmodules-load:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_can_libmodprobed:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_can_libmodules-load:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_can_modprobeconf:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_can_runmodprobed:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_can_runmodules-load:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_cfg80211_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_cfg80211_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_cfg80211_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_cfg80211_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_cfg80211_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_cfg80211_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_cfg80211_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_cramfs_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_cramfs_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_cramfs_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_cramfs_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_cramfs_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_cramfs_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_cramfs_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_dccp_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_dccp_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_dccp_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_dccp_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_dccp_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_dccp_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_dccp_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_firewire-core_disabled:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_firewire-core_etcmodules-load:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_firewire-core_libmodprobed:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_firewire-core_libmodules-load:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_firewire-core_modprobeconf:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_firewire-core_runmodprobed:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_firewire-core_runmodules-load:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_freevxfs_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_freevxfs_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_freevxfs_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_freevxfs_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_freevxfs_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_freevxfs_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_freevxfs_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfs_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfs_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfs_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfs_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfs_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfs_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfs_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfsplus_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfsplus_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfsplus_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfsplus_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfsplus_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfsplus_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfsplus_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_iwlmvm_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_iwlmvm_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_iwlmvm_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_iwlmvm_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_iwlmvm_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_iwlmvm_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_iwlmvm_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_iwlwifi_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_iwlwifi_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_iwlwifi_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_iwlwifi_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_iwlwifi_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_iwlwifi_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_iwlwifi_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_jffs2_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_jffs2_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_jffs2_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_jffs2_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_jffs2_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_jffs2_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_jffs2_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_mac80211_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_mac80211_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_mac80211_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_mac80211_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_mac80211_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_mac80211_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_mac80211_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_rds_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_rds_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_rds_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_rds_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_rds_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_rds_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_rds_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_squashfs_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_squashfs_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_squashfs_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_squashfs_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_squashfs_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_squashfs_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_squashfs_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_tipc_disabled:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_tipc_etcmodules-load:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_tipc_libmodprobed:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_tipc_libmodules-load:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_tipc_modprobeconf:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_tipc_runmodprobed:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_tipc_runmodules-load:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_kernmod_udf_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_udf_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_udf_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_udf_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_udf_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_udf_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_udf_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_usb-storage_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_usb-storage_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_usb-storage_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_usb-storage_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_usb-storage_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_usb-storage_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_usb-storage_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_vfat_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_vfat_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_vfat_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_vfat_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_vfat_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_vfat_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_vfat_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_limitsd_maxlogins:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_limitsd_maxlogins_exists:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_linuxshield_install_antivirus:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_logfile_sudoers:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_logrotate_conf_daily_setting:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_logrotate_conf_no_other_keyword:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_logwatch_configured_hostlimit:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_logwatch_configured_splithosts:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_lsb:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_maxlogins:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_mcafee_accm_exists:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_mcafee_auditengine_exists:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_mcafee_management_agent:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_mcafee_runtime_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_messages_nx_active:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_mount_option_var_tmp:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_mount_option_var_tmp_bind:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_mount_option_var_tmp_bind_compare_source:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_auditd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_auditd_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_chronyd:tst:1" version="1" check_existence="any_exist" check="all" result="true">
                  <tested_item item_id="10425241" result="true"/>
                </test>
                <test test_id="oval:ssg-test_multi_user_wants_chronyd_socket:tst:1" version="1" check_existence="any_exist" check="all" result="false">
                  <tested_item item_id="10425241" result="false"/>
                </test>
                <test test_id="oval:ssg-test_multi_user_wants_cron:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_cron_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_crond:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_crond_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_dnf-automatic:tst:1" version="1" check_existence="any_exist" check="all" result="false">
                  <tested_item item_id="10425241" result="false"/>
                </test>
                <test test_id="oval:ssg-test_multi_user_wants_firewalld:tst:1" version="1" check_existence="any_exist" check="all" result="true">
                  <tested_item item_id="10425241" result="true"/>
                </test>
                <test test_id="oval:ssg-test_multi_user_wants_firewalld_socket:tst:1" version="1" check_existence="any_exist" check="all" result="false">
                  <tested_item item_id="10425241" result="false"/>
                </test>
                <test test_id="oval:ssg-test_multi_user_wants_ip6tables:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_ip6tables_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_iptables:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_iptables_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_ntp:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_ntp_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_ntpd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_ntpd_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_pcscd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_pcscd_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_rngd:tst:1" version="1" check_existence="any_exist" check="all" result="false">
                  <tested_item item_id="10425241" result="false"/>
                </test>
                <test test_id="oval:ssg-test_multi_user_wants_rngd_socket:tst:1" version="1" check_existence="any_exist" check="all" result="false">
                  <tested_item item_id="10425241" result="false"/>
                </test>
                <test test_id="oval:ssg-test_multi_user_wants_rsyslog:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_rsyslog_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_syslog-ng:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_syslog-ng_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_usbguard:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_usbguard_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_network_ipv6_default_gateway:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_network_ipv6_disable_rpc_tcp6:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_network_ipv6_disable_rpc_udp6:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_network_ipv6_privacy_extensions:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_network_ipv6_static_address:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_network_nmcli_permissions:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_authenticate_etc_sudoers:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_authenticate_etc_sudoers_d:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_cd_dvd_drive_in_etc_fstab:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_custom_emergency_service:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_custom_emergency_target:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_custom_rescue_service:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_no_custom_runlevel1_target:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_no_direct_root_logins:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_empty_passwords:tst:1" version="1" check_existence="none_exist" check="all" result="false">
                  <tested_item item_id="10425252" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_no_empty_passwords_etc_shadow:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_insecure_locks_exports:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_legacy_plus_entries_etc_group:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_legacy_plus_entries_etc_passwd:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_legacy_plus_entries_etc_shadow:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_netrc_files_home:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_root_or_ALL_in_runas_spec:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_rsh_trust_files_etc:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_rsh_trust_files_home:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_rsh_trust_files_root:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_tmux_in_shells:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_user_spec_rules:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_nodev_etc_fstab_cd_dvd_drive:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_nodev_etc_fstab_not_cd_dvd_drive:tst:1" version="1" check_existence="all_exist" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_nodev_nonroot_local_partitions:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_noexec_cmd_line:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_noexec_etc_fstab_cd_dvd_drive:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_noexec_etc_fstab_not_cd_dvd_drive:tst:1" version="1" check_existence="all_exist" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_noexec_sudoers:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_nopasswd_etc_sudoers:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_nopasswd_etc_sudoers_d:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_nosuid_etc_fstab_cd_dvd_drive:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_nosuid_etc_fstab_not_cd_dvd_drive:tst:1" version="1" check_existence="all_exist" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_ntp_all_server_has_maxpoll:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ntp_no_server:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ntp_remote_server:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ntp_set_maxpoll:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ntpd_configure_restrictions_ipv4:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ntpd_configure_restrictions_ipv6:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ntpd_multiple_servers:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ntpd_run_as_ntp_user_etc_sysconfig_ntpd:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ntpd_run_as_ntp_user_systemd:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_nx_disabled_grub:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ol7_system:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_ol8_system:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_ol9_system:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_openssh-server_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_opensuse_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_opensuse_leap15_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_opensuse_leap42_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_opt_partition_nosuid_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ownership_binary_directories:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ownership_binary_files:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ownership_var_log_audit_directories-non_root:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ownership_var_log_audit_directories:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ownership_var_log_audit_files-non_root:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ownership_var_log_audit_files:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_GConf2_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_MFEhiplsm_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_abrt-addon-ccpp_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_abrt-addon-kerneloops_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_abrt-cli_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_abrt-plugin-logger_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_abrt-plugin-rhtsupport_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_abrt-plugin-sosreport_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_abrt_removed:tst:1" version="1" check_existence="none_exist" check="all" result="false">
                  <tested_item item_id="104252503" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_package_aide_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_audispd-plugins_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_audit-audispd-plugins_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_audit_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_avahi_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_bind_removed:tst:1" version="1" check_existence="none_exist" check="all" result="true"/>
                <test test_id="oval:ssg-test_package_binutils_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_chrony_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_cron_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_cryptsetup-luks_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_dconf_installed:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425226" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_package_dnf-automatic_installed:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_package_esc_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_fapolicyd_installed:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_package_gdm_installed:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425234" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_package_gdm_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_geolite2-city_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_geolite2-country_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_gnutls-utils_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_gpgkey-38ab71f4-60242b08_installed:tst:1" version="1" check="only one" result="false">
                  <tested_item item_id="10425239" result="false"/>
                </test>
                <test test_id="oval:ssg-test_package_gpgkey-45719a39-5f2c0192_installed:tst:1" version="1" check="only one" result="false">
                  <tested_item item_id="10425239" result="false"/>
                </test>
                <test test_id="oval:ssg-test_package_gpgkey-5323552a-6112bcdc_installed:tst:1" version="1" check="only one" result="true">
                  <tested_item item_id="10425239" result="true"/>
                </test>
                <test test_id="oval:ssg-test_package_gpgkey-9867c58f-601c49ca_installed:tst:1" version="1" check="only one" result="false">
                  <tested_item item_id="10425239" result="false"/>
                </test>
                <test test_id="oval:ssg-test_package_gssproxy_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_inetutils-telnetd_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_iprutils_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_iptables_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_kernel-PAE_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_krb5-workstation_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_libcap-ng-utils_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_libreport-plugin-logger_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_libreport-plugin-rhtsupport_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_libreswan_installed:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_package_libselinux_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_mcstrans_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_net-snmp_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_nfs-utils_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_nis_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_nss-tools_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_ntp_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_ntpdate_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_openldap-clients_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_opensc_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_openscap-scanner_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_openssh-server_installed:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="104252507" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_package_openssh-server_removed:tst:1" version="1" check_existence="none_exist" check="all" result="false">
                  <tested_item item_id="104252507" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_package_openssl-pkcs11_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_pam_ldap_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_pcsc-lite_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_policycoreutils_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_prelink_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_python3-abrt-addon_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_rear_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_rng-tools_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_rsyslog-gnutls_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_rsyslog_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_samba-common_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_scap-security-guide_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_screen_installed:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_package_sendmail_removed:tst:1" version="1" check_existence="none_exist" check="all" result="true"/>
                <test test_id="oval:ssg-test_package_setroubleshoot-plugins_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_setroubleshoot-server_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_setroubleshoot_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_sssd-ipa_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_sudo_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_syslog-ng_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_tar_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_telnetd-ssl_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_telnetd_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_tmux_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_tuned_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_usbguard_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_vim-enhanced_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_vsftpd_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_vsftpd_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_xorg-x11-server-common_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_pam_pkcs11_cert_policy_ocsp_on:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_pam_unix_passwordauth_sha512:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_pam_unix_sha512:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_pass_max_days:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_pass_min_days:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_pass_min_len:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_password_minlen_login_defs:var:1">15</tested_variable>
                </test>
                <test test_id="oval:ssg-test_pass_warn_age:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_password_auth_default_pam_unix_rounds_var:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_password_auth_pam_unix_rounds_is_default:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_password_auth_pam_unix_rounds_is_set:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_password_pam_pwquality:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10425244" result="not evaluated"/>
                  <tested_variable variable_id="oval:ssg-var_pam_pwquality_config_path:var:1">/etc/pam.d/system-auth</tested_variable>
                </test>
                <test test_id="oval:ssg-test_password_pam_pwquality_dcredit:tst:1" version="3" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_password_pam_dcredit:var:1">-1</tested_variable>
                </test>
                <test test_id="oval:ssg-test_password_pam_pwquality_dictcheck:tst:1" version="3" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_password_pam_pwquality_difok:tst:1" version="3" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_password_pam_pwquality_lcredit:tst:1" version="3" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_password_pam_lcredit:var:1">-1</tested_variable>
                </test>
                <test test_id="oval:ssg-test_password_pam_pwquality_maxclassrepeat:tst:1" version="3" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_password_pam_pwquality_maxrepeat:tst:1" version="3" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_password_pam_pwquality_minclass:tst:1" version="3" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_password_pam_pwquality_minlen:tst:1" version="3" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_password_pam_minlen:var:1">12</tested_variable>
                </test>
                <test test_id="oval:ssg-test_password_pam_pwquality_ocredit:tst:1" version="3" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_password_pam_ocredit:var:1">-1</tested_variable>
                </test>
                <test test_id="oval:ssg-test_password_pam_pwquality_retry_pwquality_conf:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_password_pam_retry:var:1">3</tested_variable>
                </test>
                <test test_id="oval:ssg-test_password_pam_pwquality_retry_system_auth:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_password_pam_retry:var:1">3</tested_variable>
                </test>
                <test test_id="oval:ssg-test_password_pam_pwquality_ucredit:tst:1" version="3" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_password_pam_ucredit:var:1">-1</tested_variable>
                </test>
                <test test_id="oval:ssg-test_permissions_systemmap_files:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_perms_binary_files:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_postfix_client_configure_mail_alias:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_allowed-failures_change:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_prevent_user_banner_change:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_prevent_user_banner_gui_enabled_change:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_prevent_user_change_gnome_thumbnailers:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_change_idle_activation_enabled:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_prevent_user_change_idle_activation_locked:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_clock_geolocation:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_disable_smartcard:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_disable_user_list:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_enable_ctrlaltdel:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_enable_restart_buttons:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_enable_wifi_creation:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_enable_wifi_notification:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_gnome_automount:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_gnome_automount_open:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_gnome_autorun:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_info_change:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_prevent_user_power_setting_change:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_remote_access_creds:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_remote_access_encryption:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_removal-action:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_screensaver_lock:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_prevent_user_screensaver_lock_locked:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_screensaver_mode_change:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_prevent_user_sys_geolocation:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_user-administration-disabled:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_proc_cpuinfo_64_bit:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_proc_net_wireless_exists:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_proc_no_partition_hidepid_optional_no:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_proc_partition_hidepid_optional_no:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_proc_sys_kernel_osrelease_64_bit:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_proc_sys_kernel_osrelease_arch_aarch64:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_promisc_interfaces:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_remote_method_monitoring_auth:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_remote_method_monitoring_authpriv:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_remote_method_monitoring_daemon:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_remote_rsyslog_conf:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_remote_rsyslog_d:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_removable_partition_doesnt_exist:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_require_emergency_service:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_require_emergency_service_emergency_target:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_require_rescue_service:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425249" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_require_rescue_service_runlevel1:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425250" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_requiretty_sudoers:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhcos4:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhcos:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel7_client:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_rhel7_computenode:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_rhel7_server:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_rhel7_unix_family:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10425224" result="true"/>
                </test>
                <test test_id="oval:ssg-test_rhel7_workstation:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_rhel8:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_rhel8_0:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_10:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_1:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_2:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_3:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_4:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_5:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_7:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_8:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_9:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_unix_family:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10425224" result="true"/>
                </test>
                <test test_id="oval:ssg-test_rhel9:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_rhel9_unix_family:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10425224" result="true"/>
                </test>
                <test test_id="oval:ssg-test_rhevh_rhel7_version:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_rhevh_rhel8_version:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_rhevh_rhel9_version:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_rhevm4_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhvh4_version:tst:1" version="1" check_existence="only_one_exists" check="all" result="false"/>
                <test test_id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rsyslog_files_groupownership:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rsyslog_files_ownership:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rsyslog_files_permissions:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rsyslog_nolisten:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rsyslog_remote_tls:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rsyslog_remote_tls_cacert:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_screensaver_disable_user_info:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_screensaver_idle_activation_enabled:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_screensaver_idle_delay:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_screensaver_idle_delay_setting:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-inactivity_timeout_value:var:1">900</tested_variable>
                </test>
                <test test_id="oval:ssg-test_screensaver_lock_delay:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_screensaver_lock_delay_setting:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_screensaver_lock_delay:var:1">0</tested_variable>
                </test>
                <test test_id="oval:ssg-test_screensaver_lock_enabled:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_screensaver_mode_blank:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_selinux_confinement_of_daemons:tst:1" version="2" check_existence="any_exist" check="none satisfy" result="false">
                  <tested_item item_id="104252309" result="true"/>
                  <tested_item item_id="104252310" result="true"/>
                  <tested_item item_id="104252311" result="true"/>
                  <tested_item item_id="104252312" result="true"/>
                  <tested_item item_id="104252313" result="true"/>
                  <tested_item item_id="104252314" result="true"/>
                  <tested_item item_id="104252315" result="true"/>
                  <tested_item item_id="104252316" result="true"/>
                  <tested_item item_id="104252317" result="true"/>
                  <tested_item item_id="104252318" result="true"/>
                  <tested_item item_id="104252319" result="true"/>
                  <tested_item item_id="104252320" result="true"/>
                  <tested_item item_id="104252321" result="true"/>
                  <tested_item item_id="104252322" result="true"/>
                  <tested_item item_id="104252323" result="true"/>
                  <tested_item item_id="104252324" result="true"/>
                  <tested_item item_id="104252326" result="true"/>
                  <tested_item item_id="104252325" result="true"/>
                  <tested_item item_id="104252327" result="true"/>
                  <tested_item item_id="104252328" result="true"/>
                  <tested_item item_id="104252329" result="true"/>
                  <tested_item item_id="104252330" result="true"/>
                  <tested_item item_id="104252331" result="true"/>
                  <tested_item item_id="104252332" result="true"/>
                  <tested_item item_id="104252333" result="true"/>
                  <tested_item item_id="104252334" result="true"/>
                  <tested_item item_id="104252335" result="true"/>
                  <tested_item item_id="104252336" result="true"/>
                  <tested_item item_id="104252337" result="true"/>
                  <tested_item item_id="104252338" result="true"/>
                  <tested_item item_id="104252339" result="true"/>
                  <tested_item item_id="104252340" result="true"/>
                  <tested_item item_id="104252341" result="true"/>
                  <tested_item item_id="104252342" result="true"/>
                  <tested_item item_id="104252343" result="true"/>
                  <tested_item item_id="104252344" result="true"/>
                  <tested_item item_id="104252345" result="true"/>
                  <tested_item item_id="104252346" result="true"/>
                  <tested_item item_id="104252347" result="true"/>
                  <tested_item item_id="104252348" result="true"/>
                  <tested_item item_id="104252349" result="true"/>
                  <tested_item item_id="104252350" result="true"/>
                  <tested_item item_id="104252351" result="true"/>
                  <tested_item item_id="104252352" result="true"/>
                  <tested_item item_id="104252353" result="true"/>
                  <tested_item item_id="104252354" result="true"/>
                  <tested_item item_id="104252355" result="true"/>
                  <tested_item item_id="104252356" result="true"/>
                  <tested_item item_id="104252357" result="true"/>
                  <tested_item item_id="104252358" result="true"/>
                  <tested_item item_id="104252359" result="true"/>
                  <tested_item item_id="104252360" result="true"/>
                  <tested_item item_id="104252361" result="true"/>
                  <tested_item item_id="104252362" result="true"/>
                  <tested_item item_id="104252363" result="true"/>
                  <tested_item item_id="104252364" result="true"/>
                  <tested_item item_id="104252365" result="true"/>
                  <tested_item item_id="104252366" result="true"/>
                  <tested_item item_id="104252367" result="true"/>
                  <tested_item item_id="104252368" result="true"/>
                  <tested_item item_id="104252369" result="true"/>
                  <tested_item item_id="104252370" result="true"/>
                  <tested_item item_id="104252371" result="true"/>
                  <tested_item item_id="104252372" result="true"/>
                  <tested_item item_id="104252374" result="true"/>
                  <tested_item item_id="104252373" result="true"/>
                  <tested_item item_id="104252375" result="true"/>
                  <tested_item item_id="104252376" result="true"/>
                  <tested_item item_id="104252377" result="true"/>
                  <tested_item item_id="104252378" result="true"/>
                  <tested_item item_id="104252379" result="true"/>
                  <tested_item item_id="104252380" result="true"/>
                  <tested_item item_id="104252381" result="true"/>
                  <tested_item item_id="104252382" result="true"/>
                  <tested_item item_id="104252383" result="true"/>
                  <tested_item item_id="104252384" result="true"/>
                  <tested_item item_id="104252385" result="true"/>
                  <tested_item item_id="104252386" result="true"/>
                  <tested_item item_id="104252387" result="true"/>
                  <tested_item item_id="104252388" result="true"/>
                  <tested_item item_id="104252389" result="true"/>
                  <tested_item item_id="104252390" result="true"/>
                  <tested_item item_id="104252391" result="true"/>
                  <tested_item item_id="104252392" result="true"/>
                  <tested_item item_id="104252393" result="true"/>
                  <tested_item item_id="104252394" result="true"/>
                  <tested_item item_id="104252395" result="true"/>
                  <tested_item item_id="104252396" result="true"/>
                  <tested_item item_id="104252397" result="true"/>
                  <tested_item item_id="104252398" result="true"/>
                  <tested_item item_id="104252399" result="true"/>
                  <tested_item item_id="104252400" result="true"/>
                  <tested_item item_id="104252401" result="true"/>
                  <tested_item item_id="104252402" result="true"/>
                  <tested_item item_id="104252403" result="true"/>
                  <tested_item item_id="104252404" result="true"/>
                  <tested_item item_id="104252406" result="true"/>
                  <tested_item item_id="104252405" result="true"/>
                  <tested_item item_id="104252407" result="true"/>
                  <tested_item item_id="104252408" result="true"/>
                  <tested_item item_id="104252409" result="true"/>
                  <tested_item item_id="104252410" result="true"/>
                  <tested_item item_id="104252411" result="true"/>
                  <tested_item item_id="104252412" result="true"/>
                  <tested_item item_id="104252413" result="true"/>
                  <tested_item item_id="104252414" result="true"/>
                  <tested_item item_id="104252415" result="true"/>
                  <tested_item item_id="104252416" result="true"/>
                  <tested_item item_id="104252417" result="true"/>
                  <tested_item item_id="104252418" result="true"/>
                  <tested_item item_id="104252419" result="true"/>
                  <tested_item item_id="104252420" result="true"/>
                  <tested_item item_id="104252422" result="true"/>
                  <tested_item item_id="104252421" result="true"/>
                  <tested_item item_id="104252423" result="true"/>
                  <tested_item item_id="104252424" result="true"/>
                  <tested_item item_id="104252425" result="true"/>
                  <tested_item item_id="104252426" result="true"/>
                  <tested_item item_id="104252427" result="true"/>
                  <tested_item item_id="104252428" result="true"/>
                  <tested_item item_id="104252429" result="true"/>
                  <tested_item item_id="104252430" result="true"/>
                  <tested_item item_id="104252431" result="true"/>
                  <tested_item item_id="104252432" result="true"/>
                  <tested_item item_id="104252433" result="true"/>
                  <tested_item item_id="104252434" result="true"/>
                  <tested_item item_id="104252435" result="true"/>
                  <tested_item item_id="104252436" result="true"/>
                  <tested_item item_id="104252437" result="true"/>
                  <tested_item item_id="104252438" result="true"/>
                  <tested_item item_id="104252439" result="true"/>
                  <tested_item item_id="104252440" result="true"/>
                  <tested_item item_id="104252441" result="true"/>
                  <tested_item item_id="104252442" result="true"/>
                  <tested_item item_id="104252443" result="true"/>
                  <tested_item item_id="104252444" result="true"/>
                  <tested_item item_id="104252445" result="true"/>
                  <tested_item item_id="104252446" result="true"/>
                  <tested_item item_id="104252447" result="true"/>
                  <tested_item item_id="104252448" result="true"/>
                  <tested_item item_id="104252449" result="true"/>
                  <tested_item item_id="104252450" result="true"/>
                  <tested_item item_id="104252451" result="true"/>
                  <tested_item item_id="104252452" result="true"/>
                  <tested_item item_id="104252453" result="true"/>
                  <tested_item item_id="104252454" result="true"/>
                  <tested_item item_id="104252455" result="true"/>
                  <tested_item item_id="104252456" result="true"/>
                  <tested_item item_id="104252457" result="true"/>
                  <tested_item item_id="104252458" result="true"/>
                  <tested_item item_id="104252459" result="true"/>
                  <tested_item item_id="104252460" result="true"/>
                  <tested_item item_id="104252461" result="true"/>
                  <tested_item item_id="104252462" result="true"/>
                  <tested_item item_id="104252463" result="true"/>
                  <tested_item item_id="104252464" result="true"/>
                  <tested_item item_id="104252465" result="true"/>
                  <tested_item item_id="104252466" result="true"/>
                  <tested_item item_id="104252467" result="true"/>
                  <tested_item item_id="104252468" result="true"/>
                  <tested_item item_id="104252470" result="true"/>
                  <tested_item item_id="104252469" result="true"/>
                  <tested_item item_id="104252471" result="true"/>
                  <tested_item item_id="104252472" result="true"/>
                  <tested_item item_id="104252473" result="true"/>
                  <tested_item item_id="104252474" result="true"/>
                  <tested_item item_id="104252475" result="true"/>
                  <tested_item item_id="104252476" result="true"/>
                  <tested_item item_id="104252477" result="true"/>
                  <tested_item item_id="104252478" result="true"/>
                  <tested_item item_id="104252479" result="true"/>
                  <tested_item item_id="104252480" result="true"/>
                  <tested_item item_id="104252481" result="true"/>
                  <tested_item item_id="104252482" result="true"/>
                  <tested_item item_id="104252483" result="true"/>
                  <tested_item item_id="104252484" result="true"/>
                  <tested_item item_id="104252485" result="true"/>
                  <tested_item item_id="104252486" result="true"/>
                  <tested_item item_id="104252487" result="true"/>
                  <tested_item item_id="104252488" result="true"/>
                  <tested_item item_id="104252489" result="true"/>
                  <tested_item item_id="104252490" result="true"/>
                  <tested_item item_id="104252491" result="true"/>
                  <tested_item item_id="104252492" result="true"/>
                  <tested_item item_id="104252493" result="true"/>
                  <tested_item item_id="104252494" result="true"/>
                  <tested_item item_id="104252495" result="true"/>
                  <tested_item item_id="104252496" result="true"/>
                  <tested_item item_id="104252497" result="true"/>
                  <tested_item item_id="104252498" result="true"/>
                  <tested_item item_id="104252499" result="true"/>
                  <tested_item item_id="104252500" result="true"/>
                </test>
                <test test_id="oval:ssg-test_selinux_default_grub:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_selinux_dev_device_t:tst:1" version="2" check_existence="any_exist" check="none satisfy" result="true">
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/bus/usb/002/001</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu2</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs2</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/kvm</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/watchdog0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/watchdog</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vhost-net</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vhci</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vfio/vfio</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/uinput</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ppp</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cuse</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/lp3</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/lp2</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/lp1</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/lp0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vda1</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/fb0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vport2p2</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vport2p1</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vda</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/uhid</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/loop-control</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/fuse</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/bsg/2:0:0:0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/sg0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/sr0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/btrfs-control</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu_dma_latency</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/mcelog</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/mapper/control</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/rtc0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event3</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/usbmon2</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/usbmon1</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/usbmon0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/udmabuf</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/nvram</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/hpet</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS31</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS30</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS29</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS28</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS27</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS26</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS25</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS24</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS23</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS22</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS21</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS20</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS19</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS18</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS17</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS16</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS15</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vhost-vsock</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs4</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa3</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu3</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs3</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa2</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa6</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu6</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs6</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa5</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu5</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs5</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa4</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS14</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS13</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS12</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS11</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS10</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS9</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS8</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS7</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS6</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS5</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS4</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS3</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS2</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS1</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ptmx</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/autofs</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snapshot</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/hwrng</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty63</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty62</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty61</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty60</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty59</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty58</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty57</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty56</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty55</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty54</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty53</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty52</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty51</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty50</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty49</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty48</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty47</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty46</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty45</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty44</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty43</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty42</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty41</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty40</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty39</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty38</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty37</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty36</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty35</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty34</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty33</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty32</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty31</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty30</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty29</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty28</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty27</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty26</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty25</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty24</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty23</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty22</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty21</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty20</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty19</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty18</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty17</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty16</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty15</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty14</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty13</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty12</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty11</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty10</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty9</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty8</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty7</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty6</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty5</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty4</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty3</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty2</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty1</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa1</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu1</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs1</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/console</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/kmsg</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/urandom</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/random</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/full</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/zero</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/port</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/null</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/mem</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vga_arbiter</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu4</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/net/tun</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snd/controlC0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snd/hwC0D0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snd/pcmC0D0c</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snd/pcmC0D0p</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snd/seq</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snd/timer</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/zram0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vda2</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/dri/card0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/dri/renderD128</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/rfkill</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/hidraw0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/pts/0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/pts/ptmx</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/js0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event6</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/mouse3</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/dma_heap/system</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event5</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/7/cpuid</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/bus/usb/001/003</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event4</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/mouse2</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/mouse1</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event2</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/mouse0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event1</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/mice</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/6/cpuid</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/bus/usb/001/002</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/bus/usb/001/001</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/5/cpuid</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/4/cpuid</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/7/msr</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/3/cpuid</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/6/msr</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/2/cpuid</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/5/msr</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/1/cpuid</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/4/msr</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/0/cpuid</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/3/msr</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/2/msr</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/1/msr</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/0/msr</tested_variable>
                </test>
                <test test_id="oval:ssg-test_selinux_dev_unlabeled_t:tst:1" version="2" check_existence="any_exist" check="none satisfy" result="true">
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/bus/usb/002/001</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu2</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs2</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/kvm</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/watchdog0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/watchdog</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vhost-net</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vhci</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vfio/vfio</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/uinput</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ppp</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cuse</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/lp3</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/lp2</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/lp1</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/lp0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vda1</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/fb0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vport2p2</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vport2p1</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vda</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/uhid</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/loop-control</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/fuse</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/bsg/2:0:0:0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/sg0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/sr0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/btrfs-control</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu_dma_latency</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/mcelog</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/mapper/control</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/rtc0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event3</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/usbmon2</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/usbmon1</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/usbmon0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/udmabuf</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/nvram</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/hpet</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS31</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS30</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS29</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS28</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS27</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS26</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS25</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS24</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS23</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS22</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS21</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS20</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS19</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS18</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS17</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS16</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS15</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vhost-vsock</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs4</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa3</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu3</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs3</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa2</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa6</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu6</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs6</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa5</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu5</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs5</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa4</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS14</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS13</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS12</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS11</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS10</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS9</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS8</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS7</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS6</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS5</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS4</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS3</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS2</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS1</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ptmx</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/autofs</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snapshot</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/hwrng</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty63</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty62</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty61</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty60</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty59</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty58</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty57</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty56</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty55</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty54</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty53</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty52</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty51</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty50</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty49</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty48</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty47</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty46</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty45</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty44</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty43</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty42</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty41</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty40</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty39</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty38</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty37</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty36</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty35</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty34</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty33</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty32</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty31</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty30</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty29</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty28</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty27</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty26</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty25</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty24</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty23</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty22</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty21</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty20</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty19</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty18</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty17</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty16</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty15</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty14</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty13</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty12</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty11</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty10</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty9</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty8</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty7</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty6</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty5</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty4</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty3</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty2</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty1</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa1</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu1</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs1</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/console</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/kmsg</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/urandom</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/random</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/full</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/zero</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/port</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/null</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/mem</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vga_arbiter</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu4</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/net/tun</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snd/controlC0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snd/hwC0D0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snd/pcmC0D0c</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snd/pcmC0D0p</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snd/seq</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snd/timer</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/zram0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vda2</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/dri/card0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/dri/renderD128</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/rfkill</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/hidraw0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/pts/0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/pts/ptmx</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/js0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event6</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/mouse3</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/dma_heap/system</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event5</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/7/cpuid</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/bus/usb/001/003</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event4</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/mouse2</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/mouse1</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event2</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/mouse0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event1</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event0</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/mice</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/6/cpuid</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/bus/usb/001/002</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/bus/usb/001/001</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/5/cpuid</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/4/cpuid</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/7/msr</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/3/cpuid</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/6/msr</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/2/cpuid</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/5/msr</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/1/cpuid</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/4/msr</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/0/cpuid</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/3/msr</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/2/msr</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/1/msr</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/0/msr</tested_variable>
                </test>
                <test test_id="oval:ssg-test_selinux_enforcing:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_selinux_grub2_cfg:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_selinux_grub_dir:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_selinux_policy:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="104252501" result="true"/>
                  <tested_variable variable_id="oval:ssg-var_selinux_policy_name:var:1">targeted</tested_variable>
                </test>
                <test test_id="oval:ssg-test_serial_ports_etc_securetty:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_atd_package_at_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_auditd_package_audit_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_autofs_package_autofs_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_bluetooth_package_bluez_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_chronyd_package_chrony_installed:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="104252504" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_service_cron_package_cron_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_crond_package_cronie_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_debug-shell_package_systemd_removed:tst:1" version="1" check_existence="none_exist" check="all" result="false">
                  <tested_item item_id="10425245" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_service_firewalld_package_firewalld_installed:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425265" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_service_ip6tables_package_iptables-ipv6_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_iptables_package_iptables_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_atd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_autofs:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_bluetooth:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_debug-shell:tst:1" version="1" check_existence="any_exist" check="all" result="true"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_netfs:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_nfs-server:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_nfslock:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_rpcgssd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_rpcidmapd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_rpcsvcgssd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_rsyncd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_sshd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_sssd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_syslog:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_systemd-coredump:tst:1" version="1" check_existence="any_exist" check="all" result="false">
                  <tested_item item_id="10425289" result="false"/>
                </test>
                <test test_id="oval:ssg-test_service_netfs_package_netfs_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_nfs-server_package_nfs-utils_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_nfslock_package_nfs-utils_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_atd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_autofs:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_bluetooth:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_debug-shell:tst:1" version="1" check_existence="any_exist" check="all" result="true"/>
                <test test_id="oval:ssg-test_service_not_running_netfs:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_nfs-server:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_nfslock:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_rpcgssd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_rpcidmapd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_rpcsvcgssd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_rsyncd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_sshd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_sssd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_syslog:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_systemd-coredump:tst:1" version="1" check_existence="any_exist" check="all" result="false">
                  <tested_item item_id="10425288" result="false"/>
                </test>
                <test test_id="oval:ssg-test_service_ntp_package_ntp_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_ntpd_package_ntp_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_pcscd_package_pcsc-lite_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_rngd_package_rng-tools_installed:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_service_rpcgssd_package_nfs-utils_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_rpcidmapd_package_nfs-utils_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_rpcsvcgssd_package_nfs-utils_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_rsyncd_package_rsync-daemon_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_rsyslog_package_rsyslog_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_auditd:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_chronyd:tst:1" version="1" check="at least one" result="true">
                  <tested_item item_id="104252505" result="true"/>
                </test>
                <test test_id="oval:ssg-test_service_running_cron:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_crond:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_firewalld:tst:1" version="1" check="at least one" result="true">
                  <tested_item item_id="10425266" result="true"/>
                </test>
                <test test_id="oval:ssg-test_service_running_ip6tables:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_iptables:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_ntp:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_ntpd:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_pcscd:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_rngd:tst:1" version="1" check="at least one" result="false"/>
                <test test_id="oval:ssg-test_service_running_rsyslog:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_syslog-ng:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_usbguard:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_sshd_package_openssh-server_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_sssd_package_sssd-common_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_syslog-ng_package_syslog-ng_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_syslog_package_rsyslog_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_systemd-coredump_package_systemd_removed:tst:1" version="1" check_existence="none_exist" check="all" result="false">
                  <tested_item item_id="10425245" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_service_usbguard_package_usbguard_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_shell_defined_default_uid_range:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_shell_defined_reserved_uid_range:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sl6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sl7:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sle12_desktop:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_sle12_server:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_sle12_unix_family:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10425224" result="true"/>
                </test>
                <test test_id="oval:ssg-test_sle15_desktop:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_sle15_server:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_sle15_unix_family:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10425224" result="true"/>
                </test>
                <test test_id="oval:ssg-test_sles_12_for_sap:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_sles_15_for_sap:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_smart_card_enabled_system_auth:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_smart_card_required_smartcard_auth:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_smart_card_required_system_auth:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_snmp_default_communities:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_snmp_versions:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_srv_partition_nosuid_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_allow_only_protocol2:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_clientalivecountmax:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_clientalivecountmax_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_compression:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_empty_passwords:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_sshd_disable_empty_passwords_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_sshd_disable_gssapi_auth:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_sshd_disable_gssapi_auth_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_item item_id="104252508" result="false"/>
                </test>
                <test test_id="oval:ssg-test_sshd_disable_kerb_auth:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_sshd_disable_kerb_auth_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_sshd_disable_pubkey_auth:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_pubkey_auth_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_rhosts:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_rhosts_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_rhosts_rsa:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_root_login:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_sshd_disable_root_login_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_sshd_disable_root_password_login:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_root_password_login_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_tcp_forwarding:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_tcp_forwarding_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_user_known_hosts:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_user_known_hosts_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_x11_forwarding:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_x11_forwarding_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_do_not_permit_user_env:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_do_not_permit_user_env_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_enable_gssapi_auth:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_enable_gssapi_auth_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_enable_pam:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_enable_pam_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_enable_pubkey_auth:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_enable_pubkey_auth_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_enable_strictmodes:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_enable_strictmodes_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_enable_warning_banner:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_sshd_enable_warning_banner_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_sshd_enable_warning_banner_net:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_enable_warning_banner_net_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_enable_x11_forwarding:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_enable_x11_forwarding_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_idle_timeout:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_idle_timeout_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_includes_config_files:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_login_grace_time:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_max_auth_tries:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_max_sessions:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_not_required:tst:1" version="1" check="all" result="false">
                  <tested_item item_id="104252506" result="false"/>
                  <tested_variable variable_id="oval:ssg-sshd_required:var:1">0</tested_variable>
                </test>
                <test test_id="oval:ssg-test_sshd_print_last_log:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_print_last_log_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_rekey_limit:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_rekey_limit_time:var:1">1h</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_rekey_limit_size:var:1">512M</tested_variable>
                  <tested_variable variable_id="oval:ssg-sshd_line_regex:var:1">^[\s]*RekeyLimit[\s]+512M[\s]+1h[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_sshd_rekey_limit_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_rekey_limit_time:var:1">1h</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_rekey_limit_size:var:1">512M</tested_variable>
                  <tested_variable variable_id="oval:ssg-sshd_line_regex:var:1">^[\s]*RekeyLimit[\s]+512M[\s]+1h[\s]*$</tested_variable>
                </test>
                <test test_id="oval:ssg-test_sshd_required:tst:1" version="1" check="all" result="false">
                  <tested_item item_id="104252506" result="false"/>
                  <tested_variable variable_id="oval:ssg-sshd_required:var:1">0</tested_variable>
                </test>
                <test test_id="oval:ssg-test_sshd_requirement_unset:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="104252506" result="true"/>
                  <tested_variable variable_id="oval:ssg-sshd_required:var:1">0</tested_variable>
                </test>
                <test test_id="oval:ssg-test_sshd_set_keepalive_0:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_set_keepalive_0_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_set_loglevel_info:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_set_loglevel_info_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_set_loglevel_verbose:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_set_loglevel_verbose_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_use_directory_configuration_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_use_priv_separation:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_x11_use_localhost:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_x11_use_localhost_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sssd_certificate_verification:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sssd_conf_exists:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sssd_enable_certmap:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sssd_enable_smartcards:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sssd_memcache_timeout:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sssd_offline_cred_expiration:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sssd_run_as_sssd_user:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_sssd_ssh_known_hosts_timeout:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_fs_protected_fifos:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_fs_protected_hardlinks:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_fs_protected_regular:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_fs_protected_symlinks:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_fs_suid_dumpable:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_core_pattern:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_dmesg_restrict:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_kexec_load_disabled:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_kptr_restrict:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-sysctl_kernel_kptr_restrict_value:var:1">1</tested_variable>
                </test>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_modules_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_panic_on_oops:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_perf_event_paranoid:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_pid_max:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_randomize_va_space:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_sysrq:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_unprivileged_bpf_disabled:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_yama_ptrace_scope:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_core_bpf_jit_harden:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_local:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_arp_filter:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_arp_ignore:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_route_localnet:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_shared_media:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_shared_media:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_forward:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_local_port_range:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_autoconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_max_addresses:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_autoconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_max_addresses:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_user_max_user_namespaces:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_vm_mmap_min_addr:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_fs_protected_fifos:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_fs_protected_hardlinks:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_fs_protected_regular:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_fs_protected_symlinks:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_fs_suid_dumpable:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_core_pattern:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_dmesg_restrict:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_kexec_load_disabled:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_kptr_restrict:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-sysctl_kernel_kptr_restrict_value:var:1">1</tested_variable>
                </test>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_modules_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_panic_on_oops:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_perf_event_paranoid:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_pid_max:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_randomize_va_space:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_sysrq:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_unprivileged_bpf_disabled:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_yama_ptrace_scope:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_core_bpf_jit_harden:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_local:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_arp_filter:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_arp_ignore:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_route_localnet:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_shared_media:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_shared_media:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_ip_forward:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_ip_local_port_range:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_autoconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_max_addresses:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_autoconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_max_addresses:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_user_max_user_namespaces:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_run_sysctld_vm_mmap_min_addr:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_fs_protected_fifos:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_fs_protected_hardlinks:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_fs_protected_regular:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_fs_protected_symlinks:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_fs_suid_dumpable:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_core_pattern:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_dmesg_restrict:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_kexec_load_disabled:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_kptr_restrict:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-sysctl_kernel_kptr_restrict_value:var:1">1</tested_variable>
                </test>
                <test test_id="oval:ssg-test_static_sysctl_kernel_modules_disabled:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_panic_on_oops:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_perf_cpu_time_max_percent:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_perf_event_max_sample_rate:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_perf_event_paranoid:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_pid_max:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_randomize_va_space:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_sysrq:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_unprivileged_bpf_disabled:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_yama_ptrace_scope:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_sysctl_net_core_bpf_jit_harden:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_local:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_source_route:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_arp_filter:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_arp_ignore:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_log_martians:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_route_localnet:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_rp_filter:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_secure_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_send_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_shared_media:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_source_route:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_log_martians:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_rp_filter:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_secure_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_send_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_shared_media:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_ip_forward:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_ip_local_port_range:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_tcp_syncookies:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_autoconf:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_max_addresses:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_router_solicitations:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_autoconf:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_max_addresses:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_router_solicitations:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_user_max_user_namespaces:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_sysctl_vm_mmap_min_addr:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_fs_protected_fifos:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_fs_protected_hardlinks:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_fs_protected_regular:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_fs_protected_symlinks:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_fs_suid_dumpable:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_core_pattern:tst:1" version="1" check="all" result="false">
                  <tested_item item_id="10425268" result="false"/>
                </test>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_dmesg_restrict:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_kexec_load_disabled:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_kptr_restrict:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-sysctl_kernel_kptr_restrict_value:var:1">1</tested_variable>
                </test>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_modules_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_panic_on_oops:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_paranoid:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_pid_max:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_randomize_va_space:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_sysrq:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_yama_ptrace_scope:tst:1" version="1" check="all" result="false">
                  <tested_item item_id="10425280" result="false"/>
                </test>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_core_bpf_jit_harden:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_local:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_arp_filter:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_arp_ignore:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_route_localnet:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_shared_media:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_shared_media:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_forward:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_local_port_range:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_autoconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_max_addresses:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_autoconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_max_addresses:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_user_max_user_namespaces:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_vm_mmap_min_addr:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sudoers_default_includedir:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sudoers_explicit_command_args:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sudoers_no_command_negation:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sudoers_passwd_n_files:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sudoers_rootpw_config:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sudoers_runaspw_config:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sudoers_targetpw_config:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sudoers_without_include:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sudoersd_without_includes:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sys_uid_max_not_defined:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sys_uid_min_not_defined:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysconfig_nozeroconf_yes:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_crypto_fips_enabled:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_item item_id="10425212" result="false"/>
                </test>
                <test test_id="oval:ssg-test_sysctl_fs_protected_fifos_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_fs_protected_hardlinks_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_fs_protected_regular_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_fs_protected_symlinks_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_fs_suid_dumpable_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_kernel_core_pattern_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425270" result="true"/>
                  <tested_variable variable_id="oval:ssg-local_var_unique_sysctl_kernel_core_pattern_counter:var:1">1</tested_variable>
                </test>
                <test test_id="oval:ssg-test_sysctl_kernel_dmesg_restrict_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-local_var_unique_sysctl_kernel_dmesg_restrict_counter:var:1">0</tested_variable>
                </test>
                <test test_id="oval:ssg-test_sysctl_kernel_kexec_load_disabled_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-local_var_unique_sysctl_kernel_kexec_load_disabled_counter:var:1">0</tested_variable>
                </test>
                <test test_id="oval:ssg-test_sysctl_kernel_kptr_restrict_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-local_var_unique_sysctl_kernel_kptr_restrict_counter:var:1">0</tested_variable>
                </test>
                <test test_id="oval:ssg-test_sysctl_kernel_modules_disabled_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_kernel_panic_on_oops_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_kernel_perf_cpu_time_max_percent_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_kernel_perf_event_max_sample_rate_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_kernel_perf_event_paranoid_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-local_var_unique_sysctl_kernel_perf_event_paranoid_counter:var:1">0</tested_variable>
                </test>
                <test test_id="oval:ssg-test_sysctl_kernel_pid_max_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_kernel_randomize_va_space_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_kernel_sysrq_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_kernel_unprivileged_bpf_disabled_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-local_var_unique_sysctl_kernel_unprivileged_bpf_disabled_counter:var:1">0</tested_variable>
                </test>
                <test test_id="oval:ssg-test_sysctl_kernel_yama_ptrace_scope_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425282" result="true"/>
                  <tested_variable variable_id="oval:ssg-local_var_unique_sysctl_kernel_yama_ptrace_scope_counter:var:1">1</tested_variable>
                </test>
                <test test_id="oval:ssg-test_sysctl_net_core_bpf_jit_harden_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-local_var_unique_sysctl_net_core_bpf_jit_harden_counter:var:1">0</tested_variable>
                </test>
                <test test_id="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_local_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_filter_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_ignore_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv4_conf_all_route_localnet_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv4_conf_all_shared_media_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv4_conf_default_shared_media_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv4_ip_forward_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv4_ip_local_port_range_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_defrtr_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_pinfo_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv6_conf_all_autoconf_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv6_conf_all_max_addresses_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv6_conf_all_router_solicitations_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_defrtr_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_pinfo_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv6_conf_default_autoconf_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv6_conf_default_disable_ipv6_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv6_conf_default_max_addresses_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_net_ipv6_conf_default_router_solicitations_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_fs_protected_fifos:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_fs_protected_hardlinks:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_fs_protected_regular:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_fs_protected_symlinks:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_fs_suid_dumpable:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_core_pattern:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_item item_id="10425271" result="false"/>
                </test>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_dmesg_restrict:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_item item_id="10425273" result="false"/>
                </test>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_kexec_load_disabled:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_item item_id="10425275" result="false"/>
                </test>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_kptr_restrict:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_item item_id="10425291" result="false"/>
                  <tested_variable variable_id="oval:ssg-sysctl_kernel_kptr_restrict_value:var:1">1</tested_variable>
                </test>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_modules_disabled:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_panic_on_oops:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_perf_cpu_time_max_percent:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_perf_event_max_sample_rate:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_perf_event_paranoid:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10425277" result="true"/>
                </test>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_pid_max:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_randomize_va_space:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_sysrq:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_unprivileged_bpf_disabled:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_item item_id="10425279" result="false"/>
                </test>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_yama_ptrace_scope:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_item item_id="10425283" result="false"/>
                </test>
                <test test_id="oval:ssg-test_sysctl_runtime_net_core_bpf_jit_harden:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_item item_id="10425285" result="false"/>
                </test>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_local:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_source_route:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_arp_filter:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_arp_ignore:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_drop_gratuitous_arp:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_log_martians:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_route_localnet:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_rp_filter:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_secure_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_send_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_shared_media:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_source_route:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_log_martians:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_rp_filter:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_secure_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_send_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_shared_media:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_ip_forward:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_ip_local_port_range:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_tcp_syncookies:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_autoconf:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_max_addresses:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_router_solicitations:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_autoconf:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_max_addresses:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_router_solicitations:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_user_max_user_namespaces:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_item item_id="10425287" result="false"/>
                </test>
                <test test_id="oval:ssg-test_sysctl_runtime_vm_mmap_min_addr:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_user_max_user_namespaces_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-local_var_unique_sysctl_user_max_user_namespaces_counter:var:1">0</tested_variable>
                </test>
                <test test_id="oval:ssg-test_sysctl_vm_mmap_min_addr_defined_in_one_file:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_system_auth_default_pam_unix_rounds_var:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_system_auth_pam_unix_rounds_is_default:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_system_auth_pam_unix_rounds_is_set:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_system_crypto_policy_value:tst:1" version="1" check="at least one" result="true">
                  <tested_item item_id="10425219" result="true"/>
                  <tested_variable variable_id="oval:ssg-var_system_crypto_policy:var:1">FIPS</tested_variable>
                </test>
                <test test_id="oval:ssg-test_system_info_architecture_aarch_64:tst:1" version="1" check="all" result="false">
                  <tested_item item_id="10425256" result="false"/>
                </test>
                <test test_id="oval:ssg-test_system_info_architecture_ppc_64:tst:1" version="1" check="all" result="false">
                  <tested_item item_id="10425256" result="false"/>
                </test>
                <test test_id="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" version="1" check="all" result="false">
                  <tested_item item_id="10425256" result="false"/>
                </test>
                <test test_id="oval:ssg-test_system_info_architecture_s390_64:tst:1" version="1" check="all" result="false">
                  <tested_item item_id="10425256" result="false"/>
                </test>
                <test test_id="oval:ssg-test_system_info_architecture_x86:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_system_info_architecture_x86_64:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10425256" result="true"/>
                </test>
                <test test_id="oval:ssg-test_system_using_opal:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_timer_running_dnf-automatic:tst:1" version="1" check="at least one" result="false"/>
                <test test_id="oval:ssg-test_tmp_in_namespace_conf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_tmp_inst:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_tmp_partition_nodev_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_tmp_partition_noexec_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_tmp_partition_nosuid_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ubuntu:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ubuntu_bionic:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ubuntu_focal:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ubuntu_xenial:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_unix_family:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10425224" result="true"/>
                </test>
                <test test_id="oval:ssg-test_unix_wrlinux1019:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_unix_wrlinux8:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_usbguard_rules_nonempty:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_use_pam_wheel_for_su:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_use_pty_sudoers:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_user_change_idle_delay_lock:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_user_change_lock_delay_lock:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_var_log_audit_partition_nodev_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_var_log_audit_partition_noexec_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_var_log_audit_partition_nosuid_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_var_log_partition_nodev_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_var_log_partition_noexec_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_var_log_partition_nosuid_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_var_partition_nodev_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_var_partition_noexec_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_var_partition_nosuid_optional_yes:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_var_removable_partition_is_cd_dvd_drive:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_var_tmp_in_namespace_conf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_var_tmp_tmp_inst:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_vdsm_nopasswd_etc_sudoers:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_vdsm_nopasswd_etc_sudoers_d:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_verify_all_rpms_mode:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_virtual_consoles_etc_securetty:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_wireless_disable_interfaces:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_wrlinux1019_name:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_wrlinux1019_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_wrlinux8_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_yum_clean_components_post_updating:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_yum_ensure_gpgcheck_local_packages:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_yum_ensure_gpgcheck_repo_metadata:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-testboot_partition:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-testhome_partition:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-testopt_partition:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-testsrv_partition:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-testtmp_partition:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-testusr_partition:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-testvar_log_audit_partition:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-testvar_log_partition:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-testvar_partition:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-tst_accounts_umask_etc_login_defs:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-tst_accounts_umask_etc_profile:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-tst_maxstartups_full_parameter:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-tst_maxstartups_rate_parameter:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-tst_maxstartups_start_parameter:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-tst_umask_for_daemons:tst:1" version="1" check="all" result="not evaluated"/>
              </tests>
              <oval_system_characteristics xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:unix-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#unix" xmlns:ind-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#independent" xmlns:lin-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#linux" xmlns:win-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows" xmlns="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5 oval-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#independent independent-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#unix unix-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#linux linux-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows windows-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#macos macos-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
                <generator>
                  <oval:product_name>cpe:/a:open-scap:oscap</oval:product_name>
                  <oval:product_version>ssg: [0, 1, 62], python: 3.11.0b4</oval:product_version>
                  <oval:schema_version>5.11</oval:schema_version>
                  <oval:timestamp>2022-08-01T16:21:57</oval:timestamp>
                </generator>
                <system_info>
                  <os_name>Fedora Linux</os_name>
                  <os_version>37 (Workstation Edition Prerelease)</os_version>
                  <architecture>x86_64</architecture>
                  <primary_host_name>localhost-live</primary_host_name>
                  <interfaces>
                    <interface>
                      <interface_name>lo</interface_name>
                      <ip_address>127.0.0.1</ip_address>
                      <mac_address>00:00:00:00:00:00</mac_address>
                    </interface>
                    <interface>
                      <interface_name>enp1s0</interface_name>
                      <ip_address>192.168.122.178</ip_address>
                      <mac_address>52:54:00:43:3D:D8</mac_address>
                    </interface>
                    <interface>
                      <interface_name>lo</interface_name>
                      <ip_address>::1</ip_address>
                      <mac_address>00:00:00:00:00:00</mac_address>
                    </interface>
                    <interface>
                      <interface_name>enp1s0</interface_name>
                      <ip_address>fe80::8000:d679:2b11:8d8</ip_address>
                      <mac_address>52:54:00:43:3D:D8</mac_address>
                    </interface>
                  </interfaces>
                </system_info>
                <collected_objects>
                  <object id="oval:ssg-crypto_policies_config_file:obj:1" version="1" flag="complete">
                    <reference item_ref="10425215"/>
                  </object>
                  <object id="oval:ssg-crypto_policies_current_file:obj:1" version="1" flag="complete">
                    <reference item_ref="10425217"/>
                  </object>
                  <object id="oval:ssg-obj_auditd_freq:obj:1" version="1" flag="complete">
                    <reference item_ref="10425257"/>
                  </object>
                  <object id="oval:ssg-obj_auditd_local_events:obj:1" version="1" flag="complete">
                    <reference item_ref="10425258"/>
                  </object>
                  <object id="oval:ssg-obj_auditd_local_events_default_not_overriden:obj:1" version="1" flag="complete">
                    <reference item_ref="10425259"/>
                  </object>
                  <object id="oval:ssg-obj_auditd_log_format:obj:1" version="1" flag="complete">
                    <reference item_ref="10425260"/>
                  </object>
                  <object id="oval:ssg-obj_auditd_name_format:obj:1" version="1" flag="complete">
                    <reference item_ref="10425261"/>
                  </object>
                  <object id="oval:ssg-obj_auditd_write_logs:obj:1" version="1" flag="complete">
                    <reference item_ref="10425262"/>
                  </object>
                  <object id="oval:ssg-obj_auditd_write_logs_default_not_overriden:obj:1" version="1" flag="complete">
                    <reference item_ref="10425263"/>
                  </object>
                  <object id="oval:ssg-obj_banner_gui_enabled:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_chronyd_cmdport_value:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_chronyd_port_value:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_configure_allowed_failures:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_coredump_disable_backtraces:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_coredump_disable_storage:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_cron_logging_rsyslog:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_cron_logging_rsyslog_dir:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_dconf_distro_config:obj:1" version="1" flag="complete">
                    <reference item_ref="10425229"/>
                    <reference item_ref="10425230"/>
                  </object>
                  <object id="oval:ssg-obj_dconf_distro_db:obj:1" version="1" flag="complete">
                    <reference item_ref="10425227"/>
                  </object>
                  <object id="oval:ssg-obj_dconf_local_config:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_dconf_local_db:obj:1" version="1" flag="complete">
                    <reference item_ref="10425231"/>
                  </object>
                  <object id="oval:ssg-obj_dconf_user_profile:obj:1" version="2" flag="complete">
                    <reference item_ref="10425233"/>
                  </object>
                  <object id="oval:ssg-obj_disable_automatic_login:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_disable_guest_login:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_disable_host_auth:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_disable_host_auth_config_dir:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_dnf-automatic_apply_updates:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_dnf-automatic_apply_updates_config_file:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_dnf-automatic_security_updates_only:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_dnf-automatic_security_updates_only_config_file:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_ensure_gpgcheck_never_disabled:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_firewalld_input_drop:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_gdm_login_banner_text_setting:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_atm_disabled:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_atm_etcmodules-load:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_atm_libmodprobed:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_atm_libmodules-load:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_atm_modprobeconf:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_atm_runmodprobed:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_atm_runmodules-load:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_can_disabled:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_can_etcmodules-load:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_can_libmodprobed:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_can_libmodules-load:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_can_modprobeconf:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_can_runmodprobed:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_can_runmodules-load:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_firewire-core_disabled:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_firewire-core_etcmodules-load:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_firewire-core_libmodprobed:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_firewire-core_libmodules-load:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_firewire-core_modprobeconf:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_firewire-core_runmodprobed:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_firewire-core_runmodules-load:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_tipc_disabled:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_tipc_etcmodules-load:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_tipc_libmodprobed:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_tipc_libmodules-load:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_tipc_modprobeconf:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_tipc_runmodprobed:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_kernmod_tipc_runmodules-load:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_ol7_system:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_ol8_system:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_password_pam_pwquality:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-var_pam_pwquality_config_path:var:1">/etc/pam.d/system-auth</variable_value>
                    <reference item_ref="10425244"/>
                  </object>
                  <object id="oval:ssg-obj_password_pam_pwquality_dcredit:obj:1" version="3" flag="does not exist"/>
                  <object id="oval:ssg-obj_password_pam_pwquality_lcredit:obj:1" version="3" flag="does not exist"/>
                  <object id="oval:ssg-obj_password_pam_pwquality_minlen:obj:1" version="3" flag="does not exist"/>
                  <object id="oval:ssg-obj_password_pam_pwquality_ocredit:obj:1" version="3" flag="does not exist"/>
                  <object id="oval:ssg-obj_password_pam_pwquality_retry_pwquality_conf:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_password_pam_pwquality_retry_system_auth:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_password_pam_pwquality_ucredit:obj:1" version="3" flag="does not exist"/>
                  <object id="oval:ssg-obj_prevent_user_allowed-failures_change:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_prevent_user_banner_change:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_prevent_user_banner_gui_enabled_change:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_prevent_user_change_idle_activation_enabled:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_prevent_user_info_change:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_prevent_user_screensaver_lock:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_prevent_user_screensaver_mode_change:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_require_rescue_service:obj:1" version="1" flag="complete">
                    <reference item_ref="10425249"/>
                  </object>
                  <object id="oval:ssg-obj_require_rescue_service_runlevel1:obj:1" version="1" flag="complete">
                    <reference item_ref="10425250"/>
                  </object>
                  <object id="oval:ssg-obj_rhel7_client:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_rhel7_computenode:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_rhel7_server:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_rhel7_unix_family:obj:1" version="1" flag="complete">
                    <reference item_ref="10425224"/>
                  </object>
                  <object id="oval:ssg-obj_rhel7_workstation:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_rhel8:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_rhel8_unix_family:obj:1" version="1" flag="complete">
                    <reference item_ref="10425224"/>
                  </object>
                  <object id="oval:ssg-obj_rhel9:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_rhel9_unix_family:obj:1" version="1" flag="complete">
                    <reference item_ref="10425224"/>
                  </object>
                  <object id="oval:ssg-obj_rhevh_rhel7_version:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_rhevh_rhel8_version:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_rhevh_rhel9_version:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_rhvh4_version:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_screensaver_disable_user_info:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_screensaver_idle_activation_enabled:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_screensaver_idle_delay:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_screensaver_idle_delay_setting:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_screensaver_lock_delay:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_screensaver_lock_delay_setting:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_screensaver_lock_enabled:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_screensaver_mode_blank:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_selinux_policy:obj:1" version="1" flag="complete">
                    <reference item_ref="104252501"/>
                  </object>
                  <object id="oval:ssg-obj_service_loadstate_is_masked_debug-shell:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_service_loadstate_is_masked_systemd-coredump:obj:1" version="1" flag="complete">
                    <reference item_ref="10425289"/>
                  </object>
                  <object id="oval:ssg-obj_service_not_running_debug-shell:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_service_not_running_systemd-coredump:obj:1" version="1" flag="complete">
                    <reference item_ref="10425288"/>
                  </object>
                  <object id="oval:ssg-obj_service_running_chronyd:obj:1" version="1" flag="complete">
                    <reference item_ref="104252505"/>
                  </object>
                  <object id="oval:ssg-obj_service_running_firewalld:obj:1" version="1" flag="complete">
                    <reference item_ref="10425266"/>
                  </object>
                  <object id="oval:ssg-obj_service_running_rngd:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_sle12_desktop:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_sle12_server:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_sle12_unix_family:obj:1" version="1" flag="complete">
                    <reference item_ref="10425224"/>
                  </object>
                  <object id="oval:ssg-obj_sle15_desktop:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_sle15_server:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_sle15_unix_family:obj:1" version="1" flag="complete">
                    <reference item_ref="10425224"/>
                  </object>
                  <object id="oval:ssg-obj_sles_12_for_sap:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_sles_15_for_sap:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_sshd_disable_empty_passwords:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_sshd_disable_empty_passwords_config_dir:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_sshd_disable_gssapi_auth:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_sshd_disable_gssapi_auth_config_dir:obj:1" version="1" flag="complete">
                    <reference item_ref="104252508"/>
                  </object>
                  <object id="oval:ssg-obj_sshd_disable_kerb_auth:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_sshd_disable_kerb_auth_config_dir:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_sshd_disable_root_login:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_sshd_disable_root_login_config_dir:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_sshd_enable_warning_banner:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_sshd_enable_warning_banner_config_dir:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_sshd_rekey_limit:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_rekey_limit_time:var:1">1h</variable_value>
                    <variable_value variable_id="oval:ssg-var_rekey_limit_size:var:1">512M</variable_value>
                    <variable_value variable_id="oval:ssg-sshd_line_regex:var:1">^[\s]*RekeyLimit[\s]+512M[\s]+1h[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-obj_sshd_rekey_limit_config_dir:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_rekey_limit_time:var:1">1h</variable_value>
                    <variable_value variable_id="oval:ssg-var_rekey_limit_size:var:1">512M</variable_value>
                    <variable_value variable_id="oval:ssg-sshd_line_regex:var:1">^[\s]*RekeyLimit[\s]+512M[\s]+1h[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-obj_sssd_user_value:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_system_crypto_policy_value:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-var_system_crypto_policy:var:1">FIPS</variable_value>
                    <reference item_ref="10425219"/>
                  </object>
                  <object id="oval:ssg-obj_test_package_abrt_removed:obj:1" version="1" flag="complete">
                    <reference item_ref="104252503"/>
                  </object>
                  <object id="oval:ssg-obj_test_package_bind_removed:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_test_package_dconf_installed:obj:1" version="1" flag="complete">
                    <reference item_ref="10425226"/>
                  </object>
                  <object id="oval:ssg-obj_test_package_dnf-automatic_installed:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_test_package_fapolicyd_installed:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_test_package_gdm_installed:obj:1" version="1" flag="complete">
                    <reference item_ref="10425234"/>
                  </object>
                  <object id="oval:ssg-obj_test_package_libreswan_installed:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_test_package_openssh-server_installed:obj:1" version="1" flag="complete">
                    <reference item_ref="104252507"/>
                  </object>
                  <object id="oval:ssg-obj_test_package_openssh-server_removed:obj:1" version="1" flag="complete">
                    <reference item_ref="104252507"/>
                  </object>
                  <object id="oval:ssg-obj_test_package_screen_installed:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_test_package_sendmail_removed:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_test_service_chronyd_package_chrony_installed:obj:1" version="1" flag="complete">
                    <reference item_ref="104252504"/>
                  </object>
                  <object id="oval:ssg-obj_test_service_debug-shell_package_systemd_removed:obj:1" version="1" flag="complete">
                    <reference item_ref="10425245"/>
                  </object>
                  <object id="oval:ssg-obj_test_service_firewalld_package_firewalld_installed:obj:1" version="1" flag="complete">
                    <reference item_ref="10425265"/>
                  </object>
                  <object id="oval:ssg-obj_test_service_rngd_package_rng-tools_installed:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_test_service_systemd-coredump_package_systemd_removed:obj:1" version="1" flag="complete">
                    <reference item_ref="10425245"/>
                  </object>
                  <object id="oval:ssg-obj_timer_running_dnf-automatic:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_user_change_idle_delay_lock:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_user_change_lock_delay_lock:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_chmod_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_chmod_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_chown_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_chown_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_delete_module_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_delete_module_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_fchmod_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_fchmod_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_fchmodat_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_fchmodat_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_fchown_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_fchown_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_fchownat_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_fchownat_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_fremovexattr_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_fremovexattr_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_fsetxattr_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_fsetxattr_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_init_module_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_init_module_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_lchown_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_lchown_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_lremovexattr_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_lremovexattr_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_lsetxattr_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_lsetxattr_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_removexattr_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_removexattr_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_rename_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_rename_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_renameat_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_renameat_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_rmdir_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_rmdir_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_setxattr_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_setxattr_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_unlink_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_unlink_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_unlinkat_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_ardm_unlinkat_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_32bit_arufm_eacces_chmod_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_chmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_chmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_chmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_chmod_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_chmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_chmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_chmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_chown_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_chown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_chown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_chown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_chown_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_chown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_chown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_chown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_creat_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_creat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_creat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_creat_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_creat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_creat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_fchmod_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_fchmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_fchmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_fchmod_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_fchmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_fchmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_fchmodat_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchmodat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_fchmodat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_fchmodat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_fchmodat_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchmodat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_fchmodat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_fchmodat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_fchown_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_fchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_fchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_fchown_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_fchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_fchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_fchownat_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchownat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_fchownat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_fchownat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_fchownat_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchownat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_fchownat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_fchownat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_fremovexattr_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_fremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_fremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_fremovexattr_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_fremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_fremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_fsetxattr_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_fsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_fsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_fsetxattr_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_fsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_fsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_ftruncate_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_ftruncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_ftruncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_ftruncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_ftruncate_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_ftruncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_ftruncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_ftruncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_lchown_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_lchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_lchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_lchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_lchown_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_lchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_lchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_lchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_lremovexattr_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_lremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_lremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_lremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_lremovexattr_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_lremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_lremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_lremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_lsetxattr_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_lsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_lsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_lsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_lsetxattr_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_lsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_lsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_lsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_open_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_open_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_open_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_open_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_open_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_open_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_open_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_open_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_open_by_handle_at_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_open_by_handle_at_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_open_by_handle_at_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_open_by_handle_at_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_open_by_handle_at_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_open_by_handle_at_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_open_by_handle_at_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_open_by_handle_at_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_openat_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_openat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_openat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_openat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_openat_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_openat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_openat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_openat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_removexattr_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_removexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_removexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_removexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_removexattr_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_removexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_removexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_removexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_rename_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_rename_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_rename_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_rename_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_rename_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_rename_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_rename_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_rename_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_renameat_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_renameat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_renameat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_renameat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_renameat_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_renameat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_renameat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_renameat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_setxattr_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_setxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_setxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_setxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_setxattr_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_setxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_setxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_setxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_truncate_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_truncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_truncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_truncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_truncate_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_truncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_truncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_truncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_unlink_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_unlink_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_unlink_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_unlink_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_unlink_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_unlink_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_unlink_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_unlink_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_unlinkat_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_unlinkat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_unlinkat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_unlinkat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eacces_unlinkat_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_unlinkat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_unlinkat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eacces_unlinkat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_chmod_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_chmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_chmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_chmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_chmod_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_chmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_chmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_chmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_chown_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_chown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_chown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_chown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_chown_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_chown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_chown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_chown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_creat_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_creat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_creat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_creat_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_creat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_creat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_fchmod_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_fchmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_fchmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_fchmod_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_fchmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_fchmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_fchmodat_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchmodat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_fchmodat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_fchmodat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_fchmodat_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchmodat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_fchmodat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_fchmodat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_fchown_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_fchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_fchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_fchown_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_fchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_fchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_fchownat_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchownat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_fchownat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_fchownat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_fchownat_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchownat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_fchownat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_fchownat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_fremovexattr_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_fremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_fremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_fremovexattr_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_fremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_fremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_fsetxattr_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_fsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_fsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_fsetxattr_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_fsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_fsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_ftruncate_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_ftruncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_ftruncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_ftruncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_ftruncate_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_ftruncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_ftruncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_ftruncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_lchown_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_lchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_lchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_lchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_lchown_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_lchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_lchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_lchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_lremovexattr_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_lremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_lremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_lremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_lremovexattr_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_lremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_lremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_lremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_lsetxattr_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_lsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_lsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_lsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_lsetxattr_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_lsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_lsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_lsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_open_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_open_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_open_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_open_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_open_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_open_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_open_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_open_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_open_by_handle_at_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_open_by_handle_at_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_open_by_handle_at_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_open_by_handle_at_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_open_by_handle_at_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_open_by_handle_at_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_open_by_handle_at_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_open_by_handle_at_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_openat_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_openat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_openat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_openat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_openat_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_openat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_openat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_openat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_removexattr_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_removexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_removexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_removexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_removexattr_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_removexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_removexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_removexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_rename_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_rename_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_rename_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_rename_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_rename_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_rename_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_rename_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_rename_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_renameat_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_renameat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_renameat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_renameat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_renameat_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_renameat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_renameat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_renameat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_setxattr_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_setxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_setxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_setxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_setxattr_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_setxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_setxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_setxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_truncate_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_truncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_truncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_truncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_truncate_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_truncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_truncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_truncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_unlink_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_unlink_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_unlink_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_unlink_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_unlink_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_unlink_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_unlink_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_unlink_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_unlinkat_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_unlinkat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_unlinkat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_unlinkat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_32bit_arufm_eperm_unlinkat_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_unlinkat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_unlinkat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_32bit_arufm_eperm_unlinkat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_ardm_chmod_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_chmod_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_chown_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_chown_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_delete_module_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_delete_module_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_fchmod_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_fchmod_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_fchmodat_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_fchmodat_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_fchown_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_fchown_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_fchownat_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_fchownat_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_fremovexattr_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_fremovexattr_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_fsetxattr_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_fsetxattr_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_init_module_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_init_module_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_lchown_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_lchown_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_lremovexattr_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_lremovexattr_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_lsetxattr_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_lsetxattr_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_removexattr_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_removexattr_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_rename_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_rename_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_renameat_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_renameat_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_rmdir_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_rmdir_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_setxattr_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_setxattr_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_unlink_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_unlink_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_unlinkat_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_ardm_unlinkat_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_64bit_arufm_eacces_chmod_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_chmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_chmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_chmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_chmod_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_chmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_chmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_chmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_chown_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_chown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_chown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_chown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_chown_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_chown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_chown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_chown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_creat_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_creat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_creat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_creat_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_creat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_creat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_fchmod_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_fchmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_fchmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_fchmod_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_fchmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_fchmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_fchmodat_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchmodat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_fchmodat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_fchmodat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_fchmodat_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchmodat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_fchmodat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_fchmodat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_fchown_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_fchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_fchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_fchown_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_fchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_fchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_fchownat_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchownat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_fchownat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_fchownat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_fchownat_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchownat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_fchownat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_fchownat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_fremovexattr_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_fremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_fremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_fremovexattr_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_fremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_fremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_fsetxattr_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_fsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_fsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_fsetxattr_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_fsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_fsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_ftruncate_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_ftruncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_ftruncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_ftruncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_ftruncate_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_ftruncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_ftruncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_ftruncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_lchown_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_lchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_lchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_lchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_lchown_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_lchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_lchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_lchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_lremovexattr_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_lremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_lremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_lremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_lremovexattr_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_lremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_lremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_lremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_lsetxattr_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_lsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_lsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_lsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_lsetxattr_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_lsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_lsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_lsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_open_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_open_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_open_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_open_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_open_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_open_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_open_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_open_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_open_by_handle_at_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_open_by_handle_at_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_open_by_handle_at_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_open_by_handle_at_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_open_by_handle_at_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_open_by_handle_at_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_open_by_handle_at_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_open_by_handle_at_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_openat_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_openat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_openat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_openat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_openat_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_openat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_openat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_openat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_removexattr_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_removexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_removexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_removexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_removexattr_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_removexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_removexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_removexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_rename_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_rename_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_rename_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_rename_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_rename_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_rename_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_rename_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_rename_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_renameat_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_renameat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_renameat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_renameat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_renameat_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_renameat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_renameat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_renameat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_setxattr_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_setxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_setxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_setxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_setxattr_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_setxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_setxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_setxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_truncate_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_truncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_truncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_truncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_truncate_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_truncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_truncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_truncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_unlink_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_unlink_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_unlink_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_unlink_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_unlink_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_unlink_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_unlink_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_unlink_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_unlinkat_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_unlinkat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_unlinkat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_unlinkat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eacces_unlinkat_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_unlinkat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_unlinkat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eacces_unlinkat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_chmod_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_chmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_chmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_chmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_chmod_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_chmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_chmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_chmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_chown_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_chown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_chown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_chown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_chown_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_chown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_chown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_chown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_creat_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_creat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_creat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_creat_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_creat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_creat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_fchmod_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_fchmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_fchmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_fchmod_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchmod_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_fchmod_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_fchmod_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_fchmodat_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchmodat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_fchmodat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_fchmodat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_fchmodat_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchmodat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_fchmodat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_fchmodat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_fchown_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_fchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_fchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_fchown_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_fchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_fchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_fchownat_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchownat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_fchownat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_fchownat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_fchownat_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fchownat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_fchownat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_fchownat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_fremovexattr_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_fremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_fremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_fremovexattr_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_fremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_fremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_fsetxattr_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_fsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_fsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_fsetxattr_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_fsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_fsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_fsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_ftruncate_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_ftruncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_ftruncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_ftruncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_ftruncate_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_ftruncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_ftruncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_ftruncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_lchown_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_lchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_lchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_lchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_lchown_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_lchown_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_lchown_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_lchown_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_lremovexattr_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_lremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_lremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_lremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_lremovexattr_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_lremovexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_lremovexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_lremovexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_lsetxattr_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_lsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_lsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_lsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_lsetxattr_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_lsetxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_lsetxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_lsetxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_open_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_open_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_open_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_open_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_open_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_open_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_open_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_open_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_open_by_handle_at_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_open_by_handle_at_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_open_by_handle_at_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_open_by_handle_at_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_open_by_handle_at_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_open_by_handle_at_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_open_by_handle_at_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_open_by_handle_at_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_openat_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_openat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_openat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_openat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_openat_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_openat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_openat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_openat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_removexattr_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_removexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_removexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_removexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_removexattr_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_removexattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_removexattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_removexattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_rename_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_rename_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_rename_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_rename_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_rename_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_rename_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_rename_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_rename_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_renameat_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_renameat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_renameat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_renameat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_renameat_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_renameat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_renameat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_renameat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_setxattr_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_setxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_setxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_setxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_setxattr_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_setxattr_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_setxattr_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_setxattr_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_truncate_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_truncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_truncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_truncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_truncate_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_truncate_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_truncate_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_truncate_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_unlink_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_unlink_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_unlink_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_unlink_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_unlink_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_unlink_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_unlink_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_unlink_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_unlinkat_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_unlinkat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_unlinkat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_unlinkat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_64bit_arufm_eperm_unlinkat_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_arufm_unlinkat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_unlinkat_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</variable_value>
                    <variable_value variable_id="oval:ssg-var_64bit_arufm_eperm_unlinkat_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_faillock_conf:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_faillock_conf_deny_parameter_regex:var:1">^[\s]*deny[\s]*=[\s]*([0-9]+)</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_password:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_deny_parameter_regex:var:1">^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*deny=([0-9]+)</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_system:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_deny_parameter_regex:var:1">^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*deny=([0-9]+)</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_faillock_account:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_account_regex:var:1">^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_faillock_auth:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_auth_regex:var:1">^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_unix_auth:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_unix_regex:var:1">^[\s]*auth\N+pam_unix\.so</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_faillock_conf:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_faillock_conf_parameter_regex:var:1">^[\s]*even_deny_root</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_pamd_password:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_parameter_regex:var:1">^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*even_deny_root</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_pamd_system:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_parameter_regex:var:1">^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*even_deny_root</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_account:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_account_regex:var:1">^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_auth:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_auth_regex:var:1">^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_password_pam_unix_auth:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_unix_regex:var:1">^[\s]*auth\N+pam_unix\.so</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_account:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_account_regex:var:1">^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_auth:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_auth_regex:var:1">^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_system_pam_unix_auth:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_unix_regex:var:1">^[\s]*auth\N+pam_unix\.so</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_faillock_account:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_account_regex:var:1">^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_faillock_auth:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_auth_regex:var:1">^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_unix_auth:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_unix_regex:var:1">^[\s]*auth\N+pam_unix\.so</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_faillock_conf:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_interval_faillock_conf_fail_interval_parameter_regex:var:1">^[\s]*fail_interval[\s]*=[\s]*([0-9]+)</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_pamd_password:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_fail_interval_parameter_regex:var:1">^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*fail_interval=([0-9]+)</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_pamd_system:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_fail_interval_parameter_regex:var:1">^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*fail_interval=([0-9]+)</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_interval_password_pam_faillock_account:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_account_regex:var:1">^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_interval_password_pam_faillock_auth:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_auth_regex:var:1">^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_interval_password_pam_unix_auth:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_unix_regex:var:1">^[\s]*auth\N+pam_unix\.so</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_interval_system_pam_faillock_account:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_account_regex:var:1">^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_interval_system_pam_faillock_auth:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_faillock_auth_regex:var:1">^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_interval_system_pam_unix_auth:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_interval_pam_unix_regex:var:1">^[\s]*auth\N+pam_unix\.so</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_faillock_conf:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_faillock_conf_unlock_time_parameter_regex:var:1">^[\s]*unlock_time[\s]*=[\s]*([0-9]+)</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_password:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_unlock_time_parameter_regex:var:1">^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*unlock_time=([0-9]+)</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_system:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_unlock_time_parameter_regex:var:1">^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*unlock_time=([0-9]+)</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_account:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_account_regex:var:1">^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_auth:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_auth_regex:var:1">^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_unix_auth:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_unix_regex:var:1">^[\s]*auth\N+pam_unix\.so</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_account:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_account_regex:var:1">^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_auth:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_auth_regex:var:1">^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</variable_value>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_unix_auth:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_unix_regex:var:1">^[\s]*auth\N+pam_unix\.so</variable_value>
                  </object>
                  <object id="oval:ssg-object_ari_locked_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_ari_locked_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_arle_faillock_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_arle_faillock_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_arle_lastlog_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_arle_lastlog_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_arle_tallylog_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_arle_tallylog_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_armm_selinux_watch_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_armm_selinux_watch_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_arse_btmp_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_arse_btmp_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_arse_utmp_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_arse_utmp_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_arse_wtmp_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_arse_wtmp_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_auditctl_e</message>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_eacces_aug</message>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_auditctl_e</message>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_eperm_auge</message>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_arufm_open_by_handle_at_order_64bit_auditctl_eacces</message>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_eacces_aug</message>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_auditctl_e</message>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_eperm_auge</message>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_creat_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_creat_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_creat_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_creat_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_creat_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_creat_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_creat_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_creat_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_trunc_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_trunc_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_trunc_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_trunc_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_trunc_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_trunc_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_trunc_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_trunc_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_32bit_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_arufm_rule_order_32bit_open_auditctl_eacces_regex:v</message>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_32bit_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_arufm_rule_order_32bit_open_eacces_augenrules_regex</message>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_32bit_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_arufm_rule_order_32bit_open_auditctl_eperm_regex:va</message>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_32bit_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_arufm_rule_order_32bit_open_eperm_augenrules_regex:</message>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_64bit_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_arufm_open_order_64bit_auditctl_eacces_regex:var:1)</message>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_64bit_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_arufm_rule_order_64bit_open_eacces_augenrules_regex</message>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_64bit_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_arufm_rule_order_64bit_open_auditctl_eperm_regex:va</message>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_64bit_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_arufm_rule_order_64bit_open_eperm_augenrules_regex:</message>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_32bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_open_order_64bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_creat_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_creat_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_creat_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_creat_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_creat_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_creat_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_creat_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_creat_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_32bit_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_arufm_rule_order_32bit_openat_auditctl_eacces_regex</message>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_32bit_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_arufm_rule_order_32bit_openat_eacces_augenrules_reg</message>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_32bit_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_arufm_rule_order_32bit_openat_auditctl_eperm_regex:</message>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_32bit_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_arufm_rule_order_32bit_openat_eperm_augenrules_rege</message>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_64bit_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_arufm_openat_order_64bit_auditctl_eacces_regex:var:</message>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_64bit_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_arufm_rule_order_64bit_openat_eacces_augenrules_reg</message>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_64bit_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_arufm_rule_order_64bit_openat_auditctl_eperm_regex:</message>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_64bit_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_arufm_rule_order_64bit_openat_eperm_augenrules_rege</message>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_32bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_eacces_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EACCES)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_tail:var:1">[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</variable_value>
                    <variable_value variable_id="oval:ssg-var_audit_rule_openat_order_64bit_eperm_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F\s+exit=-EPERM)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_augenrules:obj:1" version="1" flag="complete">
                    <reference item_ref="10425255"/>
                  </object>
                  <object id="oval:ssg-object_audit_rules_execution_chcon_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_execution_chcon_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_execution_restorecon_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_execution_restorecon_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_execution_semanage_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_execution_semanage_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_execution_setsebool_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_execution_setsebool_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_execution_seunshare_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_execution_seunshare_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_at_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_at_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_chage_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_chage_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_chsh_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_chsh_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_crontab_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_crontab_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_gpasswd_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_gpasswd_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_mount_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_mount_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_newgidmap_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_newgidmap_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_newgrp_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_newgrp_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_newuidmap_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_newuidmap_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_passwd_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_passwd_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_pt_chown_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_pt_chown_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_ssh_keysign_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_ssh_keysign_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_su_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_su_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_sudo_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_sudo_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_sudoedit_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_sudoedit_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_umount_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_umount_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_unix_chkpwd_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_unix_chkpwd_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_userhelper_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_userhelper_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_usernetctl_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_privileged_commands_usernetctl_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_d_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_d_augenrules:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_tc_group_open_32bit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_32bit_open_write_tc_group_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_group_open_32bit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_32bit_open_write_tc_group_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_group_open_64bit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_64bit_open_write_tc_group_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_group_open_64bit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_64bit_open_write_tc_group_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_32bit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_group_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_32bit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_group_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_64bit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_group_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_64bit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_group_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_group_openat_32bit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_32bit_openat_write_tc_group_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_group_openat_32bit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_32bit_openat_write_tc_group_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_group_openat_64bit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_64bit_openat_write_tc_group_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_group_openat_64bit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_64bit_openat_write_tc_group_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_gshadow_open_32bit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_32bit_open_write_tc_gshadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_gshadow_open_32bit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_32bit_open_write_tc_gshadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_gshadow_open_64bit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_64bit_open_write_tc_gshadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_gshadow_open_64bit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_64bit_open_write_tc_gshadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_32bit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_gshadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_32bit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_gshadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_64bit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_gshadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_64bit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_gshadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_gshadow_openat_32bit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_32bit_openat_write_tc_gshadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_gshadow_openat_32bit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_32bit_openat_write_tc_gshadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_gshadow_openat_64bit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_64bit_openat_write_tc_gshadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_gshadow_openat_64bit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_64bit_openat_write_tc_gshadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_passwd_open_32bit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_32bit_open_write_tc_passwd_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_passwd_open_32bit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_32bit_open_write_tc_passwd_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_passwd_open_64bit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_64bit_open_write_tc_passwd_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_passwd_open_64bit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_64bit_open_write_tc_passwd_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_32bit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_passwd_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_32bit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_passwd_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_64bit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_passwd_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_64bit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_passwd_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_passwd_openat_32bit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_32bit_openat_write_tc_passwd_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_passwd_openat_32bit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_32bit_openat_write_tc_passwd_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_passwd_openat_64bit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_64bit_openat_write_tc_passwd_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_passwd_openat_64bit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_64bit_openat_write_tc_passwd_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_shadow_open_32bit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_32bit_open_write_tc_shadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_shadow_open_32bit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_32bit_open_write_tc_shadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_shadow_open_64bit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_64bit_open_write_tc_shadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_shadow_open_64bit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_64bit_open_write_tc_shadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_32bit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_shadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_32bit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_shadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_64bit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_shadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_64bit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_shadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_shadow_openat_32bit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_32bit_openat_write_tc_shadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_shadow_openat_32bit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_32bit_openat_write_tc_shadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_shadow_openat_64bit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_64bit_openat_write_tc_shadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_tc_shadow_openat_64bit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_64bit_openat_write_tc_shadow_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_audit_rules_usergroup_modification_group_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_usergroup_modification_group_augen:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_usergroup_modification_gshadow_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_usergroup_modification_gshadow_augen:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_usergroup_modification_opasswd_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_usergroup_modification_opasswd_augen:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_usergroup_modification_passwd_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_usergroup_modification_passwd_augen:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_usergroup_modification_shadow_auditctl:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_audit_rules_usergroup_modification_shadow_augen:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_auditd_audispd_configure_remote_server:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_auditd_audispd_encrypt_sent_records:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_auditd_audispd_syslog_plugin_activated:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_banner_etc_issue:obj:1" version="1" flag="complete">
                    <reference item_ref="10425242"/>
                  </object>
                  <object id="oval:ssg-object_bootloader_disable_recovery_argument:obj:1" version="1" flag="complete">
                    <reference item_ref="10425248"/>
                  </object>
                  <object id="oval:ssg-object_bootloader_superuser:obj:1" version="2" flag="complete">
                    <reference item_ref="10425264"/>
                  </object>
                  <object id="oval:ssg-object_configure_bind_crypto_policy:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_configure_crypto_policy:obj:1" version="1" flag="complete">
                    <reference item_ref="10425213"/>
                  </object>
                  <object id="oval:ssg-object_configure_crypto_policy_current:obj:1" version="1" flag="complete">
                    <reference item_ref="10425214"/>
                  </object>
                  <object id="oval:ssg-object_configure_libreswan_crypto_policy:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_configure_openssl_crypto_policy:obj:1" version="1" flag="complete">
                    <reference item_ref="10425223"/>
                  </object>
                  <object id="oval:ssg-object_configure_ssh_crypto_policy:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_crypto_policies_config_file_modified_time:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-variable_crypto_policies_config_file_timestamp:var:1">1656317058</variable_value>
                    <reference item_ref="10425216"/>
                  </object>
                  <object id="oval:ssg-object_crypto_policy_nss_config:obj:1" version="1" flag="complete">
                    <reference item_ref="10425218"/>
                  </object>
                  <object id="oval:ssg-object_dev_device_files:obj:1" version="1" flag="complete">
                    <reference item_ref="104252165"/>
                    <reference item_ref="104252105"/>
                    <reference item_ref="104252106"/>
                    <reference item_ref="104252107"/>
                    <reference item_ref="104252108"/>
                    <reference item_ref="104252109"/>
                    <reference item_ref="104252117"/>
                    <reference item_ref="104252118"/>
                    <reference item_ref="104252119"/>
                    <reference item_ref="104252120"/>
                    <reference item_ref="104252121"/>
                    <reference item_ref="104252123"/>
                    <reference item_ref="104252124"/>
                    <reference item_ref="104252125"/>
                    <reference item_ref="104252126"/>
                    <reference item_ref="104252127"/>
                    <reference item_ref="104252130"/>
                    <reference item_ref="104252131"/>
                    <reference item_ref="104252132"/>
                    <reference item_ref="104252133"/>
                    <reference item_ref="104252136"/>
                    <reference item_ref="104252138"/>
                    <reference item_ref="104252139"/>
                    <reference item_ref="104252140"/>
                    <reference item_ref="104252144"/>
                    <reference item_ref="104252145"/>
                    <reference item_ref="104252146"/>
                    <reference item_ref="104252147"/>
                    <reference item_ref="104252148"/>
                    <reference item_ref="104252149"/>
                    <reference item_ref="104252150"/>
                    <reference item_ref="104252151"/>
                    <reference item_ref="104252158"/>
                    <reference item_ref="104252169"/>
                    <reference item_ref="104252170"/>
                    <reference item_ref="104252171"/>
                    <reference item_ref="104252172"/>
                    <reference item_ref="104252174"/>
                    <reference item_ref="104252175"/>
                    <reference item_ref="104252176"/>
                    <reference item_ref="104252177"/>
                    <reference item_ref="104252178"/>
                    <reference item_ref="104252179"/>
                    <reference item_ref="104252180"/>
                    <reference item_ref="104252181"/>
                    <reference item_ref="104252182"/>
                    <reference item_ref="104252183"/>
                    <reference item_ref="104252184"/>
                    <reference item_ref="104252185"/>
                    <reference item_ref="104252186"/>
                    <reference item_ref="104252187"/>
                    <reference item_ref="104252188"/>
                    <reference item_ref="104252189"/>
                    <reference item_ref="104252190"/>
                    <reference item_ref="104252191"/>
                    <reference item_ref="104252192"/>
                    <reference item_ref="104252116"/>
                    <reference item_ref="104252100"/>
                    <reference item_ref="104252101"/>
                    <reference item_ref="104252102"/>
                    <reference item_ref="104252103"/>
                    <reference item_ref="104252104"/>
                    <reference item_ref="10425292"/>
                    <reference item_ref="10425293"/>
                    <reference item_ref="10425294"/>
                    <reference item_ref="10425295"/>
                    <reference item_ref="10425296"/>
                    <reference item_ref="10425297"/>
                    <reference item_ref="10425298"/>
                    <reference item_ref="104252193"/>
                    <reference item_ref="104252194"/>
                    <reference item_ref="104252195"/>
                    <reference item_ref="104252196"/>
                    <reference item_ref="104252197"/>
                    <reference item_ref="104252198"/>
                    <reference item_ref="104252199"/>
                    <reference item_ref="104252200"/>
                    <reference item_ref="104252201"/>
                    <reference item_ref="104252202"/>
                    <reference item_ref="104252203"/>
                    <reference item_ref="104252204"/>
                    <reference item_ref="104252205"/>
                    <reference item_ref="104252206"/>
                    <reference item_ref="104252207"/>
                    <reference item_ref="104252208"/>
                    <reference item_ref="104252209"/>
                    <reference item_ref="104252210"/>
                    <reference item_ref="104252227"/>
                    <reference item_ref="104252228"/>
                    <reference item_ref="104252229"/>
                    <reference item_ref="104252230"/>
                    <reference item_ref="104252231"/>
                    <reference item_ref="104252232"/>
                    <reference item_ref="104252233"/>
                    <reference item_ref="104252234"/>
                    <reference item_ref="104252235"/>
                    <reference item_ref="104252236"/>
                    <reference item_ref="104252237"/>
                    <reference item_ref="104252238"/>
                    <reference item_ref="104252239"/>
                    <reference item_ref="104252240"/>
                    <reference item_ref="104252241"/>
                    <reference item_ref="104252242"/>
                    <reference item_ref="104252243"/>
                    <reference item_ref="104252244"/>
                    <reference item_ref="104252245"/>
                    <reference item_ref="104252246"/>
                    <reference item_ref="104252247"/>
                    <reference item_ref="104252248"/>
                    <reference item_ref="104252249"/>
                    <reference item_ref="104252250"/>
                    <reference item_ref="104252251"/>
                    <reference item_ref="104252252"/>
                    <reference item_ref="104252253"/>
                    <reference item_ref="104252254"/>
                    <reference item_ref="104252255"/>
                    <reference item_ref="104252256"/>
                    <reference item_ref="104252257"/>
                    <reference item_ref="104252258"/>
                    <reference item_ref="104252259"/>
                    <reference item_ref="104252260"/>
                    <reference item_ref="104252261"/>
                    <reference item_ref="104252262"/>
                    <reference item_ref="104252263"/>
                    <reference item_ref="104252264"/>
                    <reference item_ref="104252265"/>
                    <reference item_ref="104252266"/>
                    <reference item_ref="104252267"/>
                    <reference item_ref="104252268"/>
                    <reference item_ref="104252269"/>
                    <reference item_ref="104252270"/>
                    <reference item_ref="104252271"/>
                    <reference item_ref="104252272"/>
                    <reference item_ref="104252273"/>
                    <reference item_ref="104252274"/>
                    <reference item_ref="104252275"/>
                    <reference item_ref="104252276"/>
                    <reference item_ref="104252277"/>
                    <reference item_ref="104252278"/>
                    <reference item_ref="104252279"/>
                    <reference item_ref="104252280"/>
                    <reference item_ref="104252281"/>
                    <reference item_ref="104252282"/>
                    <reference item_ref="104252283"/>
                    <reference item_ref="104252284"/>
                    <reference item_ref="104252285"/>
                    <reference item_ref="104252286"/>
                    <reference item_ref="104252287"/>
                    <reference item_ref="104252288"/>
                    <reference item_ref="104252289"/>
                    <reference item_ref="104252290"/>
                    <reference item_ref="104252291"/>
                    <reference item_ref="104252292"/>
                    <reference item_ref="104252293"/>
                    <reference item_ref="104252294"/>
                    <reference item_ref="104252295"/>
                    <reference item_ref="104252296"/>
                    <reference item_ref="104252297"/>
                    <reference item_ref="104252298"/>
                    <reference item_ref="104252299"/>
                    <reference item_ref="104252300"/>
                    <reference item_ref="104252301"/>
                    <reference item_ref="104252302"/>
                    <reference item_ref="104252303"/>
                    <reference item_ref="104252304"/>
                    <reference item_ref="104252305"/>
                    <reference item_ref="104252306"/>
                    <reference item_ref="104252307"/>
                    <reference item_ref="104252308"/>
                    <reference item_ref="10425299"/>
                    <reference item_ref="104252122"/>
                    <reference item_ref="104252110"/>
                    <reference item_ref="104252111"/>
                    <reference item_ref="104252112"/>
                    <reference item_ref="104252113"/>
                    <reference item_ref="104252114"/>
                    <reference item_ref="104252115"/>
                    <reference item_ref="104252128"/>
                    <reference item_ref="104252129"/>
                    <reference item_ref="104252134"/>
                    <reference item_ref="104252135"/>
                    <reference item_ref="104252137"/>
                    <reference item_ref="104252141"/>
                    <reference item_ref="104252142"/>
                    <reference item_ref="104252143"/>
                    <reference item_ref="104252152"/>
                    <reference item_ref="104252153"/>
                    <reference item_ref="104252154"/>
                    <reference item_ref="104252173"/>
                    <reference item_ref="104252155"/>
                    <reference item_ref="104252211"/>
                    <reference item_ref="104252166"/>
                    <reference item_ref="104252156"/>
                    <reference item_ref="104252157"/>
                    <reference item_ref="104252159"/>
                    <reference item_ref="104252160"/>
                    <reference item_ref="104252161"/>
                    <reference item_ref="104252162"/>
                    <reference item_ref="104252163"/>
                    <reference item_ref="104252164"/>
                    <reference item_ref="104252213"/>
                    <reference item_ref="104252167"/>
                    <reference item_ref="104252168"/>
                    <reference item_ref="104252215"/>
                    <reference item_ref="104252217"/>
                    <reference item_ref="104252212"/>
                    <reference item_ref="104252219"/>
                    <reference item_ref="104252214"/>
                    <reference item_ref="104252221"/>
                    <reference item_ref="104252216"/>
                    <reference item_ref="104252223"/>
                    <reference item_ref="104252218"/>
                    <reference item_ref="104252225"/>
                    <reference item_ref="104252220"/>
                    <reference item_ref="104252222"/>
                    <reference item_ref="104252224"/>
                    <reference item_ref="104252226"/>
                  </object>
                  <object id="oval:ssg-object_dev_shm_partition_nodev_optional_no:obj:1" version="1" flag="complete">
                    <reference item_ref="10425267"/>
                  </object>
                  <object id="oval:ssg-object_dev_shm_partition_noexec_optional_no:obj:1" version="1" flag="complete">
                    <reference item_ref="10425267"/>
                  </object>
                  <object id="oval:ssg-object_dev_shm_partition_nosuid_optional_no:obj:1" version="1" flag="complete">
                    <reference item_ref="10425267"/>
                  </object>
                  <object id="oval:ssg-object_directory_acccess_var_log_audit_auditctl:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_access_var_log_audit_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+dir=/var/log/audit/)[\s]+(?:-F[\s]+perm=r)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_directory_acccess_var_log_audit_augenrules:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-var_audit_rule_access_var_log_audit_regex:var:1">^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+dir=/var/log/audit/)[\s]+(?:-F[\s]+perm=r)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</variable_value>
                  </object>
                  <object id="oval:ssg-object_distro_db_modified_time:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-var_dconf_distro_db_modified_time:var:1">1751</variable_value>
                    <reference item_ref="10425228"/>
                  </object>
                  <object id="oval:ssg-object_enable_dracut_fips_module:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_ensure_gpgcheck_globally_activated:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_etc_profile_tmout:obj:1" version="3" flag="does not exist"/>
                  <object id="oval:ssg-object_etc_profiled_tmout:obj:1" version="3" flag="does not exist"/>
                  <object id="oval:ssg-object_etc_selinux_config:obj:1" version="1" flag="complete">
                    <reference item_ref="104252502"/>
                  </object>
                  <object id="oval:ssg-object_etc_system_fips:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_fedora_release_rpm:obj:1" version="1" flag="complete">
                    <reference item_ref="10425235"/>
                    <reference item_ref="10425237"/>
                    <reference item_ref="10425236"/>
                  </object>
                  <object id="oval:ssg-object_fedora_vendor_product:obj:1" version="1" flag="complete">
                    <reference item_ref="10425238"/>
                  </object>
                  <object id="oval:ssg-object_files_fail_md5_hash:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_grub2_audit_argument:obj:1" version="1" flag="complete">
                    <reference item_ref="10425253"/>
                  </object>
                  <object id="oval:ssg-object_grub2_audit_argument_default:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_grub2_audit_backlog_limit_argument:obj:1" version="1" flag="complete">
                    <reference item_ref="10425253"/>
                  </object>
                  <object id="oval:ssg-object_grub2_audit_backlog_limit_argument_default:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_grub2_disable_interactive_boot_grub_cmdline_linux:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_grub2_disable_interactive_boot_grub_cmdline_linux_default:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_grub2_page_poison_argument:obj:1" version="1" flag="complete">
                    <reference item_ref="10425253"/>
                  </object>
                  <object id="oval:ssg-object_grub2_page_poison_argument_default:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_grub2_password_grubcfg:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_grub2_password_usercfg:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_grub2_pti_argument:obj:1" version="1" flag="complete">
                    <reference item_ref="10425253"/>
                  </object>
                  <object id="oval:ssg-object_grub2_pti_argument_default:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_grub2_slub_debug_argument:obj:1" version="1" flag="complete">
                    <reference item_ref="10425253"/>
                  </object>
                  <object id="oval:ssg-object_grub2_slub_debug_argument_default:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_grub2_vsyscall_argument:obj:1" version="1" flag="complete">
                    <reference item_ref="10425253"/>
                  </object>
                  <object id="oval:ssg-object_grub2_vsyscall_argument_default:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_kerberos_crypto_policy_backend:obj:1" version="1" flag="complete">
                    <reference item_ref="10425222"/>
                  </object>
                  <object id="oval:ssg-object_kerberos_crypto_policy_configuration:obj:1" version="1" flag="complete">
                    <reference item_ref="10425220"/>
                  </object>
                  <object id="oval:ssg-object_kernel_core_pattern_symlinks:obj:1" version="1" flag="does not exist">
                    <message level="info">File '/usr/lib/sysctl.d/50-coredump.conf' is not a symlink.</message>
                    <variable_value variable_id="oval:ssg-local_var_conf_files_kernel_core_pattern:var:1">/usr/lib/sysctl.d/50-coredump.conf</variable_value>
                  </object>
                  <object id="oval:ssg-object_kernel_dmesg_restrict_symlinks:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-local_var_conf_files_kernel_dmesg_restrict:var:1).</message>
                  </object>
                  <object id="oval:ssg-object_kernel_kexec_load_disabled_symlinks:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-local_var_conf_files_kernel_kexec_load_disabled:var:1).</message>
                  </object>
                  <object id="oval:ssg-object_kernel_kptr_restrict_symlinks:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-local_var_conf_files_kernel_kptr_restrict:var:1).</message>
                  </object>
                  <object id="oval:ssg-object_kernel_perf_event_paranoid_symlinks:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-local_var_conf_files_kernel_perf_event_paranoid:var:1).</message>
                  </object>
                  <object id="oval:ssg-object_kernel_unprivileged_bpf_disabled_symlinks:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-local_var_conf_files_kernel_unprivileged_bpf_disabled:v</message>
                  </object>
                  <object id="oval:ssg-object_kernel_yama_ptrace_scope_symlinks:obj:1" version="1" flag="does not exist">
                    <message level="info">File '/usr/lib/sysctl.d/10-default-yama-scope.conf' is not a symlink.</message>
                    <variable_value variable_id="oval:ssg-local_var_conf_files_kernel_yama_ptrace_scope:var:1">/usr/lib/sysctl.d/10-default-yama-scope.conf</variable_value>
                  </object>
                  <object id="oval:ssg-object_last_pass_min_len_from_etc_login_defs:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_last_pass_min_len_instance_value:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-variable_last_pass_min_len_instance_value:var:1).</message>
                  </object>
                  <object id="oval:ssg-object_local_db_modified_time:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-var_dconf_local_db_modified_time:var:1">1751</variable_value>
                    <reference item_ref="10425232"/>
                  </object>
                  <object id="oval:ssg-object_multi_user_target_for_chronyd_enabled:obj:1" version="1" flag="complete">
                    <reference item_ref="10425241"/>
                  </object>
                  <object id="oval:ssg-object_multi_user_target_for_chronyd_socket_enabled:obj:1" version="1" flag="complete">
                    <reference item_ref="10425241"/>
                  </object>
                  <object id="oval:ssg-object_multi_user_target_for_dnf-automatic_enabled:obj:1" version="1" flag="complete">
                    <reference item_ref="10425241"/>
                  </object>
                  <object id="oval:ssg-object_multi_user_target_for_firewalld_enabled:obj:1" version="1" flag="complete">
                    <reference item_ref="10425241"/>
                  </object>
                  <object id="oval:ssg-object_multi_user_target_for_firewalld_socket_enabled:obj:1" version="1" flag="complete">
                    <reference item_ref="10425241"/>
                  </object>
                  <object id="oval:ssg-object_multi_user_target_for_rngd_enabled:obj:1" version="1" flag="complete">
                    <reference item_ref="10425241"/>
                  </object>
                  <object id="oval:ssg-object_multi_user_target_for_rngd_socket_enabled:obj:1" version="1" flag="complete">
                    <reference item_ref="10425241"/>
                  </object>
                  <object id="oval:ssg-object_net_core_bpf_jit_harden_symlinks:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-local_var_conf_files_net_core_bpf_jit_harden:var:1).</message>
                  </object>
                  <object id="oval:ssg-object_no_custom_rescue_service:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_no_custom_runlevel1_target:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_no_empty_passwords:obj:1" version="1" flag="complete">
                    <reference item_ref="10425252"/>
                  </object>
                  <object id="oval:ssg-object_package_gpg-pubkey:obj:1" version="1" flag="complete">
                    <reference item_ref="10425239"/>
                  </object>
                  <object id="oval:ssg-object_remote_loghost_rsyslog_conf:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_remote_loghost_rsyslog_d:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_selinux_confinement_of_daemons:obj:1" version="1" flag="complete">
                    <reference item_ref="104252309"/>
                    <reference item_ref="104252310"/>
                    <reference item_ref="104252311"/>
                    <reference item_ref="104252312"/>
                    <reference item_ref="104252313"/>
                    <reference item_ref="104252314"/>
                    <reference item_ref="104252315"/>
                    <reference item_ref="104252316"/>
                    <reference item_ref="104252317"/>
                    <reference item_ref="104252318"/>
                    <reference item_ref="104252319"/>
                    <reference item_ref="104252320"/>
                    <reference item_ref="104252321"/>
                    <reference item_ref="104252322"/>
                    <reference item_ref="104252323"/>
                    <reference item_ref="104252324"/>
                    <reference item_ref="104252326"/>
                    <reference item_ref="104252325"/>
                    <reference item_ref="104252327"/>
                    <reference item_ref="104252328"/>
                    <reference item_ref="104252329"/>
                    <reference item_ref="104252330"/>
                    <reference item_ref="104252331"/>
                    <reference item_ref="104252332"/>
                    <reference item_ref="104252333"/>
                    <reference item_ref="104252334"/>
                    <reference item_ref="104252335"/>
                    <reference item_ref="104252336"/>
                    <reference item_ref="104252337"/>
                    <reference item_ref="104252338"/>
                    <reference item_ref="104252339"/>
                    <reference item_ref="104252340"/>
                    <reference item_ref="104252341"/>
                    <reference item_ref="104252342"/>
                    <reference item_ref="104252343"/>
                    <reference item_ref="104252344"/>
                    <reference item_ref="104252345"/>
                    <reference item_ref="104252346"/>
                    <reference item_ref="104252347"/>
                    <reference item_ref="104252348"/>
                    <reference item_ref="104252349"/>
                    <reference item_ref="104252350"/>
                    <reference item_ref="104252351"/>
                    <reference item_ref="104252352"/>
                    <reference item_ref="104252353"/>
                    <reference item_ref="104252354"/>
                    <reference item_ref="104252355"/>
                    <reference item_ref="104252356"/>
                    <reference item_ref="104252357"/>
                    <reference item_ref="104252358"/>
                    <reference item_ref="104252359"/>
                    <reference item_ref="104252360"/>
                    <reference item_ref="104252361"/>
                    <reference item_ref="104252362"/>
                    <reference item_ref="104252363"/>
                    <reference item_ref="104252364"/>
                    <reference item_ref="104252365"/>
                    <reference item_ref="104252366"/>
                    <reference item_ref="104252367"/>
                    <reference item_ref="104252368"/>
                    <reference item_ref="104252369"/>
                    <reference item_ref="104252370"/>
                    <reference item_ref="104252371"/>
                    <reference item_ref="104252372"/>
                    <reference item_ref="104252374"/>
                    <reference item_ref="104252373"/>
                    <reference item_ref="104252375"/>
                    <reference item_ref="104252376"/>
                    <reference item_ref="104252377"/>
                    <reference item_ref="104252378"/>
                    <reference item_ref="104252379"/>
                    <reference item_ref="104252380"/>
                    <reference item_ref="104252381"/>
                    <reference item_ref="104252382"/>
                    <reference item_ref="104252383"/>
                    <reference item_ref="104252384"/>
                    <reference item_ref="104252385"/>
                    <reference item_ref="104252386"/>
                    <reference item_ref="104252387"/>
                    <reference item_ref="104252388"/>
                    <reference item_ref="104252389"/>
                    <reference item_ref="104252390"/>
                    <reference item_ref="104252391"/>
                    <reference item_ref="104252392"/>
                    <reference item_ref="104252393"/>
                    <reference item_ref="104252394"/>
                    <reference item_ref="104252395"/>
                    <reference item_ref="104252396"/>
                    <reference item_ref="104252397"/>
                    <reference item_ref="104252398"/>
                    <reference item_ref="104252399"/>
                    <reference item_ref="104252400"/>
                    <reference item_ref="104252401"/>
                    <reference item_ref="104252402"/>
                    <reference item_ref="104252403"/>
                    <reference item_ref="104252404"/>
                    <reference item_ref="104252406"/>
                    <reference item_ref="104252405"/>
                    <reference item_ref="104252407"/>
                    <reference item_ref="104252408"/>
                    <reference item_ref="104252409"/>
                    <reference item_ref="104252410"/>
                    <reference item_ref="104252411"/>
                    <reference item_ref="104252412"/>
                    <reference item_ref="104252413"/>
                    <reference item_ref="104252414"/>
                    <reference item_ref="104252415"/>
                    <reference item_ref="104252416"/>
                    <reference item_ref="104252417"/>
                    <reference item_ref="104252418"/>
                    <reference item_ref="104252419"/>
                    <reference item_ref="104252420"/>
                    <reference item_ref="104252422"/>
                    <reference item_ref="104252421"/>
                    <reference item_ref="104252423"/>
                    <reference item_ref="104252424"/>
                    <reference item_ref="104252425"/>
                    <reference item_ref="104252426"/>
                    <reference item_ref="104252427"/>
                    <reference item_ref="104252428"/>
                    <reference item_ref="104252429"/>
                    <reference item_ref="104252430"/>
                    <reference item_ref="104252431"/>
                    <reference item_ref="104252432"/>
                    <reference item_ref="104252433"/>
                    <reference item_ref="104252434"/>
                    <reference item_ref="104252435"/>
                    <reference item_ref="104252436"/>
                    <reference item_ref="104252437"/>
                    <reference item_ref="104252438"/>
                    <reference item_ref="104252439"/>
                    <reference item_ref="104252440"/>
                    <reference item_ref="104252441"/>
                    <reference item_ref="104252442"/>
                    <reference item_ref="104252443"/>
                    <reference item_ref="104252444"/>
                    <reference item_ref="104252445"/>
                    <reference item_ref="104252446"/>
                    <reference item_ref="104252447"/>
                    <reference item_ref="104252448"/>
                    <reference item_ref="104252449"/>
                    <reference item_ref="104252450"/>
                    <reference item_ref="104252451"/>
                    <reference item_ref="104252452"/>
                    <reference item_ref="104252453"/>
                    <reference item_ref="104252454"/>
                    <reference item_ref="104252455"/>
                    <reference item_ref="104252456"/>
                    <reference item_ref="104252457"/>
                    <reference item_ref="104252458"/>
                    <reference item_ref="104252459"/>
                    <reference item_ref="104252460"/>
                    <reference item_ref="104252461"/>
                    <reference item_ref="104252462"/>
                    <reference item_ref="104252463"/>
                    <reference item_ref="104252464"/>
                    <reference item_ref="104252465"/>
                    <reference item_ref="104252466"/>
                    <reference item_ref="104252467"/>
                    <reference item_ref="104252468"/>
                    <reference item_ref="104252470"/>
                    <reference item_ref="104252469"/>
                    <reference item_ref="104252471"/>
                    <reference item_ref="104252472"/>
                    <reference item_ref="104252473"/>
                    <reference item_ref="104252474"/>
                    <reference item_ref="104252475"/>
                    <reference item_ref="104252476"/>
                    <reference item_ref="104252477"/>
                    <reference item_ref="104252478"/>
                    <reference item_ref="104252479"/>
                    <reference item_ref="104252480"/>
                    <reference item_ref="104252481"/>
                    <reference item_ref="104252482"/>
                    <reference item_ref="104252483"/>
                    <reference item_ref="104252484"/>
                    <reference item_ref="104252485"/>
                    <reference item_ref="104252486"/>
                    <reference item_ref="104252487"/>
                    <reference item_ref="104252488"/>
                    <reference item_ref="104252489"/>
                    <reference item_ref="104252490"/>
                    <reference item_ref="104252491"/>
                    <reference item_ref="104252492"/>
                    <reference item_ref="104252493"/>
                    <reference item_ref="104252494"/>
                    <reference item_ref="104252495"/>
                    <reference item_ref="104252496"/>
                    <reference item_ref="104252497"/>
                    <reference item_ref="104252498"/>
                    <reference item_ref="104252499"/>
                    <reference item_ref="104252500"/>
                  </object>
                  <object id="oval:ssg-object_selinux_dev_device_t:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/bus/usb/002/001</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu2</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs2</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/kvm</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/watchdog0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/watchdog</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vhost-net</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vhci</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vfio/vfio</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/uinput</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ppp</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cuse</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/lp3</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/lp2</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/lp1</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/lp0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vda1</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/fb0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vport2p2</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vport2p1</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vda</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/uhid</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/loop-control</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/fuse</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/bsg/2:0:0:0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/sg0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/sr0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/btrfs-control</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu_dma_latency</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/mcelog</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/mapper/control</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/rtc0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event3</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/usbmon2</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/usbmon1</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/usbmon0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/udmabuf</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/nvram</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/hpet</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS31</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS30</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS29</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS28</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS27</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS26</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS25</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS24</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS23</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS22</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS21</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS20</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS19</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS18</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS17</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS16</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS15</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vhost-vsock</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs4</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa3</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu3</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs3</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa2</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa6</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu6</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs6</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa5</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu5</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs5</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa4</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS14</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS13</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS12</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS11</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS10</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS9</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS8</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS7</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS6</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS5</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS4</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS3</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS2</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS1</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ptmx</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/autofs</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snapshot</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/hwrng</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty63</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty62</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty61</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty60</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty59</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty58</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty57</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty56</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty55</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty54</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty53</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty52</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty51</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty50</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty49</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty48</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty47</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty46</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty45</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty44</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty43</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty42</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty41</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty40</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty39</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty38</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty37</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty36</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty35</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty34</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty33</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty32</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty31</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty30</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty29</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty28</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty27</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty26</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty25</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty24</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty23</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty22</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty21</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty20</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty19</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty18</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty17</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty16</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty15</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty14</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty13</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty12</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty11</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty10</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty9</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty8</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty7</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty6</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty5</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty4</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty3</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty2</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty1</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa1</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu1</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs1</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/console</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/kmsg</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/urandom</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/random</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/full</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/zero</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/port</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/null</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/mem</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vga_arbiter</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu4</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/net/tun</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snd/controlC0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snd/hwC0D0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snd/pcmC0D0c</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snd/pcmC0D0p</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snd/seq</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snd/timer</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/zram0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vda2</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/dri/card0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/dri/renderD128</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/rfkill</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/hidraw0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/pts/0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/pts/ptmx</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/js0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event6</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/mouse3</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/dma_heap/system</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event5</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/7/cpuid</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/bus/usb/001/003</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event4</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/mouse2</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/mouse1</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event2</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/mouse0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event1</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/mice</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/6/cpuid</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/bus/usb/001/002</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/bus/usb/001/001</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/5/cpuid</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/4/cpuid</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/7/msr</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/3/cpuid</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/6/msr</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/2/cpuid</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/5/msr</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/1/cpuid</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/4/msr</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/0/cpuid</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/3/msr</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/2/msr</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/1/msr</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/0/msr</variable_value>
                  </object>
                  <object id="oval:ssg-object_selinux_dev_unlabeled_t:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/bus/usb/002/001</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu2</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs2</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/kvm</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/watchdog0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/watchdog</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vhost-net</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vhci</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vfio/vfio</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/uinput</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ppp</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cuse</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/lp3</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/lp2</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/lp1</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/lp0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vda1</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/fb0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vport2p2</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vport2p1</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vda</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/uhid</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/loop-control</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/fuse</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/bsg/2:0:0:0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/sg0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/sr0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/btrfs-control</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu_dma_latency</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/mcelog</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/mapper/control</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/rtc0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event3</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/usbmon2</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/usbmon1</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/usbmon0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/udmabuf</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/nvram</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/hpet</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS31</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS30</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS29</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS28</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS27</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS26</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS25</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS24</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS23</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS22</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS21</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS20</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS19</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS18</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS17</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS16</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS15</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vhost-vsock</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs4</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa3</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu3</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs3</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa2</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa6</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu6</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs6</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa5</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu5</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs5</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa4</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS14</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS13</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS12</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS11</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS10</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS9</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS8</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS7</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS6</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS5</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS4</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS3</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS2</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS1</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ttyS0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/ptmx</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/autofs</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snapshot</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/hwrng</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty63</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty62</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty61</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty60</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty59</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty58</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty57</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty56</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty55</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty54</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty53</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty52</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty51</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty50</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty49</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty48</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty47</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty46</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty45</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty44</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty43</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty42</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty41</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty40</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty39</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty38</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty37</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty36</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty35</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty34</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty33</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty32</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty31</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty30</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty29</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty28</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty27</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty26</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty25</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty24</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty23</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty22</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty21</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty20</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty19</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty18</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty17</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty16</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty15</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty14</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty13</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty12</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty11</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty10</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty9</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty8</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty7</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty6</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty5</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty4</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty3</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty2</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty1</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa1</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu1</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs1</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsa</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcs</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/console</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/tty</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/kmsg</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/urandom</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/random</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/full</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/zero</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/port</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/null</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/mem</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vga_arbiter</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vcsu4</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/net/tun</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snd/controlC0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snd/hwC0D0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snd/pcmC0D0c</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snd/pcmC0D0p</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snd/seq</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/snd/timer</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/zram0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/vda2</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/dri/card0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/dri/renderD128</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/rfkill</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/hidraw0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/pts/0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/pts/ptmx</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/js0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event6</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/mouse3</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/dma_heap/system</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event5</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/7/cpuid</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/bus/usb/001/003</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event4</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/mouse2</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/mouse1</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event2</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/mouse0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event1</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/event0</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/input/mice</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/6/cpuid</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/bus/usb/001/002</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/bus/usb/001/001</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/5/cpuid</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/4/cpuid</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/7/msr</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/3/cpuid</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/6/msr</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/2/cpuid</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/5/msr</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/1/cpuid</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/4/msr</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/0/cpuid</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/3/msr</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/2/msr</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/1/msr</variable_value>
                    <variable_value variable_id="oval:ssg-variable_dev_device_files:var:1">/dev/cpu/0/msr</variable_value>
                  </object>
                  <object id="oval:ssg-object_sshd_not_required:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-sshd_required:var:1">0</variable_value>
                    <reference item_ref="104252506"/>
                  </object>
                  <object id="oval:ssg-object_sshd_required:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-sshd_required:var:1">0</variable_value>
                    <reference item_ref="104252506"/>
                  </object>
                  <object id="oval:ssg-object_sshd_requirement_unknown:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-sshd_required:var:1">0</variable_value>
                    <reference item_ref="104252506"/>
                  </object>
                  <object id="oval:ssg-object_static_etc_sysctld_kernel_core_pattern:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_etc_sysctld_kernel_dmesg_restrict:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_etc_sysctld_kernel_kexec_load_disabled:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_etc_sysctld_kernel_kptr_restrict:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_etc_sysctld_kernel_perf_event_paranoid:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_etc_sysctld_kernel_unprivileged_bpf_disabled:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_etc_sysctld_kernel_yama_ptrace_scope:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_etc_sysctld_net_core_bpf_jit_harden:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_etc_sysctld_user_max_user_namespaces:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_run_sysctld_kernel_core_pattern:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_run_sysctld_kernel_dmesg_restrict:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_run_sysctld_kernel_kexec_load_disabled:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_run_sysctld_kernel_kptr_restrict:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_run_sysctld_kernel_perf_event_paranoid:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_run_sysctld_kernel_unprivileged_bpf_disabled:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_run_sysctld_kernel_yama_ptrace_scope:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_run_sysctld_net_core_bpf_jit_harden:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_run_sysctld_user_max_user_namespaces:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_set_sysctls_kernel_core_pattern:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-local_var_safe_symlinks_kernel_core_pattern:var:1"></variable_value>
                    <reference item_ref="10425268"/>
                  </object>
                  <object id="oval:ssg-object_static_set_sysctls_kernel_dmesg_restrict:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-local_var_safe_symlinks_kernel_dmesg_restrict:var:1"></variable_value>
                  </object>
                  <object id="oval:ssg-object_static_set_sysctls_kernel_kexec_load_disabled:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-local_var_safe_symlinks_kernel_kexec_load_disabled:var:1"></variable_value>
                  </object>
                  <object id="oval:ssg-object_static_set_sysctls_kernel_kptr_restrict:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-local_var_safe_symlinks_kernel_kptr_restrict:var:1"></variable_value>
                  </object>
                  <object id="oval:ssg-object_static_set_sysctls_kernel_perf_event_paranoid:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-local_var_safe_symlinks_kernel_perf_event_paranoid:var:1"></variable_value>
                  </object>
                  <object id="oval:ssg-object_static_set_sysctls_kernel_unprivileged_bpf_disabled:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-local_var_safe_symlinks_kernel_unprivileged_bpf_disabled:var:1"></variable_value>
                  </object>
                  <object id="oval:ssg-object_static_set_sysctls_kernel_yama_ptrace_scope:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-local_var_safe_symlinks_kernel_yama_ptrace_scope:var:1"></variable_value>
                    <reference item_ref="10425280"/>
                  </object>
                  <object id="oval:ssg-object_static_set_sysctls_net_core_bpf_jit_harden:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-local_var_safe_symlinks_net_core_bpf_jit_harden:var:1"></variable_value>
                  </object>
                  <object id="oval:ssg-object_static_set_sysctls_user_max_user_namespaces:obj:1" version="1" flag="does not exist">
                    <variable_value variable_id="oval:ssg-local_var_safe_symlinks_user_max_user_namespaces:var:1"></variable_value>
                  </object>
                  <object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_core_pattern:obj:1" version="1" flag="complete">
                    <reference item_ref="10425268"/>
                  </object>
                  <object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_dmesg_restrict:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_kexec_load_disabled:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_kptr_restrict:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_perf_event_paranoid:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_unprivileged_bpf_disabled:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_set_unfiltered_sysctls_kernel_yama_ptrace_scope:obj:1" version="1" flag="complete">
                    <reference item_ref="10425280"/>
                  </object>
                  <object id="oval:ssg-object_static_set_unfiltered_sysctls_net_core_bpf_jit_harden:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_set_unfiltered_sysctls_user_max_user_namespaces:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_sysctl_kernel_core_pattern:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_sysctl_kernel_dmesg_restrict:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_sysctl_kernel_kexec_load_disabled:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_sysctl_kernel_kptr_restrict:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_sysctl_kernel_perf_event_paranoid:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_sysctl_kernel_unprivileged_bpf_disabled:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_sysctl_kernel_yama_ptrace_scope:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_sysctl_net_core_bpf_jit_harden:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_sysctl_user_max_user_namespaces:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_usr_lib_sysctld_kernel_core_pattern:obj:1" version="1" flag="complete">
                    <reference item_ref="10425268"/>
                  </object>
                  <object id="oval:ssg-object_static_usr_lib_sysctld_kernel_dmesg_restrict:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_usr_lib_sysctld_kernel_kexec_load_disabled:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_usr_lib_sysctld_kernel_kptr_restrict:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_paranoid:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_usr_lib_sysctld_kernel_yama_ptrace_scope:obj:1" version="1" flag="complete">
                    <reference item_ref="10425280"/>
                  </object>
                  <object id="oval:ssg-object_static_usr_lib_sysctld_net_core_bpf_jit_harden:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_static_usr_lib_sysctld_user_max_user_namespaces:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_symlink_kerberos_crypto_policy_configuration:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-var_symlink_kerberos_crypto_policy_configuration:var:1">/usr/share/crypto-policies/DEFAULT/krb5.txt</variable_value>
                    <reference item_ref="10425221"/>
                  </object>
                  <object id="oval:ssg-object_sysctl_crypto_fips_enabled:obj:1" version="1" flag="complete">
                    <reference item_ref="10425212"/>
                  </object>
                  <object id="oval:ssg-object_sysctl_runtime_kernel_core_pattern:obj:1" version="1" flag="complete">
                    <reference item_ref="10425271"/>
                  </object>
                  <object id="oval:ssg-object_sysctl_runtime_kernel_dmesg_restrict:obj:1" version="1" flag="complete">
                    <reference item_ref="10425273"/>
                  </object>
                  <object id="oval:ssg-object_sysctl_runtime_kernel_kexec_load_disabled:obj:1" version="1" flag="complete">
                    <reference item_ref="10425275"/>
                  </object>
                  <object id="oval:ssg-object_sysctl_runtime_kernel_kptr_restrict:obj:1" version="1" flag="complete">
                    <reference item_ref="10425291"/>
                  </object>
                  <object id="oval:ssg-object_sysctl_runtime_kernel_perf_event_paranoid:obj:1" version="1" flag="complete">
                    <reference item_ref="10425277"/>
                  </object>
                  <object id="oval:ssg-object_sysctl_runtime_kernel_unprivileged_bpf_disabled:obj:1" version="1" flag="complete">
                    <reference item_ref="10425279"/>
                  </object>
                  <object id="oval:ssg-object_sysctl_runtime_kernel_yama_ptrace_scope:obj:1" version="1" flag="complete">
                    <reference item_ref="10425283"/>
                  </object>
                  <object id="oval:ssg-object_sysctl_runtime_net_core_bpf_jit_harden:obj:1" version="1" flag="complete">
                    <reference item_ref="10425285"/>
                  </object>
                  <object id="oval:ssg-object_sysctl_runtime_user_max_user_namespaces:obj:1" version="1" flag="complete">
                    <reference item_ref="10425287"/>
                  </object>
                  <object id="oval:ssg-object_system_info_architecture_aarch_64:obj:1" version="1" flag="complete">
                    <reference item_ref="10425256"/>
                  </object>
                  <object id="oval:ssg-object_system_info_architecture_ppc_64:obj:1" version="1" flag="complete">
                    <reference item_ref="10425256"/>
                  </object>
                  <object id="oval:ssg-object_system_info_architecture_ppcle_64:obj:1" version="1" flag="complete">
                    <reference item_ref="10425256"/>
                  </object>
                  <object id="oval:ssg-object_system_info_architecture_s390_64:obj:1" version="1" flag="complete">
                    <reference item_ref="10425256"/>
                  </object>
                  <object id="oval:ssg-object_system_info_architecture_x86_64:obj:1" version="1" flag="complete">
                    <reference item_ref="10425256"/>
                  </object>
                  <object id="oval:ssg-object_unix_family:obj:1" version="1" flag="complete">
                    <reference item_ref="10425224"/>
                  </object>
                  <object id="oval:ssg-object_user_max_user_namespaces_symlinks:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-local_var_conf_files_user_max_user_namespaces:var:1).</message>
                  </object>
                  <object id="oval:ssg-object_yum_ensure_gpgcheck_local_packages:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-oject_sysctl_kernel_core_pattern_defined_in_one_file:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-local_var_unique_sysctl_kernel_core_pattern_counter:var:1">1</variable_value>
                    <reference item_ref="10425270"/>
                  </object>
                  <object id="oval:ssg-oject_sysctl_kernel_dmesg_restrict_defined_in_one_file:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-local_var_unique_sysctl_kernel_dmesg_restrict_counter:v</message>
                    <variable_value variable_id="oval:ssg-local_var_unique_sysctl_kernel_dmesg_restrict_counter:var:1">0</variable_value>
                  </object>
                  <object id="oval:ssg-oject_sysctl_kernel_kexec_load_disabled_defined_in_one_file:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-local_var_unique_sysctl_kernel_kexec_load_disabled_coun</message>
                    <variable_value variable_id="oval:ssg-local_var_unique_sysctl_kernel_kexec_load_disabled_counter:var:1">0</variable_value>
                  </object>
                  <object id="oval:ssg-oject_sysctl_kernel_kptr_restrict_defined_in_one_file:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-local_var_unique_sysctl_kernel_kptr_restrict_counter:va</message>
                    <variable_value variable_id="oval:ssg-local_var_unique_sysctl_kernel_kptr_restrict_counter:var:1">0</variable_value>
                  </object>
                  <object id="oval:ssg-oject_sysctl_kernel_perf_event_paranoid_defined_in_one_file:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-local_var_unique_sysctl_kernel_perf_event_paranoid_coun</message>
                    <variable_value variable_id="oval:ssg-local_var_unique_sysctl_kernel_perf_event_paranoid_counter:var:1">0</variable_value>
                  </object>
                  <object id="oval:ssg-oject_sysctl_kernel_unprivileged_bpf_disabled_defined_in_one_file:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-local_var_unique_sysctl_kernel_unprivileged_bpf_disable</message>
                    <variable_value variable_id="oval:ssg-local_var_unique_sysctl_kernel_unprivileged_bpf_disabled_counter:var:1">0</variable_value>
                  </object>
                  <object id="oval:ssg-oject_sysctl_kernel_yama_ptrace_scope_defined_in_one_file:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-local_var_unique_sysctl_kernel_yama_ptrace_scope_counter:var:1">1</variable_value>
                    <reference item_ref="10425282"/>
                  </object>
                  <object id="oval:ssg-oject_sysctl_net_core_bpf_jit_harden_defined_in_one_file:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-local_var_unique_sysctl_net_core_bpf_jit_harden_counter</message>
                    <variable_value variable_id="oval:ssg-local_var_unique_sysctl_net_core_bpf_jit_harden_counter:var:1">0</variable_value>
                  </object>
                  <object id="oval:ssg-oject_sysctl_user_max_user_namespaces_defined_in_one_file:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-local_var_unique_sysctl_user_max_user_namespaces_counte</message>
                    <variable_value variable_id="oval:ssg-local_var_unique_sysctl_user_max_user_namespaces_counter:var:1">0</variable_value>
                  </object>
                  <object id="oval:ssg-var_obj_symlink_kernel_core_pattern:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-local_var_symlinks_kernel_core_pattern:var:1).</message>
                  </object>
                  <object id="oval:ssg-var_obj_symlink_kernel_dmesg_restrict:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-local_var_symlinks_kernel_dmesg_restrict:var:1).</message>
                  </object>
                  <object id="oval:ssg-var_obj_symlink_kernel_kexec_load_disabled:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-local_var_symlinks_kernel_kexec_load_disabled:var:1).</message>
                  </object>
                  <object id="oval:ssg-var_obj_symlink_kernel_kptr_restrict:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-local_var_symlinks_kernel_kptr_restrict:var:1).</message>
                  </object>
                  <object id="oval:ssg-var_obj_symlink_kernel_perf_event_paranoid:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-local_var_symlinks_kernel_perf_event_paranoid:var:1).</message>
                  </object>
                  <object id="oval:ssg-var_obj_symlink_kernel_unprivileged_bpf_disabled:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-local_var_symlinks_kernel_unprivileged_bpf_disabled:var</message>
                  </object>
                  <object id="oval:ssg-var_obj_symlink_kernel_yama_ptrace_scope:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-local_var_symlinks_kernel_yama_ptrace_scope:var:1).</message>
                  </object>
                  <object id="oval:ssg-var_obj_symlink_net_core_bpf_jit_harden:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-local_var_symlinks_net_core_bpf_jit_harden:var:1).</message>
                  </object>
                  <object id="oval:ssg-var_obj_symlink_user_max_user_namespaces:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-local_var_symlinks_user_max_user_namespaces:var:1).</message>
                  </object>
                  <object id="oval:ssg-var_object_symlink_kernel_core_pattern:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-local_var_blank_path_kernel_core_pattern:var:1"></variable_value>
                    <reference item_ref="10425269"/>
                  </object>
                  <object id="oval:ssg-var_object_symlink_kernel_dmesg_restrict:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-local_var_blank_path_kernel_dmesg_restrict:var:1"></variable_value>
                    <reference item_ref="10425272"/>
                  </object>
                  <object id="oval:ssg-var_object_symlink_kernel_kexec_load_disabled:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-local_var_blank_path_kernel_kexec_load_disabled:var:1"></variable_value>
                    <reference item_ref="10425274"/>
                  </object>
                  <object id="oval:ssg-var_object_symlink_kernel_kptr_restrict:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-local_var_blank_path_kernel_kptr_restrict:var:1"></variable_value>
                    <reference item_ref="10425290"/>
                  </object>
                  <object id="oval:ssg-var_object_symlink_kernel_perf_event_paranoid:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-local_var_blank_path_kernel_perf_event_paranoid:var:1"></variable_value>
                    <reference item_ref="10425276"/>
                  </object>
                  <object id="oval:ssg-var_object_symlink_kernel_unprivileged_bpf_disabled:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-local_var_blank_path_kernel_unprivileged_bpf_disabled:var:1"></variable_value>
                    <reference item_ref="10425278"/>
                  </object>
                  <object id="oval:ssg-var_object_symlink_kernel_yama_ptrace_scope:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-local_var_blank_path_kernel_yama_ptrace_scope:var:1"></variable_value>
                    <reference item_ref="10425281"/>
                  </object>
                  <object id="oval:ssg-var_object_symlink_net_core_bpf_jit_harden:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-local_var_blank_path_net_core_bpf_jit_harden:var:1"></variable_value>
                    <reference item_ref="10425284"/>
                  </object>
                  <object id="oval:ssg-var_object_symlink_user_max_user_namespaces:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-local_var_blank_path_user_max_user_namespaces:var:1"></variable_value>
                    <reference item_ref="10425286"/>
                  </object>
                </collected_objects>
                <system_data>
                  <unix-sys:file_item id="10425299" status="exists">
                    <unix-sys:filepath>/dev/vcsu4</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vcsu4</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362928</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362928</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362928</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="10425298" status="exists">
                    <unix-sys:filepath>/dev/vcsa4</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vcsa4</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362928</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362928</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362928</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="10425297" status="exists">
                    <unix-sys:filepath>/dev/vcs5</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vcs5</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362928</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362928</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362928</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="10425296" status="exists">
                    <unix-sys:filepath>/dev/vcsu5</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vcsu5</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362928</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362928</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362928</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="10425295" status="exists">
                    <unix-sys:filepath>/dev/vcsa5</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vcsa5</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362928</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362928</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362928</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="10425294" status="exists">
                    <unix-sys:filepath>/dev/vcs6</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vcs6</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362928</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362928</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362928</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="10425293" status="exists">
                    <unix-sys:filepath>/dev/vcsu6</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vcsu6</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362928</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362928</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362928</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="10425292" status="exists">
                    <unix-sys:filepath>/dev/vcsa6</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vcsa6</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362928</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362928</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362928</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:sysctl_item id="10425291" status="exists">
                    <unix-sys:name>kernel.kptr_restrict</unix-sys:name>
                    <unix-sys:value>0</unix-sys:value>
                  </unix-sys:sysctl_item>
                  <ind-sys:variable_item id="10425290" status="exists">
                    <ind-sys:var_ref>oval:ssg-local_var_blank_path_kernel_kptr_restrict:var:1</ind-sys:var_ref>
                    <ind-sys:value/>
                  </ind-sys:variable_item>
                  <lin-sys:systemdunitproperty_item id="10425289" status="exists">
                    <lin-sys:unit>systemd-coredump.socket</lin-sys:unit>
                    <lin-sys:property>LoadState</lin-sys:property>
                    <lin-sys:value>loaded</lin-sys:value>
                  </lin-sys:systemdunitproperty_item>
                  <lin-sys:systemdunitproperty_item id="10425288" status="exists">
                    <lin-sys:unit>systemd-coredump.socket</lin-sys:unit>
                    <lin-sys:property>ActiveState</lin-sys:property>
                    <lin-sys:value>active</lin-sys:value>
                  </lin-sys:systemdunitproperty_item>
                  <unix-sys:sysctl_item id="10425287" status="exists">
                    <unix-sys:name>user.max_user_namespaces</unix-sys:name>
                    <unix-sys:value>31637</unix-sys:value>
                  </unix-sys:sysctl_item>
                  <ind-sys:variable_item id="10425286" status="exists">
                    <ind-sys:var_ref>oval:ssg-local_var_blank_path_user_max_user_namespaces:var:1</ind-sys:var_ref>
                    <ind-sys:value/>
                  </ind-sys:variable_item>
                  <unix-sys:sysctl_item id="10425285" status="exists">
                    <unix-sys:name>net.core.bpf_jit_harden</unix-sys:name>
                    <unix-sys:value>0</unix-sys:value>
                  </unix-sys:sysctl_item>
                  <ind-sys:variable_item id="10425284" status="exists">
                    <ind-sys:var_ref>oval:ssg-local_var_blank_path_net_core_bpf_jit_harden:var:1</ind-sys:var_ref>
                    <ind-sys:value/>
                  </ind-sys:variable_item>
                  <unix-sys:sysctl_item id="10425283" status="exists">
                    <unix-sys:name>kernel.yama.ptrace_scope</unix-sys:name>
                    <unix-sys:value>0</unix-sys:value>
                  </unix-sys:sysctl_item>
                  <ind-sys:variable_item id="10425282" status="exists">
                    <ind-sys:var_ref>oval:ssg-local_var_unique_sysctl_kernel_yama_ptrace_scope_counter:var:1</ind-sys:var_ref>
                    <ind-sys:value>1</ind-sys:value>
                  </ind-sys:variable_item>
                  <ind-sys:variable_item id="10425281" status="exists">
                    <ind-sys:var_ref>oval:ssg-local_var_blank_path_kernel_yama_ptrace_scope:var:1</ind-sys:var_ref>
                    <ind-sys:value/>
                  </ind-sys:variable_item>
                  <ind-sys:textfilecontent_item id="10425280" status="exists">
                    <ind-sys:filepath>/usr/lib/sysctl.d/10-default-yama-scope.conf</ind-sys:filepath>
                    <ind-sys:path>/usr/lib/sysctl.d</ind-sys:path>
                    <ind-sys:filename>10-default-yama-scope.conf</ind-sys:filename>
                    <ind-sys:pattern>^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*(.*)[\s]*$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*(.*)[\s]*$</ind-sys:line>
                    <ind-sys:text>kernel.yama.ptrace_scope = 0

</ind-sys:text>
                    <ind-sys:subexpression>0</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <unix-sys:sysctl_item id="10425279" status="exists">
                    <unix-sys:name>kernel.unprivileged_bpf_disabled</unix-sys:name>
                    <unix-sys:value>2</unix-sys:value>
                  </unix-sys:sysctl_item>
                  <ind-sys:variable_item id="10425278" status="exists">
                    <ind-sys:var_ref>oval:ssg-local_var_blank_path_kernel_unprivileged_bpf_disabled:var:1</ind-sys:var_ref>
                    <ind-sys:value/>
                  </ind-sys:variable_item>
                  <unix-sys:sysctl_item id="10425277" status="exists">
                    <unix-sys:name>kernel.perf_event_paranoid</unix-sys:name>
                    <unix-sys:value>2</unix-sys:value>
                  </unix-sys:sysctl_item>
                  <ind-sys:variable_item id="10425276" status="exists">
                    <ind-sys:var_ref>oval:ssg-local_var_blank_path_kernel_perf_event_paranoid:var:1</ind-sys:var_ref>
                    <ind-sys:value/>
                  </ind-sys:variable_item>
                  <unix-sys:sysctl_item id="10425275" status="exists">
                    <unix-sys:name>kernel.kexec_load_disabled</unix-sys:name>
                    <unix-sys:value>0</unix-sys:value>
                  </unix-sys:sysctl_item>
                  <ind-sys:variable_item id="10425274" status="exists">
                    <ind-sys:var_ref>oval:ssg-local_var_blank_path_kernel_kexec_load_disabled:var:1</ind-sys:var_ref>
                    <ind-sys:value/>
                  </ind-sys:variable_item>
                  <unix-sys:sysctl_item id="10425273" status="exists">
                    <unix-sys:name>kernel.dmesg_restrict</unix-sys:name>
                    <unix-sys:value>0</unix-sys:value>
                  </unix-sys:sysctl_item>
                  <ind-sys:variable_item id="10425272" status="exists">
                    <ind-sys:var_ref>oval:ssg-local_var_blank_path_kernel_dmesg_restrict:var:1</ind-sys:var_ref>
                    <ind-sys:value/>
                  </ind-sys:variable_item>
                  <unix-sys:sysctl_item id="10425271" status="exists">
                    <unix-sys:name>kernel.core_pattern</unix-sys:name>
                    <unix-sys:value>|/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h</unix-sys:value>
                  </unix-sys:sysctl_item>
                  <ind-sys:variable_item id="10425270" status="exists">
                    <ind-sys:var_ref>oval:ssg-local_var_unique_sysctl_kernel_core_pattern_counter:var:1</ind-sys:var_ref>
                    <ind-sys:value>1</ind-sys:value>
                  </ind-sys:variable_item>
                  <ind-sys:variable_item id="10425269" status="exists">
                    <ind-sys:var_ref>oval:ssg-local_var_blank_path_kernel_core_pattern:var:1</ind-sys:var_ref>
                    <ind-sys:value/>
                  </ind-sys:variable_item>
                  <ind-sys:textfilecontent_item id="10425268" status="exists">
                    <ind-sys:filepath>/usr/lib/sysctl.d/50-coredump.conf</ind-sys:filepath>
                    <ind-sys:path>/usr/lib/sysctl.d</ind-sys:path>
                    <ind-sys:filename>50-coredump.conf</ind-sys:filename>
                    <ind-sys:pattern>^[\s]*kernel.core_pattern[\s]*=[\s]*(.*)[\s]*$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^[\s]*kernel.core_pattern[\s]*=[\s]*(.*)[\s]*$</ind-sys:line>
                    <ind-sys:text>kernel.core_pattern=|/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h
</ind-sys:text>
                    <ind-sys:subexpression>|/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <lin-sys:partition_item id="10425267" status="exists">
                    <lin-sys:mount_point>/dev/shm</lin-sys:mount_point>
                    <lin-sys:device>tmpfs</lin-sys:device>
                    <lin-sys:uuid status="does not exist"/>
                    <lin-sys:fs_type>tmpfs</lin-sys:fs_type>
                    <lin-sys:mount_options>rw</lin-sys:mount_options>
                    <lin-sys:mount_options>seclabel</lin-sys:mount_options>
                    <lin-sys:mount_options>nosuid</lin-sys:mount_options>
                    <lin-sys:mount_options>nodev</lin-sys:mount_options>
                    <lin-sys:mount_options>inode64</lin-sys:mount_options>
                    <lin-sys:total_space datatype="int">1017697</lin-sys:total_space>
                    <lin-sys:space_used datatype="int">0</lin-sys:space_used>
                    <lin-sys:space_left datatype="int">1017697</lin-sys:space_left>
                  </lin-sys:partition_item>
                  <lin-sys:systemdunitproperty_item id="10425266" status="exists">
                    <lin-sys:unit>firewalld.service</lin-sys:unit>
                    <lin-sys:property>ActiveState</lin-sys:property>
                    <lin-sys:value>active</lin-sys:value>
                  </lin-sys:systemdunitproperty_item>
                  <lin-sys:rpminfo_item id="10425265" status="exists">
                    <lin-sys:name>firewalld</lin-sys:name>
                    <lin-sys:arch>noarch</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>2.fc37</lin-sys:release>
                    <lin-sys:version>1.1.1</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:1.1.1-2.fc37</lin-sys:evr>
                    <lin-sys:signature_keyid>f55ad3fb5323552a</lin-sys:signature_keyid>
                    <lin-sys:extended_name>firewalld-0:1.1.1-2.fc37.noarch</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <ind-sys:textfilecontent_item id="10425264" status="exists">
                    <ind-sys:filepath>/boot/grub2/grub.cfg</ind-sys:filepath>
                    <ind-sys:path>/boot/grub2</ind-sys:path>
                    <ind-sys:filename>grub.cfg</ind-sys:filename>
                    <ind-sys:pattern>^[\s]*set[\s]+superusers=("?)[a-zA-Z_]+\1$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^[\s]*set[\s]+superusers=("?)[a-zA-Z_]+\1$</ind-sys:line>
                    <ind-sys:text>    set superusers="root"</ind-sys:text>
                    <ind-sys:subexpression>"</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10425263" status="exists">
                    <ind-sys:filepath>/etc/audit/auditd.conf</ind-sys:filepath>
                    <ind-sys:path>/etc/audit</ind-sys:path>
                    <ind-sys:filename>auditd.conf</ind-sys:filename>
                    <ind-sys:pattern>^[ \t]*(?i)write_logs(?-i)[ \t]*=[ \t]*</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^[ \t]*(?i)write_logs(?-i)[ \t]*=[ \t]*</ind-sys:line>
                    <ind-sys:text>write_logs = </ind-sys:text>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10425262" status="exists">
                    <ind-sys:filepath>/etc/audit/auditd.conf</ind-sys:filepath>
                    <ind-sys:path>/etc/audit</ind-sys:path>
                    <ind-sys:filename>auditd.conf</ind-sys:filename>
                    <ind-sys:pattern>^[ \t]*(?i)write_logs(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^[ \t]*(?i)write_logs(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-sys:line>
                    <ind-sys:text>write_logs = yes</ind-sys:text>
                    <ind-sys:subexpression>yes</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10425261" status="exists">
                    <ind-sys:filepath>/etc/audit/auditd.conf</ind-sys:filepath>
                    <ind-sys:path>/etc/audit</ind-sys:path>
                    <ind-sys:filename>auditd.conf</ind-sys:filename>
                    <ind-sys:pattern>^[ \t]*(?i)name_format(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^[ \t]*(?i)name_format(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-sys:line>
                    <ind-sys:text>name_format = NONE</ind-sys:text>
                    <ind-sys:subexpression>NONE</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10425260" status="exists">
                    <ind-sys:filepath>/etc/audit/auditd.conf</ind-sys:filepath>
                    <ind-sys:path>/etc/audit</ind-sys:path>
                    <ind-sys:filename>auditd.conf</ind-sys:filename>
                    <ind-sys:pattern>^[ \t]*(?i)log_format(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^[ \t]*(?i)log_format(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-sys:line>
                    <ind-sys:text>log_format = ENRICHED</ind-sys:text>
                    <ind-sys:subexpression>ENRICHED</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10425259" status="exists">
                    <ind-sys:filepath>/etc/audit/auditd.conf</ind-sys:filepath>
                    <ind-sys:path>/etc/audit</ind-sys:path>
                    <ind-sys:filename>auditd.conf</ind-sys:filename>
                    <ind-sys:pattern>^[ \t]*(?i)local_events(?-i)[ \t]*=[ \t]*</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^[ \t]*(?i)local_events(?-i)[ \t]*=[ \t]*</ind-sys:line>
                    <ind-sys:text>local_events = </ind-sys:text>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10425258" status="exists">
                    <ind-sys:filepath>/etc/audit/auditd.conf</ind-sys:filepath>
                    <ind-sys:path>/etc/audit</ind-sys:path>
                    <ind-sys:filename>auditd.conf</ind-sys:filename>
                    <ind-sys:pattern>^[ \t]*(?i)local_events(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^[ \t]*(?i)local_events(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-sys:line>
                    <ind-sys:text>local_events = yes</ind-sys:text>
                    <ind-sys:subexpression>yes</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10425257" status="exists">
                    <ind-sys:filepath>/etc/audit/auditd.conf</ind-sys:filepath>
                    <ind-sys:path>/etc/audit</ind-sys:path>
                    <ind-sys:filename>auditd.conf</ind-sys:filename>
                    <ind-sys:pattern>^[ \t]*(?i)freq(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^[ \t]*(?i)freq(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-sys:line>
                    <ind-sys:text>freq = 50</ind-sys:text>
                    <ind-sys:subexpression>50</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <unix-sys:uname_item id="10425256" status="exists">
                    <unix-sys:machine_class>x86_64</unix-sys:machine_class>
                    <unix-sys:node_name>localhost-live</unix-sys:node_name>
                    <unix-sys:os_name>Linux</unix-sys:os_name>
                    <unix-sys:os_release>5.19.0-0.rc3.20220624git92f20ff72066.30.fc37.x86_64</unix-sys:os_release>
                    <unix-sys:os_version>#1 SMP PREEMPT_DYNAMIC Fri Jun 24 14:48:57 UTC 2022</unix-sys:os_version>
                    <unix-sys:processor_type>x86_64</unix-sys:processor_type>
                  </unix-sys:uname_item>
                  <ind-sys:textfilecontent_item id="10425255" status="exists">
                    <ind-sys:filepath>/usr/lib/systemd/system/auditd.service</ind-sys:filepath>
                    <ind-sys:path>/usr/lib/systemd/system</ind-sys:path>
                    <ind-sys:filename>auditd.service</ind-sys:filename>
                    <ind-sys:pattern>^ExecStartPost=\-\/sbin\/augenrules.*$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^ExecStartPost=\-\/sbin\/augenrules.*$</ind-sys:line>
                    <ind-sys:text>ExecStartPost=-/sbin/augenrules --load</ind-sys:text>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10425253" status="exists">
                    <ind-sys:filepath>/etc/default/grub</ind-sys:filepath>
                    <ind-sys:path>/etc/default</ind-sys:path>
                    <ind-sys:filename>grub</ind-sys:filename>
                    <ind-sys:pattern>^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind-sys:line>
                    <ind-sys:text>GRUB_CMDLINE_LINUX="rhgb quiet"</ind-sys:text>
                    <ind-sys:subexpression>rhgb quiet</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10425252" status="exists">
                    <ind-sys:filepath>/etc/pam.d/system-auth</ind-sys:filepath>
                    <ind-sys:path>/etc/pam.d</ind-sys:path>
                    <ind-sys:filename>system-auth</ind-sys:filename>
                    <ind-sys:pattern>^[^#]*\bnullok\b.*$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^[^#]*\bnullok\b.*$</ind-sys:line>
                    <ind-sys:text>
auth        required                                     pam_env.so
auth        required                                     pam_faildelay.so delay=2000000
auth        sufficient                                   pam_fprintd.so
auth        [default=1 ignore=ignore success=ok]         pam_usertype.so isregular
auth        [default=1 ignore=ignore success=ok]         pam_localuser.so
auth        sufficient                                   pam_unix.so nullok
auth        [default=1 ignore=ignore success=ok]         pam_usertype.so isregular
auth        sufficient                                   pam_sss.so forward_pass
auth        required                                     pam_deny.so

account     required                                     pam_unix.so
account     sufficient                                   pam_localuser.so
account     sufficient                                   pam_usertype.so issystem
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
account     required                                     pam_permit.so

password    requisite                                    pam_pwquality.so local_users_only
password    sufficient                                   pam_unix.so yescrypt shadow nullok use_authtok</ind-sys:text>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="104252508" status="exists">
                    <ind-sys:filepath>/etc/ssh/sshd_config.d/50-redhat.conf</ind-sys:filepath>
                    <ind-sys:path>/etc/ssh/sshd_config.d</ind-sys:path>
                    <ind-sys:filename>50-redhat.conf</ind-sys:filename>
                    <ind-sys:pattern>^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-sys:line>
                    <ind-sys:text>GSSAPIAuthentication yes</ind-sys:text>
                    <ind-sys:subexpression>yes</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <lin-sys:rpminfo_item id="104252507" status="exists">
                    <lin-sys:name>openssh-server</lin-sys:name>
                    <lin-sys:arch>x86_64</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>2.fc37.1</lin-sys:release>
                    <lin-sys:version>8.8p1</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:8.8p1-2.fc37.1</lin-sys:evr>
                    <lin-sys:signature_keyid>f55ad3fb5323552a</lin-sys:signature_keyid>
                    <lin-sys:extended_name>openssh-server-0:8.8p1-2.fc37.1.x86_64</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <ind-sys:variable_item id="104252506" status="exists">
                    <ind-sys:var_ref>oval:ssg-sshd_required:var:1</ind-sys:var_ref>
                    <ind-sys:value>0</ind-sys:value>
                  </ind-sys:variable_item>
                  <lin-sys:systemdunitproperty_item id="104252505" status="exists">
                    <lin-sys:unit>chronyd.service</lin-sys:unit>
                    <lin-sys:property>ActiveState</lin-sys:property>
                    <lin-sys:value>active</lin-sys:value>
                  </lin-sys:systemdunitproperty_item>
                  <lin-sys:rpminfo_item id="104252504" status="exists">
                    <lin-sys:name>chrony</lin-sys:name>
                    <lin-sys:arch>x86_64</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>6.fc37</lin-sys:release>
                    <lin-sys:version>4.2</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:4.2-6.fc37</lin-sys:evr>
                    <lin-sys:signature_keyid>f55ad3fb5323552a</lin-sys:signature_keyid>
                    <lin-sys:extended_name>chrony-0:4.2-6.fc37.x86_64</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <lin-sys:rpminfo_item id="104252503" status="exists">
                    <lin-sys:name>abrt</lin-sys:name>
                    <lin-sys:arch>x86_64</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>3.fc37</lin-sys:release>
                    <lin-sys:version>2.15.1</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:2.15.1-3.fc37</lin-sys:evr>
                    <lin-sys:signature_keyid>f55ad3fb5323552a</lin-sys:signature_keyid>
                    <lin-sys:extended_name>abrt-0:2.15.1-3.fc37.x86_64</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <ind-sys:textfilecontent_item id="104252502" status="exists">
                    <ind-sys:filepath>/etc/selinux/config</ind-sys:filepath>
                    <ind-sys:path>/etc/selinux</ind-sys:path>
                    <ind-sys:filename>config</ind-sys:filename>
                    <ind-sys:pattern>^SELINUX=(.*)$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^SELINUX=(.*)$</ind-sys:line>
                    <ind-sys:text>SELINUX=enforcing</ind-sys:text>
                    <ind-sys:subexpression>enforcing</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="104252501" status="exists">
                    <ind-sys:filepath>/etc/selinux/config</ind-sys:filepath>
                    <ind-sys:path>/etc/selinux</ind-sys:path>
                    <ind-sys:filename>config</ind-sys:filename>
                    <ind-sys:pattern>^SELINUXTYPE=([\w]*)[\s]*$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^SELINUXTYPE=([\w]*)[\s]*$</ind-sys:line>
                    <ind-sys:text>SELINUXTYPE=targeted


</ind-sys:text>
                    <ind-sys:subexpression>targeted</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252500" status="exists">
                    <lin-sys:filepath>/proc/1093/ksm_merging_pages</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>ksm_merging_pages</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <ind-sys:textfilecontent_item id="10425250" status="exists">
                    <ind-sys:filepath>/usr/lib/systemd/system/runlevel1.target</ind-sys:filepath>
                    <ind-sys:path>/usr/lib/systemd/system</ind-sys:path>
                    <ind-sys:filename>runlevel1.target</ind-sys:filename>
                    <ind-sys:pattern>^Requires=.*rescue.service</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^Requires=.*rescue.service</ind-sys:line>
                    <ind-sys:text>Requires=sysinit.target rescue.service</ind-sys:text>
                  </ind-sys:textfilecontent_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252499" status="exists">
                    <lin-sys:filepath>/proc/1093/arch_status</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>arch_status</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252498" status="exists">
                    <lin-sys:filepath>/proc/1093/patch_state</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>patch_state</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252497" status="exists">
                    <lin-sys:filepath>/proc/1093/timerslack_ns</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>timerslack_ns</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252496" status="exists">
                    <lin-sys:filepath>/proc/1093/timers</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>timers</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252495" status="exists">
                    <lin-sys:filepath>/proc/1093/setgroups</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>setgroups</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252494" status="exists">
                    <lin-sys:filepath>/proc/1093/projid_map</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>projid_map</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252493" status="exists">
                    <lin-sys:filepath>/proc/1093/gid_map</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>gid_map</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252492" status="exists">
                    <lin-sys:filepath>/proc/1093/uid_map</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>uid_map</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252491" status="exists">
                    <lin-sys:filepath>/proc/1093/io</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>io</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252490" status="exists">
                    <lin-sys:filepath>/proc/1093/coredump_filter</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>coredump_filter</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <ind-sys:textfilecontent_item id="10425249" status="exists">
                    <ind-sys:filepath>/usr/lib/systemd/system/rescue.service</ind-sys:filepath>
                    <ind-sys:path>/usr/lib/systemd/system</ind-sys:path>
                    <ind-sys:filename>rescue.service</ind-sys:filename>
                    <ind-sys:pattern>^ExecStart=\-.*/usr/lib/systemd/systemd-sulogin-shell[ ]+rescue</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^ExecStart=\-.*/usr/lib/systemd/systemd-sulogin-shell[ ]+rescue</ind-sys:line>
                    <ind-sys:text>ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue</ind-sys:text>
                  </ind-sys:textfilecontent_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252489" status="exists">
                    <lin-sys:filepath>/proc/1093/fail-nth</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>fail-nth</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252488" status="exists">
                    <lin-sys:filepath>/proc/1093/make-it-fail</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>make-it-fail</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252487" status="exists">
                    <lin-sys:filepath>/proc/1093/sessionid</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>sessionid</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252486" status="exists">
                    <lin-sys:filepath>/proc/1093/loginuid</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>loginuid</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252485" status="exists">
                    <lin-sys:filepath>/proc/1093/oom_score_adj</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>oom_score_adj</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252484" status="exists">
                    <lin-sys:filepath>/proc/1093/oom_adj</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>oom_adj</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252483" status="exists">
                    <lin-sys:filepath>/proc/1093/oom_score</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>oom_score</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252482" status="exists">
                    <lin-sys:filepath>/proc/1093/cpu_resctrl_groups</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>cpu_resctrl_groups</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252481" status="exists">
                    <lin-sys:filepath>/proc/1093/cgroup</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>cgroup</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252480" status="exists">
                    <lin-sys:filepath>/proc/1093/cpuset</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>cpuset</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <ind-sys:textfilecontent_item id="10425248" status="exists">
                    <ind-sys:filepath>/etc/default/grub</ind-sys:filepath>
                    <ind-sys:path>/etc/default</ind-sys:path>
                    <ind-sys:filename>grub</ind-sys:filename>
                    <ind-sys:pattern>^\s*GRUB_DISABLE_RECOVERY=(.*)$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^\s*GRUB_DISABLE_RECOVERY=(.*)$</ind-sys:line>
                    <ind-sys:text>GRUB_DISABLE_RECOVERY="true"</ind-sys:text>
                    <ind-sys:subexpression>"true"</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252479" status="exists">
                    <lin-sys:filepath>/proc/1093/latency</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>latency</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252478" status="exists">
                    <lin-sys:filepath>/proc/1093/schedstat</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>schedstat</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252477" status="exists">
                    <lin-sys:filepath>/proc/1093/stack</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>stack</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252476" status="exists">
                    <lin-sys:filepath>/proc/1093/wchan</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>wchan</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252475" status="exists">
                    <lin-sys:filepath>/proc/1093/pagemap</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>pagemap</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252474" status="exists">
                    <lin-sys:filepath>/proc/1093/smaps_rollup</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>smaps_rollup</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252473" status="exists">
                    <lin-sys:filepath>/proc/1093/smaps</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>smaps</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252472" status="exists">
                    <lin-sys:filepath>/proc/1093/clear_refs</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>clear_refs</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252471" status="exists">
                    <lin-sys:filepath>/proc/1093/mountstats</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>mountstats</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252470" status="exists">
                    <lin-sys:filepath>/proc/1093/mountinfo</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>mountinfo</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252469" status="exists">
                    <lin-sys:filepath>/proc/1093/mounts</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>mounts</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252468" status="exists">
                    <lin-sys:filepath>/proc/1093/mem</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>mem</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252467" status="exists">
                    <lin-sys:filepath>/proc/1093/numa_maps</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>numa_maps</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252466" status="exists">
                    <lin-sys:filepath>/proc/1093/maps</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>maps</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252465" status="exists">
                    <lin-sys:filepath>/proc/1093/statm</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>statm</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252464" status="exists">
                    <lin-sys:filepath>/proc/1093/stat</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>stat</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252463" status="exists">
                    <lin-sys:filepath>/proc/1093/cmdline</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>cmdline</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252462" status="exists">
                    <lin-sys:filepath>/proc/1093/syscall</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>syscall</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252461" status="exists">
                    <lin-sys:filepath>/proc/1093/comm</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>comm</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252460" status="exists">
                    <lin-sys:filepath>/proc/1093/timens_offsets</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>timens_offsets</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252459" status="exists">
                    <lin-sys:filepath>/proc/1093/autogroup</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>autogroup</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252458" status="exists">
                    <lin-sys:filepath>/proc/1093/sched</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>sched</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252457" status="exists">
                    <lin-sys:filepath>/proc/1093/limits</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>limits</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252456" status="exists">
                    <lin-sys:filepath>/proc/1093/personality</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>personality</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252455" status="exists">
                    <lin-sys:filepath>/proc/1093/status</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>status</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252454" status="exists">
                    <lin-sys:filepath>/proc/1093/auxv</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>auxv</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252453" status="exists">
                    <lin-sys:filepath>/proc/1093/environ</lin-sys:filepath>
                    <lin-sys:path>/proc/1093</lin-sys:path>
                    <lin-sys:filename>environ</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252452" status="exists">
                    <lin-sys:filepath>/proc/841/ksm_merging_pages</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>ksm_merging_pages</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252451" status="exists">
                    <lin-sys:filepath>/proc/841/arch_status</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>arch_status</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252450" status="exists">
                    <lin-sys:filepath>/proc/841/patch_state</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>patch_state</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:rpminfo_item id="10425245" status="exists">
                    <lin-sys:name>systemd</lin-sys:name>
                    <lin-sys:arch>x86_64</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>2.fc37</lin-sys:release>
                    <lin-sys:version>251.3</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:251.3-2.fc37</lin-sys:evr>
                    <lin-sys:signature_keyid>f55ad3fb5323552a</lin-sys:signature_keyid>
                    <lin-sys:extended_name>systemd-0:251.3-2.fc37.x86_64</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252449" status="exists">
                    <lin-sys:filepath>/proc/841/timerslack_ns</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>timerslack_ns</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252448" status="exists">
                    <lin-sys:filepath>/proc/841/timers</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>timers</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252447" status="exists">
                    <lin-sys:filepath>/proc/841/setgroups</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>setgroups</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252446" status="exists">
                    <lin-sys:filepath>/proc/841/projid_map</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>projid_map</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252445" status="exists">
                    <lin-sys:filepath>/proc/841/gid_map</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>gid_map</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252444" status="exists">
                    <lin-sys:filepath>/proc/841/uid_map</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>uid_map</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252443" status="exists">
                    <lin-sys:filepath>/proc/841/io</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>io</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252442" status="exists">
                    <lin-sys:filepath>/proc/841/coredump_filter</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>coredump_filter</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252441" status="exists">
                    <lin-sys:filepath>/proc/841/fail-nth</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>fail-nth</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252440" status="exists">
                    <lin-sys:filepath>/proc/841/make-it-fail</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>make-it-fail</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <ind-sys:textfilecontent_item id="10425244" status="exists">
                    <ind-sys:filepath>/etc/pam.d/system-auth</ind-sys:filepath>
                    <ind-sys:path>/etc/pam.d</ind-sys:path>
                    <ind-sys:filename>system-auth</ind-sys:filename>
                    <ind-sys:pattern>^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*$</ind-sys:line>
                    <ind-sys:text>
password    requisite                                    pam_pwquality.so local_users_only</ind-sys:text>
                  </ind-sys:textfilecontent_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252439" status="exists">
                    <lin-sys:filepath>/proc/841/sessionid</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>sessionid</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252438" status="exists">
                    <lin-sys:filepath>/proc/841/loginuid</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>loginuid</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252437" status="exists">
                    <lin-sys:filepath>/proc/841/oom_score_adj</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>oom_score_adj</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252436" status="exists">
                    <lin-sys:filepath>/proc/841/oom_adj</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>oom_adj</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252435" status="exists">
                    <lin-sys:filepath>/proc/841/oom_score</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>oom_score</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252434" status="exists">
                    <lin-sys:filepath>/proc/841/cpu_resctrl_groups</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>cpu_resctrl_groups</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252433" status="exists">
                    <lin-sys:filepath>/proc/841/cgroup</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>cgroup</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252432" status="exists">
                    <lin-sys:filepath>/proc/841/cpuset</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>cpuset</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252431" status="exists">
                    <lin-sys:filepath>/proc/841/latency</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>latency</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252430" status="exists">
                    <lin-sys:filepath>/proc/841/schedstat</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>schedstat</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252429" status="exists">
                    <lin-sys:filepath>/proc/841/stack</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>stack</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252428" status="exists">
                    <lin-sys:filepath>/proc/841/wchan</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>wchan</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252427" status="exists">
                    <lin-sys:filepath>/proc/841/pagemap</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>pagemap</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252426" status="exists">
                    <lin-sys:filepath>/proc/841/smaps_rollup</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>smaps_rollup</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252425" status="exists">
                    <lin-sys:filepath>/proc/841/smaps</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>smaps</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252424" status="exists">
                    <lin-sys:filepath>/proc/841/clear_refs</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>clear_refs</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252423" status="exists">
                    <lin-sys:filepath>/proc/841/mountstats</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>mountstats</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252422" status="exists">
                    <lin-sys:filepath>/proc/841/mountinfo</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>mountinfo</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252421" status="exists">
                    <lin-sys:filepath>/proc/841/mounts</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>mounts</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252420" status="exists">
                    <lin-sys:filepath>/proc/841/mem</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>mem</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <ind-sys:textfilecontent_item id="10425242" status="exists">
                    <ind-sys:filepath>/etc/issue</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>issue</ind-sys:filename>
                    <ind-sys:pattern>^(.*)$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^(.*)$</ind-sys:line>
                    <ind-sys:text>\S
Kernel \r on an \m (\l)

</ind-sys:text>
                    <ind-sys:subexpression>\S
Kernel \r on an \m (\l)

</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252419" status="exists">
                    <lin-sys:filepath>/proc/841/numa_maps</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>numa_maps</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252418" status="exists">
                    <lin-sys:filepath>/proc/841/maps</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>maps</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252417" status="exists">
                    <lin-sys:filepath>/proc/841/statm</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>statm</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252416" status="exists">
                    <lin-sys:filepath>/proc/841/stat</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>stat</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252415" status="exists">
                    <lin-sys:filepath>/proc/841/cmdline</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>cmdline</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252414" status="exists">
                    <lin-sys:filepath>/proc/841/syscall</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>syscall</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252413" status="exists">
                    <lin-sys:filepath>/proc/841/comm</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>comm</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252412" status="exists">
                    <lin-sys:filepath>/proc/841/timens_offsets</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>timens_offsets</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252411" status="exists">
                    <lin-sys:filepath>/proc/841/autogroup</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>autogroup</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252410" status="exists">
                    <lin-sys:filepath>/proc/841/sched</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>sched</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:systemdunitdependency_item id="10425241" status="exists">
                    <lin-sys:unit>multi-user.target</lin-sys:unit>
                    <lin-sys:dependency>basic.target</lin-sys:dependency>
                    <lin-sys:dependency>-.mount</lin-sys:dependency>
                    <lin-sys:dependency>sysinit.target</lin-sys:dependency>
                    <lin-sys:dependency>ldconfig.service</lin-sys:dependency>
                    <lin-sys:dependency>cryptsetup.target</lin-sys:dependency>
                    <lin-sys:dependency>systemd-ask-password-console.path</lin-sys:dependency>
                    <lin-sys:dependency>systemd-hwdb-update.service</lin-sys:dependency>
                    <lin-sys:dependency>selinux-autorelabel-mark.service</lin-sys:dependency>
                    <lin-sys:dependency>systemd-repart.service</lin-sys:dependency>
                    <lin-sys:dependency>systemd-network-generator.service</lin-sys:dependency>
                    <lin-sys:dependency>systemd-journal-catalog-update.service</lin-sys:dependency>
                    <lin-sys:dependency>sys-kernel-tracing.mount</lin-sys:dependency>
                    <lin-sys:dependency>lvm2-lvmpolld.socket</lin-sys:dependency>
                    <lin-sys:dependency>systemd-update-done.service</lin-sys:dependency>
                    <lin-sys:dependency>systemd-resolved.service</lin-sys:dependency>
                    <lin-sys:dependency>systemd-sysusers.service</lin-sys:dependency>
                    <lin-sys:dependency>dracut-shutdown.service</lin-sys:dependency>
                    <lin-sys:dependency>systemd-boot-update.service</lin-sys:dependency>
                    <lin-sys:dependency>plymouth-start.service</lin-sys:dependency>
                    <lin-sys:dependency>systemd-random-seed.service</lin-sys:dependency>
                    <lin-sys:dependency>systemd-binfmt.service</lin-sys:dependency>
                    <lin-sys:dependency>swap.target</lin-sys:dependency>
                    <lin-sys:dependency>dev-zram0.swap</lin-sys:dependency>
                    <lin-sys:dependency>sys-kernel-config.mount</lin-sys:dependency>
                    <lin-sys:dependency>systemd-sysctl.service</lin-sys:dependency>
                    <lin-sys:dependency>integritysetup.target</lin-sys:dependency>
                    <lin-sys:dependency>plymouth-read-write.service</lin-sys:dependency>
                    <lin-sys:dependency>dev-hugepages.mount</lin-sys:dependency>
                    <lin-sys:dependency>sys-kernel-debug.mount</lin-sys:dependency>
                    <lin-sys:dependency>systemd-machine-id-commit.service</lin-sys:dependency>
                    <lin-sys:dependency>dev-mqueue.mount</lin-sys:dependency>
                    <lin-sys:dependency>systemd-modules-load.service</lin-sys:dependency>
                    <lin-sys:dependency>systemd-update-utmp.service</lin-sys:dependency>
                    <lin-sys:dependency>sys-fs-fuse-connections.mount</lin-sys:dependency>
                    <lin-sys:dependency>veritysetup.target</lin-sys:dependency>
                    <lin-sys:dependency>systemd-udev-trigger.service</lin-sys:dependency>
                    <lin-sys:dependency>kmod-static-nodes.service</lin-sys:dependency>
                    <lin-sys:dependency>systemd-boot-system-token.service</lin-sys:dependency>
                    <lin-sys:dependency>systemd-tmpfiles-setup.service</lin-sys:dependency>
                    <lin-sys:dependency>import-state.service</lin-sys:dependency>
                    <lin-sys:dependency>local-fs.target</lin-sys:dependency>
                    <lin-sys:dependency>home.mount</lin-sys:dependency>
                    <lin-sys:dependency>boot.mount</lin-sys:dependency>
                    <lin-sys:dependency>systemd-remount-fs.service</lin-sys:dependency>
                    <lin-sys:dependency>tmp.mount</lin-sys:dependency>
                    <lin-sys:dependency>ostree-remount.service</lin-sys:dependency>
                    <lin-sys:dependency>iscsi-onboot.service</lin-sys:dependency>
                    <lin-sys:dependency>systemd-journal-flush.service</lin-sys:dependency>
                    <lin-sys:dependency>systemd-journald.service</lin-sys:dependency>
                    <lin-sys:dependency>proc-sys-fs-binfmt_misc.automount</lin-sys:dependency>
                    <lin-sys:dependency>systemd-firstboot.service</lin-sys:dependency>
                    <lin-sys:dependency>systemd-tmpfiles-setup-dev.service</lin-sys:dependency>
                    <lin-sys:dependency>systemd-udevd.service</lin-sys:dependency>
                    <lin-sys:dependency>lvm2-monitor.service</lin-sys:dependency>
                    <lin-sys:dependency>timers.target</lin-sys:dependency>
                    <lin-sys:dependency>fstrim.timer</lin-sys:dependency>
                    <lin-sys:dependency>raid-check.timer</lin-sys:dependency>
                    <lin-sys:dependency>systemd-tmpfiles-clean.timer</lin-sys:dependency>
                    <lin-sys:dependency>logrotate.timer</lin-sys:dependency>
                    <lin-sys:dependency>plocate-updatedb.timer</lin-sys:dependency>
                    <lin-sys:dependency>dnf-makecache.timer</lin-sys:dependency>
                    <lin-sys:dependency>unbound-anchor.timer</lin-sys:dependency>
                    <lin-sys:dependency>rpmdb-migrate.service</lin-sys:dependency>
                    <lin-sys:dependency>paths.target</lin-sys:dependency>
                    <lin-sys:dependency>slices.target</lin-sys:dependency>
                    <lin-sys:dependency>-.slice</lin-sys:dependency>
                    <lin-sys:dependency>system.slice</lin-sys:dependency>
                    <lin-sys:dependency>sockets.target</lin-sys:dependency>
                    <lin-sys:dependency>virtnetworkd.socket</lin-sys:dependency>
                    <lin-sys:dependency>virtinterfaced.socket</lin-sys:dependency>
                    <lin-sys:dependency>virtlogd.socket</lin-sys:dependency>
                    <lin-sys:dependency>systemd-journald-audit.socket</lin-sys:dependency>
                    <lin-sys:dependency>systemd-userdbd.socket</lin-sys:dependency>
                    <lin-sys:dependency>virtlockd.socket</lin-sys:dependency>
                    <lin-sys:dependency>systemd-udevd-control.socket</lin-sys:dependency>
                    <lin-sys:dependency>virtqemud.socket</lin-sys:dependency>
                    <lin-sys:dependency>virtstoraged.socket</lin-sys:dependency>
                    <lin-sys:dependency>systemd-journald-dev-log.socket</lin-sys:dependency>
                    <lin-sys:dependency>sssd-kcm.socket</lin-sys:dependency>
                    <lin-sys:dependency>iscsid.socket</lin-sys:dependency>
                    <lin-sys:dependency>virtqemud-admin.socket</lin-sys:dependency>
                    <lin-sys:dependency>dm-event.socket</lin-sys:dependency>
                    <lin-sys:dependency>iscsiuio.socket</lin-sys:dependency>
                    <lin-sys:dependency>virtnodedevd.socket</lin-sys:dependency>
                    <lin-sys:dependency>virtproxyd.socket</lin-sys:dependency>
                    <lin-sys:dependency>pcscd.socket</lin-sys:dependency>
                    <lin-sys:dependency>systemd-journald.socket</lin-sys:dependency>
                    <lin-sys:dependency>virtnwfilterd.socket</lin-sys:dependency>
                    <lin-sys:dependency>dbus.socket</lin-sys:dependency>
                    <lin-sys:dependency>systemd-initctl.socket</lin-sys:dependency>
                    <lin-sys:dependency>cups.socket</lin-sys:dependency>
                    <lin-sys:dependency>virtsecretd.socket</lin-sys:dependency>
                    <lin-sys:dependency>avahi-daemon.socket</lin-sys:dependency>
                    <lin-sys:dependency>systemd-udevd-kernel.socket</lin-sys:dependency>
                    <lin-sys:dependency>virtqemud-ro.socket</lin-sys:dependency>
                    <lin-sys:dependency>systemd-coredump.socket</lin-sys:dependency>
                    <lin-sys:dependency>rpmdb-rebuild.service</lin-sys:dependency>
                    <lin-sys:dependency>low-memory-monitor.service</lin-sys:dependency>
                    <lin-sys:dependency>sssd.service</lin-sys:dependency>
                    <lin-sys:dependency>chronyd.service</lin-sys:dependency>
                    <lin-sys:dependency>auditd.service</lin-sys:dependency>
                    <lin-sys:dependency>systemd-user-sessions.service</lin-sys:dependency>
                    <lin-sys:dependency>livesys.service</lin-sys:dependency>
                    <lin-sys:dependency>virtqemud.service</lin-sys:dependency>
                    <lin-sys:dependency>vboxservice.service</lin-sys:dependency>
                    <lin-sys:dependency>remote-fs.target</lin-sys:dependency>
                    <lin-sys:dependency>var-lib-machines.mount</lin-sys:dependency>
                    <lin-sys:dependency>iscsi.service</lin-sys:dependency>
                    <lin-sys:dependency>nfs-client.target</lin-sys:dependency>
                    <lin-sys:dependency>remote-fs-pre.target</lin-sys:dependency>
                    <lin-sys:dependency>rpc-statd-notify.service</lin-sys:dependency>
                    <lin-sys:dependency>auth-rpcgss-module.service</lin-sys:dependency>
                    <lin-sys:dependency>cups.path</lin-sys:dependency>
                    <lin-sys:dependency>NetworkManager.service</lin-sys:dependency>
                    <lin-sys:dependency>firewalld.service</lin-sys:dependency>
                    <lin-sys:dependency>plymouth-quit-wait.service</lin-sys:dependency>
                    <lin-sys:dependency>systemd-ask-password-wall.path</lin-sys:dependency>
                    <lin-sys:dependency>systemd-oomd.service</lin-sys:dependency>
                    <lin-sys:dependency>thermald.service</lin-sys:dependency>
                    <lin-sys:dependency>plymouth-quit.service</lin-sys:dependency>
                    <lin-sys:dependency>mdmonitor.service</lin-sys:dependency>
                    <lin-sys:dependency>flatpak-add-fedora-repos.service</lin-sys:dependency>
                    <lin-sys:dependency>abrtd.service</lin-sys:dependency>
                    <lin-sys:dependency>ModemManager.service</lin-sys:dependency>
                    <lin-sys:dependency>mcelog.service</lin-sys:dependency>
                    <lin-sys:dependency>livesys-late.service</lin-sys:dependency>
                    <lin-sys:dependency>abrt-vmcore.service</lin-sys:dependency>
                    <lin-sys:dependency>avahi-daemon.service</lin-sys:dependency>
                    <lin-sys:dependency>vmtoolsd.service</lin-sys:dependency>
                    <lin-sys:dependency>getty.target</lin-sys:dependency>
                    <lin-sys:dependency>getty@tty1.service</lin-sys:dependency>
                    <lin-sys:dependency>systemd-update-utmp-runlevel.service</lin-sys:dependency>
                    <lin-sys:dependency>abrt-xorg.service</lin-sys:dependency>
                    <lin-sys:dependency>abrt-oops.service</lin-sys:dependency>
                    <lin-sys:dependency>abrt-journal-core.service</lin-sys:dependency>
                    <lin-sys:dependency>systemd-logind.service</lin-sys:dependency>
                  </lin-sys:systemdunitdependency_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252409" status="exists">
                    <lin-sys:filepath>/proc/841/limits</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>limits</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252408" status="exists">
                    <lin-sys:filepath>/proc/841/personality</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>personality</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252407" status="exists">
                    <lin-sys:filepath>/proc/841/status</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>status</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252406" status="exists">
                    <lin-sys:filepath>/proc/841/auxv</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>auxv</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252405" status="exists">
                    <lin-sys:filepath>/proc/841/environ</lin-sys:filepath>
                    <lin-sys:path>/proc/841</lin-sys:path>
                    <lin-sys:filename>environ</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252404" status="exists">
                    <lin-sys:filepath>/proc/838/ksm_merging_pages</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>ksm_merging_pages</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252403" status="exists">
                    <lin-sys:filepath>/proc/838/arch_status</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>arch_status</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252402" status="exists">
                    <lin-sys:filepath>/proc/838/patch_state</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>patch_state</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252401" status="exists">
                    <lin-sys:filepath>/proc/838/timerslack_ns</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>timerslack_ns</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252400" status="exists">
                    <lin-sys:filepath>/proc/838/timers</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>timers</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252399" status="exists">
                    <lin-sys:filepath>/proc/838/setgroups</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>setgroups</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252398" status="exists">
                    <lin-sys:filepath>/proc/838/projid_map</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>projid_map</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252397" status="exists">
                    <lin-sys:filepath>/proc/838/gid_map</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>gid_map</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252396" status="exists">
                    <lin-sys:filepath>/proc/838/uid_map</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>uid_map</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252395" status="exists">
                    <lin-sys:filepath>/proc/838/io</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>io</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252394" status="exists">
                    <lin-sys:filepath>/proc/838/coredump_filter</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>coredump_filter</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252393" status="exists">
                    <lin-sys:filepath>/proc/838/fail-nth</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>fail-nth</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252392" status="exists">
                    <lin-sys:filepath>/proc/838/make-it-fail</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>make-it-fail</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252391" status="exists">
                    <lin-sys:filepath>/proc/838/sessionid</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>sessionid</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252390" status="exists">
                    <lin-sys:filepath>/proc/838/loginuid</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>loginuid</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:rpminfo_item id="10425239" status="exists">
                    <lin-sys:name>gpg-pubkey</lin-sys:name>
                    <lin-sys:arch>(none)</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>6112bcdc</lin-sys:release>
                    <lin-sys:version>5323552a</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:5323552a-6112bcdc</lin-sys:evr>
                    <lin-sys:signature_keyid>0</lin-sys:signature_keyid>
                    <lin-sys:extended_name>gpg-pubkey-0:5323552a-6112bcdc.(none)</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252389" status="exists">
                    <lin-sys:filepath>/proc/838/oom_score_adj</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>oom_score_adj</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252388" status="exists">
                    <lin-sys:filepath>/proc/838/oom_adj</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>oom_adj</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252387" status="exists">
                    <lin-sys:filepath>/proc/838/oom_score</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>oom_score</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252386" status="exists">
                    <lin-sys:filepath>/proc/838/cpu_resctrl_groups</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>cpu_resctrl_groups</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252385" status="exists">
                    <lin-sys:filepath>/proc/838/cgroup</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>cgroup</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252384" status="exists">
                    <lin-sys:filepath>/proc/838/cpuset</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>cpuset</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252383" status="exists">
                    <lin-sys:filepath>/proc/838/latency</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>latency</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252382" status="exists">
                    <lin-sys:filepath>/proc/838/schedstat</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>schedstat</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252381" status="exists">
                    <lin-sys:filepath>/proc/838/stack</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>stack</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252380" status="exists">
                    <lin-sys:filepath>/proc/838/wchan</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>wchan</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <ind-sys:textfilecontent_item id="10425238" status="exists">
                    <ind-sys:filepath>/etc/system-release-cpe</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>system-release-cpe</ind-sys:filename>
                    <ind-sys:pattern>^cpe:\/o:fedoraproject:fedora:[\d]+$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^cpe:\/o:fedoraproject:fedora:[\d]+$</ind-sys:line>
                    <ind-sys:text>cpe:/o:fedoraproject:fedora:37</ind-sys:text>
                  </ind-sys:textfilecontent_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252379" status="exists">
                    <lin-sys:filepath>/proc/838/pagemap</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>pagemap</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252378" status="exists">
                    <lin-sys:filepath>/proc/838/smaps_rollup</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>smaps_rollup</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252377" status="exists">
                    <lin-sys:filepath>/proc/838/smaps</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>smaps</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252376" status="exists">
                    <lin-sys:filepath>/proc/838/clear_refs</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>clear_refs</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252375" status="exists">
                    <lin-sys:filepath>/proc/838/mountstats</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>mountstats</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252374" status="exists">
                    <lin-sys:filepath>/proc/838/mountinfo</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>mountinfo</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252373" status="exists">
                    <lin-sys:filepath>/proc/838/mounts</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>mounts</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252372" status="exists">
                    <lin-sys:filepath>/proc/838/mem</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>mem</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252371" status="exists">
                    <lin-sys:filepath>/proc/838/numa_maps</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>numa_maps</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252370" status="exists">
                    <lin-sys:filepath>/proc/838/maps</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>maps</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:rpminfo_item id="10425237" status="exists">
                    <lin-sys:name>fedora-release-common</lin-sys:name>
                    <lin-sys:arch>noarch</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>0.6</lin-sys:release>
                    <lin-sys:version>37</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:37-0.6</lin-sys:evr>
                    <lin-sys:signature_keyid>f55ad3fb5323552a</lin-sys:signature_keyid>
                    <lin-sys:extended_name>fedora-release-common-0:37-0.6.noarch</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252369" status="exists">
                    <lin-sys:filepath>/proc/838/statm</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>statm</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252368" status="exists">
                    <lin-sys:filepath>/proc/838/stat</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>stat</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252367" status="exists">
                    <lin-sys:filepath>/proc/838/cmdline</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>cmdline</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252366" status="exists">
                    <lin-sys:filepath>/proc/838/syscall</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>syscall</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252365" status="exists">
                    <lin-sys:filepath>/proc/838/comm</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>comm</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252364" status="exists">
                    <lin-sys:filepath>/proc/838/timens_offsets</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>timens_offsets</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252363" status="exists">
                    <lin-sys:filepath>/proc/838/autogroup</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>autogroup</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252362" status="exists">
                    <lin-sys:filepath>/proc/838/sched</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>sched</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252361" status="exists">
                    <lin-sys:filepath>/proc/838/limits</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>limits</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252360" status="exists">
                    <lin-sys:filepath>/proc/838/personality</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>personality</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:rpminfo_item id="10425236" status="exists">
                    <lin-sys:name>fedora-release-workstation</lin-sys:name>
                    <lin-sys:arch>noarch</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>0.6</lin-sys:release>
                    <lin-sys:version>37</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:37-0.6</lin-sys:evr>
                    <lin-sys:signature_keyid>f55ad3fb5323552a</lin-sys:signature_keyid>
                    <lin-sys:extended_name>fedora-release-workstation-0:37-0.6.noarch</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252359" status="exists">
                    <lin-sys:filepath>/proc/838/status</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>status</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252358" status="exists">
                    <lin-sys:filepath>/proc/838/auxv</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>auxv</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252357" status="exists">
                    <lin-sys:filepath>/proc/838/environ</lin-sys:filepath>
                    <lin-sys:path>/proc/838</lin-sys:path>
                    <lin-sys:filename>environ</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252356" status="exists">
                    <lin-sys:filepath>/proc/830/ksm_merging_pages</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>ksm_merging_pages</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252355" status="exists">
                    <lin-sys:filepath>/proc/830/arch_status</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>arch_status</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252354" status="exists">
                    <lin-sys:filepath>/proc/830/patch_state</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>patch_state</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252353" status="exists">
                    <lin-sys:filepath>/proc/830/timerslack_ns</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>timerslack_ns</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252352" status="exists">
                    <lin-sys:filepath>/proc/830/timers</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>timers</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252351" status="exists">
                    <lin-sys:filepath>/proc/830/setgroups</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>setgroups</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252350" status="exists">
                    <lin-sys:filepath>/proc/830/projid_map</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>projid_map</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:rpminfo_item id="10425235" status="exists">
                    <lin-sys:name>fedora-release-identity-workstation</lin-sys:name>
                    <lin-sys:arch>noarch</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>0.6</lin-sys:release>
                    <lin-sys:version>37</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:37-0.6</lin-sys:evr>
                    <lin-sys:signature_keyid>f55ad3fb5323552a</lin-sys:signature_keyid>
                    <lin-sys:extended_name>fedora-release-identity-workstation-0:37-0.6.noarch</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252349" status="exists">
                    <lin-sys:filepath>/proc/830/gid_map</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>gid_map</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252348" status="exists">
                    <lin-sys:filepath>/proc/830/uid_map</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>uid_map</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252347" status="exists">
                    <lin-sys:filepath>/proc/830/io</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>io</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252346" status="exists">
                    <lin-sys:filepath>/proc/830/coredump_filter</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>coredump_filter</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252345" status="exists">
                    <lin-sys:filepath>/proc/830/fail-nth</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>fail-nth</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252344" status="exists">
                    <lin-sys:filepath>/proc/830/make-it-fail</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>make-it-fail</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252343" status="exists">
                    <lin-sys:filepath>/proc/830/sessionid</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>sessionid</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252342" status="exists">
                    <lin-sys:filepath>/proc/830/loginuid</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>loginuid</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252341" status="exists">
                    <lin-sys:filepath>/proc/830/oom_score_adj</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>oom_score_adj</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252340" status="exists">
                    <lin-sys:filepath>/proc/830/oom_adj</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>oom_adj</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:rpminfo_item id="10425234" status="exists">
                    <lin-sys:name>gdm</lin-sys:name>
                    <lin-sys:arch>x86_64</lin-sys:arch>
                    <lin-sys:epoch>1</lin-sys:epoch>
                    <lin-sys:release>1.fc37</lin-sys:release>
                    <lin-sys:version>42.0</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">1:42.0-1.fc37</lin-sys:evr>
                    <lin-sys:signature_keyid>f55ad3fb5323552a</lin-sys:signature_keyid>
                    <lin-sys:extended_name>gdm-1:42.0-1.fc37.x86_64</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252339" status="exists">
                    <lin-sys:filepath>/proc/830/oom_score</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>oom_score</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252338" status="exists">
                    <lin-sys:filepath>/proc/830/cpu_resctrl_groups</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>cpu_resctrl_groups</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252337" status="exists">
                    <lin-sys:filepath>/proc/830/cgroup</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>cgroup</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252336" status="exists">
                    <lin-sys:filepath>/proc/830/cpuset</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>cpuset</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252335" status="exists">
                    <lin-sys:filepath>/proc/830/latency</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>latency</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252334" status="exists">
                    <lin-sys:filepath>/proc/830/schedstat</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>schedstat</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252333" status="exists">
                    <lin-sys:filepath>/proc/830/stack</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>stack</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252332" status="exists">
                    <lin-sys:filepath>/proc/830/wchan</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>wchan</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252331" status="exists">
                    <lin-sys:filepath>/proc/830/pagemap</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>pagemap</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252330" status="exists">
                    <lin-sys:filepath>/proc/830/smaps_rollup</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>smaps_rollup</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <ind-sys:textfilecontent_item id="10425233" status="exists">
                    <ind-sys:filepath>/etc/dconf/profile/user</ind-sys:filepath>
                    <ind-sys:path>/etc/dconf/profile</ind-sys:path>
                    <ind-sys:filename>user</ind-sys:filename>
                    <ind-sys:pattern>^user-db:user\nsystem-db:local$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^user-db:user\nsystem-db:local$</ind-sys:line>
                    <ind-sys:text>user-db:user
system-db:local</ind-sys:text>
                  </ind-sys:textfilecontent_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252329" status="exists">
                    <lin-sys:filepath>/proc/830/smaps</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>smaps</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252328" status="exists">
                    <lin-sys:filepath>/proc/830/clear_refs</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>clear_refs</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252327" status="exists">
                    <lin-sys:filepath>/proc/830/mountstats</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>mountstats</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252326" status="exists">
                    <lin-sys:filepath>/proc/830/mountinfo</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>mountinfo</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252325" status="exists">
                    <lin-sys:filepath>/proc/830/mounts</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>mounts</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252324" status="exists">
                    <lin-sys:filepath>/proc/830/mem</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>mem</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252323" status="exists">
                    <lin-sys:filepath>/proc/830/numa_maps</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>numa_maps</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252322" status="exists">
                    <lin-sys:filepath>/proc/830/maps</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>maps</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252321" status="exists">
                    <lin-sys:filepath>/proc/830/statm</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>statm</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252320" status="exists">
                    <lin-sys:filepath>/proc/830/stat</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>stat</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <ind-sys:variable_item id="10425232" status="exists">
                    <ind-sys:var_ref>oval:ssg-var_dconf_local_db_modified_time:var:1</ind-sys:var_ref>
                    <ind-sys:value>1751</ind-sys:value>
                  </ind-sys:variable_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252319" status="exists">
                    <lin-sys:filepath>/proc/830/cmdline</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>cmdline</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252318" status="exists">
                    <lin-sys:filepath>/proc/830/syscall</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>syscall</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252317" status="exists">
                    <lin-sys:filepath>/proc/830/comm</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>comm</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252316" status="exists">
                    <lin-sys:filepath>/proc/830/timens_offsets</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>timens_offsets</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252315" status="exists">
                    <lin-sys:filepath>/proc/830/autogroup</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>autogroup</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252314" status="exists">
                    <lin-sys:filepath>/proc/830/sched</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>sched</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252313" status="exists">
                    <lin-sys:filepath>/proc/830/limits</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>limits</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252312" status="exists">
                    <lin-sys:filepath>/proc/830/personality</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>personality</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252311" status="exists">
                    <lin-sys:filepath>/proc/830/status</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>status</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252310" status="exists">
                    <lin-sys:filepath>/proc/830/auxv</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>auxv</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <unix-sys:file_item id="10425231" status="exists">
                    <unix-sys:filepath>/etc/dconf/db/local</unix-sys:filepath>
                    <unix-sys:path>/etc/dconf/db</unix-sys:path>
                    <unix-sys:filename>local</unix-sys:filename>
                    <unix-sys:type>regular</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362930</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362093</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362093</unix-sys:m_time>
                    <unix-sys:size datatype="int">104</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <lin-sys:selinuxsecuritycontext_item id="104252309" status="exists">
                    <lin-sys:filepath>/proc/830/environ</lin-sys:filepath>
                    <lin-sys:path>/proc/830</lin-sys:path>
                    <lin-sys:filename>environ</lin-sys:filename>
                    <lin-sys:user>system_u</lin-sys:user>
                    <lin-sys:role>system_r</lin-sys:role>
                    <lin-sys:type>unconfined_service_t</lin-sys:type>
                    <lin-sys:low_sensitivity>s0</lin-sys:low_sensitivity>
                    <lin-sys:rawlow_sensitivity>s0</lin-sys:rawlow_sensitivity>
                  </lin-sys:selinuxsecuritycontext_item>
                  <unix-sys:file_item id="104252308" status="exists">
                    <unix-sys:filepath>/dev/vga_arbiter</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vga_arbiter</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252307" status="exists">
                    <unix-sys:filepath>/dev/mem</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>mem</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">9</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252306" status="exists">
                    <unix-sys:filepath>/dev/null</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>null</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">true</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252305" status="exists">
                    <unix-sys:filepath>/dev/port</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>port</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">9</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252304" status="exists">
                    <unix-sys:filepath>/dev/zero</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>zero</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">true</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252303" status="exists">
                    <unix-sys:filepath>/dev/full</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>full</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">true</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252302" status="exists">
                    <unix-sys:filepath>/dev/random</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>random</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">true</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252301" status="exists">
                    <unix-sys:filepath>/dev/urandom</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>urandom</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">true</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252300" status="exists">
                    <unix-sys:filepath>/dev/kmsg</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>kmsg</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="10425230" status="exists">
                    <unix-sys:filepath>/etc/dconf/db/distro.d/20-authselect</unix-sys:filepath>
                    <unix-sys:path>/etc/dconf/db/distro.d</unix-sys:path>
                    <unix-sys:filename>20-authselect</unix-sys:filename>
                    <unix-sys:type>symbolic link</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362093</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362093</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362093</unix-sys:m_time>
                    <unix-sys:size datatype="int">24</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">true</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">true</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">true</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">true</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252299" status="exists">
                    <unix-sys:filepath>/dev/tty</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659363126</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659363125</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">true</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252298" status="exists">
                    <unix-sys:filepath>/dev/console</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>console</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252297" status="exists">
                    <unix-sys:filepath>/dev/tty0</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty0</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252296" status="exists">
                    <unix-sys:filepath>/dev/vcs</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vcs</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252295" status="exists">
                    <unix-sys:filepath>/dev/vcsu</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vcsu</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252294" status="exists">
                    <unix-sys:filepath>/dev/vcsa</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vcsa</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252293" status="exists">
                    <unix-sys:filepath>/dev/vcs1</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vcs1</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252292" status="exists">
                    <unix-sys:filepath>/dev/vcsu1</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vcsu1</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252291" status="exists">
                    <unix-sys:filepath>/dev/vcsa1</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vcsa1</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252290" status="exists">
                    <unix-sys:filepath>/dev/tty1</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty1</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659363089</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362930</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="10425229" status="exists">
                    <unix-sys:filepath>/etc/dconf/db/distro.d/locks/20-authselect</unix-sys:filepath>
                    <unix-sys:path>/etc/dconf/db/distro.d/locks</unix-sys:path>
                    <unix-sys:filename>20-authselect</unix-sys:filename>
                    <unix-sys:type>symbolic link</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362093</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362093</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362093</unix-sys:m_time>
                    <unix-sys:size datatype="int">27</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">true</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">true</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">true</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">true</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252289" status="exists">
                    <unix-sys:filepath>/dev/tty2</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty2</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">1000</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659363085</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659363084</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252288" status="exists">
                    <unix-sys:filepath>/dev/tty3</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty3</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252287" status="exists">
                    <unix-sys:filepath>/dev/tty4</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty4</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252286" status="exists">
                    <unix-sys:filepath>/dev/tty5</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty5</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252285" status="exists">
                    <unix-sys:filepath>/dev/tty6</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty6</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252284" status="exists">
                    <unix-sys:filepath>/dev/tty7</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty7</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252283" status="exists">
                    <unix-sys:filepath>/dev/tty8</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty8</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252282" status="exists">
                    <unix-sys:filepath>/dev/tty9</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty9</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252281" status="exists">
                    <unix-sys:filepath>/dev/tty10</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty10</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252280" status="exists">
                    <unix-sys:filepath>/dev/tty11</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty11</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <ind-sys:variable_item id="10425228" status="exists">
                    <ind-sys:var_ref>oval:ssg-var_dconf_distro_db_modified_time:var:1</ind-sys:var_ref>
                    <ind-sys:value>1751</ind-sys:value>
                  </ind-sys:variable_item>
                  <unix-sys:file_item id="104252279" status="exists">
                    <unix-sys:filepath>/dev/tty12</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty12</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252278" status="exists">
                    <unix-sys:filepath>/dev/tty13</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty13</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252277" status="exists">
                    <unix-sys:filepath>/dev/tty14</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty14</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252276" status="exists">
                    <unix-sys:filepath>/dev/tty15</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty15</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252275" status="exists">
                    <unix-sys:filepath>/dev/tty16</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty16</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252274" status="exists">
                    <unix-sys:filepath>/dev/tty17</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty17</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252273" status="exists">
                    <unix-sys:filepath>/dev/tty18</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty18</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252272" status="exists">
                    <unix-sys:filepath>/dev/tty19</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty19</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252271" status="exists">
                    <unix-sys:filepath>/dev/tty20</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty20</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252270" status="exists">
                    <unix-sys:filepath>/dev/tty21</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty21</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="10425227" status="exists">
                    <unix-sys:filepath>/etc/dconf/db/distro</unix-sys:filepath>
                    <unix-sys:path>/etc/dconf/db</unix-sys:path>
                    <unix-sys:filename>distro</unix-sys:filename>
                    <unix-sys:type>regular</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362930</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362093</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362093</unix-sys:m_time>
                    <unix-sys:size datatype="int">731</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252269" status="exists">
                    <unix-sys:filepath>/dev/tty22</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty22</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252268" status="exists">
                    <unix-sys:filepath>/dev/tty23</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty23</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252267" status="exists">
                    <unix-sys:filepath>/dev/tty24</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty24</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252266" status="exists">
                    <unix-sys:filepath>/dev/tty25</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty25</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252265" status="exists">
                    <unix-sys:filepath>/dev/tty26</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty26</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252264" status="exists">
                    <unix-sys:filepath>/dev/tty27</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty27</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252263" status="exists">
                    <unix-sys:filepath>/dev/tty28</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty28</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252262" status="exists">
                    <unix-sys:filepath>/dev/tty29</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty29</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252261" status="exists">
                    <unix-sys:filepath>/dev/tty30</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty30</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252260" status="exists">
                    <unix-sys:filepath>/dev/tty31</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty31</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <lin-sys:rpminfo_item id="10425226" status="exists">
                    <lin-sys:name>dconf</lin-sys:name>
                    <lin-sys:arch>x86_64</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>6.fc36</lin-sys:release>
                    <lin-sys:version>0.40.0</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:0.40.0-6.fc36</lin-sys:evr>
                    <lin-sys:signature_keyid>f55ad3fb5323552a</lin-sys:signature_keyid>
                    <lin-sys:extended_name>dconf-0:0.40.0-6.fc36.x86_64</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <unix-sys:file_item id="104252259" status="exists">
                    <unix-sys:filepath>/dev/tty32</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty32</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252258" status="exists">
                    <unix-sys:filepath>/dev/tty33</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty33</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252257" status="exists">
                    <unix-sys:filepath>/dev/tty34</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty34</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252256" status="exists">
                    <unix-sys:filepath>/dev/tty35</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty35</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252255" status="exists">
                    <unix-sys:filepath>/dev/tty36</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty36</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252254" status="exists">
                    <unix-sys:filepath>/dev/tty37</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty37</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252253" status="exists">
                    <unix-sys:filepath>/dev/tty38</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty38</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252252" status="exists">
                    <unix-sys:filepath>/dev/tty39</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty39</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252251" status="exists">
                    <unix-sys:filepath>/dev/tty40</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty40</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252250" status="exists">
                    <unix-sys:filepath>/dev/tty41</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty41</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252249" status="exists">
                    <unix-sys:filepath>/dev/tty42</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty42</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252248" status="exists">
                    <unix-sys:filepath>/dev/tty43</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty43</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252247" status="exists">
                    <unix-sys:filepath>/dev/tty44</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty44</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252246" status="exists">
                    <unix-sys:filepath>/dev/tty45</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty45</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252245" status="exists">
                    <unix-sys:filepath>/dev/tty46</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty46</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252244" status="exists">
                    <unix-sys:filepath>/dev/tty47</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty47</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252243" status="exists">
                    <unix-sys:filepath>/dev/tty48</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty48</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252242" status="exists">
                    <unix-sys:filepath>/dev/tty49</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty49</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252241" status="exists">
                    <unix-sys:filepath>/dev/tty50</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty50</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252240" status="exists">
                    <unix-sys:filepath>/dev/tty51</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty51</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <ind-sys:family_item id="10425224" status="exists">
                    <ind-sys:family>unix</ind-sys:family>
                  </ind-sys:family_item>
                  <unix-sys:file_item id="104252239" status="exists">
                    <unix-sys:filepath>/dev/tty52</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty52</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252238" status="exists">
                    <unix-sys:filepath>/dev/tty53</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty53</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252237" status="exists">
                    <unix-sys:filepath>/dev/tty54</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty54</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252236" status="exists">
                    <unix-sys:filepath>/dev/tty55</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty55</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252235" status="exists">
                    <unix-sys:filepath>/dev/tty56</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty56</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252234" status="exists">
                    <unix-sys:filepath>/dev/tty57</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty57</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252233" status="exists">
                    <unix-sys:filepath>/dev/tty58</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty58</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252232" status="exists">
                    <unix-sys:filepath>/dev/tty59</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty59</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252231" status="exists">
                    <unix-sys:filepath>/dev/tty60</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty60</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252230" status="exists">
                    <unix-sys:filepath>/dev/tty61</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty61</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <ind-sys:textfilecontent_item id="10425223" status="exists">
                    <ind-sys:filepath>/etc/pki/tls/openssl.cnf</ind-sys:filepath>
                    <ind-sys:path>/etc/pki/tls</ind-sys:path>
                    <ind-sys:filename>openssl.cnf</ind-sys:filename>
                    <ind-sys:pattern>^\s*\[\s*crypto_policy\s*\]\s*\n*\s*\.include\s*(?:=\s*)?/etc/crypto-policies/back-ends/opensslcnf.config\s*$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^\s*\[\s*crypto_policy\s*\]\s*\n*\s*\.include\s*(?:=\s*)?/etc/crypto-policies/back-ends/opensslcnf.config\s*$</ind-sys:line>
                    <ind-sys:text>
[ crypto_policy ]

.include = /etc/crypto-policies/back-ends/opensslcnf.config
</ind-sys:text>
                  </ind-sys:textfilecontent_item>
                  <unix-sys:file_item id="104252229" status="exists">
                    <unix-sys:filepath>/dev/tty62</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty62</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252228" status="exists">
                    <unix-sys:filepath>/dev/tty63</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>tty63</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252227" status="exists">
                    <unix-sys:filepath>/dev/hwrng</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>hwrng</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252226" status="exists">
                    <unix-sys:filepath>/dev/cpu/0/msr</unix-sys:filepath>
                    <unix-sys:path>/dev/cpu/0</unix-sys:path>
                    <unix-sys:filename>msr</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252225" status="exists">
                    <unix-sys:filepath>/dev/cpu/0/cpuid</unix-sys:filepath>
                    <unix-sys:path>/dev/cpu/0</unix-sys:path>
                    <unix-sys:filename>cpuid</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252224" status="exists">
                    <unix-sys:filepath>/dev/cpu/1/msr</unix-sys:filepath>
                    <unix-sys:path>/dev/cpu/1</unix-sys:path>
                    <unix-sys:filename>msr</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252223" status="exists">
                    <unix-sys:filepath>/dev/cpu/1/cpuid</unix-sys:filepath>
                    <unix-sys:path>/dev/cpu/1</unix-sys:path>
                    <unix-sys:filename>cpuid</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252222" status="exists">
                    <unix-sys:filepath>/dev/cpu/2/msr</unix-sys:filepath>
                    <unix-sys:path>/dev/cpu/2</unix-sys:path>
                    <unix-sys:filename>msr</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252221" status="exists">
                    <unix-sys:filepath>/dev/cpu/2/cpuid</unix-sys:filepath>
                    <unix-sys:path>/dev/cpu/2</unix-sys:path>
                    <unix-sys:filename>cpuid</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252220" status="exists">
                    <unix-sys:filepath>/dev/cpu/3/msr</unix-sys:filepath>
                    <unix-sys:path>/dev/cpu/3</unix-sys:path>
                    <unix-sys:filename>msr</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:symlink_item id="10425222" status="exists">
                    <unix-sys:filepath>/etc/crypto-policies/back-ends/krb5.config</unix-sys:filepath>
                    <unix-sys:canonical_path>/usr/share/crypto-policies/DEFAULT/krb5.txt</unix-sys:canonical_path>
                  </unix-sys:symlink_item>
                  <unix-sys:file_item id="104252219" status="exists">
                    <unix-sys:filepath>/dev/cpu/3/cpuid</unix-sys:filepath>
                    <unix-sys:path>/dev/cpu/3</unix-sys:path>
                    <unix-sys:filename>cpuid</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252218" status="exists">
                    <unix-sys:filepath>/dev/cpu/4/msr</unix-sys:filepath>
                    <unix-sys:path>/dev/cpu/4</unix-sys:path>
                    <unix-sys:filename>msr</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252217" status="exists">
                    <unix-sys:filepath>/dev/cpu/4/cpuid</unix-sys:filepath>
                    <unix-sys:path>/dev/cpu/4</unix-sys:path>
                    <unix-sys:filename>cpuid</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252216" status="exists">
                    <unix-sys:filepath>/dev/cpu/5/msr</unix-sys:filepath>
                    <unix-sys:path>/dev/cpu/5</unix-sys:path>
                    <unix-sys:filename>msr</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252215" status="exists">
                    <unix-sys:filepath>/dev/cpu/5/cpuid</unix-sys:filepath>
                    <unix-sys:path>/dev/cpu/5</unix-sys:path>
                    <unix-sys:filename>cpuid</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252214" status="exists">
                    <unix-sys:filepath>/dev/cpu/6/msr</unix-sys:filepath>
                    <unix-sys:path>/dev/cpu/6</unix-sys:path>
                    <unix-sys:filename>msr</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252213" status="exists">
                    <unix-sys:filepath>/dev/cpu/6/cpuid</unix-sys:filepath>
                    <unix-sys:path>/dev/cpu/6</unix-sys:path>
                    <unix-sys:filename>cpuid</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252212" status="exists">
                    <unix-sys:filepath>/dev/cpu/7/msr</unix-sys:filepath>
                    <unix-sys:path>/dev/cpu/7</unix-sys:path>
                    <unix-sys:filename>msr</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252211" status="exists">
                    <unix-sys:filepath>/dev/cpu/7/cpuid</unix-sys:filepath>
                    <unix-sys:path>/dev/cpu/7</unix-sys:path>
                    <unix-sys:filename>cpuid</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252210" status="exists">
                    <unix-sys:filepath>/dev/snapshot</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>snapshot</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <ind-sys:variable_item id="10425221" status="exists">
                    <ind-sys:var_ref>oval:ssg-var_symlink_kerberos_crypto_policy_configuration:var:1</ind-sys:var_ref>
                    <ind-sys:value>/usr/share/crypto-policies/DEFAULT/krb5.txt</ind-sys:value>
                  </ind-sys:variable_item>
                  <unix-sys:file_item id="104252209" status="exists">
                    <unix-sys:filepath>/dev/autofs</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>autofs</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252208" status="exists">
                    <unix-sys:filepath>/dev/ptmx</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ptmx</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659363240</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659363192</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">true</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252207" status="exists">
                    <unix-sys:filepath>/dev/ttyS0</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS0</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252206" status="exists">
                    <unix-sys:filepath>/dev/ttyS1</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS1</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252205" status="exists">
                    <unix-sys:filepath>/dev/ttyS2</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS2</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252204" status="exists">
                    <unix-sys:filepath>/dev/ttyS3</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS3</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252203" status="exists">
                    <unix-sys:filepath>/dev/ttyS4</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS4</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252202" status="exists">
                    <unix-sys:filepath>/dev/ttyS5</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS5</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252201" status="exists">
                    <unix-sys:filepath>/dev/ttyS6</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS6</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252200" status="exists">
                    <unix-sys:filepath>/dev/ttyS7</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS7</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:symlink_item id="10425220" status="exists">
                    <unix-sys:filepath>/etc/krb5.conf.d/crypto-policies</unix-sys:filepath>
                    <unix-sys:canonical_path>/usr/share/crypto-policies/DEFAULT/krb5.txt</unix-sys:canonical_path>
                  </unix-sys:symlink_item>
                  <unix-sys:file_item id="104252199" status="exists">
                    <unix-sys:filepath>/dev/ttyS8</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS8</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252198" status="exists">
                    <unix-sys:filepath>/dev/ttyS9</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS9</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252197" status="exists">
                    <unix-sys:filepath>/dev/ttyS10</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS10</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252196" status="exists">
                    <unix-sys:filepath>/dev/ttyS11</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS11</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252195" status="exists">
                    <unix-sys:filepath>/dev/ttyS12</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS12</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252194" status="exists">
                    <unix-sys:filepath>/dev/ttyS13</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS13</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252193" status="exists">
                    <unix-sys:filepath>/dev/ttyS14</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS14</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252192" status="exists">
                    <unix-sys:filepath>/dev/ttyS15</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS15</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252191" status="exists">
                    <unix-sys:filepath>/dev/ttyS16</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS16</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252190" status="exists">
                    <unix-sys:filepath>/dev/ttyS17</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS17</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <ind-sys:variable_item id="10425219" status="exists">
                    <ind-sys:var_ref>oval:ssg-var_system_crypto_policy:var:1</ind-sys:var_ref>
                    <ind-sys:value>FIPS</ind-sys:value>
                  </ind-sys:variable_item>
                  <unix-sys:file_item id="104252189" status="exists">
                    <unix-sys:filepath>/dev/ttyS18</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS18</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252188" status="exists">
                    <unix-sys:filepath>/dev/ttyS19</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS19</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252187" status="exists">
                    <unix-sys:filepath>/dev/ttyS20</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS20</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252186" status="exists">
                    <unix-sys:filepath>/dev/ttyS21</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS21</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252185" status="exists">
                    <unix-sys:filepath>/dev/ttyS22</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS22</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252184" status="exists">
                    <unix-sys:filepath>/dev/ttyS23</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS23</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252183" status="exists">
                    <unix-sys:filepath>/dev/ttyS24</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS24</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252182" status="exists">
                    <unix-sys:filepath>/dev/ttyS25</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS25</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252181" status="exists">
                    <unix-sys:filepath>/dev/ttyS26</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS26</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252180" status="exists">
                    <unix-sys:filepath>/dev/ttyS27</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS27</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="10425218" status="exists">
                    <unix-sys:filepath>/etc/crypto-policies/back-ends/nss.config</unix-sys:filepath>
                    <unix-sys:path>/etc/crypto-policies/back-ends</unix-sys:path>
                    <unix-sys:filename>nss.config</unix-sys:filename>
                    <unix-sys:type>regular</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362933</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659361531</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1656317194</unix-sys:m_time>
                    <unix-sys:size datatype="int">447</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252179" status="exists">
                    <unix-sys:filepath>/dev/ttyS28</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS28</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252178" status="exists">
                    <unix-sys:filepath>/dev/ttyS29</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS29</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252177" status="exists">
                    <unix-sys:filepath>/dev/ttyS30</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS30</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252176" status="exists">
                    <unix-sys:filepath>/dev/ttyS31</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ttyS31</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">18</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252175" status="exists">
                    <unix-sys:filepath>/dev/hpet</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>hpet</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252174" status="exists">
                    <unix-sys:filepath>/dev/nvram</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>nvram</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252173" status="exists">
                    <unix-sys:filepath>/dev/dma_heap/system</unix-sys:filepath>
                    <unix-sys:path>/dev/dma_heap</unix-sys:path>
                    <unix-sys:filename>system</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252172" status="exists">
                    <unix-sys:filepath>/dev/udmabuf</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>udmabuf</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">36</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252171" status="exists">
                    <unix-sys:filepath>/dev/usbmon0</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>usbmon0</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252170" status="exists">
                    <unix-sys:filepath>/dev/usbmon1</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>usbmon1</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="10425217" status="exists">
                    <unix-sys:filepath>/etc/crypto-policies/state/current</unix-sys:filepath>
                    <unix-sys:path>/etc/crypto-policies/state</unix-sys:path>
                    <unix-sys:filename>current</unix-sys:filename>
                    <unix-sys:type>regular</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659363844</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659361531</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1656317194</unix-sys:m_time>
                    <unix-sys:size datatype="int">8</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252169" status="exists">
                    <unix-sys:filepath>/dev/usbmon2</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>usbmon2</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252168" status="exists">
                    <unix-sys:filepath>/dev/bus/usb/001/001</unix-sys:filepath>
                    <unix-sys:path>/dev/bus/usb/001</unix-sys:path>
                    <unix-sys:filename>001</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252167" status="exists">
                    <unix-sys:filepath>/dev/bus/usb/001/002</unix-sys:filepath>
                    <unix-sys:path>/dev/bus/usb/001</unix-sys:path>
                    <unix-sys:filename>002</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659363726</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659363084</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659363726</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">true</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252166" status="exists">
                    <unix-sys:filepath>/dev/bus/usb/001/003</unix-sys:filepath>
                    <unix-sys:path>/dev/bus/usb/001</unix-sys:path>
                    <unix-sys:filename>003</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252165" status="exists">
                    <unix-sys:filepath>/dev/bus/usb/002/001</unix-sys:filepath>
                    <unix-sys:path>/dev/bus/usb/002</unix-sys:path>
                    <unix-sys:filename>001</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252164" status="exists">
                    <unix-sys:filepath>/dev/input/mice</unix-sys:filepath>
                    <unix-sys:path>/dev/input</unix-sys:path>
                    <unix-sys:filename>mice</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">104</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252163" status="exists">
                    <unix-sys:filepath>/dev/input/event0</unix-sys:filepath>
                    <unix-sys:path>/dev/input</unix-sys:path>
                    <unix-sys:filename>event0</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">104</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252162" status="exists">
                    <unix-sys:filepath>/dev/input/event1</unix-sys:filepath>
                    <unix-sys:path>/dev/input</unix-sys:path>
                    <unix-sys:filename>event1</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">104</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252161" status="exists">
                    <unix-sys:filepath>/dev/input/mouse0</unix-sys:filepath>
                    <unix-sys:path>/dev/input</unix-sys:path>
                    <unix-sys:filename>mouse0</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">104</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252160" status="exists">
                    <unix-sys:filepath>/dev/input/event2</unix-sys:filepath>
                    <unix-sys:path>/dev/input</unix-sys:path>
                    <unix-sys:filename>event2</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">104</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <ind-sys:variable_item id="10425216" status="exists">
                    <ind-sys:var_ref>oval:ssg-variable_crypto_policies_config_file_timestamp:var:1</ind-sys:var_ref>
                    <ind-sys:value>1656317058</ind-sys:value>
                  </ind-sys:variable_item>
                  <unix-sys:file_item id="104252159" status="exists">
                    <unix-sys:filepath>/dev/input/mouse1</unix-sys:filepath>
                    <unix-sys:path>/dev/input</unix-sys:path>
                    <unix-sys:filename>mouse1</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">104</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252158" status="exists">
                    <unix-sys:filepath>/dev/input/event3</unix-sys:filepath>
                    <unix-sys:path>/dev/input</unix-sys:path>
                    <unix-sys:filename>event3</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">104</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252157" status="exists">
                    <unix-sys:filepath>/dev/input/mouse2</unix-sys:filepath>
                    <unix-sys:path>/dev/input</unix-sys:path>
                    <unix-sys:filename>mouse2</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">104</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252156" status="exists">
                    <unix-sys:filepath>/dev/input/event4</unix-sys:filepath>
                    <unix-sys:path>/dev/input</unix-sys:path>
                    <unix-sys:filename>event4</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">104</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252155" status="exists">
                    <unix-sys:filepath>/dev/input/event5</unix-sys:filepath>
                    <unix-sys:path>/dev/input</unix-sys:path>
                    <unix-sys:filename>event5</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">104</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252154" status="exists">
                    <unix-sys:filepath>/dev/input/mouse3</unix-sys:filepath>
                    <unix-sys:path>/dev/input</unix-sys:path>
                    <unix-sys:filename>mouse3</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">104</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659363090</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659363090</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659363090</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252153" status="exists">
                    <unix-sys:filepath>/dev/input/event6</unix-sys:filepath>
                    <unix-sys:path>/dev/input</unix-sys:path>
                    <unix-sys:filename>event6</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">104</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659363090</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659363090</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659363090</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252152" status="exists">
                    <unix-sys:filepath>/dev/input/js0</unix-sys:filepath>
                    <unix-sys:path>/dev/input</unix-sys:path>
                    <unix-sys:filename>js0</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">104</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659363090</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659363090</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659363090</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252151" status="exists">
                    <unix-sys:filepath>/dev/rtc0</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>rtc0</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252150" status="exists">
                    <unix-sys:filepath>/dev/mapper/control</unix-sys:filepath>
                    <unix-sys:path>/dev/mapper</unix-sys:path>
                    <unix-sys:filename>control</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="10425215" status="exists">
                    <unix-sys:filepath>/etc/crypto-policies/config</unix-sys:filepath>
                    <unix-sys:path>/etc/crypto-policies</unix-sys:path>
                    <unix-sys:filename>config</unix-sys:filename>
                    <unix-sys:type>regular</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659363844</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659361531</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1656317058</unix-sys:m_time>
                    <unix-sys:size datatype="int">8</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252149" status="exists">
                    <unix-sys:filepath>/dev/mcelog</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>mcelog</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252148" status="exists">
                    <unix-sys:filepath>/dev/cpu_dma_latency</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>cpu_dma_latency</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252147" status="exists">
                    <unix-sys:filepath>/dev/btrfs-control</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>btrfs-control</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">6</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252146" status="exists">
                    <unix-sys:filepath>/dev/sr0</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>sr0</unix-sys:filename>
                    <unix-sys:type>block special</unix-sys:type>
                    <unix-sys:group_id datatype="int">11</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659363844</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659363087</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659363087</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">true</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252145" status="exists">
                    <unix-sys:filepath>/dev/sg0</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>sg0</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">11</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659363084</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">true</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252144" status="exists">
                    <unix-sys:filepath>/dev/bsg/2:0:0:0</unix-sys:filepath>
                    <unix-sys:path>/dev/bsg</unix-sys:path>
                    <unix-sys:filename>2:0:0:0</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252143" status="exists">
                    <unix-sys:filepath>/dev/pts/ptmx</unix-sys:filepath>
                    <unix-sys:path>/dev/pts</unix-sys:path>
                    <unix-sys:filename>ptmx</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362919</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362919</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362919</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">false</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">false</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean" status="does not exist"/>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252142" status="exists">
                    <unix-sys:filepath>/dev/pts/0</unix-sys:filepath>
                    <unix-sys:path>/dev/pts</unix-sys:path>
                    <unix-sys:filename>0</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">1000</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659363192</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659363111</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659363240</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean" status="does not exist"/>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252141" status="exists">
                    <unix-sys:filepath>/dev/hidraw0</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>hidraw0</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252140" status="exists">
                    <unix-sys:filepath>/dev/fuse</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>fuse</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659363241</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659363241</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659363241</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">true</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <ind-sys:textfilecontent_item id="10425214" status="exists">
                    <ind-sys:filepath>/etc/crypto-policies/state/current</ind-sys:filepath>
                    <ind-sys:path>/etc/crypto-policies/state</ind-sys:path>
                    <ind-sys:filename>current</ind-sys:filename>
                    <ind-sys:pattern>^(?!#)(\S+)$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^(?!#)(\S+)$</ind-sys:line>
                    <ind-sys:text>DEFAULT</ind-sys:text>
                    <ind-sys:subexpression>DEFAULT</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <unix-sys:file_item id="104252139" status="exists">
                    <unix-sys:filepath>/dev/loop-control</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>loop-control</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">6</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659363241</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659363241</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659363241</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252138" status="exists">
                    <unix-sys:filepath>/dev/uhid</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>uhid</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362919</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362919</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362919</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252137" status="exists">
                    <unix-sys:filepath>/dev/rfkill</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>rfkill</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362929</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659363084</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362929</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">true</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252136" status="exists">
                    <unix-sys:filepath>/dev/vda</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vda</unix-sys:filename>
                    <unix-sys:type>block special</unix-sys:type>
                    <unix-sys:group_id datatype="int">6</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659363242</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252135" status="exists">
                    <unix-sys:filepath>/dev/dri/renderD128</unix-sys:filepath>
                    <unix-sys:path>/dev/dri</unix-sys:path>
                    <unix-sys:filename>renderD128</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">105</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">true</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252134" status="exists">
                    <unix-sys:filepath>/dev/dri/card0</unix-sys:filepath>
                    <unix-sys:path>/dev/dri</unix-sys:path>
                    <unix-sys:filename>card0</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">39</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659363066</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659363084</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659363066</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">true</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252133" status="exists">
                    <unix-sys:filepath>/dev/vport2p1</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vport2p1</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252132" status="exists">
                    <unix-sys:filepath>/dev/vport2p2</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vport2p2</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252131" status="exists">
                    <unix-sys:filepath>/dev/fb0</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>fb0</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">39</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252130" status="exists">
                    <unix-sys:filepath>/dev/vda1</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vda1</unix-sys:filename>
                    <unix-sys:type>block special</unix-sys:type>
                    <unix-sys:group_id datatype="int">6</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659363087</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362926</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362926</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <ind-sys:textfilecontent_item id="10425213" status="exists">
                    <ind-sys:filepath>/etc/crypto-policies/config</ind-sys:filepath>
                    <ind-sys:path>/etc/crypto-policies</ind-sys:path>
                    <ind-sys:filename>config</ind-sys:filename>
                    <ind-sys:pattern>^(?!#)(\S+)$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^(?!#)(\S+)$</ind-sys:line>
                    <ind-sys:text>DEFAULT</ind-sys:text>
                    <ind-sys:subexpression>DEFAULT</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <unix-sys:file_item id="104252129" status="exists">
                    <unix-sys:filepath>/dev/vda2</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vda2</unix-sys:filename>
                    <unix-sys:type>block special</unix-sys:type>
                    <unix-sys:group_id datatype="int">6</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252128" status="exists">
                    <unix-sys:filepath>/dev/zram0</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>zram0</unix-sys:filename>
                    <unix-sys:type>block special</unix-sys:type>
                    <unix-sys:group_id datatype="int">6</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252127" status="exists">
                    <unix-sys:filepath>/dev/lp0</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>lp0</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">7</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252126" status="exists">
                    <unix-sys:filepath>/dev/lp1</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>lp1</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">7</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252125" status="exists">
                    <unix-sys:filepath>/dev/lp2</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>lp2</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">7</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252124" status="exists">
                    <unix-sys:filepath>/dev/lp3</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>lp3</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">7</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252123" status="exists">
                    <unix-sys:filepath>/dev/cuse</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>cuse</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252122" status="exists">
                    <unix-sys:filepath>/dev/net/tun</unix-sys:filepath>
                    <unix-sys:path>/dev/net</unix-sys:path>
                    <unix-sys:filename>tun</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659363241</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659363241</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659363241</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">true</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252121" status="exists">
                    <unix-sys:filepath>/dev/ppp</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>ppp</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252120" status="exists">
                    <unix-sys:filepath>/dev/uinput</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>uinput</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362935</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362935</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362935</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:sysctl_item id="10425212" status="exists">
                    <unix-sys:name>crypto.fips_enabled</unix-sys:name>
                    <unix-sys:value>0</unix-sys:value>
                  </unix-sys:sysctl_item>
                  <unix-sys:file_item id="104252119" status="exists">
                    <unix-sys:filepath>/dev/vfio/vfio</unix-sys:filepath>
                    <unix-sys:path>/dev/vfio</unix-sys:path>
                    <unix-sys:filename>vfio</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659363241</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659363241</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659363241</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">true</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252118" status="exists">
                    <unix-sys:filepath>/dev/vhci</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vhci</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362924</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362924</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362924</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252117" status="exists">
                    <unix-sys:filepath>/dev/vhost-net</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vhost-net</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">36</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659363241</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659363241</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659363241</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">true</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252116" status="exists">
                    <unix-sys:filepath>/dev/vhost-vsock</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vhost-vsock</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">36</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659363241</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659363241</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659363241</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">true</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252115" status="exists">
                    <unix-sys:filepath>/dev/snd/timer</unix-sys:filepath>
                    <unix-sys:path>/dev/snd</unix-sys:path>
                    <unix-sys:filename>timer</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">63</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659363241</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659363241</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659363241</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">true</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252114" status="exists">
                    <unix-sys:filepath>/dev/snd/seq</unix-sys:filepath>
                    <unix-sys:path>/dev/snd</unix-sys:path>
                    <unix-sys:filename>seq</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">63</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659363241</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659363241</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659363241</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">true</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252113" status="exists">
                    <unix-sys:filepath>/dev/snd/pcmC0D0p</unix-sys:filepath>
                    <unix-sys:path>/dev/snd</unix-sys:path>
                    <unix-sys:filename>pcmC0D0p</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">63</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659363181</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659363181</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">true</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252112" status="exists">
                    <unix-sys:filepath>/dev/snd/pcmC0D0c</unix-sys:filepath>
                    <unix-sys:path>/dev/snd</unix-sys:path>
                    <unix-sys:filename>pcmC0D0c</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">63</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659363085</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659363085</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">true</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252111" status="exists">
                    <unix-sys:filepath>/dev/snd/hwC0D0</unix-sys:filepath>
                    <unix-sys:path>/dev/snd</unix-sys:path>
                    <unix-sys:filename>hwC0D0</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">63</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659363084</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">true</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252110" status="exists">
                    <unix-sys:filepath>/dev/snd/controlC0</unix-sys:filepath>
                    <unix-sys:path>/dev/snd</unix-sys:path>
                    <unix-sys:filename>controlC0</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">63</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659363084</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">true</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252109" status="exists">
                    <unix-sys:filepath>/dev/watchdog</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>watchdog</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252108" status="exists">
                    <unix-sys:filepath>/dev/watchdog0</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>watchdog0</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362925</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362925</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362925</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252107" status="exists">
                    <unix-sys:filepath>/dev/kvm</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>kvm</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">36</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659363241</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659363241</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659363241</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">true</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252106" status="exists">
                    <unix-sys:filepath>/dev/vcs2</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vcs2</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362928</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362928</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362928</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252105" status="exists">
                    <unix-sys:filepath>/dev/vcsu2</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vcsu2</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362928</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362928</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362928</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252104" status="exists">
                    <unix-sys:filepath>/dev/vcsa2</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vcsa2</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362928</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362928</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362928</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252103" status="exists">
                    <unix-sys:filepath>/dev/vcs3</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vcs3</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362928</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362928</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362928</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252102" status="exists">
                    <unix-sys:filepath>/dev/vcsu3</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vcsu3</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362928</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362928</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362928</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252101" status="exists">
                    <unix-sys:filepath>/dev/vcsa3</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vcsa3</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362928</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362928</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362928</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="104252100" status="exists">
                    <unix-sys:filepath>/dev/vcs4</unix-sys:filepath>
                    <unix-sys:path>/dev</unix-sys:path>
                    <unix-sys:filename>vcs4</unix-sys:filename>
                    <unix-sys:type>character special</unix-sys:type>
                    <unix-sys:group_id datatype="int">5</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1659362928</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1659362928</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1659362928</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                </system_data>
              </oval_system_characteristics>
            </system>
          </results>
        </oval_results>
      </arf:content>
    </arf:report>
    <arf:report id="oval1">
      <arf:content>
        <oval_results xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns="http://oval.mitre.org/XMLSchema/oval-results-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-results-5 oval-results-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
          <generator>
            <oval:product_name>combine_ovals.py from SCAP Security Guide</oval:product_name>
            <oval:product_version>1.3.6</oval:product_version>
            <oval:schema_version>5.11</oval:schema_version>
            <oval:timestamp>2022-08-01T16:21:58</oval:timestamp>
          </generator>
          <directives>
            <definition_true reported="true" content="full"/>
            <definition_false reported="true" content="full"/>
            <definition_unknown reported="true" content="full"/>
            <definition_error reported="true" content="full"/>
            <definition_not_evaluated reported="true" content="full"/>
            <definition_not_applicable reported="true" content="full"/>
          </directives>
          <oval_definitions xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:win-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" xmlns:mac-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#windows windows-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#macos macos-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
            <generator>
              <oval:product_name>combine_ovals.py from SCAP Security Guide</oval:product_name>
              <oval:product_version>ssg: [0, 1, 62], python: 3.11.0b4</oval:product_version>
              <oval:schema_version>5.11</oval:schema_version>
              <oval:timestamp>2022-07-23T00:00:00</oval:timestamp>
            </generator>
            <definitions>
              <definition id="oval:ssg-system_boot_mode_is_uefi:def:1" version="1" class="inventory">
                <metadata>
                  <title>UEFI system boot mode check</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:uefi"/>
                  <description>Check if system boot mode is UEFI.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_efi_dir_existence:tst:1" comment="check if /sys/firmware/efi folder exists"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-system_boot_mode_is_non_uefi:def:1" version="1" class="inventory">
                <metadata>
                  <title>Non-UEFI system boot mode check</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:non-uefi"/>
                  <description>Check if System boot mode is non-UEFI.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-system_boot_mode_is_uefi:def:1" negate="true" comment="Pass if System boot mode is non-UEFI"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sssd_conf_uses_ldap:def:1" version="1" class="inventory">
                <metadata>
                  <title>SSSD is configured to use LDAP</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:sssd-ldap"/>
                  <description>Identification provider is not set to ad within /etc/sssd/sssd.conf</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_id_provider_is_set_to_ad:tst:1" negate="true" comment="Identification provider is not set to ad within /etc/sssd/sssd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" version="1" class="inventory">
                <metadata>
                  <title>Test that the architecture is s390x</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <description>Check that architecture of kernel in /proc/sys/kernel/osrelease is s390x</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1" comment="Architecture is s390x"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-proc_sys_kernel_osrelease_arch_not_s390x:def:1" version="1" class="inventory">
                <metadata>
                  <title>Test for different architecture than s390x</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <description>Check that architecture of kernel in /proc/sys/kernel/osrelease is not s390x</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" negate="true" comment="Architecture is not s390x"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-proc_sys_kernel_osrelease_arch_not_aarch64:def:1" version="1" class="inventory">
                <metadata>
                  <title>Test for different architecture than aarch64</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <description>Check that architecture of kernel in /proc/sys/kernel/osrelease is not aarch64</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-proc_sys_kernel_osrelease_arch_aarch64:def:1" negate="true" comment="Architecture is not aarch64"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-proc_sys_kernel_osrelease_arch_aarch64:def:1" version="1" class="inventory">
                <metadata>
                  <title>Test that the architecture is aarch64</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <description>Check that architecture of kernel in /proc/sys/kernel/osrelease is aarch64</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_proc_sys_kernel_osrelease_arch_aarch64:tst:1" comment="Architecture is aarch64"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_is_a_machine:def:1" version="2" class="inventory">
                <metadata>
                  <title>Check if the scan target is a machine</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:machine"/>
                  <description>Check for absence of files characterizing container filesystems.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_env_is_a_container:def:1" negate="true" comment="If environment is not a container, it is machine"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_is_a_container:def:1" version="2" class="inventory">
                <metadata>
                  <title>Check if the scan target is a container</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:container"/>
                  <description>Check for presence of files characterizing container filesystems.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_installed_env_is_a_docker_container:tst:1" comment="Check if /.dockerenv exists"/>
                  <criterion test_ref="oval:ssg-test_installed_env_is_a_podman_container:tst:1" comment="Check if /run/.containerenv exists"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_zipl_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>System uses zIPL</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:zipl"/>
                  <description>Checks if system uses zIPL bootloader.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_zipl_installed:tst:1" comment="Package s390utils-base is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_yum_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package yum is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:yum"/>
                  <description>Checks if package yum is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_yum_installed:tst:1" comment="Package yum is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_wifi_interface:def:1" version="1" class="inventory">
                <metadata>
                  <title>WiFi interface is present</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:wifi-iface"/>
                  <description>Checks if any wifi interface is present.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_proc_net_wireless_exists:tst:1" comment="WiFi interface is present"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_usbguard_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package usbguard is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:usbguard"/>
                  <description>Checks if package usbguard is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_usbguard_installed:tst:1" comment="Package usbguard is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_tftp_server_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package tftp-server is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:tftp-server"/>
                  <description>Checks if package tftp-server is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_tftp_server_installed:tst:1" comment="Package tftp-server is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_systemd_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package systemd is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:systemd"/>
                  <description>Checks if package systemd is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_systemd_installed:tst:1" comment="Package systemd is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_sudo_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package sudo is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:sudo"/>
                  <description>Checks if package sudo is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_sudo_installed:tst:1" comment="Package sudo is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_sssd-common_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package sssd-common is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:sssd"/>
                  <description>Checks if package sssd-common is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_sssd-common_installed:tst:1" comment="Package sssd-common is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_postfix_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package postfix is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:postfix"/>
                  <description>Checks if package postfix is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_postfix_installed:tst:1" comment="Package postfix is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_polkit_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package polkit is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:polkit"/>
                  <description>Checks if package polkit is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_polkit_installed:tst:1" comment="Package polkit is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_pam_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package pam is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:pam"/>
                  <description>Checks if package pam is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_pam_installed:tst:1" comment="Package pam is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_ovirt:def:1" version="1" class="inventory">
                <metadata>
                  <title>Check if the system acts as an oVirt host or manager</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:ovirt-host"/>
                  <description>Check if the system has ovirt-host or ovirt-engine installed</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_env_has_ovirt-host_installed:tst:1" comment="Package ovirt-host is installed"/>
                  <criterion test_ref="oval:ssg-test_env_has_ovirt-engine_installed:tst:1" comment="Package ovirt-engine is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_ntp_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package ntp is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:ntp"/>
                  <description>Checks if package ntp is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_ntp_installed:tst:1" comment="Package ntp is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_nss-pam-ldapd_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package nss-pam-ldapd is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:nss-pam-ldapd"/>
                  <description>Checks if package nss-pam-ldapd is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_nss-pam-ldapd_installed:tst:1" comment="Package nss-pam-ldapd is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_no_ovirt:def:1" version="1" class="inventory">
                <metadata>
                  <title>Check if the system doesn't act as an oVirt host or manager</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <description>Check if the system has neither ovirt-host nor ovirt-engine installed.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_env_has_ovirt:def:1" negate="true" comment="Package ovirt-host is not installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_net-snmp_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package net-snmp is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:net-snmp"/>
                  <description>Checks if package net-snmp is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_net-snmp_installed:tst:1" comment="Package net-snmp is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_login_defs:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package providing /etc/login.defs is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:login_defs"/>
                  <description>Checks if package providing /etc/login.defs and is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_login_defs_installed:tst:1" comment="Package providing /etc/login.defs is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_libuser_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package libuser is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:libuser"/>
                  <description>Checks if package libuser is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_libuser_installed:tst:1" comment="Package libuser is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_grub2_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package grub2 is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:grub2"/>
                  <description>Checks if package grub2-common is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_grub2_installed:tst:1" comment="Package grub2-common is installed"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" negate="true" comment="Test for ppcle64 architecture"/>
                    <criterion test_ref="oval:ssg-test_system_using_opal:tst:1" negate="true" comment="Test if OPAL is not used"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_gdm_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package gdm is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:gdm"/>
                  <description>Checks if package gdm is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_gdm_installed:tst:1" comment="Package gdm is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_chrony_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package chrony is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:chrony"/>
                  <description>Checks if package chrony is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_chrony_installed:tst:1" comment="Package chrony is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_audit_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package audit is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:audit"/>
                  <description>Checks if package audit is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_audit_installed:tst:1" comment="Package audit is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_app_is_rhv4:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Virtualization 4</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:redhat:virtualization:4"/>
                  <description>The application installed installed on the system is
      Red Hat Virtualization 4.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel7:def:1" comment="RHEL7 OS installed"/>
                  <criterion test_ref="oval:ssg-test_rhevm4_version:tst:1" comment="Red Hat Virtualization Manager (RHVM)"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_wrlinux8:def:1" version="1" class="inventory">
                <metadata>
                  <title>WRLinux 8</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:windriver:wrlinux"/>
                  <description>The operating system installed on the system is
      Wind River Linux 8</description>
                </metadata>
                <criteria comment="current WRLinux version is WRLinux8">
                  <criterion test_ref="oval:ssg-test_unix_wrlinux8:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criterion test_ref="oval:ssg-test_wrlinux8_version:tst:1" comment="WRLinux 8 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_wrlinux1019:def:1" version="1" class="inventory">
                <metadata>
                  <title>WRLinux 1019</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:windriver:wrlinux"/>
                  <description>The operating system installed on the system is
      Wind River Linux 1019</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_unix_wrlinux1019:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criterion test_ref="oval:ssg-test_wrlinux1019_name:tst:1" comment="Produce name is WRLinux"/>
                  <criterion test_ref="oval:ssg-test_wrlinux1019_version:tst:1" comment="WRLinux version is 1019"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ubuntu:def:1" version="1" class="inventory">
                <metadata>
                  <title>Ubuntu</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <description>The operating system installed is an Ubuntu System</description>
                </metadata>
                <criteria comment="System is Ubuntu">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_lsb:tst:1" comment="lsb-based distrib"/>
                  <criterion test_ref="oval:ssg-test_ubuntu:tst:1" comment="Ubuntu is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ubuntu2004:def:1" version="1" class="inventory">
                <metadata>
                  <title>Ubuntu 2004</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:canonical:ubuntu_linux:20.04"/>
                  <description>The operating system installed on the system is Ubuntu 2004</description>
                </metadata>
                <criteria comment="current Ubuntu version is Focal">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1" comment="Ubuntu is installed"/>
                  <criterion test_ref="oval:ssg-test_ubuntu_focal:tst:1" comment="Focal is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ubuntu1804:def:1" version="1" class="inventory">
                <metadata>
                  <title>Ubuntu 1804</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:canonical:ubuntu_linux:18.04"/>
                  <description>The operating system installed on the system is Ubuntu 1804</description>
                </metadata>
                <criteria comment="current Ubuntu version is Bionic">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1" comment="Ubuntu is installed"/>
                  <criterion test_ref="oval:ssg-test_ubuntu_bionic:tst:1" comment="Bionic is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ubuntu1604:def:1" version="1" class="inventory">
                <metadata>
                  <title>Ubuntu 1604</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:canonical:ubuntu_linux:16.04"/>
                  <description>The operating system installed on the system is Ubuntu 1604</description>
                </metadata>
                <criteria comment="current Ubuntu version is Xenial">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1" comment="Ubuntu is installed"/>
                  <criterion test_ref="oval:ssg-test_ubuntu_xenial:tst:1" comment="Xenial is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_sle15:def:1" version="1" class="inventory">
                <metadata>
                  <title>SUSE Linux Enterprise 15</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:suse:linux_enterprise_server:15"/>
                  <reference source="CPE" ref_id="cpe:/o:suse:linux_enterprise_desktop:15"/>
                  <description>The operating system installed on the system is
      SUSE Linux Enterprise 15.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sle15_unix_family:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_sle15_desktop:tst:1" comment="SLE 15 Desktop is installed"/>
                    <criterion test_ref="oval:ssg-test_sle15_server:tst:1" comment="SLE 15 Server is installed"/>
                    <criterion test_ref="oval:ssg-test_sles_15_for_sap:tst:1" comment="SLES 15 for SAP Applications is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_sle12:def:1" version="1" class="inventory">
                <metadata>
                  <title>SUSE Linux Enterprise 12</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:suse:linux_enterprise_server:12"/>
                  <reference source="CPE" ref_id="cpe:/o:suse:linux_enterprise_desktop:12"/>
                  <description>The operating system installed on the system is
      SUSE Linux Enterprise 12.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sle12_unix_family:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_sle12_desktop:tst:1" comment="SLE 12 Desktop is installed"/>
                    <criterion test_ref="oval:ssg-test_sle12_server:tst:1" comment="SLE 12 Server is installed"/>
                    <criterion test_ref="oval:ssg-test_sles_12_for_sap:tst:1" comment="SLES 12 for SAP Applications is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_sl7:def:1" version="2" class="inventory">
                <metadata>
                  <title>Scientific Linux 7</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:scientificlinux:scientificlinux:7"/>
                  <description>The operating system installed on the system is
      Scientific Linux 7</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_sl7:tst:1" comment="Scientific Linux 7 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_sl6:def:1" version="2" class="inventory">
                <metadata>
                  <title>Scientific Linux 6</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:scientificlinux:scientificlinux:6"/>
                  <description>The operating system installed on the system is
      Scientific Linux 6</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_sl6:tst:1" comment="Scientific Linux 6 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhv4:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Virtualization 4</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:virtualization:4"/>
                  <description>The operating system installed on the system is
      Red Hat Virtualization Host 4.4+ or Red Hat Enterprise Host.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel8:def:1" comment="RHEL8 OS installed"/>
                  <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" comment="Red Hat Virtualization Host (RHVH)"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel9:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 9</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:9"/>
                  <description>The operating system installed on the system is
      Red Hat Enterprise Linux 9</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel9_unix_family:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_rhel9:tst:1" comment="RHEL 9 is installed"/>
                    <criteria comment="Red Hat Enterprise Virtualization Host is installed">
                      <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" comment="Red Hat Virtualization Host (RHVH)"/>
                      <criterion test_ref="oval:ssg-test_rhevh_rhel9_version:tst:1" comment="Red Hat Enterprise Virtualization Host is based on RHEL 9"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_9:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.9</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.9"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.9</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_9:tst:1" comment="RHEL 8.9 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_8:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.8</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.8"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.8</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_8:tst:1" comment="RHEL 8.8 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_7:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.7</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.7"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.7</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_7:tst:1" comment="RHEL 8.7 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_6:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.6</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.6"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.6</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_6:tst:1" comment="RHEL 8.6 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_5:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.5</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.5"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.5</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_5:tst:1" comment="RHEL 8.5 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_4:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.4</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.4"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.4</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_4:tst:1" comment="RHEL 8.4 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_3:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.3</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.3"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.3</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_3:tst:1" comment="RHEL 8.3 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_2:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.2</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.2"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.2</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_2:tst:1" comment="RHEL 8.2 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_1:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.1</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.1"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.1</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_1:tst:1" comment="RHEL 8.1 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_10:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.10</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.10"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.10</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_10:tst:1" comment="RHEL 8.10 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_0:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.0</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.0"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.0</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_0:tst:1" comment="RHEL 8.0 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8"/>
                  <description>The operating system installed on the system is
      Red Hat Enterprise Linux 8</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_unix_family:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_rhel8:tst:1" comment="RHEL 8 is installed"/>
                    <criteria comment="Red Hat Enterprise Virtualization Host is installed">
                      <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" comment="Red Hat Virtualization Host (RHVH)"/>
                      <criterion test_ref="oval:ssg-test_rhevh_rhel8_version:tst:1" comment="Red Hat Enterprise Virtualization Host is based on RHEL 8"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel7:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 7</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:7"/>
                  <description>The operating system installed on the system is
      Red Hat Enterprise Linux 7</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel7_unix_family:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_rhel7_client:tst:1" comment="RHEL 7 Client is installed"/>
                    <criterion test_ref="oval:ssg-test_rhel7_workstation:tst:1" comment="RHEL 7 Workstation is installed"/>
                    <criterion test_ref="oval:ssg-test_rhel7_server:tst:1" comment="RHEL 7 Server is installed"/>
                    <criterion test_ref="oval:ssg-test_rhel7_computenode:tst:1" comment="RHEL 7 Compute Node is installed"/>
                    <criteria comment="Red Hat Enterprise Virtualization Host is installed">
                      <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" comment="Red Hat Virtualization Host (RHVH)"/>
                      <criterion test_ref="oval:ssg-test_rhevh_rhel7_version:tst:1" comment="Red Hat Enterprise Virtualization Host is based on RHEL 7"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhcos4:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux CoreOS</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux_coreos:4"/>
                  <description>The operating system installed on the system is
      Red Hat Enterprise Linux CoreOS release 4</description>
                </metadata>
                <criteria>
                  <criteria>
                    <criterion test_ref="oval:ssg-test_rhcos:tst:1" comment="RHCOS is installed"/>
                    <criterion test_ref="oval:ssg-test_rhcos4:tst:1" comment="RHCOS version 4 is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" class="inventory">
                <metadata>
                  <title>Installed operating system is part of the Unix family</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <description>The operating system installed on the system is part of the Unix OS family</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_unix_family:tst:1" comment="Installed operating system is part of the unix family"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_opensuse_leap42:def:1" version="1" class="inventory">
                <metadata>
                  <title>openSUSE Leap 42</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:leap:42.1"/>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:leap:42.2"/>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:leap:42.3"/>
                  <description>The operating system installed on the system is openSUSE Leap 42.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_opensuse:def:1" comment="openSUSE is installed"/>
                  <criterion test_ref="oval:ssg-test_opensuse_leap42_installed:tst:1" comment="openSUSE Leap 42 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_opensuse_leap15:def:1" version="1" class="inventory">
                <metadata>
                  <title>openSUSE Leap 15</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:leap:15.0"/>
                  <description>The operating system installed on the system is openSUSE Leap 15.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_opensuse:def:1" comment="openSUSE is installed"/>
                  <criterion test_ref="oval:ssg-test_opensuse_leap15_installed:tst:1" comment="openSUSE Leap 15 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_opensuse:def:1" version="1" class="inventory">
                <metadata>
                  <title>openSUSE</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <description>The operating system installed on the system is openSUSE.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_opensuse_installed:tst:1" comment="openSUSE is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ol9_family:def:1" version="1" class="inventory">
                <metadata>
                  <title>Oracle Linux 9</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:oracle:linux:9"/>
                  <description>The operating system installed on the system is
      Oracle Linux 9</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_ol9_system:tst:1" comment="Oracle Linux 9 System is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ol8_family:def:1" version="1" class="inventory">
                <metadata>
                  <title>Oracle Linux 8</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:oracle:linux:8"/>
                  <description>The operating system installed on the system is
      Oracle Linux 8</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_ol8_system:tst:1" comment="Oracle Linux 8 System is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ol7_family:def:1" version="1" class="inventory">
                <metadata>
                  <title>Oracle Linux 7</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:oracle:linux:7"/>
                  <description>The operating system installed on the system is
      Oracle Linux 7</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_ol7_system:tst:1" comment="Oracle Linux 7 System is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_fedora:def:1" version="3" class="inventory">
                <metadata>
                  <title>Installed operating system is Fedora</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:33"/>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:34"/>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:35"/>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:36"/>
                  <description>The operating system installed on the system is Fedora</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_fedora_release_rpm:tst:1" comment="fedora-release RPM packages are installed"/>
                  <criterion test_ref="oval:ssg-test_fedora_vendor_product:tst:1" comment="CPE vendor is 'fedoraproject' and product is 'fedora'"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_debian:def:1" version="1" class="inventory">
                <metadata>
                  <title>Debian</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <description>The operating system installed is a Debian System</description>
                </metadata>
                <criteria comment="System is Debian">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_debian:tst:1" comment="Debian is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_debian9:def:1" version="3" class="inventory">
                <metadata>
                  <title>Debian 9</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:debian:debian_linux:9"/>
                  <description>The operating system installed on the system is Debian 9</description>
                </metadata>
                <criteria comment="current Debian version is Debian Stretch">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_debian:def:1" comment="Debian is installed"/>
                  <criterion test_ref="oval:ssg-test_debian_9:tst:1" comment="Debian9 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_debian11:def:1" version="3" class="inventory">
                <metadata>
                  <title>Debian Linux 11</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:debian:debian_linux:11"/>
                  <description>The operating system installed on the system is Debian 11</description>
                </metadata>
                <criteria comment="Debian Linux is version 11">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_debian:def:1" comment="Debian is installed"/>
                  <criterion test_ref="oval:ssg-test_debian_11:tst:1" comment="Debian11 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_debian10:def:1" version="3" class="inventory">
                <metadata>
                  <title>Debian Linux 10</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:debian:debian_linux:10"/>
                  <description>The operating system installed on the system is Debian 10</description>
                </metadata>
                <criteria comment="Debian Linux is version 10">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_debian:def:1" comment="Debian is installed"/>
                  <criterion test_ref="oval:ssg-test_debian_10:tst:1" comment="Debian10 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_centos9:def:1" version="2" class="inventory">
                <metadata>
                  <title>CentOS Stream 9</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:centos:centos:9"/>
                  <description>The operating system installed on the system is
      CentOS Stream 9</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_centos9_name:tst:1" comment="OS is CentOS Stream"/>
                  <criterion test_ref="oval:ssg-test_centos9_version:tst:1" comment="OS version is 9"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_centos8:def:1" version="2" class="inventory">
                <metadata>
                  <title>CentOS 8</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:centos:centos:8"/>
                  <description>The operating system installed on the system is
      CentOS 8</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_centos8_name:tst:1" comment="OS is CentOS"/>
                  <criterion test_ref="oval:ssg-test_centos8_version:tst:1" comment="OS version is 8"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_centos7:def:1" version="2" class="inventory">
                <metadata>
                  <title>CentOS 7</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:centos:centos:7"/>
                  <description>The operating system installed on the system is
      CentOS 7</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_centos7:tst:1" comment="CentOS7 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_centos6:def:1" version="2" class="inventory">
                <metadata>
                  <title>CentOS 6</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:centos:centos:6"/>
                  <description>The operating system installed on the system is
      CentOS 6</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_centos6:tst:1" comment="CentOS6 is installed"/>
                </criteria>
              </definition>
            </definitions>
            <tests>
              <ind-def:textfilecontent54_test id="oval:ssg-test_wrlinux8_version:tst:1" version="1" check="all" comment="Check WRLinux8 version">
                <ind-def:object object_ref="oval:ssg-obj_version_wrlinux8:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_wrlinux1019_version:tst:1" version="1" check="all" comment="Check WRLinux10.19 version">
                <ind-def:object object_ref="oval:ssg-obj_version_wrlinux1019:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_wrlinux1019_name:tst:1" version="1" check="all" comment="Check WRLinux10.19 version">
                <ind-def:object object_ref="oval:ssg-obj_name_wrlinux1019:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:family_test id="oval:ssg-test_unix_wrlinux8:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_unix_wrlinux8:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_unix_wrlinux8:ste:1"/>
              </ind-def:family_test>
              <ind-def:family_test id="oval:ssg-test_unix_wrlinux1019:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_unix_wrlinux1019:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_unix_wrlinux1019:ste:1"/>
              </ind-def:family_test>
              <ind-def:family_test id="oval:ssg-test_unix_family:tst:1" version="1" check="all" comment="Test installed OS is part of the unix family">
                <ind-def:object object_ref="oval:ssg-object_unix_family:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_unix_family:ste:1"/>
              </ind-def:family_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ubuntu_xenial:tst:1" version="1" check="all" comment="Check Ubuntu version">
                <ind-def:object object_ref="oval:ssg-obj_ubuntu_xenial:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ubuntu_focal:tst:1" version="1" check="all" comment="Check Ubuntu version">
                <ind-def:object object_ref="oval:ssg-obj_ubuntu_focal:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ubuntu_bionic:tst:1" version="1" check="all" comment="Check Ubuntu version">
                <ind-def:object object_ref="oval:ssg-obj_ubuntu_bionic:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ubuntu:tst:1" version="1" check="all" comment="Check Ubuntu">
                <ind-def:object object_ref="oval:ssg-obj_ubuntu:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_system_using_opal:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if /sys/firmware/opal exists">
                <unix-def:object object_ref="oval:ssg-object_system_using_opal:obj:1"/>
              </unix-def:file_test>
              <unix-def:uname_test id="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" version="1" check="all" comment="64 bit architecture">
                <unix-def:object object_ref="oval:ssg-object_system_info_architecture_ppcle_64:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_system_info_architecture_ppcle_64:ste:1"/>
              </unix-def:uname_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sles_15_for_sap:tst:1" version="1" check="all" comment="SLES_SAP-release is version 15">
                <lin-def:object object_ref="oval:ssg-obj_sles_15_for_sap:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sles_15_for_sap:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sles_12_for_sap:tst:1" version="1" check="all" comment="SLES_SAP-release is version 12">
                <lin-def:object object_ref="oval:ssg-obj_sles_12_for_sap:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sles_12_for_sap:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:family_test id="oval:ssg-test_sle15_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_sle15_unix_family:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sle15_unix_family:ste:1"/>
              </ind-def:family_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sle15_server:tst:1" version="1" check="all" comment="sles-release is version 15">
                <lin-def:object object_ref="oval:ssg-obj_sle15_server:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sle15_server:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sle15_desktop:tst:1" version="1" check="all" comment="sled-release is version 15">
                <lin-def:object object_ref="oval:ssg-obj_sle15_desktop:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sle15_desktop:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:family_test id="oval:ssg-test_sle12_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_sle12_unix_family:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sle12_unix_family:ste:1"/>
              </ind-def:family_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sle12_server:tst:1" version="1" check="all" comment="sles-release is version 6">
                <lin-def:object object_ref="oval:ssg-obj_sle12_server:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sle12_server:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sle12_desktop:tst:1" version="1" check="all" comment="sled-release is version 6">
                <lin-def:object object_ref="oval:ssg-obj_sle12_desktop:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sle12_desktop:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sl7:tst:1" version="1" check="all" comment="sl-release is version 7">
                <lin-def:object object_ref="oval:ssg-obj_sl7:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sl7:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sl6:tst:1" version="1" check="all" comment="sl-release is version 6">
                <lin-def:object object_ref="oval:ssg-obj_sl6:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sl6:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhvh4_version:tst:1" version="1" check_existence="only_one_exists" check="all" comment="redhat-release-virtualization-host RPM package is installed">
                <lin-def:object object_ref="oval:ssg-obj_rhvh4_version:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhvh4_version:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhevm4_version:tst:1" version="1" check="all" comment="rhevm4-appliance is installed">
                <lin-def:object object_ref="oval:ssg-obj_rhevm4_version:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhevm4_version:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rhevh_rhel9_version:tst:1" version="1" check="all" comment="RHEVH base RHEL is version 9">
                <ind-def:object object_ref="oval:ssg-obj_rhevh_rhel9_version:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhevh_rhel9_version:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rhevh_rhel8_version:tst:1" version="1" check="all" comment="RHEVH base RHEL is version 8">
                <ind-def:object object_ref="oval:ssg-obj_rhevh_rhel8_version:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhevh_rhel8_version:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rhevh_rhel7_version:tst:1" version="1" check="all" comment="RHEVH base RHEL is version 7">
                <ind-def:object object_ref="oval:ssg-obj_rhevh_rhel7_version:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhevh_rhel7_version:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:family_test id="oval:ssg-test_rhel9_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_rhel9_unix_family:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhel9_unix_family:ste:1"/>
              </ind-def:family_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel9:tst:1" version="1" check="all" comment="redhat-release is version 9">
                <lin-def:object object_ref="oval:ssg-obj_rhel9:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel9:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:family_test id="oval:ssg-test_rhel8_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_rhel8_unix_family:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhel8_unix_family:ste:1"/>
              </ind-def:family_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_9:tst:1" version="1" check="all" comment="redhat-release is version 8.9">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_9:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_9:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_8:tst:1" version="1" check="all" comment="redhat-release is version 8.8">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_8:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_8:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_7:tst:1" version="1" check="all" comment="redhat-release is version 8.7">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_7:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_7:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_6:tst:1" version="1" check="all" comment="redhat-release is version 8.6">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_6:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_6:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_5:tst:1" version="1" check="all" comment="redhat-release is version 8.5">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_5:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_5:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_4:tst:1" version="1" check="all" comment="redhat-release is version 8.4">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_4:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_4:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_3:tst:1" version="1" check="all" comment="redhat-release is version 8.3">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_3:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_3:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_2:tst:1" version="1" check="all" comment="redhat-release is version 8.2">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_2:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_2:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_1:tst:1" version="1" check="all" comment="redhat-release is version 8.1">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_1:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_1:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_10:tst:1" version="1" check="all" comment="redhat-release is version 8.10">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_10:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_10:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_0:tst:1" version="1" check="all" comment="redhat-release is version 8.0">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_0:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_0:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8:tst:1" version="1" check="all" comment="redhat-release is version 8">
                <lin-def:object object_ref="oval:ssg-obj_rhel8:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel7_workstation:tst:1" version="1" check="all" comment="redhat-release-workstation is version 7">
                <lin-def:object object_ref="oval:ssg-obj_rhel7_workstation:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel7_workstation:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:family_test id="oval:ssg-test_rhel7_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_rhel7_unix_family:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhel7_unix_family:ste:1"/>
              </ind-def:family_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel7_server:tst:1" version="1" check="all" comment="redhat-release-server is version 7">
                <lin-def:object object_ref="oval:ssg-obj_rhel7_server:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel7_server:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel7_computenode:tst:1" version="1" check="all" comment="redhat-release-computenode is version 7">
                <lin-def:object object_ref="oval:ssg-obj_rhel7_computenode:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel7_computenode:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel7_client:tst:1" version="1" check="all" comment="redhat-release-client is version 7">
                <lin-def:object object_ref="oval:ssg-obj_rhel7_client:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel7_client:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rhcos:tst:1" version="1" check="all" comment="os-release is rhcos">
                <ind-def:object object_ref="oval:ssg-obj_rhcos:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhcos:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rhcos4:tst:1" version="1" check="all" comment="rhcoreos is version 4">
                <ind-def:object object_ref="oval:ssg-obj_rhcos4:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhcos4:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1" version="1" check_existence="all_exist" check="all" comment="proc_sys_kernel is for s390x architecture">
                <ind-def:object object_ref="oval:ssg-object_proc_sys_kernel_osrelease_arch_s390x:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_proc_sys_kernel_osrelease_arch_s390x:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_proc_sys_kernel_osrelease_arch_aarch64:tst:1" version="1" check_existence="all_exist" check="all" comment="proc_sys_kernel is for aarch64 architecture">
                <ind-def:object object_ref="oval:ssg-object_proc_sys_kernel_osrelease_arch_aarch64:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_proc_sys_kernel_osrelease_arch_aarch64:ste:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_proc_net_wireless_exists:tst:1" version="1" check_existence="all_exist" check="all" comment="Test if /proc/net/wireless exists">
                <unix-def:object object_ref="oval:ssg-object_proc_net_wireless_exists:obj:1"/>
              </unix-def:file_test>
              <lin-def:rpminfo_test id="oval:ssg-test_opensuse_leap42_installed:tst:1" version="1" check="all" comment="openSUSE Leap 42 is installed">
                <lin-def:object object_ref="oval:ssg-obj_opensuse_leap42_installed:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_opensuse_leap42_installed:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_opensuse_leap15_installed:tst:1" version="1" check="all" comment="openSUSE Leap 15 is installed">
                <lin-def:object object_ref="oval:ssg-obj_opensuse_leap15_installed:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_opensuse_leap15_installed:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_opensuse_installed:tst:1" version="1" check="all" comment="openSUSE is installed">
                <lin-def:object object_ref="oval:ssg-obj_opensuse_installed:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_opensuse_installed:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_ol9_system:tst:1" version="1" check="all" comment="oraclelinux-release is version 9">
                <lin-def:object object_ref="oval:ssg-obj_ol9_system:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_ol9_system:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_ol8_system:tst:1" version="1" check="all" comment="oraclelinux-release is version 8">
                <lin-def:object object_ref="oval:ssg-obj_ol8_system:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_ol8_system:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_ol7_system:tst:1" version="1" check="all" comment="oraclelinux-release is version 7">
                <lin-def:object object_ref="oval:ssg-obj_ol7_system:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_ol7_system:ste:1"/>
              </lin-def:rpminfo_test>
              <unix-def:file_test id="oval:ssg-test_lsb:tst:1" version="1" check_existence="all_exist" check="all" comment="/etc/lsb-release exists">
                <unix-def:object object_ref="oval:ssg-obj_lsb:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_installed_env_is_a_podman_container:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if /run/.containerenv exists">
                <unix-def:object object_ref="oval:ssg-object_installed_env_is_a_podman_container:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_installed_env_is_a_docker_container:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if /.dockerenv exists">
                <unix-def:object object_ref="oval:ssg-object_installed_env_is_a_docker_container:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_id_provider_is_set_to_ad:tst:1" version="1" check_existence="all_exist" check="all" comment="SSSD Configuration is set to use Active Directory">
                <ind-def:object object_ref="oval:ssg-object_id_provider_is_set_to_ad:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_fedora_vendor_product:tst:1" version="1" check="all" comment="CPE vendor is 'fedoraproject' and 'product' is fedora">
                <ind-def:object object_ref="oval:ssg-object_fedora_vendor_product:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpminfo_test id="oval:ssg-test_fedora_release_rpm:tst:1" version="1" check="all" comment="fedora-release RPM packages are installed">
                <lin-def:object object_ref="oval:ssg-object_fedora_release_rpm:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_zipl_installed:tst:1" version="1" check="all" comment="system has package zipl installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_zipl_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_yum_installed:tst:1" version="1" check="all" comment="system has package yum installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_yum_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_usbguard_installed:tst:1" version="1" check="all" comment="system has package usbguard installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_usbguard_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_tftp_server_installed:tst:1" version="1" check="all" comment="system has package tftp-server installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_tftp_server_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_systemd_installed:tst:1" version="1" check="all" comment="system has package systemd installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_systemd_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_sudo_installed:tst:1" version="1" check="all" comment="system has package sudo installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_sudo_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_sssd-common_installed:tst:1" version="1" check="all" comment="system has package sssd-common installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_sssd-common_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_postfix_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package postfix is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_env_has_postfix_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_polkit_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package polkit is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_env_has_polkit_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_pam_installed:tst:1" version="1" check="all" comment="system has package pam installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_pam_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_ovirt-host_installed:tst:1" version="1" check="all" comment="system has package ovirt-host installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_ovirt-host_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_ovirt-engine_installed:tst:1" version="1" check="all" comment="system has package ovirt-engine installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_ovirt-engine_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_ntp_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package ntp is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_env_has_ntp_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_nss-pam-ldapd_installed:tst:1" version="1" check="all" comment="system has package nss-pam-ldapd installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_nss-pam-ldapd_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_net-snmp_installed:tst:1" version="1" check="all" comment="system has package net-snmp installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_net-snmp_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_login_defs_installed:tst:1" version="1" check="all" comment="system has package shadow-utils installed, which provides the /etc/login.defs file.">
                <lin-def:object object_ref="oval:ssg-obj_env_has_login_defs_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_libuser_installed:tst:1" version="1" check="all" comment="system has package libuser installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_libuser_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_grub2_installed:tst:1" version="1" check="all" comment="system has package grub2-common installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_grub2_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_gdm_installed:tst:1" version="1" check="all" comment="system has package gdm installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_gdm_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_chrony_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package chrony is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_env_has_chrony_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_audit_installed:tst:1" version="1" check="all" comment="system has package audit installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_audit_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <unix-def:file_test id="oval:ssg-test_efi_dir_existence:tst:1" version="1" check="all" comment="Verify if /sys/firmware/efi folder exists">
                <unix-def:object object_ref="oval:ssg-object_file_sys_firmware_efi:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_debian_9:tst:1" version="1" check="all" comment="Check Debian version">
                <ind-def:object object_ref="oval:ssg-obj_debian_9:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_debian_11:tst:1" version="1" check="all" comment="Check Debian version">
                <ind-def:object object_ref="oval:ssg-obj_debian_11:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_debian_10:tst:1" version="1" check="all" comment="Check Debian version">
                <ind-def:object object_ref="oval:ssg-obj_debian_10:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_debian:tst:1" version="1" check_existence="all_exist" check="all" comment="/etc/debian_version exists">
                <unix-def:object object_ref="oval:ssg-obj_debian:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_centos9_version:tst:1" version="1" check="all" comment="Check os-release VERSION_ID">
                <ind-def:object object_ref="oval:ssg-obj_version_centos9:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_version_centos9:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_centos9_name:tst:1" version="1" check="all" comment="Check os-release ID">
                <ind-def:object object_ref="oval:ssg-obj_name_centos9:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_name_centos9:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_centos8_version:tst:1" version="1" check="all" comment="Check os-release VERSION_ID">
                <ind-def:object object_ref="oval:ssg-obj_version_centos8:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_version_centos8:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_centos8_name:tst:1" version="1" check="all" comment="Check os-release ID">
                <ind-def:object object_ref="oval:ssg-obj_name_centos8:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_name_centos8:ste:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpminfo_test id="oval:ssg-test_centos7:tst:1" version="1" check="all" comment="centos-release is version 7">
                <lin-def:object object_ref="oval:ssg-obj_centos7:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_centos7:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_centos6:tst:1" version="1" check="all" comment="centos-release is version 6">
                <lin-def:object object_ref="oval:ssg-obj_centos6:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_centos6:ste:1"/>
              </lin-def:rpminfo_test>
            </tests>
            <objects>
              <ind-def:family_object id="oval:ssg-object_unix_family:obj:1" version="1"/>
              <unix-def:file_object id="oval:ssg-object_system_using_opal:obj:1" version="1">
                <unix-def:filepath>/sys/firmware/opal</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:uname_object id="oval:ssg-object_system_info_architecture_ppcle_64:obj:1" version="1" comment="64 bit architecture"/>
              <ind-def:textfilecontent54_object id="oval:ssg-object_proc_sys_kernel_osrelease_arch_s390x:obj:1" version="1">
                <ind-def:filepath>/proc/sys/kernel/osrelease</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.*\.(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_proc_sys_kernel_osrelease_arch_aarch64:obj:1" version="1">
                <ind-def:filepath>/proc/sys/kernel/osrelease</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.*\.(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_proc_net_wireless_exists:obj:1" version="1" comment="/proc/net/wireless file">
                <unix-def:filepath>/proc/net/wireless</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_installed_env_is_a_podman_container:obj:1" version="1" comment="Check file /run/.containerenv">
                <unix-def:filepath>/run/.containerenv</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_installed_env_is_a_docker_container:obj:1" version="1" comment="Check file /.dockerenv">
                <unix-def:filepath>/.dockerenv</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_id_provider_is_set_to_ad:obj:1" version="1">
                <ind-def:filepath>/etc/sssd/sssd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*\[domain\/[^]]*]([^\n\[\]]*\n+)+?[\s]*id_provider[ \t]*=[ \t]*((?i)ad)[ \t]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_file_sys_firmware_efi:obj:1" version="1" comment="/sys/firmware/efi">
                <unix-def:path>/sys/firmware/efi</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_fedora_vendor_product:obj:1" version="1">
                <ind-def:filepath>/etc/system-release-cpe</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^cpe:\/o:fedoraproject:fedora:[\d]+$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:rpminfo_object id="oval:ssg-object_fedora_release_rpm:obj:1" version="1">
                <lin-def:name operation="pattern match">fedora-release.*</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_version_wrlinux8:obj:1" version="1" comment="Check WRLinux8 version">
                <ind-def:filepath>/etc/wrlinux-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^VERSION=.8\.0.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_version_wrlinux1019:obj:1" version="1" comment="Check WRLinux1019 version">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^VERSION=.10\.19.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_version_centos9:obj:1" version="1" comment="Check os-release VERSION_ID">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^VERSION_ID="(\d)"$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_version_centos8:obj:1" version="1" comment="Check os-release VERSION_ID">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^VERSION_ID="(\d)"$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:family_object id="oval:ssg-obj_unix_wrlinux8:obj:1" version="1"/>
              <ind-def:family_object id="oval:ssg-obj_unix_wrlinux1019:obj:1" version="1"/>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ubuntu_xenial:obj:1" version="1" comment="Check Ubuntu version">
                <ind-def:filepath>/etc/lsb-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^DISTRIB_CODENAME=xenial$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ubuntu_focal:obj:1" version="1" comment="Check Ubuntu version">
                <ind-def:filepath>/etc/lsb-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^DISTRIB_CODENAME=focal$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ubuntu_bionic:obj:1" version="1" comment="Check Ubuntu version">
                <ind-def:filepath>/etc/lsb-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^DISTRIB_CODENAME=bionic$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ubuntu:obj:1" version="1" comment="Check Ubuntu">
                <ind-def:filepath>/etc/lsb-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^DISTRIB_ID=Ubuntu$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_env_has_postfix_installed:obj:1" version="1">
                <lin-def:name>postfix</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_env_has_polkit_installed:obj:1" version="1">
                <lin-def:name>polkit</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_env_has_ntp_installed:obj:1" version="1">
                <lin-def:name>ntp</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_env_has_chrony_installed:obj:1" version="1">
                <lin-def:name>chrony</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_sles_15_for_sap:obj:1" version="1">
                <lin-def:name>SLES_SAP-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_sles_12_for_sap:obj:1" version="1">
                <lin-def:name>SLES_SAP-release</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:family_object id="oval:ssg-obj_sle15_unix_family:obj:1" version="1"/>
              <lin-def:rpminfo_object id="oval:ssg-obj_sle15_server:obj:1" version="1">
                <lin-def:name>sles-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_sle15_desktop:obj:1" version="1">
                <lin-def:name>sled-release</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:family_object id="oval:ssg-obj_sle12_unix_family:obj:1" version="1"/>
              <lin-def:rpminfo_object id="oval:ssg-obj_sle12_server:obj:1" version="1">
                <lin-def:name>sles-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_sle12_desktop:obj:1" version="1">
                <lin-def:name>sled-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_sl7:obj:1" version="1">
                <lin-def:name>sl-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_sl6:obj:1" version="1">
                <lin-def:name>sl-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhvh4_version:obj:1" version="1">
                <lin-def:name>redhat-release-virtualization-host</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhevm4_version:obj:1" version="1">
                <lin-def:name>rhvm-appliance</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel9_version:obj:1" version="1">
                <ind-def:filepath>/etc/redhat-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel8_version:obj:1" version="1">
                <ind-def:filepath>/etc/redhat-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel7_version:obj:1" version="1">
                <ind-def:filepath>/etc/redhat-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:family_object id="oval:ssg-obj_rhel9_unix_family:obj:1" version="1"/>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel9:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:family_object id="oval:ssg-obj_rhel8_unix_family:obj:1" version="1"/>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_9:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_8:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_7:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_6:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_5:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_4:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_3:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_2:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_1:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_10:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_0:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel7_workstation:obj:1" version="1">
                <lin-def:name>redhat-release-workstation</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:family_object id="oval:ssg-obj_rhel7_unix_family:obj:1" version="1"/>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel7_server:obj:1" version="1">
                <lin-def:name>redhat-release-server</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel7_computenode:obj:1" version="1">
                <lin-def:name>redhat-release-computenode</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel7_client:obj:1" version="1">
                <lin-def:name>redhat-release-client</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rhcos:obj:1" version="1">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^ID="(\w+)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rhcos4:obj:1" version="1">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^VERSION_ID="(\d)\.\d+"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_opensuse_leap42_installed:obj:1" version="1">
                <lin-def:name>openSUSE-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_opensuse_leap15_installed:obj:1" version="1">
                <lin-def:name>openSUSE-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_opensuse_installed:obj:1" version="1">
                <lin-def:name>openSUSE-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_ol9_system:obj:1" version="1">
                <lin-def:name>oraclelinux-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_ol8_system:obj:1" version="1">
                <lin-def:name>oraclelinux-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_ol7_system:obj:1" version="1">
                <lin-def:name>oraclelinux-release</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_name_wrlinux1019:obj:1" version="1" comment="Check WRLinux1019 produce name">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^NAME=.Wind[\s]+River[\s]+Linux.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_name_centos9:obj:1" version="1" comment="Check os-release ID">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^ID="(\w+)"$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_name_centos8:obj:1" version="1" comment="Check os-release ID">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^ID="(\w+)"$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_lsb:obj:1" version="1" comment="check /etc/lsb-release file">
                <unix-def:filepath>/etc/lsb-release</unix-def:filepath>
              </unix-def:file_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_zipl_installed:obj:1" version="1">
                <lin-def:name>s390utils-base</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_yum_installed:obj:1" version="1">
                <lin-def:name>yum</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_usbguard_installed:obj:1" version="1">
                <lin-def:name>usbguard</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_tftp_server_installed:obj:1" version="1">
                <lin-def:name>tftp-server</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_systemd_installed:obj:1" version="1">
                <lin-def:name>systemd</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_sudo_installed:obj:1" version="1">
                <lin-def:name>sudo</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_sssd-common_installed:obj:1" version="1">
                <lin-def:name>sssd-common</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_pam_installed:obj:1" version="1">
                <lin-def:name>pam</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_ovirt-host_installed:obj:1" version="1">
                <lin-def:name>ovirt-host</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_ovirt-engine_installed:obj:1" version="1">
                <lin-def:name>ovirt-engine</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_nss-pam-ldapd_installed:obj:1" version="1">
                <lin-def:name>nss-pam-ldapd</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_net-snmp_installed:obj:1" version="1">
                <lin-def:name>net-snmp</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_login_defs_installed:obj:1" version="1">
                <lin-def:name>shadow-utils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_libuser_installed:obj:1" version="1">
                <lin-def:name>libuser</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_grub2_installed:obj:1" version="1">
                <lin-def:name>grub2-common</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_gdm_installed:obj:1" version="1">
                <lin-def:name>gdm</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_audit_installed:obj:1" version="1">
                <lin-def:name>audit</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_debian_9:obj:1" version="1" comment="Check Debian version">
                <ind-def:filepath>/etc/debian_version</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^9.[0-9]+$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_debian_11:obj:1" version="1" comment="Check Debian version">
                <ind-def:filepath>/etc/debian_version</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^11.[0-9]+$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_debian_10:obj:1" version="1" comment="Check Debian version">
                <ind-def:filepath>/etc/debian_version</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^10.[0-9]+$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_debian:obj:1" version="1" comment="check /etc/debian_version file">
                <unix-def:filepath>/etc/debian_version</unix-def:filepath>
              </unix-def:file_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_centos7:obj:1" version="1">
                <lin-def:name>centos-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_centos6:obj:1" version="1">
                <lin-def:name>centos-release</lin-def:name>
              </lin-def:rpminfo_object>
            </objects>
            <states>
              <ind-def:textfilecontent54_state id="oval:ssg-state_version_centos9:ste:1" version="1">
                <ind-def:subexpression>9</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_version_centos8:ste:1" version="1">
                <ind-def:subexpression>8</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:family_state id="oval:ssg-state_unix_wrlinux8:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <ind-def:family_state id="oval:ssg-state_unix_wrlinux1019:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <ind-def:family_state id="oval:ssg-state_unix_family:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <unix-def:uname_state id="oval:ssg-state_system_info_architecture_ppcle_64:ste:1" version="1" comment="64 bit architecture">
                <unix-def:processor_type>ppc64le</unix-def:processor_type>
              </unix-def:uname_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sles_15_for_sap:ste:1" version="1">
                <lin-def:version operation="pattern match">^15.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sles_12_for_sap:ste:1" version="1">
                <lin-def:version operation="pattern match">^12.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:family_state id="oval:ssg-state_sle15_unix_family:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sle15_server:ste:1" version="1">
                <lin-def:version operation="pattern match">^15.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sle15_desktop:ste:1" version="1">
                <lin-def:version operation="pattern match">^15.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:family_state id="oval:ssg-state_sle12_unix_family:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sle12_server:ste:1" version="1">
                <lin-def:version operation="pattern match">^12.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sle12_desktop:ste:1" version="1">
                <lin-def:version operation="pattern match">^12.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sl7:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sl6:ste:1" version="1">
                <lin-def:version operation="pattern match">^6.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhvh4_version:ste:1" version="1">
                <lin-def:evr operation="greater than or equal" datatype="evr_string">0:4.4</lin-def:evr>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhevm4_version:ste:1" version="1">
                <lin-def:version operation="pattern match">^4.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_rhevh_rhel9_version:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">9</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_rhevh_rhel8_version:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">8</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_rhevh_rhel7_version:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">7</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:family_state id="oval:ssg-state_rhel9_unix_family:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel9:ste:1" version="1">
                <lin-def:version operation="pattern match">^9.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:family_state id="oval:ssg-state_rhel8_unix_family:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_9:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.9*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_8:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.8*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_7:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.7*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_6:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.6*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_5:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.5*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_4:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.4*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_3:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.3*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_2:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.2*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_1:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.1*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_10:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.10*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_0:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.0*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel7_workstation:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:family_state id="oval:ssg-state_rhel7_unix_family:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel7_server:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel7_computenode:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel7_client:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_rhcos:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">rhcos</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_rhcos4:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">4</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_proc_sys_kernel_osrelease_arch_s390x:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^s390x$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_proc_sys_kernel_osrelease_arch_aarch64:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^aarch64$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <lin-def:rpminfo_state id="oval:ssg-state_opensuse_leap42_installed:ste:1" version="1">
                <lin-def:version operation="pattern match">^42.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_opensuse_leap15_installed:ste:1" version="1">
                <lin-def:version operation="pattern match">^15.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_opensuse_installed:ste:1" version="1">
                <lin-def:name operation="pattern match">openSUSE-release</lin-def:name>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_ol9_system:ste:1" version="1">
                <lin-def:version operation="pattern match">^9.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_ol8_system:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_ol7_system:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_name_centos9:ste:1" version="1">
                <ind-def:subexpression>centos</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_name_centos8:ste:1" version="1">
                <ind-def:subexpression>centos</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <lin-def:rpminfo_state id="oval:ssg-state_centos7:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_centos6:ste:1" version="1">
                <lin-def:version operation="pattern match">^6.*$</lin-def:version>
              </lin-def:rpminfo_state>
            </states>
          </oval_definitions>
          <results>
            <system>
              <definitions>
                <definition definition_id="oval:ssg-system_boot_mode_is_uefi:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_efi_dir_existence:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-system_boot_mode_is_non_uefi:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <extend_definition definition_ref="oval:ssg-system_boot_mode_is_uefi:def:1" version="1" result="true" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sssd_conf_uses_ldap:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_id_provider_is_set_to_ad:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-proc_sys_kernel_osrelease_arch_not_s390x:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-proc_sys_kernel_osrelease_arch_not_aarch64:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-proc_sys_kernel_osrelease_arch_aarch64:def:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-proc_sys_kernel_osrelease_arch_aarch64:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_proc_sys_kernel_osrelease_arch_aarch64:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_is_a_machine:def:1" result="true" version="2">
                  <criteria operator="AND" result="true">
                    <extend_definition definition_ref="oval:ssg-installed_env_is_a_container:def:1" version="2" result="true" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_is_a_container:def:1" result="false" version="2">
                  <criteria operator="OR" result="false">
                    <criterion test_ref="oval:ssg-test_installed_env_is_a_docker_container:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_installed_env_is_a_podman_container:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_zipl_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_zipl_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_yum_package:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_env_has_yum_installed:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_wifi_interface:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_proc_net_wireless_exists:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_usbguard_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_usbguard_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_tftp_server_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_tftp_server_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_systemd_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_systemd_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_sudo_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_sudo_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_sssd-common_package:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_env_has_sssd-common_installed:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_postfix_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_postfix_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_polkit_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_polkit_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_pam_package:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_env_has_pam_installed:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_ovirt:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_ovirt-host_installed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_env_has_ovirt-engine_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_ntp_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_ntp_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_nss-pam-ldapd_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_nss-pam-ldapd_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_no_ovirt:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_env_has_ovirt:def:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_net-snmp_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_net-snmp_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_login_defs:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_env_has_login_defs_installed:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_libuser_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_libuser_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_grub2_package:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_env_has_grub2_installed:tst:1" version="1" result="true"/>
                    <criteria operator="OR" result="true">
                      <criterion test_ref="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" version="1" result="true" negate="true"/>
                      <criterion test_ref="oval:ssg-test_system_using_opal:tst:1" version="1" result="true" negate="true"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_gdm_package:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_env_has_gdm_installed:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_chrony_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_chrony_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_audit_package:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_env_has_audit_installed:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_app_is_rhv4:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel7:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_rhevm4_version:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_wrlinux8:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_unix_wrlinux8:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_wrlinux8_version:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_wrlinux1019:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_unix_wrlinux1019:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_wrlinux1019_name:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_wrlinux1019_version:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ubuntu:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_lsb:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ubuntu:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ubuntu2004:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ubuntu_focal:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ubuntu1804:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ubuntu_bionic:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ubuntu1604:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ubuntu_xenial:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_sle15:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sle15_unix_family:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_sle15_desktop:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_sle15_server:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_sles_15_for_sap:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_sle12:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sle12_unix_family:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_sle12_desktop:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_sle12_server:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_sles_12_for_sap:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_sl7:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_sl7:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_sl6:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_sl6:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhv4:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel8:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel9:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel9_unix_family:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_rhel9:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_rhevh_rhel9_version:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_9:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_9:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_8:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_8:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_7:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_7:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_6:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_6:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_5:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_5:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_4:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_4:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_3:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_3:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_2:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_2:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_1:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_1:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_10:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_10:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_0:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_unix_family:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_rhel8:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_rhevh_rhel8_version:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel7:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel7_unix_family:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_rhel7_client:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_rhel7_workstation:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_rhel7_server:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_rhel7_computenode:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_rhevh_rhel7_version:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhcos4:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_rhcos:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_rhcos4:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_unix_family:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_opensuse_leap42:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_opensuse:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_opensuse_leap42_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_opensuse_leap15:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_opensuse:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_opensuse_leap15_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_opensuse:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_opensuse_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ol9_family:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_ol9_system:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ol8_family:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_ol8_system:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ol7_family:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_ol7_system:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_fedora:def:1" result="true" version="3">
                  <criteria operator="AND" result="true">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_fedora_release_rpm:tst:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_fedora_vendor_product:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_debian:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_debian:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_debian9:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_debian:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_debian_9:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_debian11:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_debian:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_debian_11:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_debian10:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_debian:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_debian_10:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_centos9:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_centos9_name:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_centos9_version:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_centos8:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_centos8_name:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_centos8_version:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_centos7:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_centos7:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_centos6:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_centos6:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
              </definitions>
              <tests>
                <test test_id="oval:ssg-test_centos6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_centos7:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_centos8_name:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_centos8_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_centos9_name:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_centos9_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_debian:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_debian_10:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_debian_11:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_debian_9:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_efi_dir_existence:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_env_has_audit_installed:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10425254" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_env_has_chrony_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_gdm_installed:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10425225" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_env_has_grub2_installed:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10425246" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_env_has_libuser_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_login_defs_installed:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10425251" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_env_has_net-snmp_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_nss-pam-ldapd_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_ntp_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_ovirt-engine_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_ovirt-host_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_pam_installed:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10425243" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_env_has_polkit_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_postfix_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_sssd-common_installed:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="104252509" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_env_has_sudo_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_systemd_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_tftp_server_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_usbguard_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_yum_installed:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10425240" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_env_has_zipl_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_fedora_release_rpm:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="1042528" result="not evaluated"/>
                  <tested_item item_id="1042529" result="not evaluated"/>
                  <tested_item item_id="10425210" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_fedora_vendor_product:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10425211" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_id_provider_is_set_to_ad:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_installed_env_is_a_docker_container:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_installed_env_is_a_podman_container:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_lsb:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ol7_system:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ol8_system:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ol9_system:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_opensuse_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_opensuse_leap15_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_opensuse_leap42_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_proc_net_wireless_exists:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_proc_sys_kernel_osrelease_arch_aarch64:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhcos4:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhcos:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel7_client:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel7_computenode:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel7_server:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel7_unix_family:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel7_workstation:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_0:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_10:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_1:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_2:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_3:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_4:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_5:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_7:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_8:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_9:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_unix_family:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel9:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel9_unix_family:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhevh_rhel7_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhevh_rhel8_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhevh_rhel9_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhevm4_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhvh4_version:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sl6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sl7:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sle12_desktop:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sle12_server:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sle12_unix_family:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sle15_desktop:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sle15_server:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sle15_unix_family:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sles_12_for_sap:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sles_15_for_sap:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" version="1" check="all" result="false">
                  <tested_item item_id="10425247" result="false"/>
                </test>
                <test test_id="oval:ssg-test_system_using_opal:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_ubuntu:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ubuntu_bionic:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ubuntu_focal:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ubuntu_xenial:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_unix_family:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="1042527" result="true"/>
                </test>
                <test test_id="oval:ssg-test_unix_wrlinux1019:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_unix_wrlinux8:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_wrlinux1019_name:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_wrlinux1019_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_wrlinux8_version:tst:1" version="1" check="all" result="not evaluated"/>
              </tests>
              <oval_system_characteristics xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:unix-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#unix" xmlns:ind-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#independent" xmlns:lin-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#linux" xmlns:win-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows" xmlns="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5 oval-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#independent independent-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#unix unix-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#linux linux-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows windows-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#macos macos-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
                <generator>
                  <oval:product_name>combine_ovals.py from SCAP Security Guide</oval:product_name>
                  <oval:product_version>ssg: [0, 1, 62], python: 3.11.0b4</oval:product_version>
                  <oval:schema_version>5.11</oval:schema_version>
                  <oval:timestamp>2022-08-01T16:21:58</oval:timestamp>
                </generator>
                <system_info>
                  <os_name>Fedora Linux</os_name>
                  <os_version>37 (Workstation Edition Prerelease)</os_version>
                  <architecture>x86_64</architecture>
                  <primary_host_name>localhost-live</primary_host_name>
                  <interfaces>
                    <interface>
                      <interface_name>lo</interface_name>
                      <ip_address>127.0.0.1</ip_address>
                      <mac_address>00:00:00:00:00:00</mac_address>
                    </interface>
                    <interface>
                      <interface_name>enp1s0</interface_name>
                      <ip_address>192.168.122.178</ip_address>
                      <mac_address>52:54:00:43:3D:D8</mac_address>
                    </interface>
                    <interface>
                      <interface_name>lo</interface_name>
                      <ip_address>::1</ip_address>
                      <mac_address>00:00:00:00:00:00</mac_address>
                    </interface>
                    <interface>
                      <interface_name>enp1s0</interface_name>
                      <ip_address>fe80::8000:d679:2b11:8d8</ip_address>
                      <mac_address>52:54:00:43:3D:D8</mac_address>
                    </interface>
                  </interfaces>
                </system_info>
                <collected_objects>
                  <object id="oval:ssg-obj_env_has_audit_installed:obj:1" version="1" flag="complete">
                    <reference item_ref="10425254"/>
                  </object>
                  <object id="oval:ssg-obj_env_has_gdm_installed:obj:1" version="1" flag="complete">
                    <reference item_ref="10425225"/>
                  </object>
                  <object id="oval:ssg-obj_env_has_grub2_installed:obj:1" version="1" flag="complete">
                    <reference item_ref="10425246"/>
                  </object>
                  <object id="oval:ssg-obj_env_has_login_defs_installed:obj:1" version="1" flag="complete">
                    <reference item_ref="10425251"/>
                  </object>
                  <object id="oval:ssg-obj_env_has_pam_installed:obj:1" version="1" flag="complete">
                    <reference item_ref="10425243"/>
                  </object>
                  <object id="oval:ssg-obj_env_has_sssd-common_installed:obj:1" version="1" flag="complete">
                    <reference item_ref="104252509"/>
                  </object>
                  <object id="oval:ssg-obj_env_has_yum_installed:obj:1" version="1" flag="complete">
                    <reference item_ref="10425240"/>
                  </object>
                  <object id="oval:ssg-object_fedora_release_rpm:obj:1" version="1" flag="complete">
                    <reference item_ref="1042528"/>
                    <reference item_ref="1042529"/>
                    <reference item_ref="10425210"/>
                  </object>
                  <object id="oval:ssg-object_fedora_vendor_product:obj:1" version="1" flag="complete">
                    <reference item_ref="10425211"/>
                  </object>
                  <object id="oval:ssg-object_file_sys_firmware_efi:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_installed_env_is_a_docker_container:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_installed_env_is_a_podman_container:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_system_info_architecture_ppcle_64:obj:1" version="1" flag="complete">
                    <reference item_ref="10425247"/>
                  </object>
                  <object id="oval:ssg-object_system_using_opal:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_unix_family:obj:1" version="1" flag="complete">
                    <reference item_ref="1042527"/>
                  </object>
                </collected_objects>
                <system_data>
                  <lin-sys:rpminfo_item id="1042529" status="exists">
                    <lin-sys:name>fedora-release-workstation</lin-sys:name>
                    <lin-sys:arch>noarch</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>0.6</lin-sys:release>
                    <lin-sys:version>37</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:37-0.6</lin-sys:evr>
                    <lin-sys:signature_keyid>f55ad3fb5323552a</lin-sys:signature_keyid>
                    <lin-sys:extended_name>fedora-release-workstation-0:37-0.6.noarch</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <lin-sys:rpminfo_item id="1042528" status="exists">
                    <lin-sys:name>fedora-release-identity-workstation</lin-sys:name>
                    <lin-sys:arch>noarch</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>0.6</lin-sys:release>
                    <lin-sys:version>37</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:37-0.6</lin-sys:evr>
                    <lin-sys:signature_keyid>f55ad3fb5323552a</lin-sys:signature_keyid>
                    <lin-sys:extended_name>fedora-release-identity-workstation-0:37-0.6.noarch</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <ind-sys:family_item id="1042527" status="exists">
                    <ind-sys:family>unix</ind-sys:family>
                  </ind-sys:family_item>
                  <lin-sys:rpminfo_item id="10425254" status="exists">
                    <lin-sys:name>audit</lin-sys:name>
                    <lin-sys:arch>x86_64</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>2.fc37</lin-sys:release>
                    <lin-sys:version>3.0.8</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:3.0.8-2.fc37</lin-sys:evr>
                    <lin-sys:signature_keyid>f55ad3fb5323552a</lin-sys:signature_keyid>
                    <lin-sys:extended_name>audit-0:3.0.8-2.fc37.x86_64</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <lin-sys:rpminfo_item id="10425251" status="exists">
                    <lin-sys:name>shadow-utils</lin-sys:name>
                    <lin-sys:arch>x86_64</lin-sys:arch>
                    <lin-sys:epoch>2</lin-sys:epoch>
                    <lin-sys:release>2.fc37</lin-sys:release>
                    <lin-sys:version>4.11.1</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">2:4.11.1-2.fc37</lin-sys:evr>
                    <lin-sys:signature_keyid>f55ad3fb5323552a</lin-sys:signature_keyid>
                    <lin-sys:extended_name>shadow-utils-2:4.11.1-2.fc37.x86_64</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <lin-sys:rpminfo_item id="104252509" status="exists">
                    <lin-sys:name>sssd-common</lin-sys:name>
                    <lin-sys:arch>x86_64</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>3.fc37</lin-sys:release>
                    <lin-sys:version>2.7.1</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:2.7.1-3.fc37</lin-sys:evr>
                    <lin-sys:signature_keyid>f55ad3fb5323552a</lin-sys:signature_keyid>
                    <lin-sys:extended_name>sssd-common-0:2.7.1-3.fc37.x86_64</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <unix-sys:uname_item id="10425247" status="exists">
                    <unix-sys:machine_class>x86_64</unix-sys:machine_class>
                    <unix-sys:node_name>localhost-live</unix-sys:node_name>
                    <unix-sys:os_name>Linux</unix-sys:os_name>
                    <unix-sys:os_release>5.19.0-0.rc3.20220624git92f20ff72066.30.fc37.x86_64</unix-sys:os_release>
                    <unix-sys:os_version>#1 SMP PREEMPT_DYNAMIC Fri Jun 24 14:48:57 UTC 2022</unix-sys:os_version>
                    <unix-sys:processor_type>x86_64</unix-sys:processor_type>
                  </unix-sys:uname_item>
                  <lin-sys:rpminfo_item id="10425246" status="exists">
                    <lin-sys:name>grub2-common</lin-sys:name>
                    <lin-sys:arch>noarch</lin-sys:arch>
                    <lin-sys:epoch>1</lin-sys:epoch>
                    <lin-sys:release>42.fc37</lin-sys:release>
                    <lin-sys:version>2.06</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">1:2.06-42.fc37</lin-sys:evr>
                    <lin-sys:signature_keyid>f55ad3fb5323552a</lin-sys:signature_keyid>
                    <lin-sys:extended_name>grub2-common-1:2.06-42.fc37.noarch</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <lin-sys:rpminfo_item id="10425243" status="exists">
                    <lin-sys:name>pam</lin-sys:name>
                    <lin-sys:arch>x86_64</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>12.fc37</lin-sys:release>
                    <lin-sys:version>1.5.2</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:1.5.2-12.fc37</lin-sys:evr>
                    <lin-sys:signature_keyid>f55ad3fb5323552a</lin-sys:signature_keyid>
                    <lin-sys:extended_name>pam-0:1.5.2-12.fc37.x86_64</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <lin-sys:rpminfo_item id="10425240" status="exists">
                    <lin-sys:name>yum</lin-sys:name>
                    <lin-sys:arch>noarch</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>2.fc37</lin-sys:release>
                    <lin-sys:version>4.13.0</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:4.13.0-2.fc37</lin-sys:evr>
                    <lin-sys:signature_keyid>f55ad3fb5323552a</lin-sys:signature_keyid>
                    <lin-sys:extended_name>yum-0:4.13.0-2.fc37.noarch</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <lin-sys:rpminfo_item id="10425225" status="exists">
                    <lin-sys:name>gdm</lin-sys:name>
                    <lin-sys:arch>x86_64</lin-sys:arch>
                    <lin-sys:epoch>1</lin-sys:epoch>
                    <lin-sys:release>1.fc37</lin-sys:release>
                    <lin-sys:version>42.0</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">1:42.0-1.fc37</lin-sys:evr>
                    <lin-sys:signature_keyid>f55ad3fb5323552a</lin-sys:signature_keyid>
                    <lin-sys:extended_name>gdm-1:42.0-1.fc37.x86_64</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <ind-sys:textfilecontent_item id="10425211" status="exists">
                    <ind-sys:filepath>/etc/system-release-cpe</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>system-release-cpe</ind-sys:filename>
                    <ind-sys:pattern>^cpe:\/o:fedoraproject:fedora:[\d]+$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^cpe:\/o:fedoraproject:fedora:[\d]+$</ind-sys:line>
                    <ind-sys:text>cpe:/o:fedoraproject:fedora:37</ind-sys:text>
                  </ind-sys:textfilecontent_item>
                  <lin-sys:rpminfo_item id="10425210" status="exists">
                    <lin-sys:name>fedora-release-common</lin-sys:name>
                    <lin-sys:arch>noarch</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>0.6</lin-sys:release>
                    <lin-sys:version>37</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:37-0.6</lin-sys:evr>
                    <lin-sys:signature_keyid>f55ad3fb5323552a</lin-sys:signature_keyid>
                    <lin-sys:extended_name>fedora-release-common-0:37-0.6.noarch</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                </system_data>
              </oval_system_characteristics>
            </system>
          </results>
        </oval_results>
      </arf:content>
    </arf:report>
    <arf:report id="oval2">
      <arf:content>
        <oval_results xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns="http://oval.mitre.org/XMLSchema/oval-results-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-results-5 oval-results-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
          <generator>
            <oval:product_name>vim</oval:product_name>
            <oval:product_version>1.3.6</oval:product_version>
            <oval:schema_version>5.10.1</oval:schema_version>
            <oval:timestamp>2022-08-01T16:21:57</oval:timestamp>
          </generator>
          <directives>
            <definition_true reported="true" content="full"/>
            <definition_false reported="true" content="full"/>
            <definition_unknown reported="true" content="full"/>
            <definition_error reported="true" content="full"/>
            <definition_not_evaluated reported="true" content="full"/>
            <definition_not_applicable reported="true" content="full"/>
          </directives>
          <oval_definitions xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:win-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" xmlns:mac-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#windows windows-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#macos macos-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
            <generator>
              <oval:product_name>vim</oval:product_name>
              <oval:schema_version>5.10.1</oval:schema_version>
              <oval:timestamp>2012-11-22T15:00:00+01:00</oval:timestamp>
            </generator>
            <definitions>
              <definition id="oval:org.open-scap.cpe.wrlinux:def:8" version="1" class="inventory">
                <metadata>
                  <title>Wind River Linux 8</title>
                  <affected family="unix">
                    <platform>Wind River Linux 8</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:windriver:wrlinux:8"/>
                  <description>The operating system installed on the system is Wind River Linux 8</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.wrlinux:tst:8" comment="Wind River Linux version is 8."/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.wrlinux:def:1019" version="1" class="inventory">
                <metadata>
                  <title>Wind River Linux 1019</title>
                  <affected family="unix">
                    <platform>Wind River Linux 1019</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:windriver:wrlinux:1019"/>
                  <description>The operating system installed on the system is Wind River Linux 1019</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.wrlinux:tst:1019" comment="Wind River Linux version is 1019."/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.wrlinux:def:1" version="1" class="inventory">
                <metadata>
                  <title>Wind River Linux</title>
                  <affected family="unix">
                    <platform>Wind River Linux</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:windriver:wrlinux"/>
                  <description>The operating system installed on the system is Wind River Linux</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.wrlinux:tst:1" comment="Installed operating system is part of the unix family."/>
                  <criterion test_ref="oval:org.open-scap.cpe.wrlinux:tst:2" comment="Wind River Linux is installed."/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.windows:def:81" version="1" class="inventory">
                <metadata>
                  <title>Microsoft Windows 8.1</title>
                  <affected family="windows">
                    <platform>Microsoft Windows 8.1</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:microsoft:windows_8.1"/>
                  <description>The operating system installed on the system is Microsoft Windows 8.1</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:org.open-scap.cpe.windows:tst:81" comment="Microsoft Windows 8.1 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.windows:def:8" version="1" class="inventory">
                <metadata>
                  <title>Microsoft Windows 8</title>
                  <affected family="windows">
                    <platform>Microsoft Windows 8</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:microsoft:windows_8"/>
                  <description>The operating system installed on the system is Microsoft Windows 8</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:org.open-scap.cpe.windows:tst:8" comment="Microsoft Windows 8 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.windows:def:7" version="1" class="inventory">
                <metadata>
                  <title>Microsoft Windows 7</title>
                  <affected family="windows">
                    <platform>Microsoft Windows 7</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:microsoft:windows_7"/>
                  <description>The operating system installed on the system is Microsoft Windows 7</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:org.open-scap.cpe.windows:tst:7" comment="Microsoft Windows 7 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.windows:def:2016" version="1" class="inventory">
                <metadata>
                  <title>Microsoft Windows Server 2016</title>
                  <affected family="windows">
                    <platform>Microsoft Windows Server 2016</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:microsoft:windows_server_2016"/>
                  <description>The operating system installed on the system is Microsoft Windows Server 2016</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:org.open-scap.cpe.windows:tst:2016" comment="Microsoft Windows Server 2016 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.windows:def:2012" version="1" class="inventory">
                <metadata>
                  <title>Microsoft Windows Server 2012</title>
                  <affected family="windows">
                    <platform>Microsoft Windows Server 2012</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:microsoft:windows_server_2012"/>
                  <description>The operating system installed on the system is Microsoft Windows Server 2012</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:org.open-scap.cpe.windows:tst:2012" comment="Microsoft Windows Server 2012 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.windows:def:2008" version="1" class="inventory">
                <metadata>
                  <title>Microsoft Windows Server 2008</title>
                  <affected family="windows">
                    <platform>Microsoft Windows Server 2008</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:microsoft:windows_server_2008"/>
                  <description>The operating system installed on the system is Microsoft Windows Server 2008</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:org.open-scap.cpe.windows:tst:2008" comment="Microsoft Windows Server 2008 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.windows:def:10" version="1" class="inventory">
                <metadata>
                  <title>Microsoft Windows 10</title>
                  <affected family="windows">
                    <platform>Microsoft Windows 10</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:microsoft:windows_10"/>
                  <description>The operating system installed on the system is Microsoft Windows 10</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:org.open-scap.cpe.windows:tst:10" comment="Microsoft Windows 10 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.sles:def:12" version="1" class="inventory">
                <metadata>
                  <title>SUSE Linux Enterprise Server 12</title>
                  <affected family="unix">
                    <platform>SUSE Linux Enterprise Server 12</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:suse:sles:12"/>
                  <description>The operating system installed on the system is SUSE Linux Enterprise Server 12</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.sles:tst:12" comment="SLES 12 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.sles:def:10" version="1" class="inventory">
                <metadata>
                  <title>SUSE Linux Enterprise Server 10</title>
                  <affected family="unix">
                    <platform>SUSE Linux Enterprise Server 10</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:suse:sles:10"/>
                  <description>The operating system installed on the system is SUSE Linux Enterprise Server 10</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.sles:tst:10" comment="SLES 10 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.sled:def:12" version="1" class="inventory">
                <metadata>
                  <title>SUSE Linux Enterprise Desktop 12</title>
                  <affected family="unix">
                    <platform>SUSE Linux Enterprise Desktop 12</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:suse:sled:12"/>
                  <description>The operating system installed on the system is SUSE Linux Enterprise Desktop 12</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.sled:tst:12" comment="SLED 12 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.sled:def:10" version="1" class="inventory">
                <metadata>
                  <title>SUSE Linux Enterprise Desktop 10</title>
                  <affected family="unix">
                    <platform>SUSE Linux Enterprise Desktop 10</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:suse:sled:10"/>
                  <description>The operating system installed on the system is SUSE Linux Enterprise Desktop 10</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.sled:tst:10" comment="SLED 10 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.sle:def:11" version="1" class="inventory">
                <metadata>
                  <title>SUSE Linux Enterprise 11</title>
                  <affected family="unix">
                    <platform>SUSE Linux Enterprise Server 11</platform>
                    <platform>SUSE Linux Enterprise Desktop 11</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:suse:linux_enterprise_server:11"/>
                  <reference source="CPE" ref_id="cpe:/o:suse:linux_enterprise_desktop:11"/>
                  <reference source="galford" ref_id="20160920" ref_url="test_attestation"/>
                  <description>The operating system installed on the system is SUSE Linux Enterprise 11.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.sle:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:org.open-scap.cpe.sled:tst:11" comment="SLE 11 Desktop is installed"/>
                    <criterion test_ref="oval:org.open-scap.cpe.sles:tst:11" comment="SLE 11 Server is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.sle:def:1" version="1" class="inventory">
                <metadata>
                  <title>SUSE Linux Enterprise All Platforms</title>
                  <affected family="unix">
                    <platform>SUSE Linux Enterprise All Platforms</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:suse:sle"/>
                  <description>The operating system installed on the system is SUSE Linux Enterprise</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:org.open-scap.cpe.sles:tst:1" comment="SLES is installed"/>
                    <criterion test_ref="oval:org.open-scap.cpe.sled:tst:1" comment="SLED is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.scientific:def:7" version="1" class="inventory">
                <metadata>
                  <title>Scientific Linux 7</title>
                  <affected family="unix">
                    <platform>Scientific Linux 7</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:scientificlinux:scientificlinux:7"/>
                  <description>The operating system installed on the system is Scientific Linux 7</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.scientific:tst:7" comment="Scientific Linux 7 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.scientific:def:6" version="1" class="inventory">
                <metadata>
                  <title>Scientific Linux 6</title>
                  <affected family="unix">
                    <platform>Scientific Linux 6</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:scientificlinux:scientificlinux:6"/>
                  <description>The operating system installed on the system is Scientific Linux 6</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.scientific:tst:6" comment="Scientific Linux 6 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.scientific:def:5" version="1" class="inventory">
                <metadata>
                  <title>Scientific Linux 5</title>
                  <affected family="unix">
                    <platform>Scientific Linux 5</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:scientificlinux:scientificlinux:5"/>
                  <description>The operating system installed on the system is Scientific Linux 5</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.scientific:tst:5" comment="Scientific Linux 5 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.rhel:def:8" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8</title>
                  <affected family="unix">
                    <platform>Red Hat Enterprise Linux 8</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:8" comment="Red Hat Enterprise Linux 8 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.rhel:def:7" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 7</title>
                  <affected family="unix">
                    <platform>Red Hat Enterprise Linux 7</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:7"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 7</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:7" comment="Red Hat Enterprise Linux 7 is installed"/>
                  <criteria comment="Red Hat Enterpise Virtualization Host is installed">
                    <criterion test_ref="oval:org.open-scap.cpe.rhevh:tst:1" comment="redhat-release-virtualization-host RPM package is installed"/>
                    <criterion test_ref="oval:org.open-scap.cpe.rhevh:tst:2" comment="Red Hat Enterpise Virtualization Host is based on RHEL 7"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.rhel:def:6" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 6</title>
                  <affected family="unix">
                    <platform>Red Hat Enterprise Linux 6</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:6"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 6</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:6" comment="Red Hat Enterprise Linux 6 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.rhel:def:5" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 5</title>
                  <affected family="unix">
                    <platform>Red Hat Enterprise Linux 5</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:5"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 5</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:5" comment="Red Hat Enterprise Linux 5 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.rhel:def:1007" version="1" class="inventory">
                <metadata>
                  <title>Community Enterprise Operating System 7</title>
                  <affected family="unix">
                    <platform>Community Enterprise Operating System 7</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:centos:centos:7"/>
                  <description>The operating system installed on the system is Community Enterprise Operating System 7</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:1007" comment="Community Enterprise Operating System 7 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.rhel:def:1006" version="1" class="inventory">
                <metadata>
                  <title>Community Enterprise Operating System 6</title>
                  <affected family="unix">
                    <platform>Community Enterprise Operating System 6</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:centos:centos:6"/>
                  <description>The operating system installed on the system is Community Enterprise Operating System 6</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:1006" comment="Community Enterprise Operating System 6 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.rhel:def:1005" version="1" class="inventory">
                <metadata>
                  <title>Community Enterprise Operating System 5</title>
                  <affected family="unix">
                    <platform>Community Enterprise Operating System 5</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:centos:centos:5"/>
                  <description>The operating system installed on the system is Community Enterprise Operating System 5</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:1005" comment="Community Enterprise Operating System 5 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.rhel:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux</title>
                  <affected family="unix">
                    <platform>Red Hat Enterprise Linux</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:2" comment="Red Hat Enterprise Linux is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.opensuse:def:423" version="1" class="inventory">
                <metadata>
                  <title>openSUSE Leap 42.3</title>
                  <affected family="unix">
                    <platform>openSUSE Leap 42.3</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:leap:42.3"/>
                  <description>The operating system installed on the system is openSUSE Leap 42.3</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:423" comment="openSUSE Leap 42.3 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.opensuse:def:422" version="1" class="inventory">
                <metadata>
                  <title>openSUSE Leap 42.2</title>
                  <affected family="unix">
                    <platform>openSUSE Leap 42.2</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:novell:leap:42.2"/>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:leap:42.2"/>
                  <description>The operating system installed on the system is openSUSE Leap 42.2</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:422" comment="openSUSE Leap 42.2 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.opensuse:def:421" version="1" class="inventory">
                <metadata>
                  <title>openSUSE Leap 42.1</title>
                  <affected family="unix">
                    <platform>openSUSE Leap 42.1</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:novell:leap:42.1"/>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:leap:42.1"/>
                  <description>The operating system installed on the system is openSUSE Leap 42.1</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:421" comment="openSUSE Leap 42.1 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.opensuse:def:150" version="1" class="inventory">
                <metadata>
                  <title>openSUSE Leap 15.0</title>
                  <affected family="unix">
                    <platform>openSUSE Leap 15.0</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:leap:15.0"/>
                  <description>The operating system installed on the system is openSUSE Leap 15.0</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:150" comment="openSUSE Leap 15.0 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.opensuse:def:132" version="1" class="inventory">
                <metadata>
                  <title>openSUSE 13.2</title>
                  <affected family="unix">
                    <platform>openSUSE 13.2</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:opensuse:13.2"/>
                  <description>The operating system installed on the system is openSUSE 13.2</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:132" comment="openSUSE 13.2 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.opensuse:def:131" version="1" class="inventory">
                <metadata>
                  <title>openSUSE 13.1</title>
                  <affected family="unix">
                    <platform>openSUSE 13.1</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:opensuse:13.1"/>
                  <description>The operating system installed on the system is openSUSE 13.1</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:131" comment="openSUSE 13.1 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.opensuse:def:114" version="1" class="inventory">
                <metadata>
                  <title>openSUSE 11.4</title>
                  <affected family="unix">
                    <platform>openSUSE 11.4</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:opensuse:11.4"/>
                  <description>The operating system installed on the system is openSUSE 11.4</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:114" comment="openSUSE 11.4 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.opensuse:def:1" version="1" class="inventory">
                <metadata>
                  <title>openSUSE All Versions</title>
                  <affected family="unix">
                    <platform>openSUSE</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:opensuse"/>
                  <description>The operating system installed on the system is openSUSE</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:1" comment="openSUSE is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.ol:def:8" version="1" class="inventory">
                <metadata>
                  <title>Oracle Linux 8</title>
                  <affected family="unix">
                    <platform>Oracle Linux 8</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:oracle:linux:8"/>
                  <description>The operating system installed on the system is Oracle Linux 8</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.ol:tst:8" comment="Oracle Linux 8 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.ol:def:7" version="1" class="inventory">
                <metadata>
                  <title>Oracle Linux 7</title>
                  <affected family="unix">
                    <platform>Oracle Linux 7</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:oracle:linux:7"/>
                  <description>The operating system installed on the system is Oracle Linux 7</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.ol:tst:7" comment="Oracle Linux 7 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.ol:def:6" version="1" class="inventory">
                <metadata>
                  <title>Oracle Linux 6</title>
                  <affected family="unix">
                    <platform>Oracle Linux 6</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:oracle:linux:6"/>
                  <description>The operating system installed on the system is Oracle Linux 6</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.ol:tst:6" comment="Oracle Linux 6 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.ol:def:5" version="1" class="inventory">
                <metadata>
                  <title>Oracle Linux 5</title>
                  <affected family="unix">
                    <platform>Oracle Linux 5</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:oracle:linux:5"/>
                  <description>The operating system installed on the system is Oracle Linux 5</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.ol:tst:5" comment="Oracle Linux 5 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:35" version="1" class="inventory">
                <metadata>
                  <title>Fedora 35</title>
                  <affected family="unix">
                    <platform>Fedora 35</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:35"/>
                  <description>The operating system installed on the system is Fedora 35</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:35" comment="Fedora 35 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:34" version="1" class="inventory">
                <metadata>
                  <title>Fedora 34</title>
                  <affected family="unix">
                    <platform>Fedora 34</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:34"/>
                  <description>The operating system installed on the system is Fedora 34</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:34" comment="Fedora 34 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:33" version="1" class="inventory">
                <metadata>
                  <title>Fedora 33</title>
                  <affected family="unix">
                    <platform>Fedora 33</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:33"/>
                  <description>The operating system installed on the system is Fedora 33</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:33" comment="Fedora 33 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:32" version="1" class="inventory">
                <metadata>
                  <title>Fedora 32</title>
                  <affected family="unix">
                    <platform>Fedora 32</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:32"/>
                  <description>The operating system installed on the system is Fedora 32</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:32" comment="Fedora 32 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:31" version="1" class="inventory">
                <metadata>
                  <title>Fedora 31</title>
                  <affected family="unix">
                    <platform>Fedora 31</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:31"/>
                  <description>The operating system installed on the system is Fedora 31</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:31" comment="Fedora 31 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:30" version="1" class="inventory">
                <metadata>
                  <title>Fedora 30</title>
                  <affected family="unix">
                    <platform>Fedora 30</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:30"/>
                  <description>The operating system installed on the system is Fedora 30</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:30" comment="Fedora 30 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:29" version="1" class="inventory">
                <metadata>
                  <title>Fedora 29</title>
                  <affected family="unix">
                    <platform>Fedora 29</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:29"/>
                  <description>The operating system installed on the system is Fedora 29</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:29" comment="Fedora 29 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:28" version="1" class="inventory">
                <metadata>
                  <title>Fedora 28</title>
                  <affected family="unix">
                    <platform>Fedora 28</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:28"/>
                  <description>The operating system installed on the system is Fedora 28</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:28" comment="Fedora 28 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:27" version="1" class="inventory">
                <metadata>
                  <title>Fedora 27</title>
                  <affected family="unix">
                    <platform>Fedora 27</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:27"/>
                  <description>The operating system installed on the system is Fedora 27</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:27" comment="Fedora 27 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:26" version="1" class="inventory">
                <metadata>
                  <title>Fedora 26</title>
                  <affected family="unix">
                    <platform>Fedora 26</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:26"/>
                  <description>The operating system installed on the system is Fedora 26</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:26" comment="Fedora 26 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:25" version="1" class="inventory">
                <metadata>
                  <title>Fedora 25</title>
                  <affected family="unix">
                    <platform>Fedora 25</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:25"/>
                  <description>The operating system installed on the system is Fedora 25</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:25" comment="Fedora 25 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:24" version="1" class="inventory">
                <metadata>
                  <title>Fedora 24</title>
                  <affected family="unix">
                    <platform>Fedora 24</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:24"/>
                  <description>The operating system installed on the system is Fedora 24</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:24" comment="Fedora 24 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:23" version="1" class="inventory">
                <metadata>
                  <title>Fedora 23</title>
                  <affected family="unix">
                    <platform>Fedora 23</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:23"/>
                  <description>The operating system installed on the system is Fedora 23</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:23" comment="Fedora 23 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:22" version="1" class="inventory">
                <metadata>
                  <title>Fedora 22</title>
                  <affected family="unix">
                    <platform>Fedora 22</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:22"/>
                  <description>The operating system installed on the system is Fedora 22</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:22" comment="Fedora 22 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:21" version="1" class="inventory">
                <metadata>
                  <title>Fedora 21</title>
                  <affected family="unix">
                    <platform>Fedora 21</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:21"/>
                  <description>The operating system installed on the system is Fedora 21</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:21" comment="Fedora 21 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:20" version="1" class="inventory">
                <metadata>
                  <title>Fedora 20</title>
                  <affected family="unix">
                    <platform>Fedora 20</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:20"/>
                  <description>The operating system installed on the system is Fedora 20</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:20" comment="Fedora 20 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:19" version="1" class="inventory">
                <metadata>
                  <title>Fedora 19</title>
                  <affected family="unix">
                    <platform>Fedora 19</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:19"/>
                  <description>The operating system installed on the system is Fedora 19</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:19" comment="Fedora 19 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:18" version="1" class="inventory">
                <metadata>
                  <title>Fedora 18</title>
                  <affected family="unix">
                    <platform>Fedora 18</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:18"/>
                  <description>The operating system installed on the system is Fedora 18</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:18" comment="Fedora 18 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:17" version="1" class="inventory">
                <metadata>
                  <title>Fedora 17</title>
                  <affected family="unix">
                    <platform>Fedora 17</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:17"/>
                  <description>The operating system installed on the system is Fedora 17</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:17" comment="Fedora 17 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:16" version="1" class="inventory">
                <metadata>
                  <title>Fedora 16</title>
                  <affected family="unix">
                    <platform>Fedora 16</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:16"/>
                  <description>The operating system installed on the system is Fedora 16</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:16" comment="Fedora 16 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.centos:def:8" version="1" class="inventory">
                <metadata>
                  <title>Community Enterprise Operating System 8</title>
                  <affected family="unix">
                    <platform>Community Enterprise Operating System 8</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:centos:centos:8"/>
                  <description>The operating system installed on the system is Community Enterprise Operating System 8</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.centos:tst:8" comment="Community Enterprise Operating System is installed"/>
                  <criterion test_ref="oval:org.open-scap.cpe.centos:tst:8000" comment="Community Enterprise Operating System version is 8"/>
                </criteria>
              </definition>
            </definitions>
            <tests>
              <ind-def:textfilecontent54_test id="oval:org.open-scap.cpe.wrlinux:tst:8" version="1" check_existence="all_exist" check="all" comment="Check /etc/wrlinux-release for VERSION 8 specification.">
                <ind-def:object object_ref="oval:org.open-scap.cpe.wrlinux-release:obj:2"/>
                <ind-def:state state_ref="oval:org.open-scap.cpe.wrlinux-release:ste:8"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:org.open-scap.cpe.wrlinux:tst:2" version="1" check="all" comment="Test presence of /etc/wrlinux-release.">
                <unix-def:object object_ref="oval:org.open-scap.cpe.wrlinux-release:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:org.open-scap.cpe.wrlinux:tst:1019" version="1" check_existence="all_exist" check="all" comment="Check /etc/os-release for VERSION 1019 specification.">
                <ind-def:object object_ref="oval:org.open-scap.cpe.wrlinux-release:obj:3"/>
                <ind-def:state state_ref="oval:org.open-scap.cpe.wrlinux-release:ste:10"/>
              </ind-def:textfilecontent54_test>
              <ind-def:family_test id="oval:org.open-scap.cpe.wrlinux:tst:1" version="1" check="only one" comment="Installed operating system is part of the Unix family.">
                <ind-def:object object_ref="oval:org.open-scap.cpe.unix:obj:1"/>
                <ind-def:state state_ref="oval:org.open-scap.cpe.unix:ste:1"/>
              </ind-def:family_test>
              <win-def:registry_test id="oval:org.open-scap.cpe.windows:tst:81" version="1" check="at least one" comment="Windows 8.1 is installed">
                <win-def:object object_ref="oval:org.open-scap.cpe.windows:obj:1"/>
                <win-def:state state_ref="oval:org.open-scap.cpe.windows:ste:81"/>
              </win-def:registry_test>
              <win-def:registry_test id="oval:org.open-scap.cpe.windows:tst:8" version="1" check="at least one" comment="Windows 8 is installed">
                <win-def:object object_ref="oval:org.open-scap.cpe.windows:obj:1"/>
                <win-def:state state_ref="oval:org.open-scap.cpe.windows:ste:8"/>
              </win-def:registry_test>
              <win-def:registry_test id="oval:org.open-scap.cpe.windows:tst:7" version="1" check="at least one" comment="Windows 7 is installed">
                <win-def:object object_ref="oval:org.open-scap.cpe.windows:obj:1"/>
                <win-def:state state_ref="oval:org.open-scap.cpe.windows:ste:7"/>
              </win-def:registry_test>
              <win-def:registry_test id="oval:org.open-scap.cpe.windows:tst:2016" version="1" check="at least one" comment="Windows Server 2016 is installed">
                <win-def:object object_ref="oval:org.open-scap.cpe.windows:obj:1"/>
                <win-def:state state_ref="oval:org.open-scap.cpe.windows:ste:2016"/>
              </win-def:registry_test>
              <win-def:registry_test id="oval:org.open-scap.cpe.windows:tst:2012" version="1" check="at least one" comment="Windows Server 2012 is installed">
                <win-def:object object_ref="oval:org.open-scap.cpe.windows:obj:1"/>
                <win-def:state state_ref="oval:org.open-scap.cpe.windows:ste:2012"/>
              </win-def:registry_test>
              <win-def:registry_test id="oval:org.open-scap.cpe.windows:tst:2008" version="1" check="at least one" comment="Windows Server 2008 is installed">
                <win-def:object object_ref="oval:org.open-scap.cpe.windows:obj:1"/>
                <win-def:state state_ref="oval:org.open-scap.cpe.windows:ste:2008"/>
              </win-def:registry_test>
              <win-def:registry_test id="oval:org.open-scap.cpe.windows:tst:10" version="1" check="at least one" comment="Windows 10 is installed">
                <win-def:object object_ref="oval:org.open-scap.cpe.windows:obj:1"/>
                <win-def:state state_ref="oval:org.open-scap.cpe.windows:ste:10"/>
              </win-def:registry_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.sles:tst:12" version="1" check="at least one" comment="sles-release is version 12">
                <lin-def:object object_ref="oval:org.open-scap.cpe.sles-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.sles:ste:12"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.sles:tst:11" version="1" check="at least one" comment="sles-release is version 11">
                <lin-def:object object_ref="oval:org.open-scap.cpe.sles-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.sles:ste:11"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.sles:tst:10" version="1" check="at least one" comment="sles-release is version 10">
                <lin-def:object object_ref="oval:org.open-scap.cpe.sles-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.sles:ste:10"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.sles:tst:1" version="1" check="at least one" comment="/etc/sles-release is provided by sles-release package">
                <lin-def:object object_ref="oval:org.open-scap.cpe.sles-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.sles:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.sled:tst:12" version="1" check="at least one" comment="sled-release is version 12">
                <lin-def:object object_ref="oval:org.open-scap.cpe.sled-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.sled:ste:12"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.sled:tst:11" version="1" check="at least one" comment="sled-release is version 11">
                <lin-def:object object_ref="oval:org.open-scap.cpe.sled-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.sled:ste:11"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.sled:tst:10" version="1" check="at least one" comment="sled-release is version 10">
                <lin-def:object object_ref="oval:org.open-scap.cpe.sled-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.sled:ste:10"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.sled:tst:1" version="1" check="at least one" comment="/etc/sled-release is provided by sled-release package">
                <lin-def:object object_ref="oval:org.open-scap.cpe.sled-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.sled:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:family_test id="oval:org.open-scap.cpe.sle:tst:1" version="1" check="only one" comment="Installed operating system is part of the Unix family.">
                <ind-def:object object_ref="oval:org.open-scap.cpe.unix:obj:1"/>
                <ind-def:state state_ref="oval:org.open-scap.cpe.unix:ste:1"/>
              </ind-def:family_test>
              <lin-def:rpmverifyfile_test id="oval:org.open-scap.cpe.scientific:tst:7" version="1" check="at least one" comment="sl-release is version 7">
                <lin-def:object object_ref="oval:org.open-scap.cpe.redhat-release:obj:3"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.scientific:ste:7"/>
              </lin-def:rpmverifyfile_test>
              <lin-def:rpmverifyfile_test id="oval:org.open-scap.cpe.scientific:tst:6" version="1" check="at least one" comment="sl-release is version 6">
                <lin-def:object object_ref="oval:org.open-scap.cpe.redhat-release:obj:3"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.scientific:ste:6"/>
              </lin-def:rpmverifyfile_test>
              <lin-def:rpmverifyfile_test id="oval:org.open-scap.cpe.scientific:tst:5" version="1" check="at least one" comment="sl-release is version 5">
                <lin-def:object object_ref="oval:org.open-scap.cpe.redhat-release:obj:3"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.scientific:ste:5"/>
              </lin-def:rpmverifyfile_test>
              <ind-def:textfilecontent54_test id="oval:org.open-scap.cpe.rhevh:tst:2" version="1" check="all" comment="RHEVH base RHEL is version 7">
                <ind-def:object object_ref="oval:org.open-scap.cpe.rhevh:obj:2"/>
                <ind-def:state state_ref="oval:org.open-scap.cpe.rhevh:ste:2"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.rhevh:tst:1" version="1" check_existence="only_one_exists" check="all" comment="redhat-release-virtualization-host RPM package is installed">
                <lin-def:object object_ref="oval:org.open-scap.cpe.rhevh:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpmverifyfile_test id="oval:org.open-scap.cpe.rhel:tst:8" version="1" check="at least one" comment="redhat-release is version 8">
                <lin-def:object object_ref="oval:org.open-scap.cpe.redhat-release:obj:3"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.rhel:ste:8"/>
              </lin-def:rpmverifyfile_test>
              <lin-def:rpmverifyfile_test id="oval:org.open-scap.cpe.rhel:tst:7" version="1" check="at least one" comment="redhat-release is version 7">
                <lin-def:object object_ref="oval:org.open-scap.cpe.redhat-release:obj:3"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.rhel:ste:7"/>
              </lin-def:rpmverifyfile_test>
              <lin-def:rpmverifyfile_test id="oval:org.open-scap.cpe.rhel:tst:6" version="1" check="at least one" comment="redhat-release is version 6">
                <lin-def:object object_ref="oval:org.open-scap.cpe.redhat-release:obj:3"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.rhel:ste:6"/>
              </lin-def:rpmverifyfile_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.rhel:tst:5" version="1" check="at least one" comment="redhat-release is version 5">
                <lin-def:object object_ref="oval:org.open-scap.cpe.redhat-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.rhel:ste:5"/>
              </lin-def:rpminfo_test>
              <lin-def:rpmverifyfile_test id="oval:org.open-scap.cpe.rhel:tst:2" version="1" check="at least one" comment="/etc/redhat-release is provided by redhat-release package">
                <lin-def:object object_ref="oval:org.open-scap.cpe.redhat-release:obj:3"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.rhel:ste:2"/>
              </lin-def:rpmverifyfile_test>
              <lin-def:rpmverifyfile_test id="oval:org.open-scap.cpe.rhel:tst:1007" version="1" check="at least one" comment="centos-release is version 7">
                <lin-def:object object_ref="oval:org.open-scap.cpe.redhat-release:obj:3"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.rhel:ste:1007"/>
              </lin-def:rpmverifyfile_test>
              <lin-def:rpmverifyfile_test id="oval:org.open-scap.cpe.rhel:tst:1006" version="1" check="at least one" comment="centos-release is version 6">
                <lin-def:object object_ref="oval:org.open-scap.cpe.redhat-release:obj:3"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.rhel:ste:1006"/>
              </lin-def:rpmverifyfile_test>
              <lin-def:rpmverifyfile_test id="oval:org.open-scap.cpe.rhel:tst:1005" version="1" check="at least one" comment="centos-release is version 5">
                <lin-def:object object_ref="oval:org.open-scap.cpe.redhat-release:obj:3"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.rhel:ste:1005"/>
              </lin-def:rpmverifyfile_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.opensuse:tst:423" version="2" check="at least one" comment="openSUSE-release is version 42.3">
                <lin-def:object object_ref="oval:org.open-scap.cpe.openSUSE-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.opensuse:ste:423"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.opensuse:tst:422" version="2" check="at least one" comment="openSUSE-release is version 42.2">
                <lin-def:object object_ref="oval:org.open-scap.cpe.openSUSE-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.opensuse:ste:422"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.opensuse:tst:421" version="1" check="at least one" comment="openSUSE-release is version 42.1">
                <lin-def:object object_ref="oval:org.open-scap.cpe.openSUSE-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.opensuse:ste:421"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.opensuse:tst:150" version="2" check="at least one" comment="openSUSE-release is version 15.0">
                <lin-def:object object_ref="oval:org.open-scap.cpe.openSUSE-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.opensuse:ste:150"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.opensuse:tst:132" version="1" check="at least one" comment="openSUSE-release is version 13.2">
                <lin-def:object object_ref="oval:org.open-scap.cpe.openSUSE-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.opensuse:ste:132"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.opensuse:tst:131" version="1" check="at least one" comment="openSUSE-release is version 13.1">
                <lin-def:object object_ref="oval:org.open-scap.cpe.openSUSE-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.opensuse:ste:131"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.opensuse:tst:114" version="1" check="at least one" comment="openSUSE-release is version 11.4">
                <lin-def:object object_ref="oval:org.open-scap.cpe.openSUSE-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.opensuse:ste:114"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.opensuse:tst:1" version="1" check="at least one" comment="openSUSE-release is version 11.4">
                <lin-def:object object_ref="oval:org.open-scap.cpe.openSUSE-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.opensuse:ste:2"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.ol:tst:8" version="1" check="at least one" comment="oraclelinux-release is version 8">
                <lin-def:object object_ref="oval:org.open-scap.cpe.oraclelinux-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.ol:ste:8"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.ol:tst:7" version="1" check="at least one" comment="oraclelinux-release is version 7">
                <lin-def:object object_ref="oval:org.open-scap.cpe.oraclelinux-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.ol:ste:7"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.ol:tst:6" version="1" check="at least one" comment="oraclelinux-release is version 6">
                <lin-def:object object_ref="oval:org.open-scap.cpe.oraclelinux-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.ol:ste:6"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.ol:tst:5" version="1" check="at least one" comment="oraclelinux-release is version 5">
                <lin-def:object object_ref="oval:org.open-scap.cpe.oraclelinux-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.ol:ste:5"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:35" version="1" check="at least one" comment="fedora-release is version Fedora 35">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:35"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:34" version="1" check="at least one" comment="fedora-release is version Fedora 34">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:34"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:33" version="1" check="at least one" comment="fedora-release is version Fedora 33">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:33"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:32" version="1" check="at least one" comment="fedora-release is version Fedora 32">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:32"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:31" version="1" check="at least one" comment="fedora-release is version Fedora 31">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:31"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:30" version="1" check="at least one" comment="fedora-release is version Fedora 30">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:30"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:29" version="1" check="at least one" comment="fedora-release is version Fedora 29">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:29"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:28" version="1" check="at least one" comment="fedora-release is version Fedora 28">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:28"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:27" version="1" check="at least one" comment="fedora-release is version Fedora 27">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:27"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:26" version="1" check="at least one" comment="fedora-release is version Fedora 26">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:26"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:25" version="1" check="at least one" comment="fedora-release is version Fedora 25">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:25"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:24" version="1" check="at least one" comment="fedora-release is version Fedora 24">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:24"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:23" version="1" check="at least one" comment="fedora-release is version Fedora 23">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:23"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:22" version="1" check="at least one" comment="fedora-release is version Fedora 22">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:22"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:21" version="1" check="at least one" comment="fedora-release is version Fedora 21">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:21"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:20" version="1" check="at least one" comment="fedora-release is version Fedora 20">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:20"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:19" version="1" check="at least one" comment="fedora-release is version Fedora 19">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:19"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:18" version="1" check="at least one" comment="fedora-release is version Fedora 18">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:18"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:17" version="1" check="at least one" comment="fedora-release is version Fedora 17">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:17"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:16" version="1" check="at least one" comment="fedora-release is version Fedora 16">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:16"/>
              </lin-def:rpminfo_test>
              <ind-def:textfilecontent54_test id="oval:org.open-scap.cpe.centos:tst:8000" version="1" check="all" comment="Check /etc/os-release VERSION_ID is 8">
                <ind-def:object object_ref="oval:org.open-scap.cpe.centos:obj:8000"/>
                <ind-def:state state_ref="oval:org.open-scap.cpe.centos:ste:8000"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:org.open-scap.cpe.centos:tst:8" version="1" check="all" comment="Check /etc/os-release ID is centos">
                <ind-def:object object_ref="oval:org.open-scap.cpe.centos:obj:8"/>
                <ind-def:state state_ref="oval:org.open-scap.cpe.centos:ste:8"/>
              </ind-def:textfilecontent54_test>
            </tests>
            <objects>
              <ind-def:textfilecontent54_object id="oval:org.open-scap.cpe.wrlinux-release:obj:3" version="1" comment="Check VERSION specification in /etc/os-release.">
                <ind-def:path>/etc</ind-def:path>
                <ind-def:filename>os-release</ind-def:filename>
                <ind-def:pattern operation="pattern match">^VERSION=.(\d*.\d*)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:org.open-scap.cpe.wrlinux-release:obj:2" version="1" comment="Check VERSION specification in /etc/wrlinux-release.">
                <ind-def:path>/etc</ind-def:path>
                <ind-def:filename>wrlinux-release</ind-def:filename>
                <ind-def:pattern operation="pattern match">^VERSION=.([[:digit:]]*)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:org.open-scap.cpe.wrlinux-release:obj:1" version="1">
                <unix-def:filepath>/etc/wrlinux-release</unix-def:filepath>
              </unix-def:file_object>
              <win-def:registry_object id="oval:org.open-scap.cpe.windows:obj:1" version="1">
                <win-def:hive>HKEY_LOCAL_MACHINE</win-def:hive>
                <win-def:key>SOFTWARE\Microsoft\Windows NT\CurrentVersion</win-def:key>
                <win-def:name>ProductName</win-def:name>
              </win-def:registry_object>
              <ind-def:family_object id="oval:org.open-scap.cpe.unix:obj:1" version="1"/>
              <lin-def:rpminfo_object id="oval:org.open-scap.cpe.sles-release:obj:1" version="1">
                <lin-def:name>sles-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:org.open-scap.cpe.sled-release:obj:1" version="1">
                <lin-def:name>sled-release</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:org.open-scap.cpe.rhevh:obj:2" version="1">
                <ind-def:filepath>/etc/redhat-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:rpminfo_object id="oval:org.open-scap.cpe.rhevh:obj:1" version="1">
                <lin-def:name>redhat-release-virtualization-host</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpmverifyfile_object id="oval:org.open-scap.cpe.redhat-release:obj:3" version="1">
                <lin-def:behaviors nolinkto="true" nomd5="true" nosize="true" nouser="true" nogroup="true" nomtime="true" nomode="true" nordev="true" noconfigfiles="true" noghostfiles="true"/>
                <lin-def:name operation="pattern match"></lin-def:name>
                <lin-def:epoch operation="pattern match"></lin-def:epoch>
                <lin-def:version operation="pattern match"></lin-def:version>
                <lin-def:release operation="pattern match"></lin-def:release>
                <lin-def:arch operation="pattern match"></lin-def:arch>
                <lin-def:filepath>/etc/redhat-release</lin-def:filepath>
              </lin-def:rpmverifyfile_object>
              <lin-def:rpminfo_object id="oval:org.open-scap.cpe.redhat-release:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:org.open-scap.cpe.oraclelinux-release:obj:1" version="1">
                <lin-def:name>oraclelinux-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:org.open-scap.cpe.openSUSE-release:obj:1" version="1">
                <lin-def:name>openSUSE-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:org.open-scap.cpe.fedora-release:obj:2" version="1">
                <lin-def:name operation="pattern match">^fedora-release.*</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:org.open-scap.cpe.centos:obj:8000" version="1" comment="Check os-release VERSION_ID">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^VERSION_ID="(\d)"$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:org.open-scap.cpe.centos:obj:8" version="1" comment="Check os-release ID">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^ID="(\w+)"$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
            </objects>
            <states>
              <ind-def:textfilecontent54_state id="oval:org.open-scap.cpe.wrlinux-release:ste:8" version="1" comment="Check the /etc/wrlinux-release file for VERSION 8 specification.">
                <ind-def:subexpression operation="pattern match">8</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:org.open-scap.cpe.wrlinux-release:ste:10" version="1" comment="Check the /etc/os-release file for VERSION 1019 specification.">
                <ind-def:subexpression operation="pattern match">10.19</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <win-def:registry_state id="oval:org.open-scap.cpe.windows:ste:81" version="1">
                <win-def:value operation="pattern match">^Windows 8\.1.*$</win-def:value>
              </win-def:registry_state>
              <win-def:registry_state id="oval:org.open-scap.cpe.windows:ste:8" version="1">
                <win-def:value operation="pattern match">^Windows 8.*$</win-def:value>
              </win-def:registry_state>
              <win-def:registry_state id="oval:org.open-scap.cpe.windows:ste:7" version="1">
                <win-def:value operation="pattern match">^Windows 7.*$</win-def:value>
              </win-def:registry_state>
              <win-def:registry_state id="oval:org.open-scap.cpe.windows:ste:2016" version="1">
                <win-def:value operation="pattern match">^.*2016.*$</win-def:value>
              </win-def:registry_state>
              <win-def:registry_state id="oval:org.open-scap.cpe.windows:ste:2012" version="1">
                <win-def:value operation="pattern match">^.*2012.*$</win-def:value>
              </win-def:registry_state>
              <win-def:registry_state id="oval:org.open-scap.cpe.windows:ste:2008" version="1">
                <win-def:value operation="pattern match">^.*2008.*$</win-def:value>
              </win-def:registry_state>
              <win-def:registry_state id="oval:org.open-scap.cpe.windows:ste:10" version="1">
                <win-def:value operation="pattern match">^Windows 10.*$</win-def:value>
              </win-def:registry_state>
              <ind-def:family_state id="oval:org.open-scap.cpe.unix:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.sles:ste:12" version="1">
                <lin-def:version operation="pattern match">^12($|[^\d])</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.sles:ste:11" version="1">
                <lin-def:version operation="pattern match">^11($|[^\d])</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.sles:ste:10" version="1">
                <lin-def:version operation="pattern match">^10($|[^\d])</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.sles:ste:1" version="1">
                <lin-def:name operation="pattern match">^sles-release</lin-def:name>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.sled:ste:12" version="1">
                <lin-def:version operation="pattern match">^12($|[^\d])</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.sled:ste:11" version="1">
                <lin-def:version operation="pattern match">^11($|[^\d])</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.sled:ste:10" version="1">
                <lin-def:version operation="pattern match">^10($|[^\d])</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.sled:ste:1" version="1">
                <lin-def:name operation="pattern match">^sled-release</lin-def:name>
              </lin-def:rpminfo_state>
              <lin-def:rpmverifyfile_state id="oval:org.open-scap.cpe.scientific:ste:7" version="1">
                <lin-def:name operation="pattern match">^sl-release</lin-def:name>
                <lin-def:version operation="pattern match">^7</lin-def:version>
              </lin-def:rpmverifyfile_state>
              <lin-def:rpmverifyfile_state id="oval:org.open-scap.cpe.scientific:ste:6" version="1">
                <lin-def:name operation="pattern match">^sl-release</lin-def:name>
                <lin-def:version operation="pattern match">^6</lin-def:version>
              </lin-def:rpmverifyfile_state>
              <lin-def:rpmverifyfile_state id="oval:org.open-scap.cpe.scientific:ste:5" version="1">
                <lin-def:name operation="pattern match">^sl-release</lin-def:name>
                <lin-def:version operation="pattern match">^5</lin-def:version>
              </lin-def:rpmverifyfile_state>
              <ind-def:textfilecontent54_state id="oval:org.open-scap.cpe.rhevh:ste:2" version="1">
                <ind-def:subexpression operation="pattern match">7</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <lin-def:rpmverifyfile_state id="oval:org.open-scap.cpe.rhel:ste:8" version="1">
                <lin-def:name operation="pattern match">^redhat-release</lin-def:name>
                <lin-def:version operation="pattern match">^8[^\d]</lin-def:version>
              </lin-def:rpmverifyfile_state>
              <lin-def:rpmverifyfile_state id="oval:org.open-scap.cpe.rhel:ste:7" version="1">
                <lin-def:name operation="pattern match">^redhat-release</lin-def:name>
                <lin-def:version operation="pattern match">^7[^\d]</lin-def:version>
              </lin-def:rpmverifyfile_state>
              <lin-def:rpmverifyfile_state id="oval:org.open-scap.cpe.rhel:ste:6" version="1">
                <lin-def:name operation="pattern match">^redhat-release</lin-def:name>
                <lin-def:version operation="pattern match">^6[^\d]</lin-def:version>
              </lin-def:rpmverifyfile_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.rhel:ste:5" version="1">
                <lin-def:version operation="pattern match">^5[^\d]</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpmverifyfile_state id="oval:org.open-scap.cpe.rhel:ste:2" version="1">
                <lin-def:name operation="pattern match">^redhat-release</lin-def:name>
              </lin-def:rpmverifyfile_state>
              <lin-def:rpmverifyfile_state id="oval:org.open-scap.cpe.rhel:ste:1007" version="1">
                <lin-def:name operation="pattern match">^centos-release</lin-def:name>
                <lin-def:version operation="pattern match">^7</lin-def:version>
              </lin-def:rpmverifyfile_state>
              <lin-def:rpmverifyfile_state id="oval:org.open-scap.cpe.rhel:ste:1006" version="1">
                <lin-def:name operation="pattern match">^centos-release</lin-def:name>
                <lin-def:version operation="pattern match">^6</lin-def:version>
              </lin-def:rpmverifyfile_state>
              <lin-def:rpmverifyfile_state id="oval:org.open-scap.cpe.rhel:ste:1005" version="1">
                <lin-def:name operation="pattern match">^centos-release</lin-def:name>
                <lin-def:version operation="pattern match">^5</lin-def:version>
              </lin-def:rpmverifyfile_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.opensuse:ste:423" version="1">
                <lin-def:version operation="pattern match">^42.3$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.opensuse:ste:422" version="1">
                <lin-def:version operation="pattern match">^42.2$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.opensuse:ste:421" version="1">
                <lin-def:version operation="pattern match">^42.1$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.opensuse:ste:2" version="1">
                <lin-def:name operation="pattern match">^openSUSE-release</lin-def:name>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.opensuse:ste:150" version="1">
                <lin-def:version operation="pattern match">^15.0$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.opensuse:ste:132" version="1">
                <lin-def:version operation="pattern match">^13.2$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.opensuse:ste:131" version="1">
                <lin-def:version operation="pattern match">^13.1$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.opensuse:ste:114" version="1">
                <lin-def:version operation="pattern match">^11.4$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.ol:ste:8" version="1">
                <lin-def:name operation="pattern match">^oraclelinux-release</lin-def:name>
                <lin-def:version operation="pattern match">^8</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.ol:ste:7" version="1">
                <lin-def:name operation="pattern match">^oraclelinux-release</lin-def:name>
                <lin-def:version operation="pattern match">^7</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.ol:ste:6" version="1">
                <lin-def:name operation="pattern match">^oraclelinux-release</lin-def:name>
                <lin-def:version operation="pattern match">^6</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.ol:ste:5" version="1">
                <lin-def:name operation="pattern match">^oraclelinux-release</lin-def:name>
                <lin-def:version operation="pattern match">^5</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:35" version="1">
                <lin-def:version operation="pattern match">^35$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:34" version="1">
                <lin-def:version operation="pattern match">^34$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:33" version="1">
                <lin-def:version operation="pattern match">^33$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:32" version="1">
                <lin-def:version operation="pattern match">^32$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:31" version="1">
                <lin-def:version operation="pattern match">^31$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:30" version="1">
                <lin-def:version operation="pattern match">^30$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:29" version="1">
                <lin-def:version operation="pattern match">^29$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:28" version="1">
                <lin-def:version operation="pattern match">^28$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:27" version="1">
                <lin-def:version operation="pattern match">^27$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:26" version="1">
                <lin-def:version operation="pattern match">^26$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:25" version="1">
                <lin-def:version operation="pattern match">^25$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:24" version="1">
                <lin-def:version operation="pattern match">^24$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:23" version="1">
                <lin-def:version operation="pattern match">^23$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:22" version="1">
                <lin-def:version operation="pattern match">^22$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:21" version="1">
                <lin-def:version operation="pattern match">^21$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:20" version="1">
                <lin-def:version operation="pattern match">^20$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:19" version="1">
                <lin-def:version operation="pattern match">^19$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:18" version="1">
                <lin-def:version operation="pattern match">^18$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:17" version="1">
                <lin-def:version operation="pattern match">^17$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:16" version="1">
                <lin-def:version operation="pattern match">^16$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:textfilecontent54_state id="oval:org.open-scap.cpe.centos:ste:8000" version="1">
                <ind-def:subexpression>8</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:org.open-scap.cpe.centos:ste:8" version="1">
                <ind-def:subexpression>centos</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
            </states>
          </oval_definitions>
          <results>
            <system>
              <definitions>
                <definition definition_id="oval:org.open-scap.cpe.wrlinux:def:8" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.wrlinux:tst:8" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.wrlinux:def:1019" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.wrlinux:tst:1019" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.wrlinux:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.wrlinux:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:org.open-scap.cpe.wrlinux:tst:2" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.windows:def:81" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.windows:tst:81" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.windows:def:8" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.windows:tst:8" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.windows:def:7" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.windows:tst:7" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.windows:def:2016" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.windows:tst:2016" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.windows:def:2012" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.windows:tst:2012" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.windows:def:2008" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.windows:tst:2008" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.windows:def:10" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.windows:tst:10" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.sles:def:12" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.sles:tst:12" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.sles:def:10" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.sles:tst:10" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.sled:def:12" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.sled:tst:12" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.sled:def:10" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.sled:tst:10" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.sle:def:11" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.sle:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:org.open-scap.cpe.sled:tst:11" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:org.open-scap.cpe.sles:tst:11" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.sle:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:org.open-scap.cpe.sles:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:org.open-scap.cpe.sled:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.scientific:def:7" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.scientific:tst:7" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.scientific:def:6" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.scientific:tst:6" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.scientific:def:5" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.scientific:tst:5" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.rhel:def:8" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:8" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.rhel:def:7" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:7" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:org.open-scap.cpe.rhevh:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:org.open-scap.cpe.rhevh:tst:2" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.rhel:def:6" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:6" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.rhel:def:5" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:5" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.rhel:def:1007" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:1007" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.rhel:def:1006" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:1006" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.rhel:def:1005" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:1005" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.rhel:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:2" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.opensuse:def:423" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:423" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.opensuse:def:422" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:422" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.opensuse:def:421" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:421" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.opensuse:def:150" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:150" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.opensuse:def:132" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:132" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.opensuse:def:131" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:131" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.opensuse:def:114" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:114" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.opensuse:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.ol:def:8" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.ol:tst:8" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.ol:def:7" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.ol:tst:7" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.ol:def:6" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.ol:tst:6" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.ol:def:5" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.ol:tst:5" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:35" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:35" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:34" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:34" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:33" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:33" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:32" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:32" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:31" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:31" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:30" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:30" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:29" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:29" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:28" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:28" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:27" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:27" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:26" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:26" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:25" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:25" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:24" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:24" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:23" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:23" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:22" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:22" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:21" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:21" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:20" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:20" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:19" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:19" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:18" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:18" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:17" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:17" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:16" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:16" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.centos:def:8" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.centos:tst:8" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:org.open-scap.cpe.centos:tst:8000" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
              </definitions>
              <tests>
                <test test_id="oval:org.open-scap.cpe.centos:tst:8" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.centos:tst:8000" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:16" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:17" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:18" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:19" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:20" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:21" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:22" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:23" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:24" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:25" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:26" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:27" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:28" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:29" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:30" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:31" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:32" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:33" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:34" version="1" check="at least one" result="false">
                  <tested_item item_id="1042523" result="false"/>
                  <tested_item item_id="1042525" result="false"/>
                  <tested_item item_id="1042524" result="false"/>
                </test>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:35" version="1" check="at least one" result="false">
                  <tested_item item_id="1042523" result="false"/>
                  <tested_item item_id="1042525" result="false"/>
                  <tested_item item_id="1042524" result="false"/>
                </test>
                <test test_id="oval:org.open-scap.cpe.ol:tst:5" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.ol:tst:6" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.ol:tst:7" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.ol:tst:8" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.opensuse:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.opensuse:tst:114" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.opensuse:tst:131" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.opensuse:tst:132" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.opensuse:tst:150" version="2" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.opensuse:tst:421" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.opensuse:tst:422" version="2" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.opensuse:tst:423" version="2" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.rhel:tst:1005" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.rhel:tst:1006" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.rhel:tst:1007" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.rhel:tst:2" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.rhel:tst:5" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.rhel:tst:6" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.rhel:tst:7" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.rhel:tst:8" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.rhevh:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.rhevh:tst:2" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.scientific:tst:5" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.scientific:tst:6" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.scientific:tst:7" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.sle:tst:1" version="1" check="only one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.sled:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.sled:tst:10" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.sled:tst:11" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.sled:tst:12" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.sles:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.sles:tst:10" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.sles:tst:11" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.sles:tst:12" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.windows:tst:10" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.windows:tst:2008" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.windows:tst:2012" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.windows:tst:2016" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.windows:tst:7" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.windows:tst:8" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.windows:tst:81" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.wrlinux:tst:1" version="1" check="only one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.wrlinux:tst:1019" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.wrlinux:tst:2" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.wrlinux:tst:8" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
              </tests>
              <oval_system_characteristics xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:unix-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#unix" xmlns:ind-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#independent" xmlns:lin-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#linux" xmlns:win-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows" xmlns="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5 oval-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#independent independent-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#unix unix-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#linux linux-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows windows-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#macos macos-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
                <generator>
                  <oval:product_name>vim</oval:product_name>
                  <oval:schema_version>5.10.1</oval:schema_version>
                  <oval:timestamp>2022-08-01T16:21:57</oval:timestamp>
                </generator>
                <system_info>
                  <os_name>Fedora Linux</os_name>
                  <os_version>37 (Workstation Edition Prerelease)</os_version>
                  <architecture>x86_64</architecture>
                  <primary_host_name>localhost-live</primary_host_name>
                  <interfaces>
                    <interface>
                      <interface_name>lo</interface_name>
                      <ip_address>127.0.0.1</ip_address>
                      <mac_address>00:00:00:00:00:00</mac_address>
                    </interface>
                    <interface>
                      <interface_name>enp1s0</interface_name>
                      <ip_address>192.168.122.178</ip_address>
                      <mac_address>52:54:00:43:3D:D8</mac_address>
                    </interface>
                    <interface>
                      <interface_name>lo</interface_name>
                      <ip_address>::1</ip_address>
                      <mac_address>00:00:00:00:00:00</mac_address>
                    </interface>
                    <interface>
                      <interface_name>enp1s0</interface_name>
                      <ip_address>fe80::8000:d679:2b11:8d8</ip_address>
                      <mac_address>52:54:00:43:3D:D8</mac_address>
                    </interface>
                  </interfaces>
                </system_info>
                <collected_objects>
                  <object id="oval:org.open-scap.cpe.fedora-release:obj:2" version="1" flag="complete">
                    <reference item_ref="1042523"/>
                    <reference item_ref="1042525"/>
                    <reference item_ref="1042524"/>
                  </object>
                </collected_objects>
                <system_data>
                  <lin-sys:rpminfo_item id="1042525" status="exists">
                    <lin-sys:name>fedora-release-common</lin-sys:name>
                    <lin-sys:arch>noarch</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>0.6</lin-sys:release>
                    <lin-sys:version>37</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:37-0.6</lin-sys:evr>
                    <lin-sys:signature_keyid>f55ad3fb5323552a</lin-sys:signature_keyid>
                    <lin-sys:extended_name>fedora-release-common-0:37-0.6.noarch</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <lin-sys:rpminfo_item id="1042524" status="exists">
                    <lin-sys:name>fedora-release-workstation</lin-sys:name>
                    <lin-sys:arch>noarch</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>0.6</lin-sys:release>
                    <lin-sys:version>37</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:37-0.6</lin-sys:evr>
                    <lin-sys:signature_keyid>f55ad3fb5323552a</lin-sys:signature_keyid>
                    <lin-sys:extended_name>fedora-release-workstation-0:37-0.6.noarch</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <lin-sys:rpminfo_item id="1042523" status="exists">
                    <lin-sys:name>fedora-release-identity-workstation</lin-sys:name>
                    <lin-sys:arch>noarch</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>0.6</lin-sys:release>
                    <lin-sys:version>37</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:37-0.6</lin-sys:evr>
                    <lin-sys:signature_keyid>f55ad3fb5323552a</lin-sys:signature_keyid>
                    <lin-sys:extended_name>fedora-release-identity-workstation-0:37-0.6.noarch</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                </system_data>
              </oval_system_characteristics>
            </system>
          </results>
        </oval_results>
      </arf:content>
    </arf:report>
  </arf:reports>
</arf:asset-report-collection>
